ZopDay Developer Seats: Assign Now, Reduce at Renewal
Admins assign and unassign developer seats. Members beyond the purchased count show as Waiting. Seats can be added anytime but reduced only at renewal.
Posts tagged platform-engineering.
zopdev writing tagged platform-engineering. Engineering and FinOps notes, post-mortems, and benchmarks.
A Self-Service Overrides Tab: Create Moves Into the Filter Box
A primary action should be in the same place whether or not there is any data. Creating an override is a self-service action: a person bypasses a schedule themselves, without asking anyone. On…
A Self-Service Feedback Form That Resizes Screenshots
The fastest way to learn what is wrong with a product is to let people tell you from inside it. ZopNight, ZopDay and ZopCloud now share a Feedback item in the sidebar, directly above Settings. It…
Self-Service MCP Sign-In Needed a Developer Experience Fix
Connecting Cursor, VS Code, or Claude Code to ZopNight used to assume the setup work was already done: an account, an organization, and an administrator who had separately switched MCP on before any…
A Self-Service Sign-In Now Decides Which Product You Meant
Three products behind one login used to mean three separate bookmarks, a small self-service tax that added up every time someone forgot which one they'd saved. ZopNight now has a single shared…
Self-Service Switching Exposed Every Place Identity Was Guessed
Moving between ZopNight, zopcloud, and ZopDay used to mean logging out of one and back into another. A new switcher in the sidebar removes that entirely, letting a person move between all three…
The Imported Service Was a Black Box. Now It Has a Front Door.
When you provision a service through ZopDay, you get its whole story: configuration, live status, and how to reach it. When you
Adopting running apps should not cost a redeploy, so ZopDay reads your Helm releases instead of rewriting them
Most tools that promise to manage your existing workloads ask for one thing first: redeploy everything through us. That is the wrong price. A re-rollout against production carries a real downtime…
An AWS VM is not a deploy target until domains, HTTPS, and a registry are wired in at provision time
A fresh EC2 instance is not an environment. It is a Linux box with an IP address and a checklist attached. Someone still has to point a domain at it, terminate TLS, give it pull access to a private…
A VM should cost you one push, not a week of firewall rules: ZopDay runs your service behind a managed edge
Most teams pick a VM because the runtime is simple. Then they spend a week paying for that choice in firewall rules, SSH key rotation, a certbot cron job, and a DNS ticket. The VM was never the…
Ephemeral Kubernetes Preview Environments: How We Run 200 On-Demand Clusters for $11 Each
Most engineering teams pick one of two bad options for preview environments. They share a staging environment and fight over it. Or they give every engineer a dedicated environment that runs 24 hours…
Self-Service Terraform: 8 Modules That Killed 60% of Our Platform Tickets
Self-Service Terraform: 8 Modules That Killed 60% of Our Platform Tickets Platform teams do not fail because they hire the wrong people. They fail because the right people spend most of their time…
ZopDay: Provisioning EKS, GKE, AKS, and a Managed Datastore in One 8-Step Wizard
A new engineer joins on Monday. By Friday they need their first production-grade EKS cluster running so they can deploy the service they were hired to build. They open the company's Terraform module.…
Cloud Custodian vs OPA vs MCP-Enforced Policy: A 2026 Decision Matrix for Autonomous Remediation
A platform team picks Cloud Custodian in week one. By week six they realize Custodian fires after the resource is created, the wrong shape for blocking misconfigured Terraform plans. They add OPA. By…
The Golden Path Tax: 14 Hours/Week of Engineer Onboarding We Bought Back With 6 Months of IDP Work
The cost of onboarding a new engineer at a mid-sized cloud-infrastructure org never shows up on a finance dashboard. There's no line item for "hours spent searching for the right runbook" or "Slack…
What IAM Permissions Does a Cost-Optimization Tool Actually Need? An Honest Read-Only Scope You Can Defend in Security Review
A platform team starts a security review for a cost-optimization vendor. The vendor's onboarding doc asks for a CloudFormation template that creates a role with "to ensure all features work." The…
Incident Triage in One Query: Asking Your AI Agent 'Who Owns This and Why Is It Broken' and Getting a Real Answer
An alert fires at 2:47 AM. A pod in the namespace is in CrashLoopBackOff. The on-call engineer reads the alert, opens Slack to find the team that owns , opens the wiki to find what policies apply to…
eBPF Gives Kubernetes Full Network Visibility Without the Sidecar CPU Tax
Istio sidecars cost 0.5 vCPU per pod at idle. At 100 pods, you're paying for 50 idle vCPUs. eBPF moves observability into the kernel — one hook point per node, not per pod. Here's the architecture, the tools, and when you still need Envoy.
Golden Paths That Include Cost Guardrails: A Platform Engineering Playbook
Every service provisioned from a Backstage template starts with zero budget alerts, zero mandatory tags, and a dev environment that runs 24/7. The platform team didn't choose this — they just never added cost defaults to the template. Here's how to fix that.
Backstage Is Not Free: The Real TCO of Building vs Buying an Internal Developer Platform
Backstage has a $0 license fee and requires 2-3 senior engineers full-time. This piece works through the build vs buy decision with real TCO numbers and a decision framework.
Backstage Costs More Than You Budgeted: The Real Platform Engineering ROI Calculation
Teams adopt Backstage for developer experience but few measure what it costs to run. This breakdown covers hosting, staffing, plugin rot, catalog hygiene overhead, and when the ROI actually makes sense.
Cloud Governance RBAC Done Right: Viewer, Editor, Admin, and Why Custom Roles Matter
Most cloud governance platforms have a blind spot. They enforce access controls on your infrastructure but leave their own control plane wide open. Here's how to fix it with graduated RBAC.
Kubernetes Multi-Tenancy: Namespace Isolation, RBAC, and Network Policies Explained
Most teams running shared Kubernetes clusters believe they have isolation. They have namespaces. It feels like separation. It is not. Here's how to configure actual multi-tenancy.
Get the weekly in your inbox.
One post a week. Sundays. No "10 ways to think about cloud" listicles, just the engineering and FinOps notes we'd want to read.