Blog
Thoughts on engineering, design, and building great products.
kubelet: Bringing the Workers Into the Cluster
The kubelet is the only process on a worker that talks to the api-server and gives orders to containerd. This article distributes the certificate for each node, writes a KubeletConfiguration pointing at the containerd socket, builds the systemd unit, then watches the two workers register into the cluster — and understands why they show up as NotReady rather than Ready.
Container Runtime and CRI: Installing containerd on the Workers
The kubelet doesn't run containers itself — it delegates that to a container runtime through a standard interface called CRI. This article explains what CRI is, who does what in the kubelet → containerd → runc stack, then installs containerd v2.3 and runc on the two workers, sets the cgroup driver to match the kubelet, and verifies it all with crictl.
HAProxy Consolidates Three API Servers, and Remote kubectl
Three api-servers are running, but clients need to know which one to call. This article stands up HAProxy on lb-0 to consolidate them into a single address in TCP passthrough mode — preserving end-to-end mTLS, then configures kubectl on your laptop to point at the Elastic IP and sets up the RBAC so the api-server can call down to the kubelet.
controller-manager and scheduler: Control Loops and Leader Election
The two components that turn desired state into action: kube-controller-manager runs dozens of control loops, kube-scheduler picks the node for a pod. This article stands up both on three controllers, explains how the scheduler filters and scores nodes, then watches leader election work for real — three instances running, but only one doing the work.
kube-apiserver: The Cluster's Entry Point and the Request Pipeline
The component that sits right in front of etcd and is the cluster's single entry point. This article digs into the authn → authz → admission chain every request must pass through, then stands up kube-apiserver on all three controllers: connecting to etcd over TLS, enabling Secret encryption, and actually verifying a Secret is encrypted by reading the raw bytes in etcd.
etcd: Quorum, Raft, and Standing Up a Three-Node Cluster
The first control plane component, and the foundation for everything above it: etcd. This article explains what etcd stores, why it needs an odd number of nodes, and what quorum means via the Raft algorithm — then stands up a three-node etcd cluster on the controllers with TLS, and verifies the leader and cluster health.
Bundle Certs into kubeconfig and Configure Secret Encryption
The certificates are ready, but the Kubernetes binaries read them through a pre-bundled format: kubeconfig. This article generates kubeconfigs for admin, controller-manager, scheduler, kube-proxy and each kubelet — explaining the cluster/user/context model and why the control plane points at 127.0.0.1 while workers go through the load balancer. It ends by creating the Secret-at-rest encryption file for etcd.