tag
35 posts
A safe namespace-termination investigation covering discovery failures, remaining objects, finalizers, APIService health, and last-resort finalization.
A deterministic Argo CD rollout using phases, integer waves, health gates, idempotent hooks, selective-sync caveats, and observable failure recovery.
A fail-safe Sigstore workflow for signing immutable image digests, constraining identities, enforcing admission policy, and preserving rollback access.
A recovery-first etcd procedure covering consistent snapshots, encryption keys, revision bumps, restore topology, and proof that Kubernetes reconciles.
A precise guide to Guaranteed, Burstable, and BestEffort Pods, including request math, cgroup enforcement, OOM behavior, and node-pressure eviction.
How Kubernetes impersonation headers and RBAC verbs support least-privilege authorization tests while preserving identity, scope, and audit evidence.
How Server-Side Apply records field ownership, detects conflicting intent, supports shared objects, and differs from replacement and merge patch workflows.
What AWS manages in EKS, what remains in your account, and how node choices, VPC networking, identity, observability, availability, and cost interact.
A production model for AKS architecture, Entra authentication, node pools, CNI choices, upgrades, observability, availability, and shared responsibility.
How GKE divides control between Google and the customer across Autopilot and Standard modes, including scaling, identity, networking, upgrades, security, and cost.
A deep guide to Helm charts and releases, value precedence, dependencies, lifecycle operations, GitOps, secrets, validation, and Helm 4 compatibility.
How KEDA turns queue and event metrics into pod or Job scaling, with authentication, timing controls, observability, backpressure, and production safeguards.
How GatewayClass, Gateway, and typed Route resources improve multi-team traffic management beyond a single overloaded Ingress object.
Recover a failed or pending Helm release by preserving evidence, inspecting revisions and resources, testing rollback, and avoiding unsafe secret edits.
Resolve Kubernetes ImagePullBackOff by classifying event errors, verifying immutable image identity, credentials, node networking, and runtime health.
Diagnose a Kubernetes NotReady node through conditions, leases, kubelet, runtime, storage, networking, and safe workload evacuation with evidence intact.
Investigate Kubernetes OOMKilled containers with termination evidence, time-series memory data, runtime ceilings, node pressure, and load validation.
Diagnose Kubernetes Pending pods from scheduler events, requests, affinity, taints, storage, topology, quota, and admission without weakening safeguards.
Configure Flagger canaries with metric gates, controlled traffic shifts, load tests, and automatic rollback while preserving operational safeguards.
Implement GitOps with Argo CD using pinned installation assets, constrained projects, safe automated sync, drift detection, and tested recovery.
Deploy Kubernetes NetworkPolicies with verified CNI enforcement, default-deny baselines, explicit DNS access, namespace labels, and negative tests.
Configure and test Kubernetes PodDisruptionBudgets for safe drains and upgrades without mistaking eviction limits for an availability guarantee.
Build a reusable Helm chart with safe templates, documented values, schema validation, immutable images, release tests, and OCI packaging checks.
Kubernetes 1.24 removed dockershim after a long deprecation, moving nodes to CRI-native runtimes without invalidating Docker-built OCI images.
Helm began at Deis in 2015, merged ideas with Deployment Manager, removed Tiller in Helm 3, and matured into Kubernetes package management.
Build a production-minded Kubernetes logging pipeline with Fluent Bit, Elasticsearch, Kibana, secure transport, retention, and failure controls.
How admission controllers intercept API requests before they're persisted, and how OPA/Gatekeeper turn that hook into cluster-wide policy enforcement.
How the OCI runtime and image specs standardized what a 'container' actually is, and how containerd/CRI-O/runc fit together beneath Docker and Kubernetes.
Diagnose Kubernetes CrashLoopBackOff from events, previous logs, exit status, probes, configuration, and controlled debugging without erasing evidence.
A practical Kubernetes guide to blue-green cutovers and cautious canary releases, with health gates, rollback checks, and routing caveats.
Configure Kubernetes HPA with verified metrics, resource requests, scaling behavior, load tests, and capacity safeguards for reliable autoscaling.
Create a reproducible local Kubernetes cluster with kind, load development images safely, expose services, test multiple nodes, and clean up.
How pod-to-pod networking, Services, and kube-proxy's packet rewriting fit together to make Kubernetes' flat network model actually work.
The two-phase filter-and-score process the Kubernetes scheduler uses to decide which node a pod lands on, and how to influence it.
Kubernetes 1.0 arrived in July 2015 as Google placed the project with the newly launched CNCF, anchoring a vendor-neutral ecosystem.