mypie Engineering Blog
Real war stories from building mypie.io on AWS EKS — infrastructure failures, debugging sessions, and the fixes that worked.
-
Security and GDPR Compliance on AWS EKS: What We Built and Why
mypie processes personal financial data — pie (investment portfolio) positions, subscription status, user identities. This post covers every security control we've implemented across AWS, Kubernetes, and network layers, and maps each to the relevant GDPR article.
Read more → -
Release Management: How We Ship Code from Commit to Production
A full walkthrough of how code moves from a developer's branch to production on mypie — GitHub Actions builds images, ArgoCD syncs Kubernetes, and Atlantis manages Terraform. Zero manual kubectl apply, zero manual terraform apply.
Read more → -
EKS Pod Limits: When Your Node Just Can't Fit One More Pod
We bootstrapped ArgoCD on EKS and one of its pods got stuck in Pending with "Too many pods." The t3.medium limit of 17 pods caught us off guard. Here's why the limit exists, how to calculate it, and what your options are.
Read more → -
ArgoCD, Private GitHub Repos, and the AWS SSO Kubeconfig Problem
After ArgoCD was installed via Helm, we tried to apply our
Read more →root-app.yamlto bootstrap the App-of-Apps pattern. Two separate issues came up in sequence — one about kubectl itself not being able to talk to the cluster, and one about ArgoCD not being able to read from our private GitHub repository. -
AWS Load Balancer Controller: Four Failures Before It Worked
The AWS Load Balancer Controller (LBC) is responsible for provisioning ALBs and NLBs in response to Kubernetes
Read more →Ingressresources. Getting it running looked simple on paper — install via Helm, point at the cluster — but we hit four distinct failures before the first ALB was created. -
ACM Wildcard Cert Validation with Cloudflare: The Duplicate CNAME Trap
We use ACM for TLS termination on our ALB. We needed a single certificate covering both the apex domain
Read more →mypie.ioand all subdomains*.mypie.io. ACM allows you to add both as Subject Alternative Names (SANs) on a single cert. What it does not tell you upfront is that both produce the same CNAME validation record. -
Recovering from a Stuck Terraform State Lock
A
Read more →terraform applyhad crashed mid-run — likely from a network interruption or a session timeout. When we tried to run the next apply, we hit: -
Importing Pre-Existing AWS Resources into Terraform State
After spending days getting the staging environment right, we ran our first
Read more →terraform applyfor production expecting smooth sailing. Instead, the output was a wall ofEntityAlreadyExistserrors.