A container log line on disk contains no idea which pod wrote it. Everything you filter by later is constructed by the collector at collection time. What the file actually looks like, how collectors find it, where every label comes from, and why that design decides the health of your logging stack.
Lessons from writing CiliumNetworkPolicies for the KubeAid-addons chart - toServices port traps, labels Cilium ignores, toFQDNs without a DNS rule, default-deny surprises, and why every namespace needs exactly one default-deny.
Deployment mode, object storage, label cardinality, multi-tenancy and auth, cross-cluster shipping, and the failures that are silent rather than loud. Written after moving a Loki install twice and debugging an object store that corrupted everything it was given.
A breakdown of how kube-apiserver audit events actually work - request stages, audit levels, writing policies, and how SREs tune them differently for prod vs dev clusters.
Two Grafana dashboards, same node, same timestamp - one shows 62 GB used, other shows 10 GB. Both are correct. Here's the full story of how Linux memory actually works and which number you should actually be watching.