Docker &amp; Kubernetes

Kubernetes Ingress: The Cluster's Smart Receptionist

Ingress acts as a smart receptionist for your cluster, routing external HTTP/S traffic to internal services based on host or path. This lets you expose many apps with one load balancer.

Ingress Controller: Your Cluster's Smart Reverse Proxy

An Ingress Controller is the traffic cop for your Kubernetes cluster, directing external HTTP/S requests to the correct internal services. It exposes multiple services under a single IP, handling host and path routing.

Kubernetes LoadBalancer: Your App's Public Entry Point

A Kubernetes LoadBalancer Service automatically provisions a cloud provider's load balancer to expose your app externally. It's the simplest way to get a public IP, but creating one per service is expensive and inflexible. Use an Ingress for more control.

EndpointSlice: Splitting the Monolithic Endpoints List

EndpointSlice shards a service's pod backends into smaller chunks instead of one massive list. This keeps kube-proxy and DNS fast when services scale to thousands of pods. Do not edit them by hand; the controller owns them and will overwrite your changes.

Kubernetes NetworkPolicy: A Firewall for Pods

NetworkPolicy is a firewall for pods, locking down traffic in a cluster where everything can talk to everything by default. Use it to isolate services, like preventing a web frontend from directly accessing a database.

kube-proxy: The Plumber for Kubernetes Services

kube-proxy is the network plumber on each node, making Kubernetes Services work. It translates a Service's virtual IP into routes to real pods using iptables or IPVS. The name is a footgun: it's a Layer 4 packet forwarder, not a Layer 7 application proxy.

ConfigMap decouples config from container images

A ConfigMap is a key-value store that injects configuration into pods without rebuilding the image. Use it for feature flags, database hostnames, or any non-secret settings. Editing one does not restart existing pods, so stale config is the common footgun.

Kubernetes Secrets: Managing Sensitive Data in Pods

A Kubernetes Secret is a dedicated object for storing sensitive data like API keys, separating them from your application code. It's used to inject database credentials or TLS certificates into pods.

Kubernetes: Inject ConfigMaps & Secrets as Env Vars

Injecting ConfigMaps and Secrets as environment variables decouples your app from its configuration. Kubernetes passes these key-value pairs into your container at startup, perfect for things like API keys or feature flags.

Projected Volumes: Mount Config as Live Files

A projected volume mounts ConfigMaps and Secrets as files inside your Pod, which update automatically when the source object changes. Use this for apps that can hot-reload config, avoiding restarts. The footgun: updates aren't instant; there's a delay.

The Kubernetes Downward API: Pod Self-Awareness

The Downward API gives a container self-awareness, injecting Pod metadata like its name or IP address as environment variables or files. Use it so apps can self-configure without calling the main K8s API.

Immutable Secrets & ConfigMaps: Write-Once Configuration

Treat your Kubernetes configuration like a container image: create it once, then create a new version to update it. The immutable flag enforces this "write-once" pattern for Secrets and ConfigMaps, reducing API server load and preventing accidental updates.

intermediate1 min read

Kustomize: Template-Free Kubernetes Configuration

Kustomize is a patch tool for Kubernetes YAML, letting you manage environment-specific configurations without complex templates. Use it to define a base config and apply overlays for dev, staging, and prod. The footgun is treating it like a templating engine.

Kubernetes ServiceAccounts: Identity for Pods

A ServiceAccount is an ID badge for a Pod, letting it securely talk to the Kubernetes API. It's used when your app needs to list other Pods or read Secrets.

External Secrets Operator: Sync Secrets into Kubernetes

Treat your cloud's secret manager as the source of truth. The External Secrets Operator (ESO) fetches secrets from external APIs like AWS Secrets Manager or Vault and injects them into native Kubernetes Secrets, keeping them in sync.

Sealed Secrets: Safely Commit K8s Secrets to Git

Sealed Secrets lets you commit encrypted Kubernetes secrets to a public Git repo. In a GitOps workflow, this allows all configuration to live in version control. The footgun: a SealedSecret is a one-way street; only the target cluster can decrypt it.

PersistentVolumeClaim: How Pods Request Storage

A PersistentVolumeClaim (PVC) is a request for storage, like a claim check for a storage locker. Pods use it to mount durable storage for databases or file uploads. The footgun: a PVC is just a request; a matching PersistentVolume must exist to fulfill it.

Kubernetes StorageClass: A Menu for Your Data

A StorageClass is an admin-defined 'menu' of storage options, abstracting the provider. Developers request storage by name (e.g., 'fast-ssd') via a PersistentVolumeClaim, and Kubernetes dynamically provisions it.

Dynamic Volume Provisioning: Storage on Demand

Dynamic Volume Provisioning lets you request storage by its type (e.g., "fast-ssd") instead of pre-provisioning a disk. Kubernetes automatically creates a matching volume. This is standard for stateful apps.