Blog
Notes on DevOps, Kubernetes, self-hosted infrastructure and consulting.
19 posts tagged kubernetes ·
clear filter
October 4, 2026
PodDisruptionBudgets and Node Drains in Kubernetes: Writing the Budget and Why Maintenance Gets Stuck
A PodDisruptionBudget only limits voluntary disruptions, and a badly written one either protects nothing or blocks node drains forever. Choosing between minAvai...
Read more →
September 29, 2026
DNS Resolution in Kubernetes: ndots, Search Domains, CoreDNS Caching and the Five-Second Stalls
Why a pod turns one external lookup into eight DNS queries, what lowering ndots breaks, when autopath and NodeLocal DNSCache are worth it, where the exact five-...
Read more →
September 26, 2026
Kubernetes Resource Requests and Limits: CPU Throttling, OOMKilled and QoS Classes
A request is the scheduler's reservation, a limit is the kernel's quota. Why CPU gets paused while memory gets killed, how QoS classes decide eviction order, an...
Read more →
September 24, 2026
Stateful Resources Under Helm: Renames, resource-policy and CRD Pitfalls
Helm deletes a renamed PVC, restarts a StatefulSet on empty disks, regenerates passwords on every upgrade and never updates a CRD. Why data gets lost when state...
Read more →
September 23, 2026
Automated TLS Certificates with ACME: Validation Method, Rate Limits and State You Must Keep
Choosing between HTTP-01, DNS-01 and TLS-ALPN-01, where Let's Encrypt rate limits will catch you, the state you actually need to back up, and pitfalls like spli...
Read more →
September 22, 2026
Zero-Downtime Deployments in Kubernetes: Probes, preStop and Getting Graceful Shutdown in the Right Order
A rolling update alone does not give you zero downtime. Unless readiness and startup probes, a preStop delay, terminationGracePeriodSeconds, maxUnavailable and...
Read more →
September 20, 2026
Why Scheduled Jobs Break Quietly: Missed Runs, Overlap and Single Instance in cron, systemd Timers and Kubernetes CronJobs
Scheduled jobs break quietly in three ways: the missed run, the overlapping run and the failure nobody sees. How cron, systemd timers and Kubernetes CronJobs an...
Read more →
September 19, 2026
Enforcing Policy in Kubernetes: OPA Gatekeeper vs. Kyverno, and When to Use Which
RBAC decides who can act, not whether the object they submit is actually valid. Admission-based policy engines close that gap. We compare OPA Gatekeeper, Kyvern...
Read more →
September 16, 2026
The PID 1 Problem in Containers: Zombie Processes and When You Need an Init System
The first process in a container is not an ordinary process as far as the kernel is concerned. Here is how that difference leads to zombie process buildup, how...
Read more →
September 15, 2026
Autoscaling Pods in Kubernetes: Choosing Between HPA, VPA, and KEDA
HPA scales replica count, VPA scales resource sizing, KEDA scales event-driven load. Using one in place of another is the root cause of most autoscaling complai...
Read more →
September 13, 2026
The Empty Map Trap When Talking to the Kubernetes API
When a Kubernetes map field is empty, whether JSON encodes it as an array or an object depends on your language, and getting it wrong silently rejects the whole...
Read more →
September 12, 2026
When You Actually Need a Service Mesh, and When It's Just Complexity
A decision guide to the real differences between Istio, Linkerd, and Cilium, what actually justifies adopting a service mesh, and the concrete pitfalls that sho...
Read more →
September 8, 2026
Cilium and eBPF: What Changes in Network Policy and Observability
Why iptables-based network policy runs into scaling walls in large clusters, how eBPF fixes that, and what Cilium's identity-based L7 policies and Hubble's side...
Read more →
September 3, 2026
Gateway API: What Changes After Ingress
Ingress has carried the same three or four fields for a decade, and everything else got bolted on through controller-specific annotations. Gateway API splits th...
Read more →
September 1, 2026
Secret Management in Kubernetes: Which Approach Fits Where
Kubernetes' built-in Secret object is not encryption. Here is how to choose between Sealed Secrets, External Secrets Operator, SOPS, and Vault's injector based...
Read more →
August 19, 2026
How to Do GitOps, and What It Actually Buys You
Why the pull model differs from push-based deployment, where self-healing turns into a fight, why environments belong in directories rather than branches, how t...
Read more →
August 4, 2026
What an active-active Kubernetes architecture really takes
Active-active is not about splitting traffic, it is about writing consistently in two regions at once, and the real work ends up in the data layer. The cost of...
Read more →
July 28, 2026
Backing up a Kubernetes cluster with Velero and restoring it into another one
The real problem with Kubernetes backups is not etcd but cluster objects and persistent volume data being captured separately. How Velero is built, when to choo...
Read more →
July 21, 2026
Kubernetes from scratch on Talos Linux: operating a cluster without a shell
Talos Linux is an immutable, API managed Kubernetes OS with no shell and no SSH on the node. How machine config works, the bootstrap and upgrade flow, debugging...
Read more →