Advanced everything in Docker & Kubernetes, page 3
Egress Gateway: Control Your Mesh's Outbound Traffic
An Egress Gateway is a monitored exit door for all outbound traffic from your service mesh. Use it to enforce security on external calls, like restricting domains or originating mTLS.
Traffic Mirroring: Test in Production, Safely
Traffic mirroring copies live production requests to a new service without affecting the user's response. It's used to test new code with real traffic before a full rollout. The main footgun is accidentally duplicating writes or other stateful actions.
Kubernetes API Aggregation Layer: Extending the API Server
The API Aggregation Layer bolts custom API servers onto the main Kubernetes API, with kube-apiserver acting as a proxy. This powers features like the metrics server (kubectl top) and enables complex extensions.
controller-runtime: The Engine for Kubernetes Operators
Think of controller-runtime as the standard library for writing Kubernetes controllers. It handles the boilerplate of watching resources and reconciling state, forming the foundation for tools like Kubebuilder and Operator SDK.
Helm Post-Rendering: Customize Charts Without Forks
Helm post-rendering lets you modify a chart's Kubernetes manifests just before deployment. It's ideal for applying kustomize patches or injecting sidecars without forking a public chart.
Flux Image Update Automation: Closing the GitOps Loop
Flux's image update automation acts like a bot that watches your container registry. It finds new image tags that match your policies (like semver) and automatically commits the change back to your Git repository, triggering a deployment.
Argo CD Sync Phases and Waves: Ordering Your Deployments
Argo CD Sync Phases and Waves are a recipe for ordering deployments. Use them for complex apps where a database migration must run pre-sync. The footgun: a single failed resource in a wave halts the entire sync process, making it brittle if overused.
Helm Hooks: Running Operations During a Release
Helm Hooks are Kubernetes resources that run at specific moments in a release lifecycle. Use them to run a database migration before an app upgrade or to back up data before a deletion. The footgun: a failing hook Job will block and fail the entire.
Helm Subcharts: Composing Applications from Dependencies
Helm subcharts are nested components a parent chart can configure, like a docker-compose for Kubernetes manifests. Use them to bundle dependencies like a database with your app. The footgun: subcharts are sandboxed and cannot access parent values directly.
Service Mesh Observability: Seeing Inside the Black Box
A service mesh provides observability by intercepting all service-to-service traffic. It automatically generates logs, metrics, and traces, helping you debug distributed systems without changing application code.
OpenTelemetry
OpenTelemetry is a CNCF standard for generating, collecting and exporting traces, metrics and logs from your services using one vendor neutral set of APIs and SDKs, so you can switch observability backends without rewriting instrumentation code.
Prometheus Alertmanager: Taming Your Alert Storms
Alertmanager is the traffic controller for your Prometheus alerts, turning a potential flood into actionable notifications. It groups, deduplicates, and routes alerts to services like PagerDuty. The footgun: don't load balance traffic to an HA cluster.
PromQL: Querying Time Series Data as Vectors
PromQL treats metrics as vectors of values over time, letting you slice and aggregate system state. It's used for Grafana dashboards and Alertmanager rules. The footgun: applying rate() to a gauge instead of a counter produces silent, nonsensical results.
Falco: Real-Time Threat Detection for Cloud-Native
Falco is a runtime security camera, watching Linux syscalls to detect threats in real time. It's used in Kubernetes to spot abnormal behavior like privilege escalation or writing to /etc. The key is it only *detects* and *alerts*; it doesn't block threats.
Kubernetes Audit Logging: Your Cluster's Black Box Recorder
Kubernetes audit logging is the security camera for your API server, recording every API call to answer "who did what, and when?". It's essential for security forensics and compliance, but a common footgun is using a weak default or logging everything.
Kubernetes API Server Authorization Modules
Kubernetes API server authorization is like a chain of security guards. A request must get a "yes" from at least one configured module (like RBAC) to pass. This is fundamental to securing any cluster. The footgun is that the chain stops at the first "allow."
K8s Authentication: Proving Who You Are to the API Server
The K8s API Server is a vault door; authentication is proving your identity to the guard. It tries a chain of methods—like OIDC for users or tokens for pods—until one succeeds. The footgun: unauthenticated requests become system:anonymous, a major risk.
Kubernetes Scheduler Framework: A Plugin System for Pod Placement
The Kubernetes Scheduler Framework is a plugin pipeline for pod placement. Use it to add custom logic—like co-scheduling ML jobs or avoiding specific nodes—without forking Kubernetes. The footgun: a slow plugin can bottleneck your entire cluster's scheduling.
Kubernetes CPU Management: Static vs. None Policy
K8s CPU policies control if your pod gets a dedicated CPU core or just a time-slice of a shared one. The default none policy maximizes utilization, while static gives exclusive cores to latency-sensitive apps.
Pod Priority: Deciding Who Gets Evicted in Kubernetes
Pod Priority is a VIP pass for your critical workloads, telling the scheduler which pods can bump others off a node. This ensures system-critical services run even on a full cluster. The footgun: high-priority pods can cause cascading evictions if not planned.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles