About Platform News

Platform News publishes deep dives and field notes on how modern infrastructure is built and run: Kubernetes, multi-cloud, observability, reliability and security, written from production experience rather than from press releases.

Every article is published in English and Vietnamese.

Who writes it

Platform News is written by Atlas, the pen name of a platform and SRE engineer who builds and operates platform infrastructure across five cloud providers (AWS, Google Cloud, Azure, Huawei Cloud and Yandex Cloud), serving production workloads in eight countries.

Platform and reliability

• Multi-cloud, multi-region Kubernetes platforms on EKS, GKE, AKS, Huawei CCE and Yandex Managed Kubernetes, standardized through GitOps with Argo CD.
• 99.95% availability for production services through multi-AZ deployments, autoscaling and automated failover.
• Replaced Elasticsearch with ClickStack (Vector → Kafka/MSK → ClickHouse → HyperDX): ~10 TB of logs per day on sharded, replicated ClickHouse with an S3 cold tier, 60% lower logging cost and retention extended to one year. Extended HyperDX to search every region from a single UI with SSO and role-based access. → Logging on ClickHouse instead of Elasticsearch
• Migrated systems from AWS to Huawei Cloud with zero downtime, cutting infrastructure cost by 40%.
• Multi-cluster, multi-cloud Istio mesh federation: cross-cluster mTLS through a shared root CA and east-west gateways, for zero-trust service-to-service traffic across clouds and regions.
• Policy-as-code with Kyverno: pod security, allowed image registries, required resource limits and labels.

Going keyless

Leading an initiative to remove static cloud credentials with workload identity federation:

• Workload identity on EKS and GKE, with IAM managed declaratively through ACK and Config Connector. → EKS Pod Identity vs IRSA, GKE Workload Identity, ACK
• Hub-and-spoke federation from a central AWS identity account to Google Cloud (27+ projects) and to Azure (managed identities with federated credentials). → AWS → Google Cloud, AWS → Azure
• Google Cloud → AWS federation for production services, using Google OIDC tokens with AssumeRoleWithWebIdentity. → Google Cloud → AWS
• Keyless access extended to Huawei Cloud and Yandex Cloud through OIDC federation and Crossplane.
• IAM Roles Anywhere for workloads that have no native cloud identity: Vault PKI for VMs, and AWS Private CA with cert-manager for pods on Huawei CCE and Yandex Managed Kubernetes. → IAM Roles Anywhere as an identity hub

The articles here are the write-ups I wish I’d had before doing that work. The whole keyless journey is collected in the Workload Identity series.

How articles are made

• Tested where it can be. Configs and code that can run locally are run before they’re published, with tools like promtool test rules, clickhouse local, vector validate and sloth generate. Cloud-specific steps are checked against official documentation and, where useful, the SDK source code. When something could only be checked against documentation, the article says so.
• Sourced. Every article ends with a Sources section linking to official documentation, specs and RFCs, so you can verify the details yourself.
• Dated. Cloud services change fast. Articles show when they were last reviewed, and versions or preview features are named explicitly.
• Vendor-neutral. No sponsored content and no affiliate links. Product names appear because they’re the tools being explained.

What we cover

• Platform engineering: internal developer platforms, golden paths, self-service
• Kubernetes: multi-cluster, multi-cloud operations and GitOps
• SRE: SLOs, error budgets, incident response, postmortems
• Observability: logs, metrics and traces at scale
• Security: workload identity, zero-trust networking, policy-as-code
• Cloud: multi-cloud architecture, migrations and cost

Start with the Workload Identity series, eight articles from EKS, GKE and AKS to cross-cloud federation and identity for AI agents.

Who it’s for

Platform, DevOps and SRE engineers, and anyone who has to keep production running.

Get in touch

Email hello@platformnews.net for questions, corrections, or ideas for an article.

Found a mistake, or something that changed since an article was written? You can also comment at the bottom of any article (comments are GitHub Discussions in platformnews/comments), and corrections get credited in the update.

Subscribe via RSS to get new articles as they’re published.