https://bala-krishnan.com/tags/incident-response/Recent content in Incident-Response on HomeHugo -- gohugo.ioenFri, 23 Oct 2026 00:00:00 +0000https://bala-krishnan.com/posts/26-lamplighter/Fri, 23 Oct 2026 00:00:00 +0000https://bala-krishnan.com/posts/26-lamplighter/When something breaks in production, the first ten minutes usually look the same. One terminal tailing the API pod. Another tailing the worker. A third running kubectl get events -w. Maybe a fourth on the ingress controller, if you can remember which namespace it lives in and what its labels are. Then you start flipping between them, trying to work out what happened first. That last part is the actual job, and none of the tools help with it.