https://carlocruciani.com/en/ Articles and podcasts on Cloud, AI and modern IT infrastructures. en-US Sat, 17 Oct 2026 19:30:00 GMT Carlo Cruciani https://carlocruciani.com/en/blog/gcp-workload-migration-banking-patterns.html https://carlocruciani.com/en/blog/gcp-workload-migration-banking-patterns.html Sat, 17 Oct 2026 19:30:00 GMT 2026-10-17 21:30 Architectural analysis of GCP migration patterns for banking workloads, evaluating trade-offs between Rehost, Replatform, and cloud-native Re-engineering. /blog/images/gcp-workload-migration-banking-patterns.webp 13 gcp architettura banking kubernetes migration enterprise https://carlocruciani.com/en/blog/alloydb-vs-cloud-sql-enterprise-resilience-dora.html https://carlocruciani.com/en/blog/alloydb-vs-cloud-sql-enterprise-resilience-dora.html Tue, 29 Sep 2026 14:00:00 GMT 2026-09-29 16:00 Comparative architectural analysis between AlloyDB and Cloud SQL for enterprise mission-critical workloads: disaggregated storage, resilience, and DORA compliance. /blog/images/alloydb-vs-cloud-sql-enterprise-resilience-dora.webp 9 gcp database alloydb cloudsql postgresql resilience compliance banking terraform https://carlocruciani.com/en/blog/gke-workload-identity-direct-principal-grants.html https://carlocruciani.com/en/blog/gke-workload-identity-direct-principal-grants.html Tue, 29 Sep 2026 10:00:00 GMT 2026-09-29 12:00 Advanced IAM architecture for GKE: evolving from intermediate Google Service Account double-hops to Direct Principal Grants for heightened security and DORA auditability. /blog/images/gke-workload-identity-direct-principal-grants.webp 8 gke kubernetes gcp security iam governance terraform https://carlocruciani.com/en/blog/finops-enterprise-market-platforms-vs-custom-in-house.html https://carlocruciani.com/en/blog/finops-enterprise-market-platforms-vs-custom-in-house.html Mon, 21 Sep 2026 20:55:00 GMT 2026-09-21 22:55 Evaluating Build vs Buy in enterprise FinOps. Why market platforms like Apptio and Flexera outperform custom billing data lakes in TCO, FOCUS, and compliance. /blog/images/finops-enterprise-market-platforms-vs-custom-in-house.webp 10 finops cloud-governance enterprise-architecture multi-cloud banking https://carlocruciani.com/en/blog/aws-immutable-infrastructure-packer-asg-codedeploy.html https://carlocruciani.com/en/blog/aws-immutable-infrastructure-packer-asg-codedeploy.html Sun, 20 Sep 2026 08:00:00 GMT 2026-09-20 10:00 Enterprise architectural guide to immutable infrastructure on AWS with Packer Golden and Silver AMIs, EFS storage, and zero-drift replacement patching. /blog/images/aws-immutable-infrastructure-packer-asg-codedeploy.webp 12 aws devops cloud security automation https://carlocruciani.com/en/blog/ansible-automation-platform-vm-baseline-cis-governance.html https://carlocruciani.com/en/blog/ansible-automation-platform-vm-baseline-cis-governance.html Thu, 17 Sep 2026 08:00:00 GMT 2026-09-17 10:00 Orchestrating cloud VM baselines with Ansible Automation Platform: multi-CSP autodiscovery, security agent deployment, and continuous CIS compliance. /blog/images/ansible-automation-platform-vm-baseline-cis-governance.webp 10 ansible automation cloud security compliance devops https://carlocruciani.com/en/blog/gke-anthos-config-sync-argocd-governance.html https://carlocruciani.com/en/blog/gke-anthos-config-sync-argocd-governance.html Mon, 14 Sep 2026 15:30:00 GMT 2026-09-14 17:30 Dual-engine GitOps architecture pattern for enterprise GKE clusters delegating cluster-wide administration to Anthos Config Sync and application lifecycles to Argo CD. /blog/images/gke-anthos-config-sync-argocd-governance.webp 6 true 22 min cloud kubernetes gke gitops argocd governance https://carlocruciani.com/en/podcast/gke-anthos-config-sync-argocd-governance.html https://carlocruciani.com/en/podcast/gke-anthos-config-sync-argocd-governance.html Sun, 13 Sep 2026 22:00:00 GMT 2026-09-14 Dual-engine GitOps architecture pattern for enterprise GKE clusters delegating cluster-wide administration to Anthos Config Sync and application lifecycles to Argo CD. /blog/images/gke-anthos-config-sync-argocd-governance.webp true 22 min kubernetes gke gitops argocd governance 0 https://carlocruciani.com/en/blog/resilient-cloud-architectures-banking-compliance.html https://carlocruciani.com/en/blog/resilient-cloud-architectures-banking-compliance.html Thu, 03 Sep 2026 23:10:00 GMT 2026-09-04 01:10 Architectural patterns to ensure zero RPO and sub-minute RTO for critical banking workloads: distributed data replication, global health routing, and DORA compliance. /blog/images/resilient-cloud-architectures-banking-compliance.webp 6 cloud architecture banking compliance disaster-recovery https://carlocruciani.com/en/blog/enterprise-landing-zone-multi-account-banking.html https://carlocruciani.com/en/blog/enterprise-landing-zone-multi-account-banking.html Thu, 03 Sep 2026 23:09:00 GMT 2026-09-04 01:09 Architectural patterns for structuring OUs, account vending machines, and Service Control Policies in banking environments compliant with EBA and DORA guidelines. /blog/images/enterprise-landing-zone-multi-account-banking.webp 6 true 23 min cloud landing-zone multi-cloud governance banking https://carlocruciani.com/en/blog/cloud-governance-guardrails-policy-as-code.html https://carlocruciani.com/en/blog/cloud-governance-guardrails-policy-as-code.html Thu, 03 Sep 2026 23:07:00 GMT 2026-09-04 01:07 Implementing preventive and reactive controls across multi-cloud landing zones using Open Policy Agent, AWS Control Tower, and Terraform Enterprise to prevent compliance drift. /blog/images/cloud-governance-guardrails-policy-as-code.webp 6 cloud governance security terraform compliance https://carlocruciani.com/en/podcast/enterprise-landing-zone-multi-account-banking.html https://carlocruciani.com/en/podcast/enterprise-landing-zone-multi-account-banking.html Thu, 03 Sep 2026 22:00:00 GMT 2026-09-04 In this episode, we explore how to design and implement a robust and scalable AWS Enterprise Landing Zone. Starting from the basics of multi-account management with AWS Control Tower, we dive into complex use cases specifically designed for highly regulated industries (Finance, Healthcare, Public Sector). We'll discuss how to set up Service Control Policies (SCP), centralize audit logs, segregate networks via Transit Gateway, and maintain continuous compliance over time while empowering development teams with the agility they need. /blog/images/enterprise-landing-zone-multi-account-banking.webp true 23 min aws cloud landing-zone governance security 0 https://carlocruciani.com/en/blog/argocd-applicationset-matrix-generator-enterprise.html https://carlocruciani.com/en/blog/argocd-applicationset-matrix-generator-enterprise.html Wed, 26 Aug 2026 07:51:00 GMT 2026-08-26 09:51 Advanced strategies for scaling declarative deployments across dozens of isolated clusters, separating infrastructure governance from application development teams. /blog/images/argocd-applicationset-matrix-generator-enterprise.webp 5 gitops argocd kubernetes platform-engineering automation https://carlocruciani.com/en/blog/cilium-tetragon-falco-runtime-security-banking.html https://carlocruciani.com/en/blog/cilium-tetragon-falco-runtime-security-banking.html Wed, 26 Aug 2026 07:15:00 GMT 2026-08-26 09:15 Architectural comparison between eBPF kprobes and tracepoints for threat detection in enterprise Kubernetes clusters: active runtime prevention and DORA compliance. /blog/images/cilium-tetragon-falco-runtime-security-banking.webp 6 security ebpf kubernetes zero-trust compliance https://carlocruciani.com/en/blog/confidential-computing-sev-snp-tdx-banking.html https://carlocruciani.com/en/blog/confidential-computing-sev-snp-tdx-banking.html Tue, 25 Aug 2026 23:30:00 GMT 2026-08-26 01:30 Protecting in-use data through hardware-based memory encryption with AMD SEV-SNP and Intel TDX in payment pipelines and remote cryptographic attestation. /blog/images/confidential-computing-sev-snp-tdx-banking.webp 6 cloud-security confidential-computing banking zero-trust compliance https://carlocruciani.com/en/blog/kubernetes-dra-structured-parameters-enterprise.html https://carlocruciani.com/en/blog/kubernetes-dra-structured-parameters-enterprise.html Tue, 25 Aug 2026 23:15:00 GMT 2026-08-26 01:15 Overcoming the Kubernetes Device Plugin model: how to allocate heterogeneous GPUs and accelerators on-demand via Structured Parameters, reducing FinOps overhead in enterprise AI clusters. /blog/images/kubernetes-dra-structured-parameters-enterprise.webp 6 kubernetes ai-infrastructure finops gpu scheduling https://carlocruciani.com/en/blog/opentelemetry-collector-enterprise-observability.html https://carlocruciani.com/en/blog/opentelemetry-collector-enterprise-observability.html Fri, 01 May 2026 08:00:00 GMT 2026-05-01 10:00 Consolidating traces, metrics, and logs into a single pipeline reduces operational debt at scale, but requires careful governance of Semantic Conventions and time series cardinality. /blog/images/opentelemetry-collector-enterprise-observability.webp 7 observability opentelemetry kubernetes platform-engineering prometheus monitoring https://carlocruciani.com/en/podcast/securing-agentic-ai-banking.html https://carlocruciani.com/en/podcast/securing-agentic-ai-banking.html Wed, 15 Apr 2026 22:00:00 GMT 2026-04-16 In this episode, we explore the evolution of banking security in 2026, marked by the shift from passive chatbots to autonomous AI agents capable of operating on databases and transactional systems. We analyze critical risks such as excessive agency and technical tool misuse, diving into the new Monetary Authority of Singapore (MAS) guidelines that promote 'just-in-time' data access and immutable traceability of decision-making processes. We'll also discuss how the NVIDIA OpenShell solution uses sandbox isolation to separate the reasoning phase from material execution, ensuring rigorous governance and the necessary human oversight for high-risk operations. /blog/images/securing-agentic-ai-banking.webp true 31 min ai security banking governance sandboxing 0 https://carlocruciani.com/en/blog/istio-ambient-mesh-enterprise.html https://carlocruciani.com/en/blog/istio-ambient-mesh-enterprise.html Wed, 15 Apr 2026 21:03:00 GMT 2026-04-15 23:03 Transitioning to a sidecarless service mesh scales the proxy layer natively in high-density banking clusters and eliminates latent computational overhead. /blog/images/istio-ambient-mesh-enterprise.webp 8 kubernetes istio service-mesh zero-trust networking https://carlocruciani.com/en/blog/securing-agentic-ai-banking.html https://carlocruciani.com/en/blog/securing-agentic-ai-banking.html Sun, 22 Mar 2026 10:10:00 GMT 2026-03-22 11:10 The evolution from chatbots to intelligent agents requires new governance paradigms based on sandboxing, just-in-time privileges, and immutable tracking of reasoning chains. /blog/images/securing-agentic-ai-banking.webp 7 true 31 min generative-ai security banking mcp-server llmops governance https://carlocruciani.com/en/blog/external-secrets-operator-vault.html https://carlocruciani.com/en/blog/external-secrets-operator-vault.html Sat, 21 Mar 2026 15:48:00 GMT 2026-03-21 16:48 How the integration between External Secrets Operator and HashiCorp Vault enables cryptographic segregation and centralized auditing in multi-tenant clusters. /blog/images/external-secrets-operator-vault.webp 8 kubernetes security zero-trust secrets-management vault https://carlocruciani.com/en/blog/kafka-kip932-queue-semantics.html https://carlocruciani.com/en/blog/kafka-kip932-queue-semantics.html Sun, 08 Mar 2026 13:30:00 GMT 2026-03-08 14:30 With Apache Kafka 4.2 and the general availability of Queues for Kafka, the boundary between event streaming and queueing disappears, transforming the architecture of enterprise messaging systems. /blog/images/kafka-kip932-queue-semantics.webp 8 kafka message-queues event-streaming architecture finops distributed-systems https://carlocruciani.com/en/blog/ingress-nginx-gateway-migration.html https://carlocruciani.com/en/blog/ingress-nginx-gateway-migration.html Tue, 03 Mar 2026 10:20:00 GMT 2026-03-03 11:20 Translating Ingress NGINX to Gateway API is not a mechanical refactor, as some implicit behaviors change semantics and can cause silent outages. /blog/images/ingress-nginx-gateway-migration.webp 4 kubernetes gke istio cilium security https://carlocruciani.com/en/blog/oracle-cloud-banking-architecture.html https://carlocruciani.com/en/blog/oracle-cloud-banking-architecture.html Tue, 03 Mar 2026 09:30:00 GMT 2026-03-03 10:30 Technical analysis of architectural choices on Oracle Cloud in high-scale and compliance banking contexts. /blog/images/oracle-cloud-banking-architecture.webp 4 oracle-cloud oci security networking compliance data-platform https://carlocruciani.com/en/blog/cloud-vm-migration-enterprise.html https://carlocruciani.com/en/blog/cloud-vm-migration-enterprise.html Sun, 01 Mar 2026 19:09:00 GMT 2026-03-01 20:09 Analysis of network patterns and replication strategies to orchestrate the rehosting of legacy workloads in high-density banking contexts. /blog/images/cloud-vm-migration-enterprise.webp 6 cloud architettura vmware enterprise networking https://carlocruciani.com/en/blog/opentofu-state-encryption-governance-enterprise.html https://carlocruciani.com/en/blog/opentofu-state-encryption-governance-enterprise.html Sat, 28 Feb 2026 20:15:00 GMT 2026-02-28 21:15 With OpenTofu 1.12 and client-side state encryption via KMS, the choice between OpenTofu and Terraform post-IBM becomes a long-term governance decision, not just a licensing issue. /blog/images/opentofu-state-encryption-governance-enterprise.webp 6 opentofu terraform infrastructure-as-code security finops gitops https://carlocruciani.com/en/blog/kubernetes-ai-inference-stack-enterprise.html https://carlocruciani.com/en/blog/kubernetes-ai-inference-stack-enterprise.html Fri, 27 Feb 2026 14:30:00 GMT 2026-02-27 15:30 The conclusion of the Kubernetes Serving Working Group marks the maturity of the cluster as an AI inference platform and defines the reference stack for enterprise environments. /blog/images/kubernetes-ai-inference-stack-enterprise.webp 4 kubernetes generative-ai llmops gateway-api cloud-native https://carlocruciani.com/en/blog/google-mcp-database-agents.html https://carlocruciani.com/en/blog/google-mcp-database-agents.html Fri, 27 Feb 2026 08:45:00 GMT 2026-02-27 09:45 Google extends MCP support to six database services, enabling AI agents to interact directly with enterprise data without infrastructural overhead. /blog/images/google-mcp-database-agents.webp 5 mcp-server google-cloud ai-agents cloud-sql spanner alloydb https://carlocruciani.com/en/blog/cilium-119-strict-encryption-zero-trust.html https://carlocruciani.com/en/blog/cilium-119-strict-encryption-zero-trust.html Thu, 26 Feb 2026 15:00:00 GMT 2026-02-26 16:00 Cilium 1.19 brings inter-node encryption in strict mode, beta integration with Ztunnel for sidecar-less mTLS, and critical observability improvements for large clusters. /blog/images/cilium-119-strict-encryption-zero-trust.webp 4 cilium ebpf kubernetes zero-trust service-mesh networking https://carlocruciani.com/en/blog/gke-inference-gateway-llm-latency.html https://carlocruciani.com/en/blog/gke-inference-gateway-llm-latency.html Thu, 26 Feb 2026 13:30:00 GMT 2026-02-26 14:30 How GKE Inference Gateway reduces Time to First Token (TTFT) latency by 35% and halves P95 for mixed AI workloads, with direct implications for enterprise teams in regulated environments. /blog/images/gke-inference-gateway-llm-latency.webp 5 kubernetes gke generative-ai llmops finops platform-engineering https://carlocruciani.com/en/blog/site-automation.html https://carlocruciani.com/en/blog/site-automation.html Wed, 25 Feb 2026 09:00:00 GMT 2026-02-25 10:00 A technical deep dive behind the scenes of my personal website. Architecture, security, and automation with Raspberry Pi, Nginx, Let's Encrypt, and Fail2Ban. /blog/images/site-automation.webp 4 raspberry-pi devops automation web-security https://carlocruciani.com/en/blog/blog-welcome.html https://carlocruciani.com/en/blog/blog-welcome.html Tue, 24 Feb 2026 08:00:00 GMT 2026-02-24 09:00 The manifesto of Carlo Cruciani's technical blog. Architectural vision, enterprise resilience, Kubernetes, FinOps, and modern distributed systems governance. /blog/images/blog-welcome.webp 2 cloud architettura kubernetes finops governance