All bites
The whole library, newest first. Filter by what you are here for, or pick a topic if you already know.
8668 bites
Page 82
Method-aware authorization with Istio policy
An ALLOW policy on user-service granting frontend's principal POST plus the users path, another granting all principals GET; deny is implicit once any ALLOW exists.
Diagnosing latency with distributed tracing
Follow the trace ID across spans, compare per-span durations to find the slow hop, distinguish service time from network and queueing.
Retries and circuit breaking in a mesh
Configure bounded retries with timeouts for transient errors, and a circuit breaker via outlier detection plus connection-pool limits to shed load from a failing dependency.
How a service mesh enables automatic mTLS
The control plane issues short-lived workload certificates, sidecars present them, both sides verify identity and encrypt the channel.
Canary release with Istio traffic splitting
DestinationRule defines subsets by label, VirtualService routes weighted 90/10 to those subsets, then shift weights as the canary proves healthy.
The sidecar proxy pattern in a mesh
A proxy container shares the pod, all in/out traffic is redirected through it, so policy and telemetry apply without code changes.
What a service mesh solves
It adds traffic management, security via mTLS, and observability at the network layer through sidecars, beyond what plain Kubernetes offers.
Preventing split-brain in HA Operators
Run active-passive replicas, only the leader reconciles, election uses a Lease object renewed under a TTL.
Mutating vs Validating webhooks with an Operator
Mutating runs first to inject defaults or sidecars, validating runs after to reject bad specs, both keyed to your CRD.
Keeping operator .status accurate under failures
Status can lag or go stale during partitions and crashes; make reconcile idempotent, observe true state each loop, use conditions and observedGeneration, handle conflicts.
When to build an Operator vs a Helm chart
Charts handle install-time templating; operators add continuous day-two logic like failover, backups, and scaling for stateful apps.
Adding a required field to a live CRD
Don't make it required immediately; add it optional with a default, introduce a new version with conversion, migrate existing objects, then tighten.
Finalizers for clean external cleanup
A finalizer is a key blocking deletion; deletion sets deletionTimestamp, the operator does cleanup then removes the finalizer so the object is purged.
The reconciliation loop in an Operator
Reconcile compares desired spec to observed state and converges them, idempotently; triggered by resource changes, watched dependents, and periodic resync.
Creating an instance of a custom resource
Write a manifest with apiVersion (group/version), kind, metadata.name, and a spec matching the CRD schema, then kubectl apply -f it.
Core components of a Kubernetes Operator
A CRD defines the type, a controller watches instances via the API server and runs a reconcile loop, encoding operational knowledge to drive real state.
What is a Custom Resource Definition?
A CRD registers a new resource kind so the API server stores and serves it like built-ins; it lets you model domain concepts declaratively.
Helm migration hooks under GitOps
Use a pre-upgrade hook Job with weights and delete policy; the challenge is GitOps tools render statically and reconcile, conflicting with Helm's imperative hook lifecycle.
GitOps repo layout for environment promotion
Shared base plus per-env overlays via Kustomize or value files, promotion by PR moving a pinned version forward, separating app source from config repos.
Argo CD App of Apps pattern
A parent Application whose manifests are themselves Application resources, so syncing one app declaratively manages many.