12 min read
Reach services across clouds with internal load balancers
One load balancer per service, or one Traefik routing by hostname. What each costs, why GKE pods need a masquerade fix, and how names resolve.
Kubernetes
24 posts tagged “Kubernetes”.
10 min read
Connect GKE to AKS over a VPN, and prove it works
Build the tunnel between Google Cloud and Azure with BGP, advertise only what should cross, then test four layers until real traffic flows.
23 min read
Building an AI hyperscaler on Kubernetes
How an AI cloud fits together on Kubernetes, from what customers actually buy and the seven layers between datacenter and console to four products on one GPU pool and how tenants share it safely, the lessons AWS and Google learned about cells and control planes, and what changes with scale.
8 min read
Moving Kubernetes workloads across an air gap with Hauler
Declare images and charts in one manifest, package them into a single archive, carry it across, and serve it from a binary with no dependencies.
13 min read
Building Kubernetes-as-a-Service from bare metal
What it takes to run managed Kubernetes when you are the cloud, from hosted control planes, cells and etcd to networking, storage, upgrades and tenant isolation without cloud APIs, plus a version small enough to build on a laptop.
4 min read
Troubleshooting cluster failures
When a node, the control plane or the network fails, a structured workflow for finding the cause, and audit logs for reconstructing who did what.
4 min read
Debugging, monitoring and logging
A systematic way to debug Pods, Services and Deployments, then the two things that make debugging possible, metrics with Prometheus and Grafana and centralized logs.
3 min read
Runtime security: Falco, immutable containers and audit logs
Watch a running cluster for attacks with Falco, stop running containers from being changed with a read-only root filesystem, and record every API request with audit logs.
4 min read
Supply chain security for Kubernetes
Everything between a commit and a running Pod can be attacked. Minimal and signed images, scanning in CI, locked-down pipelines and secrets, and checks at runtime.
8 min read
Your first ten minutes in k9s
Install it, point it at a cluster, and learn the handful of keys that replace most of the kubectl you type.
4 min read
Pod security: PSA, AppArmor, seccomp and sandboxes
Enforce Pod Security Standards per namespace, limit what a container can do with AppArmor and seccomp, and isolate untrusted workloads with gVisor or Kata Containers.
4 min read
Hardening a cluster: CIS benchmarks and API access
Check a cluster against the CIS Kubernetes Benchmark with kube-bench, then control who can do what through the API server with authentication, RBAC and network policies.
4 min read
Multi-container Pods: sidecars, ambassadors, adapters and init containers
When to put more than one container in a Pod, the three patterns for doing it, and init containers that run before your application starts.
4 min read
Liveness, readiness and startup probes
A running container is not always a working one. Probes tell Kubernetes when to restart a container, when to send it traffic, and when to wait out a slow start.
3 min read
ConfigMaps and Secrets
Keep configuration out of your images with ConfigMaps, handle passwords and keys with Secrets, and know what base64 does and does not protect.
4 min read
Upgrading a cluster and backing up etcd
Upgrade a kubeadm cluster one minor version at a time, control plane first, then take and restore etcd snapshots, because etcd holds the cluster's entire state.
5 min read
Building a cluster with kubeadm
Prepare the nodes, install a container runtime and the Kubernetes packages, bootstrap the control plane, add a network plugin and join the workers. Then what each core component does.
4 min read
Persistent storage: volumes, PVs, PVCs and StorageClasses
A container loses its files when it stops. Volumes, PersistentVolumes, PersistentVolumeClaims and StorageClasses are how Kubernetes keeps data that has to outlive it.
3 min read
Controlling Pod traffic with network policies
Every Pod can reach every other Pod by default. Network policies cut that down to what you allow, starting from a default deny.
4 min read
Services and Ingress: exposing your applications
Give a changing set of Pods one stable address with a Service, choose the right Service type, and route outside traffic by host and path with Ingress.
4 min read
Deployments, ReplicaSets, Jobs and CronJobs
Run applications that stay up with Deployments and the ReplicaSets behind them, and tasks that finish with Jobs and CronJobs.
4 min read
Kubernetes objects: Pods, YAML and namespaces
What a Kubernetes object is, how a YAML manifest describes one, and the first two objects you will create, the Pod and the namespace.
3 min read
Your first Kubernetes cluster
Install kubectl, then start a local cluster with Minikube or Kind and check that it answers.
3 min read
What Kubernetes is, and what a cluster is made of
Why containers need something to run them in production, and the two halves of every cluster, the control plane that decides and the worker nodes that do the work.