All topics

Dependency Injection in Spring

Spring's IoC container wires collaborators at startup. Prefer constructor injection for required dependencies — it enables immutability, testability, and fail-fast wiring.

springiocbeans

Transactions & @Transactional Pitfalls

@Transactional is a proxy-based AOP advice. Self-invocation, checked exceptions, and propagation defaults silently break what looks like correct code.

springjpatransactions

Java & Spring Boot/staff

JVM Tuning for Production

Pick the right GC, size the heap conservatively, and measure before tuning. Modern G1 / ZGC defaults are excellent — most 'tuning' is undoing bad flags.

jvmgcperformance

Spring Boot Startup Performance

Long startup hurts deploy velocity and Kubernetes rolling updates. Audit auto-configuration, prefer constructor injection, and consider AOT / native compilation for cold-start-sensitive workloads.

springperformancestartup

Virtual Threads (Project Loom)

Virtual threads (JDK 21+) make blocking I/O cheap again. Treat them as the default for request handling; keep platform threads for CPU-bound work.

javaconcurrencyloom

kubernetesprobesreliability

Liveness vs Readiness Probes

Liveness restarts a broken pod; readiness removes it from the Service. Confusing the two is the #1 cause of self-inflicted outages during deploys.

Requests, Limits & QoS Classes

Requests drive scheduling and QoS class; limits drive throttling and OOMKill. Memory limits without matching JVM heap settings = surprise restarts.

kubernetesresourcesqos

Designing a CI/CD Pipeline

Fast feedback for devs, immutable artifacts, separation of CI (build/test) from CD (deploy). Trunk-based + GitOps beats long-lived release branches.

ci-cdgitopsdeployment

observabilitymonitoringsre

Observability: Logs, Metrics, Traces

Metrics for what, logs for why, traces for where. Cardinality kills your bill — design label schemas like you design DB schemas.

kubernetesingressnetworking

Ingress, Service Mesh & Gateway API

Ingress is the legacy API; Gateway API is its principled replacement. Reach for a service mesh only when you need mTLS, traffic shifting, or per-service policy.

Cloud & Azure/senior

Managed Identity vs Service Principals

Managed Identity removes secrets from your workloads. If you're still rotating client secrets for an Azure-hosted app, you're carrying an unnecessary risk.

azureidentitysecurity

Cloud & Azure/senior

Azure Key Vault Patterns

Key Vault for secrets, keys, certs — accessed via Managed Identity, never via direct secret references. Cache aggressively; KV has tight throttling limits.

azuresecretskey-vault

Cloud & Azure/senior

Infrastructure as Code: Patterns That Scale

Modules for reuse, workspaces or stacks for isolation, remote state with locking, and a PR-driven plan/apply flow. Mono-stack Terraform is technical debt waiting to happen.

terraformiacbicep

OAuth2 & OIDC for Engineers

OAuth2 is authorization (access tokens); OIDC is authentication (ID tokens) layered on top. Use Authorization Code + PKCE for everything user-facing; client credentials for service-to-service.

oauth2oidcauth

JWT — Beyond the Hello World

JWTs are great for stateless authz but terrible for session management. Keep them short-lived, validate everything, and never roll your own.

jwtauthsecurity

Secrets Management

Secrets in code → secrets in vault → no secrets (workload identity). Rotation is a process, not a feature — automate it or it won't happen.

secretsvaultrotation