Blog

Watch a smart, curious person try to learn SQL. They get through SELECT * FROM x WHERE y and they’re fine. Then they hit JOIN, or GROUP BY, or a correlated subquery, and the floor opens up. Most never come back.

KQL is the opposite. It reads left to right, the way the human brain wants to think about data.

Read it out loud. “Take page views, where time is in the last seven days, where the country is the US, summarize by day and page, give me the top ten.” That sentence is the query. Nothing is hidden, nothing is out of order.

Mitchell Hashimoto wrote a post on X that I haven’t stopped thinking about.

I love AI. I lean into it harder than most people I work with and know. Engineering is genuinely better because of AI. Daily and categorically.

Purely AI written systems will scale to a point of complexity no human can ever understand. For a while it looks fine. Defects close, bug reports trend down, dashboards stay green. Then the defect close rate tapers. Token burn per defect climbs. Eventually, AI changes cause on average more defects than they close, and the whole system becomes unstable. The decay.

I’ve been running 1:1s for years and I still get them wrong. The version of “wrong” has changed. Early on, my 1:1s were status meetings with the lights off. Manager asks what you’re working on. Engineer recites their pile. Manager says “anything blocking you?”. Engineer says no, even when they mean yes. Forty-five minutes evaporate.

That isn’t a 1:1. It’s a standup with a longer time slot.

I figured out it was wrong because of one engineer. Smart, quiet, on a team I’d inherited. We’d had eight or nine “great” 1:1s in a row. He left to go work …

Part 1 was the framework pitch. Part 2 was the agent I wanted to build. This one is for the people who can’t (or won’t) ship that agent to Cloudflare Workers.

The reasons vary. Compliance says all customer data stays in our VPC. Security says no third-party serverless on the data path. Procurement won’t sign another vendor contract this fiscal year. We already run Kubernetes for everything else, so why are we paying someone to schedule containers for us? All valid.

Self-hosting a Flue agent on Kubernetes is straightforward. The trick is doing it without rebuilding the things managed serverless …

Part 1 was the framework pitch. This is the agent I actually wanted to build with it.

The setup is something I keep seeing across teams: JIRA triage is brutal. Tickets pile up in the new-issues queue. An EM or tech lead spends an hour every morning sorting them. Someone classifies, someone re-classifies, someone routes, someone re-routes. Half of them get assigned to the wrong team and bounce around for two days before landing.

The agent I’m going to walk through does that triage work. It reads each new ticket, classifies it, picks a team and a person, and either assigns it or comments on the ticket asking …

I’ve been on a kick lately, building small agents in TypeScript instead of Python. Two frameworks keep showing up in my browser tabs: Flue and Mastra. They’re both betting on the same thing: TypeScript is the right language to ship AI in. They just disagree about almost everything else.

That disagreement is the interesting part.

Flue’s pitch is one line: Agent = Model + Harness. The framework gives you a programmable harness. Sandbox, filesystem, bash, sessions, skills with structured output. You drop in a model. You get something that looks a lot like Claude Code or Codex, except you wrote it and …

Someone needed SFTP access to Azure Blob Storage. Simple enough, right? Azure even has native SFTP support built into storage accounts now. Problem solved.

Until you look at the price tag.

Azure’s native SFTP support for Blob Storage costs $0.30 per hour. That’s roughly $219 per month. Just for the endpoint. Just for it to exist. You haven’t transferred a single file yet. That’s before storage costs, before transaction costs, before anything useful happens.

This is part two of a series for new operations and cloud engineers getting into Kubernetes. In part one we covered how to set default TLS certificates on your ingress controllers. That works, but it means you’re managing certs by hand. Let’s fix that.

In the last post, we created TLS secrets manually. That’s fine for getting started. It’s not fine for production. Certificates expire. People forget to renew them. And then you’re getting paged at 3am because your site is serving a browser warning.

cert-manager is a Kubernetes-native certificate management controller. It watches your …