Divyam Khorwal

devops engg

[Divyam Khorwal @divyam_khorwal]

okay so just realized why artifactory health checks break when packages like lumen redirect straight to an S3 download page, gotta turn ⁠head⁠ requests off for that check

[Divyam Khorwal @divyam_khorwal]

did a little thing last weekend

[Divyam Khorwal @divyam_khorwal]

That new node js RCE bug is a reminder that runtime vulnerabilities dont show up in npm audit, time to manually upgrade every single self-hosted n8n instance and container😵‍💫

[Divyam Khorwal @divyam_khorwal]

@vanshxgoel damn didnt know you were a tweleb too haha definitely saying hi the next time :))

[Divyam Khorwal @divyam_khorwal]

@sudharjaaish haha was a bit skeptical going in but Im glad it was actually you

[Divyam Khorwal @divyam_khorwal]

Worked on AI infra side for the first time setting up laya (cause we liked Jev), locked down Artifactory so only approved weights pass through, strictly using ⁠safetensors⁠ (no pickle), also realised baking those verified tensors straight into the docker image keeps it safe

[Divyam Khorwal @divyam_khorwal]

Shipped a small feature I’m very proud of, our internal AI code reviewer now t-shirt sizes every MR, XS to XL.
Line counts are just the baseline as in a 3-line diff that drops a database still gets flagged as heavy.
"How hard is this to review?" is finally easy to measure :))

[Divyam Khorwal @divyam_khorwal]

is @GitProtectio any good guys?

[Divyam Khorwal @divyam_khorwal]

spent some time debugging a random TLS handshake failure in CI figured out that the builder VM and CI trusted different internal CAs so they couldn't verify each other's certs, ended up diving deep into how CA certs and private keys work together (same CA should issue all certs)

[Divyam Khorwal @divyam_khorwal]

okay so I deployed a single temporal cluster and realised it can host multiple internal namespaces to isolate different apps and act as a shared space so pods can resume multistep or agentic workflows right where they failed, saw this when I enabled @retool runtime (self hosted)

[Divyam Khorwal @divyam_khorwal]

@JasonTally yess agreed moving to IPv6 to ditch NAT costs entirely is the goal just gotta convince the rest of the stack to play along (lots of legacy stuff) and the team

[Divyam Khorwal @divyam_khorwal]

worked with NAT gateways today, so if a pod on a private IP tries to hit an external cluster’s public control plane we would need a NAT gateway, without it translating and tracking that private IP the return traffic has no way to find its way back

[Divyam Khorwal @divyam_khorwal]

Was working with self hosted artifactory today, I think the best way to set up artifactory is to use one virtual repo per package type that sits in front of all the local and remote repos, pipelines will only ever need a single url and artiF will handle the resolution and caching

[Divyam Khorwal @divyam_khorwal]

Google cloud run is almost a great PaaS until you have to bring workload identities and org policies in sync

[Divyam Khorwal @divyam_khorwal]

okay so persistent volumes are just how we beat k8s pods statelessness…I seee now

[Divyam Khorwal @divyam_khorwal]

@gitpushregret @mxximxximxxi 🤓

[Divyam Khorwal @divyam_khorwal]

before spinning up new subnets make sure you have defined IP ranges so you dont accidentally clash with internal tools, spent so much time debugging this🙂‍↔️

[Divyam Khorwal @divyam_khorwal]

just a reminder to double check your shared networks so prod clusters talk to prod, dev talks to dev, and stg talks to stg, environment isolation is only as good as the VPC routing behind it

[Divyam Khorwal @divyam_khorwal]

@Kuchbhikartihun 58 days left for gta 6

[Divyam Khorwal @divyam_khorwal]

guys replace your bash scripts in CI with mise already