Archive of posts with category 'networking'
Scaling Istio
Trim xDS config and metrics to stop istio-proxy OOMKills, and keep istiod alive through scale-outs with discoverySelectors, HPA tuning, and idle timeouts.
Work Around Max Count of Security Group Rules on EKS
EKS NLB Services can exhaust the 1000 security group rules allowed per ENI. Managing rules yourself with consecutive static NodePorts cuts 5 per Service to 2.
Layer-4 Load Balancer & Zero-downtime Autoscaling and Upgrade
externalTrafficPolicy: Local drops NLB traffic on scale-in and rolling upgrades. IP targets or ProxyTerminatingEndpoints, plus a preStop drain, fix it.
Kubernetes Networking From the First Principles
How Pod-to-Pod, ClusterIP, and NodePort traffic flows through network namespaces, veth pairs, the cbr0 bridge, VXLAN, and kube-proxy iptables NAT.
The Good, Bad, and Ugly: Istio for Short-lived Pods
Envoy sidecars keep Istio Job Pods alive and may lag app startup. A webhook-injected wrapper waits for proxy readiness; a controller stops Envoy when done.
DNS, UDP, IP Anycast, and All That
Why DNS prefers UDP: BGP anycast route changes can break TCP connections, and a UDP query takes 2 packets versus 11 for TCP, with no connection state.
Lessons from Scaling GKE: L4 ILB Tops at 250 Nodes
GKE's internal load balancer health-checks only 250 nodes. With externalTrafficPolicy Local, only Nginx nodes pass, so a subset lacking them broke ingress.
A Brilliant Hack: Why does Layer 2/3 Checksum use 1’s Complement, Not 2’s
One's complement sums are endianness-independent, so routers verify checksums without ntohs and htons swaps; receivers simply check for all ones.
JWT + Third-party Oauth in Single Page App
Returning a JWT to a single page app after OAuth login: why session cookies and URL params fall short, and a tiny HTML page that saves it to localStorage.
A Primer on Secure Communication Channels
Why clear text, symmetric keys, and raw public keys fail, how PKI and certificate authorities solve key distribution, and what a compromised CA breaks.
Sloppy Quorum And Eventual Consistency
Choosing availability over consistency: NWR quorums where W + R exceeds N keep reads fresh; smaller ones give eventual consistency, measured by t-visibility.
Never miss a story from me, subscribe to my newsletter