All bites
The whole library, newest first. Filter by what you are here for, or pick a topic if you already know.
4247 bites
Page 38
Init Containers: Setup Tasks Before Your Main App Runs
Init containers are setup tasks that run to completion before your main application starts. Use them to wait for dependencies, fetch configs, or run database migrations.
Kubernetes CronJob: Scheduled Tasks in Your Cluster
A Kubernetes CronJob is like a recurring alarm for your cluster. It automatically runs tasks like backups or reports on a schedule, creating a new Job for each run. The main footgun is concurrency: by default, jobs can overlap if one runs too long.
Pod QoS Classes: Guaranteed, Burstable, BestEffort
Kubernetes QoS classes are eviction priorities, not performance guarantees. Under node pressure, the kubelet kills BestEffort pods first, then Burstable, then Guaranteed. Omitting limits does not grant infinite headroom; it makes your pod die first.
Pod Disruption Budgets: Stop Upgrades From Killing Your App
A Pod Disruption Budget (PDB) is a contract with Kubernetes to maintain minimum availability. It limits how many pods can be voluntarily terminated at once during node drains or cluster upgrades, preventing self-inflicted outages.
Pod Affinity: Grouping or Separating Your Pods
Pod affinity tells Kubernetes to place pods together for performance or apart for high availability. Use it to co-locate a web server and cache for low latency, or spread database replicas across nodes to prevent a single point of failure.
ClusterIP Service: Internal-Only Networking
A ClusterIP service is like an unlisted phone number for your pods, providing a stable internal IP for communication *within* the cluster. Use it for backend-to-backend traffic. The footgun is assuming it's reachable from the outside—it's not.
Kubernetes DNS: How Pods Find Each Other
Kubernetes DNS gives services and pods stable, human-readable names so you don't have to track ephemeral IP addresses. It's how a frontend pod finds a backend service.
Kubernetes Ingress: The Cluster's Smart Receptionist
Ingress acts as a smart receptionist for your cluster, routing external HTTP/S traffic to internal services based on host or path. This lets you expose many apps with one load balancer.
Ingress Controller: Your Cluster's Smart Reverse Proxy
An Ingress Controller is the traffic cop for your Kubernetes cluster, directing external HTTP/S requests to the correct internal services. It exposes multiple services under a single IP, handling host and path routing.
Kubernetes LoadBalancer: Your App's Public Entry Point
A Kubernetes LoadBalancer Service automatically provisions a cloud provider's load balancer to expose your app externally. It's the simplest way to get a public IP, but creating one per service is expensive and inflexible. Use an Ingress for more control.
EndpointSlice: Splitting the Monolithic Endpoints List
EndpointSlice shards a service's pod backends into smaller chunks instead of one massive list. This keeps kube-proxy and DNS fast when services scale to thousands of pods. Do not edit them by hand; the controller owns them and will overwrite your changes.
Kubernetes NetworkPolicy: A Firewall for Pods
NetworkPolicy is a firewall for pods, locking down traffic in a cluster where everything can talk to everything by default. Use it to isolate services, like preventing a web frontend from directly accessing a database.
kube-proxy: The Plumber for Kubernetes Services
kube-proxy is the network plumber on each node, making Kubernetes Services work. It translates a Service's virtual IP into routes to real pods using iptables or IPVS. The name is a footgun: it's a Layer 4 packet forwarder, not a Layer 7 application proxy.
ConfigMap decouples config from container images
A ConfigMap is a key-value store that injects configuration into pods without rebuilding the image. Use it for feature flags, database hostnames, or any non-secret settings. Editing one does not restart existing pods, so stale config is the common footgun.
Kubernetes Secrets: Managing Sensitive Data in Pods
A Kubernetes Secret is a dedicated object for storing sensitive data like API keys, separating them from your application code. It's used to inject database credentials or TLS certificates into pods.
Kubernetes: Inject ConfigMaps & Secrets as Env Vars
Injecting ConfigMaps and Secrets as environment variables decouples your app from its configuration. Kubernetes passes these key-value pairs into your container at startup, perfect for things like API keys or feature flags.
Projected Volumes: Mount Config as Live Files
A projected volume mounts ConfigMaps and Secrets as files inside your Pod, which update automatically when the source object changes. Use this for apps that can hot-reload config, avoiding restarts. The footgun: updates aren't instant; there's a delay.
The Kubernetes Downward API: Pod Self-Awareness
The Downward API gives a container self-awareness, injecting Pod metadata like its name or IP address as environment variables or files. Use it so apps can self-configure without calling the main K8s API.
Immutable Secrets & ConfigMaps: Write-Once Configuration
Treat your Kubernetes configuration like a container image: create it once, then create a new version to update it. The immutable flag enforces this "write-once" pattern for Secrets and ConfigMaps, reducing API server load and preventing accidental updates.
Kustomize: Template-Free Kubernetes Configuration
Kustomize is a patch tool for Kubernetes YAML, letting you manage environment-specific configurations without complex templates. Use it to define a base config and apply overlays for dev, staging, and prod. The footgun is treating it like a templating engine.