Tag: #kubernetes

한국어English日本語中文

← All posts

• Envoy Gateway Deep Dive: Inside the Gateway API Reference Implementation

  In 2026, with the Ingress API frozen and Gateway API established as the standard successor, this post takes a deep look at Envoy Gateway, the reference-grade implementation built by the Envoy community itself, covering a

  2026-06-14 · 17 min read #envoy-gateway#gateway-api#envoy#kubernetes#ingress

• Ingress WAF - Applying ModSecurity/Coraza and the OWASP CRS

  A practical guide to applying a WAF at the Kubernetes Ingress layer. It covers the difference between legacy ModSecurity and its successor engine Coraza, ingress-nginx integration, OWASP CRS tuning and false-positive man

  2026-06-14 · 18 min read #ingress#waf#modsecurity#security#kubernetes

• Automating Ingress TLS — Fully Automated Certificates with cert-manager and ACME

  A hands-on guide to fully automating TLS certificates for Kubernetes Ingress using cert-manager and Let’s Encrypt ACME. Covers the Issuer/Certificate CRD model, HTTP-01 versus DNS-01 challenges, wildcard certificates, re

  2026-06-14 · 17 min read #ingress#kubernetes#cert-manager#tls#acme

• Ingress Observability — Metrics, Access Logs, and Tracing

  Define the golden signals for an Ingress controller and build a practical observability stack: ingress-nginx Prometheus metrics, Grafana dashboards, structured access logs shipped to Loki, OpenTelemetry distributed traci

  2026-06-14 · 11 min read #ingress#kubernetes#nginx#observability#networking

• ingress-nginx Deep Dive — Architecture, Annotations, and Templates

  A practitioner-focused deep dive into the ingress-nginx controller: its internal architecture, the essential annotation catalog, ConfigMap global tuning, snippet security risks, and the 2026 reality of maintenance mode a

  2026-06-14 · 12 min read #ingress#kubernetes#nginx#networking#devops

• Integrating Ingress with ExternalDNS and Cloud Load Balancers — From Domain to L4

  This post walks the full path traffic travels, from domain registration through the cloud load balancer to the Ingress controller. It covers AWS/GCP/Azure LB integration annotations, ExternalDNS automation, MetalLB, Prox

  2026-06-14 · 18 min read #ingress#kubernetes#externaldns#loadbalancer#dns

• Ingress Multitenancy and Cost Optimization — A Platform Teams Choice

  The trade-offs of a shared controller vs per-tenant controllers, namespace isolation, load balancer cost, resource quotas, noisy-neighbor prevention, security boundaries, and showback models — multi-tenant Ingress operat

  2026-06-14 · 9 min read #ingress#kubernetes#networking#multitenancy#devops

• Ingress-level Authentication — Applying SSO with oauth2-proxy and Forward Auth

  A practical guide to implementing SSO at the Ingress level using the external auth pattern. We walk through wiring oauth2-proxy as a forward auth service to layer OIDC login onto multiple apps without touching applicatio

  2026-06-14 · 18 min read #ingress#oauth2-proxy#sso#authentication#kubernetes

• The Complete Contour Guide - Managing Kubernetes Traffic with Envoy-Based Ingress and HTTPProxy

  Contour is a Kubernetes ingress controller that uses Envoy as its data plane. We cover the HTTPProxy CRD, multi-tenancy through delegation, and Gateway API support with hands-on examples, plus operational tuning and trou

  2026-06-14 · 16 min read #contour#envoy#ingress#kubernetes#httpproxy

• Containers Are a Lie — The Kernel Truth Behind cgroups and Namespaces

  There is no container object in the kernel. A tour of the seven namespaces, hands-on cgroup v2 file manipulation, building a mini container with unshare and pivotroot, overlayfs, capabilities, and seccomp — we dissect ea

  2026-06-13 · 17 min read #linux#kernel#container#cgroups#namespaces

• Kubespray Deep Dive — Building Production On-Prem Kubernetes with Ansible

  A complete walkthrough of building production-grade Kubernetes clusters on bare metal with Kubespray. Covers inventory design, dissecting key groupvars, HA control planes, air-gapped environments, day-2 playbooks for upg

  2026-06-13 · 30 min read #kubernetes#kubespray#ansible#onprem#baremetal

• eBPF Observability in Practice — Opening the Black Box with bpftrace

  Ten battle-tested bpftrace one-liners and a tour of the BCC toolbox for inspecting live systems without touching application code. Covers latency histogram interpretation, flame graphs, container environments, and three

  2026-06-13 · 15 min read #ebpf#bpftrace#observability#linux#profiling

• eBPF Runtime Security — Tetragon, Falco, and BPF LSM

  Why runtime security is essential in the era of supply chain attacks and container escapes, and how eBPF answers the call. Covers Falco rule writing, kernel-level blocking with Tetragon TracingPolicy, the principles of B

  2026-06-13 · 15 min read #ebpf#security#falco#tetragon#kubernetes

• Cluster API Deep Dive — Managing Clusters as Kubernetes Resources

  In an era of cluster sprawl, Cluster API lets you declare Kubernetes clusters themselves as Kubernetes resources and have controllers reconcile them. This deep dive dissects the architecture and core CRD relationships, a

  2026-06-13 · 24 min read #kubernetes#cluster-api#multi-cluster#gitops#infrastructure

• Istio Ambient vs Sidecar — Choosing Your Service Mesh Architecture in 2026

  A quantitative look at the resource cost and operational pain of the sidecar model, followed by a deep dive into the Ambient architecture built from ztunnel and waypoint proxies. Covers data path comparison, feature pari

  2026-06-13 · 18 min read #istio#ambient-mesh#sidecar#ztunnel#kubernetes

• Financial-Grade Kubernetes Platforms — Making Regulation and Cloud Native Coexist

  How to design and operate a Kubernetes platform under financial regulations such as network segregation and electronic finance supervision rules. Covers multi-tenancy isolation criteria, Kyverno policy gates, audit trail

  2026-06-13 · 20 min read #kubernetes#finance#security#compliance#multi-tenancy

• Istio Security in Practice — mTLS, AuthorizationPolicy, and the Zero Trust Mesh

  From the mesh security model built on SPIFFE identities and the istiod CA, through the PERMISSIVE-to-STRICT migration strategy for PeerAuthentication, least-privilege AuthorizationPolicy design, JWT end-user authenticati

  2026-06-13 · 21 min read #istio#mtls#security#authorizationpolicy#zero-trust

• Istio Traffic Management in Practice — From VirtualService to Automated Canaries

  A hands-on guide covering the relationships between Istio traffic APIs, header and weight-based routing, canary automation with Flagger and Argo Rollouts, mirroring, fault injection, and how to derive circuit breaker set

  2026-06-13 · 17 min read #istio#virtualservice#canary#traffic-management#kubernetes

• Building an IDP with Backstage Part 1 — The Software Catalog Is Everything

  A deep dive into the software catalog, the foundation of any Backstage-based Internal Developer Portal. Covers the entity data model, practical catalog-info.yaml authoring, GitHub auto-discovery, the ownership model, met

  2026-06-13 · 15 min read #backstage#idp#platform-engineering#devops#software-catalog

• Hubble and ClusterMesh — Cilium Observability and Multi-Cluster Operations

  Covers the architecture of Hubble, the observability layer of Cilium, with practical CLI queries, Prometheus metrics, and long-term flow log retention, then walks through configuring ClusterMesh for multi-cluster service

  2026-06-13 · 13 min read #cilium#hubble#clustermesh#observability#multi-cluster