Archive of posts with category 'kubernetes'
Scaling Istio
Trim xDS config and metrics to stop istio-proxy OOMKills, and keep istiod alive through scale-outs with discoverySelectors, HPA tuning, and idle timeouts.
Work Around Max Count of Security Group Rules on EKS
EKS NLB Services can exhaust the 1000 security group rules allowed per ENI. Managing rules yourself with consecutive static NodePorts cuts 5 per Service to 2.
Layer-4 Load Balancer & Zero-downtime Autoscaling and Upgrade
externalTrafficPolicy: Local drops NLB traffic on scale-in and rolling upgrades. IP targets or ProxyTerminatingEndpoints, plus a preStop drain, fix it.
Kubernetes Networking From the First Principles
How Pod-to-Pod, ClusterIP, and NodePort traffic flows through network namespaces, veth pairs, the cbr0 bridge, VXLAN, and kube-proxy iptables NAT.
Lessons from Scaling GKE: L4 ILB Tops at 250 Nodes
GKE's internal load balancer health-checks only 250 nodes. With externalTrafficPolicy Local, only Nginx nodes pass, so a subset lacking them broke ingress.
How to Configure Applications for High Availability in Kubernetes
Pods are ephemeral. Stay available with graceful SIGTERM handling, health probes, PodDisruptionBudgets, anti-affinity, autoscaling, and monitoring.
Service API Changes: Prefer Blue-green Update to Rolling Update
Kubernetes rolling updates mix old and new servers, so API changes must be forward compatible too. Blue-green updates need only backward compatibility.
CD Tricks for Kubernetes Deployment + ConfigMap
Two kubectl tricks: update a ConfigMap from file via dry-run piped to apply, and use a CONFIG_HASH env var so config edits trigger a zero-downtime rollout.
Docker Multi-stage Build: Fast, Minimal and Secure Images
Docker multi-stage builds run independent stages in parallel, shrink images without chaining RUN commands, and keep private-repo SSH keys out of the image.
Never miss a story from me, subscribe to my newsletter