Kubernetes
Manage containerized workloads at scale using Kubernetes. Tutorials cover deploying applications, configuring clusters, and automating operations.
Posts
CKNE Is Live: What the Kubernetes Network Engineer Exam Tests and How to Practice
CKNE is a new hands-on Kubernetes networking exam. Use its published domains to build a lab, rehearse packet-level debugging, and turn DNS, traffic, policy, encryption, and observability into timed terminal drills.
An Empty resources: {} Makes Kubernetes 1.34 to 1.36 Pods BestEffort
An empty pod-level block makes a pod with requests and limits BestEffort on Kubernetes 1.34 to 1.36. We measured what changes on the node, and what does not.
containerd 1.7 Reaches End of Life: What Breaks on 2.x
We ran containerd 1.7.36, 2.3.6 and 2.4.1 against the same data and an old node config. The config still loaded and the mirrors still worked. What broke was pulling schema 1 images, and it stays hidden until a node has to pull one.
Kubernetes 1.37 Really Can Flag Unused PVCs, but the Viral YAML Is Wrong
A post making the rounds says Kubernetes 1.37 adds an unusedSince field to PVC status. The feature is real and it is genuinely good news for storage bills; the YAML being shared shows an API that does not exist. Here is what KEP-5541 actually shipped, the correct fields, and a working query for "PVCs unused for 30 days".
Kubernetes 1.37 Garhwal: What Shipped and What Slipped
Kubernetes 1.37 landed on August 26 with 67 enhancements: 16 stable, 23 beta, 27 alpha. We checked the release against the June feature-freeze plan, KEP by KEP. Pod Certificates made stable, pod-level resources slipped to 1.38, the GPU-slicing feature everyone watched did not graduate, and the ipvs removal clock is now running.
Kubernetes Beyond the Basics: 7 Concepts That Take You From Junior to Mid-Level
You can write a Deployment and debug a CrashLoopBackOff. The gap between junior and mid-level is a different set of ideas: how requests really drive scheduling, why Services do not load-balance the way you think, what actually happens during a rolling deploy, and why Kubernetes is a reconciliation engine, not a command runner.
The Anatomy of Kubernetes Persistent Storage: PV, PVC and the Parts That Bite
A PersistentVolumeClaim is a request and a PersistentVolume is the thing you get. That part takes five minutes to learn. The lifecycle rules underneath, which decide whether deleting a claim also deletes your data, are where teams lose production volumes.
Build the Container Boundary You Do Not Have: Seccomp Profiles with the Security Profiles Operator
A container is not a security boundary out of the box, but you can build one. Here is a hands-on guide to recording, tuning, and enforcing seccomp profiles with the Security Profiles Operator, which just shipped v1.0.
hostNetwork Is Still a Footgun: What CVE-2026-32193 Teaches Every Cluster
A recent AKS advisory let an untrusted pod with hostNetwork break out to the worker node. The Azure-specific bug is patched, but the footgun that made it reachable lives on every Kubernetes cluster. Here is how the escape class works and what to actually lock down.
Kubernetes 1.37 Just Locked Its Feature Set: What Made the Cut
The enhancements freeze for Kubernetes 1.37 landed on June 17, so the shape of the August release is now decided. GPU partitioning keeps maturing for AI workloads, and a cgroup v1 change will stop some kubelets from starting. Here is what is locked in and what to check before you upgrade.
How NetEase Games Cut LLM Cold Starts From 42 Minutes to 30 Seconds Using Fluid
NetEase Games published a Kubernetes case study walking through how they took their serverless GPU inference cold-start time from 42 minutes down to under 30 seconds. The bottleneck isn't the GPU. It's the 60GB model weights crossing a region. Here is what they did with the CNCF Fluid project and how to apply the same pattern even if you are not on Kubernetes.
Cilium 1.19 ClusterMesh Policy Flip: The Silent Default That Will Drop Your Cross-Cluster Traffic
Cilium 1.19 changed how network policies without a cluster selector resolve in a ClusterMesh. East/West traffic that 1.18 implicitly allowed is now silently dropped. Here is how to find every affected policy before you upgrade.
Karpenter Spot Storm Fallback Gap: The Production Loop Nobody Talks About
When AWS spot capacity dries up in a region, Karpenter does not automatically fall back to on-demand. It retries the same dying offerings on a 3-minute loop. Here is why, and how to design around it.
Running Your First Chaos Engineering Experiment with Litmus
A hands-on walkthrough of installing LitmusChaos on Kubernetes, killing pods on purpose, and watching whether your app actually recovers. Real YAML, real output, no theory.
Argo CD CVE-2026-42880: When Read-Only Means Read-Everything-Including-Secrets
A critical Argo CD bug (CVSS 9.6, disclosed May 7) lets any authenticated user pull plaintext Kubernetes Secrets out of any Application that has ServerSideDiff with mutation-webhook diffs enabled. Here is the upgrade matrix, the one-liner to find at-risk apps in your cluster, and the safe RBAC scope-down for teams that cannot patch today.
Ingress-NGINX Is Retired: A Real Migration to Gateway API With ingress2gateway 1.0
In March 2026 the Kubernetes project retired ingress-nginx with no replacement waiting in the wings. Roughly half of all clusters still run it. This post is the migration that does not involve a flag day: how to inventory your annotations, what ingress2gateway 1.0 translates and what it silently drops, the side-by-side cutover pattern with the actual PromQL, and how to pick between Envoy Gateway, kgateway, Cilium Gateway, and Istio.
Istio Traffic Management: Routing, Retries, and Circuit Breaking
Configure weighted routing, automatic retries, and circuit breakers in Istio with copy-paste YAML examples and real kubectl output you can verify on your own cluster.
Kubernetes 1.36 Ships User Namespaces GA and Pod-Level In-Place Resize
Kubernetes 1.36 "Haru" landed on April 22, 2026. Two changes matter most for production: user namespaces graduated to stable, and pod-level CPU and memory can now be resized in place without restarting. Here is what each one does, the kubelet and runtime requirements, and how to enable them safely.
The Ory Ecosystem Explained: Identity, OAuth2, and SSO for Kubernetes
A practical breakdown of the Ory ecosystem - Kratos, Hydra, Polis, Oathkeeper, and Keto - what each one does, how they connect, and how to pick the right components for your auth stack.
Understanding Kubernetes Operators: A Deep Dive with a Practical Example
Learn the concepts behind Kubernetes operators, why they exist, and how the control loop pattern works, then build one yourself to solidify your understanding.
How to Publish a Helm Chart
Learn how to package and publish your Helm charts to various repositories including GitHub Pages, OCI registries, and ChartMuseum. This guide covers the complete workflow from packaging to distribution.
Introduction to ArgoCD: Getting Started with GitOps
Learn how ArgoCD brings GitOps principles to Kubernetes deployments. This hands-on guide covers core concepts, architecture, and practical examples to get you started with declarative, automated application delivery.
The 5-Minute Kubernetes Cluster Health Check
Learn how to quickly assess your Kubernetes cluster's health with essential commands and catch issues before they become critical problems.
Right-Sizing Kubernetes Resources with VPA and Karpenter
Overprovisioned CPU and memory in Kubernetes increases costs and reduces efficiency. Learn how to use Vertical Pod Autoscaler, Karpenter, and monitoring tools to balance performance and resource usage.
How Can I Trigger a Kubernetes Scheduled Job Manually?
Run a Kubernetes CronJob now with kubectl create job --from, wait for it and read its logs, change it for one run, and check the CronJob settings that decide when it runs.
How to Get Logs From All Pods, Events and Files With kubectl
Read the logs of every pod of a Deployment or ReplicationController at once, follow them live, see the events of one pod, and copy files out of a pod with kubectl.
Ingress vs Load Balancer in Kubernetes, Pending IPs and port-forward
When to expose a Service with a LoadBalancer, an Ingress or Gateway API, why EXTERNAL-IP stays pending, and how kubectl port-forward reaches a pod without exposing it.
How to Fix Pods Stuck in Terminating and Delete All Resources
Why a pod or namespace stays in Terminating, when a force delete is safe, how to handle finalizers, down nodes and volumes, and how to list or delete all resources and pods.
kubectl apply vs kubectl create, and How to Export Live YAML
Learn when to use kubectl apply, create, replace and server-side apply, how apply decides what to change, and how to get clean YAML from a resource that already runs.
Why Does a Deleted Kubernetes Pod Get Recreated? Deployments, Images
A deleted pod comes back because a controller owns it. Find and stop that controller, compare pods, Deployments and StatefulSets, update or re-pull an image, and debug ImagePullBackOff.
Kubernetes API - Get Pods on Specific Nodes
Learn how to list the pods on one node, or every pod with its node, with kubectl field selectors, custom columns and direct calls to the Kubernetes API.
How to Manage Kubernetes Environments: Namespaces, Contexts, Clusters
Separate staging, QA and production with namespaces or clusters, switch kubectl between namespaces and clusters such as GKE and minikube, reach Services in other namespaces, and sign in to a cluster web UI.
How to Restart, List and Keep Containers Running in a Kubernetes Pod
Kubernetes has no command to restart one container. Learn the ways that work, how to restart pods after a ConfigMap or Secret change, how to list containers, run several commands, keep a container running, and use local images.