Search
Find a bite, explore a topic or look for a role.
Results for “Kubernetes”
Bites 384
How mounted ConfigMap updates propagate to pods
Kubelet refreshes mounted files within roughly a sync period via an atomic symlink swap, but the app must reload on its own; env-var injection never updates.
Scaling on queue length with the HPA
Expose queue length through an external metrics adapter behind the metrics API, point the HPA at that external metric with a target per pod; KEDA packages this.
Impact of losing etcd quorum
Without quorum etcd goes read-only-ish and the API server cannot persist writes, so scheduling and changes stall, but kubelets keep running existing pods.
Guardrails for GitOps sync outages
Pre-merge schema validation, dry-run, policy gates and review; post-merge progressive sync, health checks with automated rollback, and pruning controls.
Retries and circuit breaking in a mesh
Configure bounded retries with timeouts for transient errors, and a circuit breaker via outlier detection plus connection-pool limits to shed load from a failing dependency.
How a service mesh enables automatic mTLS
The control plane issues short-lived workload certificates, sidecars present them, both sides verify identity and encrypt the channel.
Canary release with Istio traffic splitting
DestinationRule defines subsets by label, VirtualService routes weighted 90/10 to those subsets, then shift weights as the canary proves healthy.
Preventing split-brain in HA Operators
Run active-passive replicas, only the leader reconciles, election uses a Lease object renewed under a TTL.
Mutating vs Validating webhooks with an Operator
Mutating runs first to inject defaults or sidecars, validating runs after to reject bad specs, both keyed to your CRD.
When to build an Operator vs a Helm chart
Charts handle install-time templating; operators add continuous day-two logic like failover, backups, and scaling for stateful apps.
Finalizers for clean external cleanup
A finalizer is a key blocking deletion; deletion sets deletionTimestamp, the operator does cleanup then removes the finalizer so the object is purged.
The reconciliation loop in an Operator
Reconcile compares desired spec to observed state and converges them, idempotently; triggered by resource changes, watched dependents, and periodic resync.
Creating an instance of a custom resource
Write a manifest with apiVersion (group/version), kind, metadata.name, and a spec matching the CRD schema, then kubectl apply -f it.
Helm migration hooks under GitOps
Use a pre-upgrade hook Job with weights and delete policy; the challenge is GitOps tools render statically and reconcile, conflicting with Helm's imperative hook lifecycle.
Argo CD App of Apps pattern
A parent Application whose manifests are themselves Application resources, so syncing one app declaratively manages many.
Managing secrets in a GitOps workflow
Never commit plaintext; encrypt with Sealed Secrets or SOPS, or reference an external store via External Secrets Operator.
How GitOps controllers detect drift and sync
The controller renders desired manifests from Git, diffs them against live cluster objects, marks OutOfSync, then a sync applies the diff to converge.
Diagnose a Prometheus cardinality explosion
Find offenders via TSDB stats and topk count by __name__, identify unbounded labels, then drop or aggregate them with relabeling.
ConfigMap vs Secret
ConfigMaps hold non-sensitive plain config; Secrets hold sensitive data, base64-encoded and treated specially (RBAC, optional encryption at rest).
Restricting Pod ingress with a NetworkPolicy
Create a NetworkPolicy with podSelector app=frontend, policyTypes Ingress, and one ingress from-rule matching podSelector role=api-gateway; requires a CNI that enforces policies.