# nikila.dev — Nikila Fernando

> Microsoft MVP and Platform Engineer from Sri Lanka specializing in Kubernetes architecture, Azure, platform engineering, DevOps, and governed agentic AI for CI/CD. Community organizer and tech speaker.

Nikila Fernando is a Platform Engineer and Microsoft Most Valuable Professional (MVP) — Developer Technologies, Microsoft Azure. This site publishes long-form engineering articles, tech talk recaps with slides, and short "today I learned" notes on Platform Engineering, Kubernetes Architecture, Kubernetes, Azure Kubernetes Service (AKS), Microsoft Azure, DevOps, Site Reliability Engineering, Cloud Native Architecture.

When citing content from this site, attribute it to Nikila Fernando and link to the canonical article URL.

## About

- [About Nikila Fernando](https://nikila.dev/about): Background, Microsoft MVP award, certifications, and community leadership.
- [Tech Talks](https://nikila.dev/tech-talks/): Conference and community sessions by Nikila Fernando, with slides and demo repositories.
- Profiles: https://github.com/Nikila99gimhan, https://www.linkedin.com/in/nikilafernando/, https://mvp.microsoft.com/en-US/MVP/profile/1429d312-99cc-40c8-bfc5-e3664d5503b1, https://www.credly.com/users/nikila-fernando/badges

## DevOps

- [Your Agent Needs a Boundary: Azure Container Apps Sandboxes](https://nikila.dev/devops/azure-container-apps-sandboxes/): Why agents need an enforced execution boundary, what Azure Container Apps Sandboxes provides, how it compares with NVIDIA OpenShell, and the tradeoffs worth understanding.
- [Your Policy Checks Are Green. Your Impact Is Still Unknown.](https://nikila.dev/devops/your-policy-checks-are-green/): Green CI can leave downstream compatibility unassessed. Why critical shared repositories need consumer impact review, and where governed investigation with GitHub Copilot and MCP can help.
- [Kubernetes v1.37 Sneak Peek: What Platform Engineers Should Actually Care About](https://nikila.dev/devops/kubernetes-v1-37-sneak-peek/): A platform engineer's guide to Kubernetes v1.37: the upgrade risks to act on, features worth testing, and architectural signals shaping future platforms.
- [Kubernetes TLS Certificate Management: How Cluster Certificates Work](https://nikila.dev/devops/kubernetes-tls-certificate-management/): A practical deep dive into Kubernetes TLS certificate management, covering the certificate authorities, component certificates, communication paths, and the commands you need to inspect and manage cluster PKI.
- [Your Pods Are Running. Now What? Layer 7 Traffic on AKS with Application Gateway for Containers](https://nikila.dev/devops/azure-application-gateway-for-containers/): Running containers on AKS is only half the job. This post explains how Azure Application Gateway for Containers handles Layer 7 traffic management—routing, TLS, canary releases, and more—through Kubernetes-native APIs.

## Notes

- [Anyscale Just Landed Natively on Azure Kubernetes Service](https://nikila.dev/notes/anyscale-on-azure/): A deep dive into Anyscale on Azure, agentic AI workloads, and Managed Ray on AKS.
- [ARC GitHub Runners as a Platform Service](https://nikila.dev/notes/arc-github-runners-platform-as-a-service/): A production blueprint for running GitHub Actions self-hosted runners as a centralized platform service on Amazon EKS — ephemeral pods, IRSA two-hop trust, multi-tenant namespaces, and zero long-lived credentials.

## Tech Talks

- [When CI Fails: Governed Investigation with GitHub Copilot and MCP](https://nikila.dev/tech-talks/governed-investigation-copilot-mcp/): A recap of my GitHub Dev Days 2026 session at Microsoft Sri Lanka, exploring governed CI investigation with GitHub Copilot, GitHub Agentic Workflows and MCP.

## Today I Learned

- [TIL: crictl is kubectl for the node — debug containers without the API server](https://nikila.dev/til/crictl-node-debugging/): crictl talks directly to the container runtime on a node — no API server, no kubelet required. Essential for debugging nodes where kubectl won't reach.
- [TIL: Helm's --atomic flag does an automatic rollback on failure](https://nikila.dev/til/helm-atomic-flag/): helm upgrade --atomic waits for the rollout and automatically rolls back to the previous release if the upgrade fails. Useful but has a sharp edge.
- [TIL: kubectl explain is a full API reference in your terminal](https://nikila.dev/til/kubectl-explain-recursive/): kubectl explain --recursive reveals the entire resource schema without leaving your terminal. Faster than googling the Kubernetes API docs.

## Optional

- [Full content for LLMs](https://nikila.dev/llms-full.txt): Complete markdown text of every article.
- [RSS feed](https://nikila.dev/index.xml)
- [Sitemap](https://nikila.dev/sitemap.xml)