CodingProtocols
Series

Kubernetes

The cluster, end to end.

The largest body of work on this site — scheduling and autoscaling, networking and ingress, storage, security and RBAC, upgrades, and the operational failures that only appear once real traffic is on the cluster.

140 articles in this series

  1. 0113 min

    PodSecurityContext vs Container SecurityContext: Every Field, Explained

    Kubernetes has two securityContext blocks with the same name, different schemas, and one precedence rule everyone half-remembers. Here is exactly which fields live at each level, what happens when both are set, and the fsGroup and runAsNonRoot traps that break pods in production.

    Read
  2. 0214 min

    PersistentVolume vs PersistentVolumeClaim: The Difference, Explained Properly

    A PersistentVolume is storage that exists; a PersistentVolumeClaim is a request for some of it. That one sentence resolves most of the confusion — but the binding lifecycle, reclaim policies, and access modes hide real data-loss traps. Here's the full picture, from mental model to production gotchas.

    Read
  3. 0312 min

    How to Taint a Node in Kubernetes — and When You Actually Should

    Tainting a node is one kubectl command — the real skill is knowing which of the three effects to use and when a taint beats node affinity. Here's the full anatomy of taints and tolerations, every command you need, and the patterns that actually justify them: GPU pools, spot nodes, and control planes.

    Read
  4. 0415 min

    kube-proxy vs Cilium: What Replacing the Kubernetes Datapath Actually Changes

    kube-proxy has quietly translated Service VIPs into pod IPs on every node since Kubernetes 1.0 — and at scale, its iptables rule chains become the bottleneck. Here's what Cilium's eBPF kube-proxy replacement actually does differently, the measurable wins, the caveats nobody mentions, and when leaving kube-proxy alone is the right call.

    Read
  5. 0513 min

    Local Kubernetes on macOS with Apple's container — No Docker Required

    Apple's container tool can stand up a local Kubernetes cluster on macOS with no Docker anywhere in the stack. It is not a new distribution — it is kind's node image and kubeadm running on Apple's own runtime. Here's how the k8s plugin works, every command it gives you, and where it sits against kind, minikube and Docker Desktop.

    Read
  6. 0610 min

    Ansible for Kubernetes Automation: Where It Fits and Where It Doesn't

    The kubernetes.core collection lets Ansible create, patch and query any Kubernetes object, run Helm, and exec into pods. That does not make it a deployment tool — Ansible has no reconcile loop. Here are the three jobs it genuinely wins, the one it should never take, and the modules that actually exist.

    Read
  7. 0712 min

    Kafka on Kubernetes with Strimzi: Node Pools, Storage, and the Parts That Hurt

    Strimzi turns a Kafka cluster into a handful of CRDs, and ZooKeeper is gone — brokers and controllers are now KafkaNodePools running KRaft. Installing it is a morning's work. The parts that hurt are storage you cannot shrink, partition rebalancing, and deciding whether you should be running Kafka yourself at all.

    Read
  8. 0811 min

    Chaos Engineering on Kubernetes: LitmusChaos, Chaos Mesh, and Why Killing Pods Teaches You Nothing

    Chaos engineering is running an experiment against a hypothesis, not randomly deleting pods. If deleting a pod breaks you, that is a configuration bug you could have found by reading a manifest. Here are the failures actually worth injecting, and how LitmusChaos and Chaos Mesh differ in practice.

    Read
  9. 0910 min

    What Is Kubernetes? Container Orchestration Explained

    Kubernetes is an open-source container orchestration platform that runs containerised applications across a cluster of machines. You declare the state you want — how many copies, how much memory, which network route — and Kubernetes continuously works to make reality match, rescheduling and restarting containers as machines fail.

    Read
  10. 1011 min

    Upgrading to Kubernetes 1.36: What Breaks and What to Check First

    Kubernetes 1.36 'Haru' permanently disables gitRepo volumes and deprecates Service externalIPs, while kube-proxy's IPVS mode goes on a deprecation clock that ends in v1.43 — and it lands just as ingress-nginx goes unmaintained. Here's the pre-upgrade audit, ordered by blast radius, with the exact commands to find out if you're affected.

    Read
  11. 1113 min

    Rook-Ceph vs Longhorn vs OpenEBS: Choosing Cloud-Native Storage for Kubernetes

    The three most common ways to run persistent storage inside a Kubernetes cluster aren't really competing for the same job. Rook-Ceph is a full storage platform, Longhorn is simple replicated block storage, and OpenEBS Mayastor is a performance engine for databases. Here's how each one works and a decision rule for picking between them.

    Read
  12. 129 min

    Fix Kubernetes FailedScheduling: 0/N nodes are available

    A Pod stuck Pending with FailedScheduling means the scheduler looked at every node and rejected all of them. The Events line tells you why — here's how to read it and fix each cause.

    Read
  13. 138 min

    Fix Kubernetes CreateContainerConfigError

    CreateContainerConfigError means the kubelet can't build your container's config because it references a ConfigMap or Secret that's missing, misnamed, or missing a key. Here's how to find the exact reference that's broken and fix it.

    Read
  14. 149 min

    Fix Kubernetes 'Readiness probe failed': Pod Running but Not Ready

    Your pod is Running but shows 0/1 Ready, and describe pod reports 'Readiness probe failed'. That means Kubernetes pulled it out of the Service endpoints, so it gets no traffic. Here's how to find the real cause and fix it.

    Read
  15. 157 min

    Fix kubectl 'connection to the server localhost:8080 was refused'

    The connection to the server localhost:8080 was refused means kubectl has no valid kubeconfig loaded and fell back to a default that points nowhere. It's a client config problem, not a broken cluster. Here's how to fix it.

    Read
  16. 169 min

    Fix kubectl 'x509: certificate signed by unknown authority'

    This error means kubectl can't verify the API server's TLS certificate against the CA in your kubeconfig. Here's how to find which of the five common causes is yours and fix it.

    Read
  17. 179 min

    Fix Helm 'another operation (install/upgrade/rollback) is in progress'

    Helm refuses to upgrade because a release is stuck in a pending status after a previous command crashed or timed out. Here's how to diagnose the stuck revision and clear it safely.

    Read
  18. 189 min

    Fix Kubernetes 'pod has unbound immediate PersistentVolumeClaims'

    Your pod is stuck Pending with 'pod has unbound immediate PersistentVolumeClaims' because its PVC never bound to a PV. Here's how to find out why and fix each root cause.

    Read
  19. 198 min

    Fix Kubernetes Exit Code 137 (SIGKILL / OOMKilled)

    Exit code 137 means your container was killed by SIGKILL — usually OOMKilled, but not always. Here's how to tell the difference and fix each root cause.

    Read
  20. 208 min

    What Is a Kubernetes Operator? The Custom-Controller Pattern Explained

    A Kubernetes operator is a custom controller plus one or more CRDs that extends the Kubernetes API to automate an application's full lifecycle — install, upgrade, backup, failover. It encodes a human operator's runbook as software that continuously reconciles desired state.

    Read
  21. 219 min

    What Is a Service Mesh? Sidecars, mTLS, and Traffic Control Explained

    A service mesh is a dedicated infrastructure layer that manages service-to-service communication through proxies — adding mTLS, traffic control, resilience, and observability without touching application code. Here's how it works and whether you actually need one.

    Read
  22. 2210 min

    kro vs Crossplane vs Helm: Choosing How to Build Kubernetes Platform Abstractions

    Helm packages YAML, kro turns a graph of resources into a custom API, and Crossplane is a control plane for infrastructure. They're constantly compared, but they sit at different altitudes — here's what each actually does and how to choose.

    Read
  23. 2310 min

    App-of-Apps vs ApplicationSet in Argo CD: Which Pattern to Use and When

    Both App-of-Apps and ApplicationSet let one Argo CD Application manage many others — but they solve different problems. Here's the real decision: App-of-Apps for an explicit, hand-curated tree; ApplicationSet for generated fleets you don't want to maintain by hand.

    Read
  24. 246 min

    Kubernetes RBAC Verbs: The Complete List, Including the Five Nobody Documents

    Everyone knows get, list, and create. Almost nobody can explain deletecollection, bind, escalate, impersonate, or why 'use' only matters for one resource type. Here's the full verb list, what each one actually permits, and the privilege-escalation traps hidden in the obscure ones.

    Read

The rest of the series

  1. PV vs PVC vs StorageClass: Who Owns What in Kubernetes Storage
  2. Kubernetes PodSecurityContext vs SecurityContext: Which One Applies
  3. Seven Kubernetes Mistakes I Keep Seeing in Production
  4. Detecting Insider Threats on Kubernetes: Audit Logs, RBAC Anomalies, and eBPF Enforcement
  5. Running Llama 3 70B on Kubernetes: AWQ Quantization and Tensor Parallelism
  6. Fix Kubernetes Pending Pods: Pod Stuck and Never Scheduled
  7. Fix Kubernetes Ingress 502 Bad Gateway
  8. Fix Kubernetes ImagePullBackOff and ErrImagePull
  9. Kubernetes User Namespaces: How Rootless Isolation Actually Works
  10. Fix Kubernetes OOMKilled: Pod Killed Due to Out of Memory
  11. Fix Kubernetes CrashLoopBackOff: Container Keeps Restarting
  12. NVIDIA GPU Operator: Running GPU Workloads on Kubernetes
  13. eBPF Observability: Tetragon, Hubble, and Pixie in Production
  14. Kubernetes Capacity Planning: Sizing Clusters and Managing Resources
  15. Kubernetes PodDisruptionBudget and Graceful Shutdown Patterns
  16. Kubernetes Cost Optimization: FinOps Patterns for EKS at Scale
  17. Kubernetes Operators: Building Controllers with Kubebuilder
  18. Kubernetes GPU Workloads: Scheduling Machine Learning Jobs on EKS
  19. Karpenter v1: Node Provisioning, Consolidation, and Drift
  20. Kubernetes Debugging: Systematic Troubleshooting for Production Incidents
  21. Kubernetes Resource Management: Quotas, LimitRanges, and QoS Classes
  22. Kubernetes Operators: Building Controllers with controller-runtime
  23. Kubernetes Scheduling: Taints, Tolerations, Affinity, and Priority Classes
  24. Kubernetes Resource Management: Requests, Limits, QoS, and LimitRanges
  25. Kubernetes Deployment vs StatefulSet: When to Use Which
  26. Kubernetes vs Docker Compose: When to Use Which (and When to Stop Using One)
  27. Docker Swarm vs Kubernetes vs Nomad: Choosing Your Container Orchestrator
  28. Kubernetes Liveness, Readiness, and Startup Probes: Getting Them Right
  29. Kubernetes Cost Optimisation: Spot Instances, Right-Sizing, and Namespace Budgets
  30. Kubernetes Debugging: A Systematic Guide to Diagnosing Pod and Node Failures
  31. Kubernetes Operators: Building Custom Controllers with CRDs
  32. Kubernetes HPA v2: Behavior Tuning and ContainerResource Metrics
  33. Kubernetes Node Autoscaling: Cluster Autoscaler vs Karpenter
  34. Kubernetes HPA and VPA: Horizontal and Vertical Pod Autoscaling
  35. Kubernetes VPA: Right-Sizing Containers Without Manual Tuning
  36. KEDA ScaledJob: Event-Driven Batch Processing on Kubernetes
  37. Kubernetes HPA Beyond CPU: Scaling on Custom and External Metrics
  38. Kubernetes Resource Requests and Limits: The Complete Production Guide
  39. Kubernetes Jobs and CronJobs: Production Patterns for Batch Workloads
  40. cert-manager in Production: TLS Automation for Kubernetes
  41. Crossplane: Cloud Infrastructure as Kubernetes Resources
  42. cert-manager: Automated TLS for Kubernetes
  43. Vault Secrets Operator vs External Secrets Operator: Which One Should You Run?
  44. EKS vs AKS: A Production Engineer's Comparison (2026)
  45. Kubernetes Multi-Tenancy: Namespace Isolation, Capsule, and vcluster
  46. Istio Service Mesh: Sidecar Mode in Production
  47. EKS Cluster Upgrades: Zero-Downtime Strategy for Production
  48. Cluster API: Declarative Kubernetes Cluster Lifecycle Management
  49. Multi-Cluster Kubernetes: Fleet Management with Flux and Argo CD
  50. How to Install Karpenter on EKS: A Production-Ready Setup Guide
  51. Karpenter IAM Deadlock: How We Broke Our EKS Cluster with a Terraform Apply
  52. EKS vs GKE vs AKS: Choosing Your Managed Kubernetes Platform
  53. Kubernetes Multi-Tenancy: Namespaces, Resource Quotas, and Network Isolation
  54. Kubernetes Cluster Upgrades: Zero-Downtime Strategy for Production
  55. Service Mesh Comparison: Istio vs Linkerd for Kubernetes
  56. Argo CD ApplicationSet: Multi-Cluster Deployment and Generator Patterns
  57. ExternalDNS: Automated DNS Management for Kubernetes Services
  58. Flux CD: GitOps for Kubernetes with Source Controller and Kustomize
  59. Argo Rollouts: Progressive Delivery with Canary and Blue-Green Deployments
  60. ArgoCD ApplicationSet Progressive Syncs: Controlled Multi-Cluster Rollouts
  61. Kubernetes Logging with Fluent Bit and Grafana Loki
  62. Kubernetes Logging: Fluent Bit and Grafana Loki
  63. Podscape v3.2: Mastering Kubernetes Governance with RBAC Forms and Resource Visibility
  64. Kubernetes Observability: Prometheus, Grafana, and OpenTelemetry in Production
  65. Kubernetes StatefulSets and Persistent Storage: Patterns for Stateful Workloads
  66. Kubernetes ConfigMaps and Secrets: Configuration Management Patterns
  67. Kubernetes Storage: EBS and EFS CSI Drivers on EKS
  68. Kubernetes StatefulSets: Running Stateful Workloads in Production
  69. Kubernetes Persistent Volumes: A Production Guide to PV, PVC, and StorageClass
  70. Kubernetes ConfigMap and Secret Best Practices: What Most Teams Get Wrong
  71. Kubernetes Disaster Recovery: Backup and Restore with Velero
  72. Kubernetes StatefulSets: Production Patterns for Stateful Workloads
  73. CoreDNS in Production: Scaling, Tuning, and Debugging Kubernetes DNS
  74. Kubernetes NetworkPolicy: Zero-Trust Networking for Multi-Team Clusters
  75. Kubernetes Gateway API: The Modern Replacement for Ingress
  76. Cilium: Advanced Networking, Security, and Observability on Kubernetes
  77. ingress-nginx in Production: Configuration, TLS, and Rate Limiting
  78. Kubernetes DNS: CoreDNS Configuration and Tuning
  79. Kubernetes Network Policies: Zero-Trust Networking
  80. Kubernetes Network Policies: A Practical Guide to Pod-Level Traffic Control
  81. Kubernetes Ingress vs Gateway API: When to Migrate and How
  82. Cilium and eBPF: High-Performance Kubernetes Networking
  83. Kubernetes Security Hardening: CIS Benchmark and Defense-in-Depth
  84. Kubernetes Admission Webhooks: OPA Gatekeeper and Kyverno
  85. Kubernetes RBAC Advanced Patterns
  86. Kubernetes Service Accounts and Workload Identity
  87. Kubernetes Pod Security Standards: Replacing PodSecurityPolicy
  88. Cilium Mutual Authentication: mTLS Without a Service Mesh
  89. RBAC vs ABAC in Kubernetes: Why ABAC Is Dead and What to Use Instead
  90. Kubernetes RBAC in Practice: Least Privilege Without the Headache
  91. Kubernetes Pod Security Admission: The PodSecurityPolicy Replacement Guide
  92. Kubernetes Security Hardening: A Production Checklist
  93. Kubernetes Admission Webhooks: Validating and Mutating Workloads
  94. Podscape vs Lens vs k9s: A Kubernetes Management Tool Comparison
  95. Why Your HPA Isn't Scaling — Fixing It with Custom Metrics (KEDA + Prometheus)
  96. How We Built a Real-Time Kubernetes UI Using Informers
  97. The Kubernetes Periodic Table: Every Essential Tool Category Explained
  98. Service Mesh Showdown: Istio vs Linkerd in 2026
  99. The Kubernetes Decision Path: A Practical Framework for Your Cloud-Native Stack
  100. Podscape v2.7.0: Unified Logs 2.0 & The Dynamic CRD Browser
  101. Kubernetes Service Types: Choosing Between ClusterIP, NodePort, and LoadBalancer
  102. Podscape v2.3.0: The AI-Ready Kubernetes IDE with Native MCP & Security Hub
  103. Cilium vs Calico on AKS: Which CNI Should You Actually Use?
  104. How to Deploy an LLM on Kubernetes: GPU Nodes, Model Serving, and Autoscaling
  105. Multi-Cluster Kubernetes: Patterns, Pitfalls, and When You Don't Actually Need It
  106. Securing AWS EKS with Bottlerocket: A Defense Against 'BadPods'
  107. KEDA: Event-Driven Autoscaling for Kubernetes Beyond CPU and Memory
  108. Kubernetes Cluster Upgrades Without Downtime: The Strategy That Actually Works
  109. Introducing Podscape: The Premium Kubernetes IDE for Human Beings
  110. eBPF for Platform Engineers: Cilium, Hubble, and Tetragon Without the Hype
  111. Helm Best Practices for Production: Structure, Upgrades, Hooks, and When to Walk Away
  112. Secrets Management in Kubernetes: Native Secrets, ESO, Vault, and SOPS Compared
  113. Databases in Kubernetes: Smart Move or Unnecessary Risk?
  114. The King is Dead? Why NGINX Ingress Users Must Move to Gateway API
  115. Kubernetes 1.35: The Great Filter
  116. The Ultimate Guide to Kubernetes Cost Optimization on AWS

Other series

Troubleshooting Guides

Paste the error, get the fix.

Tool Comparisons

X vs Y, decided on what matters in production.

What Is… Explainers

Plain definitions of terms that get used loosely.

AWS Service Guides

One service at a time, from someone who runs them.

AI & LLM Infrastructure

Running models yourself, and knowing when not to.

CI/CD Pipelines

Building, testing and shipping, without the pipeline owning you.

Back to all articles