2 posts tagged with "migration"

Most organizations do not have an ingress strategy. They have NGINX controllers that grew with the cluster — snippet annotations, oauth2-proxy in front of internal tools, cert-manager secrets in app namespaces — and a March 2026 deadline that is not on anyone's roadmap yet.

At Resizes, we migrated production traffic on EKS from Ingress NGINX to Envoy Gateway: dual-run, canary DNS per hostname, NGINX left up until each host was proven on Envoy.

Three days is the DNS cutover window, not the full program. Platform design, Envoy Gateway rollout, and our migration toolkit came first. Those three days were lane conversion, GitOps merges, and moving ~50 hostnames — no user-visible outage, no DNS rollback, no incidents filed in our change log. We scaled NGINX down about a week later, after soak.

Most organisations do not have a “secrets strategy.” They have an AWS line item that grows every time someone creates another credential — and a platform team that still opens tickets to wire the next service into IAM.

AWS Secrets Manager charges $0.40 per secret, every month, plus API usage (official pricing). There is no volume discount. Forgotten secrets still bill. Cross-region replicas bill again. Copy the same logical secret into dev, staging, and prod and you pay three times.

That is not only a FinOps problem. It is an efficiency problem: two sources of truth (password manager for people, Secrets Manager for apps), cloud-locked access paths, and more glue each time you add a cluster.

We help organisations quantify that cost, redesign how secrets are delivered, migrate safely, and leave teams with an operating model that is cheaper and easier to run.