Kubernetes
Browse all articles, tutorials, and guides about Kubernetes
Guides
Security Gates
What security gates are and how to add them to CI/CD: policy as code, CVE gates with KEV and EPSS, compliance checks and admission control, with real runs.
Introduction to Kubernetes
Learn Kubernetes 1.37 hands-on with kind: pods, Deployments, Services, Gateway API, ConfigMaps, Secrets, storage, autoscaling, monitoring and security.
Security Principles
The CIA triad, defense in depth, least privilege and zero trust, each tested on a small app on Linux and Kubernetes with real commands and output.
Networking Fundamentals for Developers
Learn networking in a lab you build on one Linux VM: TCP/IP, subnets, DNS, firewalls, load balancing, Docker, Kubernetes, VPCs and troubleshooting.
Posts
CKNE Is Live: What the Kubernetes Network Engineer Exam Tests and How to Practice
CKNE is a new hands-on Kubernetes networking exam. Use its published domains to build a lab, rehearse packet-level debugging, and turn DNS, traffic, policy, encryption, and observability into timed terminal drills.
cgroup v2 memory.high Throttles, memory.max Kills: Measured on a Host Without Swap
We ran one allocating workload under memory.max, memory.high and both on a Linux 6.8 host with no swap. memory.max killed it in under half a second. memory.high did not kill it: new allocations waited, once per 64-page batch at best and once per page next to a busy neighbour on the same CPU. Here are the numbers, the kernel formula behind them, and what systemd, Docker and Kubernetes write.
An Empty resources: {} Makes Kubernetes 1.34 to 1.36 Pods BestEffort
An empty pod-level block makes a pod with requests and limits BestEffort on Kubernetes 1.34 to 1.36. We measured what changes on the node, and what does not.
Base64 Explained: 3 Bytes In, 4 Characters Out, Zero Secrecy
Base64 turns 3 bytes into 4 characters and hides nothing. See it in Kubernetes Secrets and JWTs, measure the 33% overhead, and fix the bugs it causes.
DORA Metrics From Git History: The Definition Picks Your Tier
We computed deployment frequency, lead time, change failure rate and recovery time from one year of Kubernetes, uv, Go and Prometheus history, once per common definition. The definition alone moved every project across two or three DORA performance levels, and the merge button decides whether Git still knows when the work started.
CVE-2026-80521: The Ubuntu Container Escape Is Not Just an Ubuntu Problem
A public exploit breaks out of default Docker and Kubernetes containers through a bug in the AF_UNIX garbage collector, and Ubuntu 24.04 and 26.04 still have no kernel fix. The same code sits in the 6.1 and 6.6 LTS kernels, where upstream has no fix either. Here is how to check any node in one command, and what to do while you wait for a patch.
GitHub Started Enforcing Self-Hosted Runner Versions. We Tested What Happens
GitHub started enforcing self-hosted runner versions on September 29. We tried four runner versions against a free github.com organization and asked GitHub's own API about every release. One was refused, one connected and then exited while its job waited in the queue, and the API scheduled every version's end about nine weeks after its successor.
containerd 1.7 Reaches End of Life: What Breaks on 2.x
We ran containerd 1.7.36, 2.3.6 and 2.4.1 against the same data and an old node config. The config still loaded and the mirrors still worked. What broke was pulling schema 1 images, and it stays hidden until a node has to pull one.
Go Is Not Just for CLIs. It Runs the Cloud Native Control Plane
Docker, Kubernetes, etcd, Terraform, Vault, Prometheus, CoreDNS, Caddy, MinIO, CockroachDB: we pulled the real language breakdown of 20 infrastructure projects from GitHub, explain why Go keeps winning the control plane, list where it does not, and build a static cross-compiled HTTP server to show the reason in under 6 MB.
Kubernetes 1.37 Really Can Flag Unused PVCs, but the Viral YAML Is Wrong
A post making the rounds says Kubernetes 1.37 adds an unusedSince field to PVC status. The feature is real and it is genuinely good news for storage bills; the YAML being shared shows an API that does not exist. Here is what KEP-5541 actually shipped, the correct fields, and a working query for "PVCs unused for 30 days".
Kubernetes 1.37 Garhwal: What Shipped and What Slipped
Kubernetes 1.37 landed on August 26 with 67 enhancements: 16 stable, 23 beta, 27 alpha. We checked the release against the June feature-freeze plan, KEP by KEP. Pod Certificates made stable, pod-level resources slipped to 1.38, the GPU-slicing feature everyone watched did not graduate, and the ipvs removal clock is now running.
Kubernetes Beyond the Basics: 7 Concepts That Take You From Junior to Mid-Level
You can write a Deployment and debug a CrashLoopBackOff. The gap between junior and mid-level is a different set of ideas: how requests really drive scheduling, why Services do not load-balance the way you think, what actually happens during a rolling deploy, and why Kubernetes is a reconciliation engine, not a command runner.
Agentic AI Vocabulary for DevOps: 12 Terms You Already Operate Under Another Name
Every agentic AI glossary is written for executives. Read the same twelve terms as an infrastructure engineer and most of them describe control loops, sandboxes and admission policies you have run for a decade. The useful exercise is finding the three where that analogy breaks, because those are the ones that will page you.
The Anatomy of Kubernetes Persistent Storage: PV, PVC and the Parts That Bite
A PersistentVolumeClaim is a request and a PersistentVolume is the thing you get. That part takes five minutes to learn. The lifecycle rules underneath, which decide whether deleting a claim also deletes your data, are where teams lose production volumes.
You Cannot Rotate a Secret You Cannot Find
Trace one credential from a laptop to production and count the copies it leaves behind. That count is your rotation cost and your blast radius, and it is why most teams never rotate anything.
The DevOps Skills That Create Openings, Not Just Pass Filters
Most skill lists tell you what gets you past a screening. They do not tell you what makes a company decide to hire someone in the first place. Those are different lists, and the second one is shorter, more specific, and worth a lot more.
Build the Container Boundary You Do Not Have: Seccomp Profiles with the Security Profiles Operator
A container is not a security boundary out of the box, but you can build one. Here is a hands-on guide to recording, tuning, and enforcing seccomp profiles with the Security Profiles Operator, which just shipped v1.0.
Your GitOps Controller Is Tier Zero: the Argo CD repo-server RCE
An unauthenticated RCE in Argo CD's repo-server turns one compromised pod into full cluster takeover. Reported 18 months ago, still unpatched. Here is how it works and the one control that stops it.
Your Container Is Not a Security Boundary: GhostLock (CVE-2026-43499)
A 15-year-old Linux kernel bug just got a public exploit that breaks out of containers and hands any local user root on the host. GhostLock is a reminder that the container is not your security boundary, the shared kernel is. Here is what actually shrinks the blast radius.
How Docker Really Works, From docker run to the Kernel
You type docker run and a container appears. Follow the CLI, dockerd, containerd and runc down to the kernel, with the commands to watch each step. Then get clear answers on image vs container, docker run vs start, containers vs VMs, the performance cost, and when Compose is enough.
hostNetwork Is Still a Footgun: What CVE-2026-32193 Teaches Every Cluster
A recent AKS advisory let an untrusted pod with hostNetwork break out to the worker node. The Azure-specific bug is patched, but the footgun that made it reachable lives on every Kubernetes cluster. Here is how the escape class works and what to actually lock down.
Kubernetes 1.37 Just Locked Its Feature Set: What Made the Cut
The enhancements freeze for Kubernetes 1.37 landed on June 17, so the shape of the August release is now decided. GPU partitioning keeps maturing for AI workloads, and a cgroup v1 change will stop some kubelets from starting. Here is what is locked in and what to check before you upgrade.
How NetEase Games Cut LLM Cold Starts From 42 Minutes to 30 Seconds Using Fluid
NetEase Games published a Kubernetes case study walking through how they took their serverless GPU inference cold-start time from 42 minutes down to under 30 seconds. The bottleneck isn't the GPU. It's the 60GB model weights crossing a region. Here is what they did with the CNCF Fluid project and how to apply the same pattern even if you are not on Kubernetes.
OpenTelemetry Just Graduated: What to Retire from Your Stack This Quarter
On May 21, 2026, CNCF graduated OpenTelemetry. All three core signals (traces, metrics, logs) are now production-ready, the project is the second-most-active in CNCF after Kubernetes itself, and Anthropic, Bloomberg, Capital One, eBay, and Heroku run it at scale. Here is the decision framework for what proprietary agents you can stop running, what is still risky, and the 90-day adoption checklist.
Cilium 1.19 ClusterMesh Policy Flip: The Silent Default That Will Drop Your Cross-Cluster Traffic
Cilium 1.19 changed how network policies without a cluster selector resolve in a ClusterMesh. East/West traffic that 1.18 implicitly allowed is now silently dropped. Here is how to find every affected policy before you upgrade.
Karpenter Spot Storm Fallback Gap: The Production Loop Nobody Talks About
When AWS spot capacity dries up in a region, Karpenter does not automatically fall back to on-demand. It retries the same dying offerings on a 3-minute loop. Here is why, and how to design around it.
Running Your First Chaos Engineering Experiment with Litmus
A hands-on walkthrough of installing LitmusChaos on Kubernetes, killing pods on purpose, and watching whether your app actually recovers. Real YAML, real output, no theory.
Argo CD CVE-2026-42880: When Read-Only Means Read-Everything-Including-Secrets
A critical Argo CD bug (CVSS 9.6, disclosed May 7) lets any authenticated user pull plaintext Kubernetes Secrets out of any Application that has ServerSideDiff with mutation-webhook diffs enabled. Here is the upgrade matrix, the one-liner to find at-risk apps in your cluster, and the safe RBAC scope-down for teams that cannot patch today.
Ingress-NGINX Is Retired: A Real Migration to Gateway API With ingress2gateway 1.0
In March 2026 the Kubernetes project retired ingress-nginx with no replacement waiting in the wings. Roughly half of all clusters still run it. This post is the migration that does not involve a flag day: how to inventory your annotations, what ingress2gateway 1.0 translates and what it silently drops, the side-by-side cutover pattern with the actual PromQL, and how to pick between Envoy Gateway, kgateway, Cilium Gateway, and Istio.
10 GitHub Repositories That Will Actually Teach You DevOps in 2026
Most "top DevOps repos" lists are recycled awesome-list links. This one is a curated set of repositories that will move the needle on your DevOps skills, with star counts, who each one is for, and how to actually use it.
Istio Traffic Management: Routing, Retries, and Circuit Breaking
Configure weighted routing, automatic retries, and circuit breakers in Istio with copy-paste YAML examples and real kubectl output you can verify on your own cluster.
CVE-2026-31431 Copy Fail: A 4-Byte Kernel Write That Escapes Containers
A new Linux kernel bug lets any unprivileged process flip 4 bytes in the page cache and break out of a container. runtime-default seccomp does not block it. Here is what to do.
Kubernetes 1.36 Ships User Namespaces GA and Pod-Level In-Place Resize
Kubernetes 1.36 "Haru" landed on April 22, 2026. Two changes matter most for production: user namespaces graduated to stable, and pod-level CPU and memory can now be resized in place without restarting. Here is what each one does, the kubelet and runtime requirements, and how to enable them safely.
GitOps with Argo CD: Structuring Your Repository for Multi-Environment Deployments
A practical guide to laying out your Git repository for Argo CD across dev, staging, and production. See real folder structures, Kustomize and Helm patterns, and the pitfalls that bite teams in production.
Best Claude Code Plugins for DevOps Engineers in 2026
A curated guide to Claude Code plugins built for DevOps workflows - from Terraform validation and Kubernetes troubleshooting to security scanning and CI/CD pipeline optimization.
The Ory Ecosystem Explained: Identity, OAuth2, and SSO for Kubernetes
A practical breakdown of the Ory ecosystem - Kratos, Hydra, Polis, Oathkeeper, and Keto - what each one does, how they connect, and how to pick the right components for your auth stack.
Building an Internal Developer Platform from Scratch
A step-by-step guide to designing and building an internal developer platform that gives your teams self-service infrastructure, faster deployments, and fewer tickets to the platform team.
5 DevOps Books Worth Reading in 2026
A curated list of DevOps books that are actually worth your time in 2026, from beginner Linux guides to production Kubernetes patterns and the SRE bible.
When Kubernetes Is the Wrong Default
Most teams adopt Kubernetes too early. Here's a pragmatic framework for deciding between managed platforms, VMs, and Kubernetes based on your team size and workload characteristics.
Understanding Kubernetes Operators: A Deep Dive with a Practical Example
Learn the concepts behind Kubernetes operators, why they exist, and how the control loop pattern works, then build one yourself to solidify your understanding.
GitOps: Deploy Docker Containers with GitHub Actions and ArgoCD
Learn how to implement a modern GitOps workflow for Docker deployments. This guide covers building images with GitHub Actions, pushing to container registries, and automated deployments with ArgoCD.
How to Publish a Helm Chart
Learn how to package and publish your Helm charts to various repositories including GitHub Pages, OCI registries, and ChartMuseum. This guide covers the complete workflow from packaging to distribution.
Introduction to ArgoCD: Getting Started with GitOps
Learn how ArgoCD brings GitOps principles to Kubernetes deployments. This hands-on guide covers core concepts, architecture, and practical examples to get you started with declarative, automated application delivery.
Deployment Strategies: Blue-Green vs Canary vs Rolling
Blue-green, canary and rolling deployments side by side: how each ships a release, how fast it rolls back, what it costs, and when to use which one.
The 5-Minute Kubernetes Cluster Health Check
Learn how to quickly assess your Kubernetes cluster's health with essential commands and catch issues before they become critical problems.
Right-Sizing Kubernetes Resources with VPA and Karpenter
Overprovisioned CPU and memory in Kubernetes increases costs and reduces efficiency. Learn how to use Vertical Pod Autoscaler, Karpenter, and monitoring tools to balance performance and resource usage.
The Hidden Costs of Over-Automation in DevOps
Automation speeds things up, but too much of it can hide failures, slow incident response, and add fragile layers you have to maintain.
A Day in the Life of a DevOps Engineer
Follow a DevOps engineer through a typical day - from morning deployments to midnight hotfixes. Real challenges, real solutions, and real impact on business operations.
How Can I Trigger a Kubernetes Scheduled Job Manually?
Run a Kubernetes CronJob now with kubectl create job --from, wait for it and read its logs, change it for one run, and check the CronJob settings that decide when it runs.
How to Get Logs From All Pods, Events and Files With kubectl
Read the logs of every pod of a Deployment or ReplicationController at once, follow them live, see the events of one pod, and copy files out of a pod with kubectl.
Ingress vs Load Balancer in Kubernetes, Pending IPs and port-forward
When to expose a Service with a LoadBalancer, an Ingress or Gateway API, why EXTERNAL-IP stays pending, and how kubectl port-forward reaches a pod without exposing it.
How to Fix Pods Stuck in Terminating and Delete All Resources
Why a pod or namespace stays in Terminating, when a force delete is safe, how to handle finalizers, down nodes and volumes, and how to list or delete all resources and pods.
kubectl apply vs kubectl create, and How to Export Live YAML
Learn when to use kubectl apply, create, replace and server-side apply, how apply decides what to change, and how to get clean YAML from a resource that already runs.
Why Does a Deleted Kubernetes Pod Get Recreated? Deployments, Images
A deleted pod comes back because a controller owns it. Find and stop that controller, compare pods, Deployments and StatefulSets, update or re-pull an image, and debug ImagePullBackOff.
Kubernetes API - Get Pods on Specific Nodes
Learn how to list the pods on one node, or every pod with its node, with kubectl field selectors, custom columns and direct calls to the Kubernetes API.
How to Manage Kubernetes Environments: Namespaces, Contexts, Clusters
Separate staging, QA and production with namespaces or clusters, switch kubectl between namespaces and clusters such as GKE and minikube, reach Services in other namespaces, and sign in to a cluster web UI.
How to Restart, List and Keep Containers Running in a Kubernetes Pod
Kubernetes has no command to restart one container. Learn the ways that work, how to restart pods after a ConfigMap or Secret change, how to list containers, run several commands, keep a container running, and use local images.