Twenty-five Helm flags, template functions, chart features and tools that most daily users never touch, each with the operational problem it solves. Written after two years of writing and managing Helm packages in production.
What eBPF actually is, why the verifier means it can't crash your kernel, hooks and maps in plain words, two runnable examples with bpftrace and libbpf, and how Cilium turns all of it into a CNI.
What Helm does with a hook step by step, the three things hooks do not do that everyone assumes they do, a migration Job that survives a rollback, and when an initContainer or an Argo CD sync wave is the better tool. Written after two years of writing and managing Helm packages in production.
A container log line on disk contains no idea which pod wrote it. Everything you filter by later is constructed by the collector at collection time. What the file actually looks like, how collectors find it, where every label comes from, and why that design decides the health of your logging stack.
Why a changed ConfigMap restarts nothing, the Helm checksum annotation done properly, the two mistakes that make it silently do nothing, and when an immutable ConfigMap, Reloader, or a reload sidecar is the better tool. Written after two years of writing and managing Helm packages in production.
Which of my Kubernetes-shaped SRE instincts are about the abstraction and which are about the machine underneath, worked out against a hosting company that runs about 12,000 single-tenant VMs across ten cloud providers with no Kubernetes at all.
Processes and signals, namespaces and cgroups, memory, storage, networking, and identity: the mechanism behind each, the two or three ways it breaks under a pod, and the one check that confirms it. Written from on-call across 100+ production Kubernetes clusters.
Lessons from writing CiliumNetworkPolicies for the KubeAid-addons chart - toServices port traps, labels Cilium ignores, toFQDNs without a DNS rule, default-deny surprises, and why every namespace needs exactly one default-deny.
Deployment mode, object storage, label cardinality, multi-tenancy and auth, cross-cluster shipping, and the failures that are silent rather than loud. Written after moving a Loki install twice and debugging an object store that corrupted everything it was given.
A breakdown of why DaemonSets using hostPort can get stuck in Pending during rolling updates, and why the default maxSurge/maxUnavailable settings aren't always right for them.