Tag
31 items tagged Kubernetes.
Replace hand-copied Argo CD Applications with an ApplicationSet driven by per-environment config files: the Git file generator, templatePatch for automated versus manual sync, AppProject boundaries and deletion policy.
Human and workload identities and the credentials that carry them: why static keys are dangerous, how a bound short-lived token differs from a legacy one, how CI assumes a role without a key, and how to scope each one.
A troubleshooting sequence (get, describe, logs, events, exec, port-forward) applied to four broken workloads: a crashing container, a missing image, a missing ConfigMap and an empty Service. Real events, real fixes.
What readiness, liveness and startup probes do (with a failing one of each), how requests decide scheduling and limits decide OOMKilled and throttling, what the cgroup counters show, and how termination grace works.
kube-prometheus-stack, Loki in single-binary mode and Alloy on a kind cluster; the PromQL and LogQL that answer operational questions; low-cardinality log labels; a real OOM restart loop diagnosed end to end.
Manual scaling, rolling updates and rollback as an operator sees them, and a HorizontalPodAutoscaler on kind with metrics-server: real utilisation figures, a 2-to-6 scale-up under load, and the scale-down window.
How a request finds a pod: cluster DNS, the Service ClusterIP, the EndpointSlice the selector fills, port versus targetPort, headless Services and Ingress in outline; each inspected on a kind cluster, mistakes included.
Deployments, StatefulSets, DaemonSets, Jobs and CronJobs on a real three-node cluster: what kubectl reports, what happens when you delete a pod of each kind, why a DaemonSet skips the control plane, and which to use.
Application, infrastructure and audit logs and what each answers; Kubernetes API audit logging enabled on a real cluster, tuned from lease noise to the events that matter, and read for denied and privileged requests.
The operating model behind the CI templates, ApplicationSets, Kyverno guardrails and observability stack on this site: what a team hands over, what the platform returns, where the golden path ends and enforcement begins.
Kyverno as a platform guardrail system: baseline and production policy layers keyed on namespace labels, delivered by Argo CD from one repository, rolled out audit-first, with scoped expiring exceptions.
The hardening checklist for a cloud-hosted production workload, built from parts 1 to 4 and the existing edge, container and Kubernetes articles: each control with the command that proves it and the gap it covers.
The secrets lifecycle for a cloud workload: credentials recovered from image history and deleted layers, a build that leaves nothing behind, Secrets in etcd before and after encryption at rest, rotation, and Vault TTLs.
Rolling updates, blue/green switches and canary releases built from plain Deployments and Services on a kind cluster, with the health checks, gates and promotion steps that decide when each one is right.
Make rollback a deploy, not a rebuild: immutable artifacts and image digests, a failed rollout detected with rollout status and conditions, kubectl rollout undo on a real failure, and migrations planned separately.
Install Argo CD, model applications and projects, enable automated sync with pruning and self-heal, and lock the control plane down so Git really is the only way to change the cluster.
Install Kyverno 1.19, write CEL-based ValidatingPolicy, MutatingPolicy and GeneratingPolicy resources for non-root pods, image tags, allowed registries and default-deny networking, and roll them out audit-first.
A layered checklist — control plane, workloads, network, secrets, supply chain and runtime — with the manifests and commands to verify each control rather than just tick it.
Create a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.
On a kind cluster, turn on the restricted Pod Security profile for a namespace, watch it reject a default pod, then add a Kyverno ValidatingPolicy in Audit mode, read the PolicyReport, and switch it to Deny.
Declarative GitOps continuous delivery controller for Kubernetes.
Centralised secrets management with dynamic, short-lived credentials.
Package manager for Kubernetes: templated charts with versioned releases.
Container orchestration platform and the deployment target for most of the toolchain.
Kubernetes-native policy engine: validate, mutate, generate and verify images with YAML.
General-purpose policy engine using the Rego language.
Pull-based metrics collection, storage and alerting with PromQL.