A container's isolation is only as strong as the code that serves its syscalls. With runc, that code is the host kernel, shared by every container on the node: namespaces, cgroups and seccomp are checks inside it; one bug in a syscall path the container can reach is code execution in the host kernel. A sandboxed …

A Service gives a group of pods one address that lasts as long as the Service, while the pods behind it come and go. The cluster is the Pod Network's. First a pod is replaced under a client that held its address. Then one Service, web, grows through its three types: ClusterIP: an address inside the cluster, for pods; …

Every node in a Kubernetes cluster has one address on the network the nodes share, and every pod an address of its own, from its node's range. The cluster is the Top View's. We follow a packet from pod to pod: on one node, then across two. Then a network policy filters it. Kubernetes sets the rules for this network, …

A working Kubernetes cluster: five computers, and a cluster admin running kubectl against them. A node is a computer. A pod is a group of one or more containers, running on one node. We look inside the nodes first, then run a pod, then a Deployment, then delete it. Reading the drawing Solid purple is the control plane; …

Kubernetes sets the rules for the cluster's network and implements none of them itself. A network plug-in keeps them, and every cluster keeps the same rules, whichever plug-in it runs: Calico, Cilium, Flannel, or a cloud's own, such as the Amazon VPC CNI on EKS. What differs from one plug-in to the next is how it keeps …

In Kubernetes, a HorizontalPodAutoscaler(or HPA) automatically updates a workload resource (such as a Deployment or StatefulSet), with more pods. Scaling basics Horizontal scaling means run more processing units, where Vertical scaling means making a single processing unit more powerfull. (read more here) HPA scales …

When you specify a Pod, you can optionally specify how much of each resource a container needs. Requests and limits Generally, you have these tools to control the resources that a pod will use: Resource Requests Resource Limits (which we'll demonstrate in another post) Resource Requests are evaluated before a pod is …

kubernetes cluster metrics When you run a pod, some load is laid on the node that runs it. The pod consume some of the memory and cpu power of that node. We'll use a tool called metrics-server to inspect resources. For minikube, the resource-server is available as an addon. Here's how to install it (my profile is …

Motivation In many cases we want to keep configuration data about our applications. Examples: lodations of servers/services (URLs, domain names, IP addresses) directory/file locations on volumes.. credentials: user names, passwords, toekens etc. The idea is to decouple environment-specific configuration from your …

JSONPath is a query language for querying values in JSON strings. It can help you navigate complex JSON values to retreive a specific value, or set of values. JSON in kubernetes You can instruct kubernetes to modify the output to json: 1$> kubectl get pods 2NAME READY STATUS RESTARTS AGE 3my-pod 1/1 Running 0 12s 4$> …