Search
Find a bite, explore a topic or look for a role.
Results for “Kubernetes”
Bites 384
Configuration Hydration: From Template to Manifest
Configuration hydration turns templates like Helm charts into final Kubernetes manifests. This lets you see the exact YAML diff in a PR, not just a variable change. The footgun is that this adds a build step which, if broken, blocks all deployments.
Score: Define Your Workload Once, Run Anywhere
Score is a universal remote for your workload configs, letting you define what your app needs once in a score.yaml file. It translates this spec into files for Docker Compose or Kubernetes, preventing config drift.
CNI: The Universal Plug for Container Networking
CNI is the standard API that decouples container runtimes from network implementations. In Kubernetes, it lets you swap networking plugins like Calico or Flannel.
Container Image: A Blueprint for Your Application
A container image is a static blueprint for your application, bundling code, runtime, and settings. You build images to ship software for Docker or Kubernetes, which then run them as live containers.
Open Policy Agent (OPA): Centralized Policy as Code
OPA decouples policy decisions from your app's code. Instead of scattering if statements, you query a central engine: 'Is this allowed?' It enforces rules in Kubernetes, CI/CD, and API gateways. A common footgun is only using it for yes/no decisions.
Graceful shutdown implementation and zero-downtime deployments?
Listen for SIGTERM, stop accepting new connections, drain in-flight requests, close resources, exit.
What are key Dockerfile steps for Node.js Express apps?
Use lightweight base image, copy app, install deps, expose port, set NODE_ENV, run.
Environment configuration and secrets management in Node.js?
Use environment variables, load from .env file (dev only), never commit secrets.
Handling uncaughtException and unhandledRejection
Listen on process for uncaughtException and unhandledRejection, log the error, stop accepting new work, drain in-flight requests, then exit non-zero for a supervisor to restart.
Operational versus programmer errors in Node.js
Operational errors are expected runtime conditions you handle and respond to; programmer errors are bugs that may corrupt state, so you log and gracefully restart.
OpenTelemetry agent and gateway architecture
Agents run per-node for local collection and host enrichment; gateways are central, horizontally scaled pools for batching, tail sampling, and routing.
Designing shallow vs deep health checks
Shallow checks confirm the process is alive; deep checks verify dependencies; use shallow for liveness/load-balancer routing and deep sparingly to avoid…
Idempotency in infrastructure provisioning scripts
Idempotency means repeated runs converge to one end state; achieve it via desired-state reconciliation or idempotency keys with read-before-write.
Loki versus Elasticsearch for logs
Loki indexes only labels and stores raw log chunks, cheap but needs label-scoped brute-force search; Elasticsearch full-text indexes content, fast arbitrary search but costly to store…
Core components of Prometheus
Server scrapes targets found via service discovery, stores samples in a local time-series database, with Alertmanager and exporters as helpers.
EFK centralized logging architecture
Fluentd runs as a DaemonSet collecting node container logs, parses and forwards to Elasticsearch for indexed storage, and Kibana queries and visualizes them.
kube-state-metrics versus node-exporter
Kube-state-metrics exposes API object state (deployment replicas, pod phase, restarts) from the control plane, while node-exporter exposes OS-level hardware metrics (CPU, memory, disk) per…
Binding a ClusterRole with a RoleBinding
A RoleBinding referencing a ClusterRole grants those rules only within the binding's namespace; reuse built-in roles like view per-team without duplicating definitions.
Root and NET_ADMIN under Pod Security Standards
Set runAsUser 0 and capabilities add NET_ADMIN in the container securityContext; this is rejected by Restricted and Baseline, so the namespace must use the Privileged profile.
First NetworkPolicy flips a pod to default-deny
Once any policy selects a pod for a direction, that direction becomes default-deny and only explicitly allowed traffic passes; unselected pods stay open.