Blog
Thoughts on engineering, design, and building great products.
PKI and TLS: Why a Cluster Needs So Many Certificates
A Kubernetes cluster needs a dozen certificates and three separate CAs. This article explains the PKI/TLS model underpinning every connection in the cluster: who the CA signs for, how two-way mTLS works, and one easily-forgotten point — the CN and O fields in a certificate are the very identity and RBAC group the api-server trusts.
Kubernetes Architecture, Up Close: Loops, Watches and the API Server
Going deeper than the familiar control plane / node diagram: where the control loop runs, how list-watch lets components coordinate without knowing each other, why everything goes through the api-server, and which stages a kubectl apply command passes through before the container runs.
Why Build Kubernetes by Hand, and What We're Going to Build
Series opener: 'from scratch' means creating every certificate by hand, bootstrapping every binary, wiring pod networking yourself — no kubeadm, no scripts. Why this long road makes Kubernetes click faster, how we'll stand up an HA cluster, then use it as a lab to deep-dive every Kubernetes concept.
Capstone: Deploy a Complete Application and Wrap Up the Series
Tying it all together: a multi-component application (a multi-replica frontend + a database with storage) deployed onto minikube end to end, using Deployment, Service, ConfigMap/Secret, PVC, Ingress, probes and resources. Then clean up the cluster, wrap up the journey and suggest where to go next.
Observe and Debug: logs, exec, describe, events
When a pod won't run, you need to know where to look. This article drills the everyday debugging skillset through two real failures — ImagePullBackOff and CrashLoopBackOff: read describe/events to learn why, logs to see what the app says, exec to inspect inside, and the dashboard for the big picture.
Workload Types: StatefulSet, DaemonSet, Job and CronJob
Deployment fits stateless apps, but not everything is stateless. StatefulSet is for apps that need a stable identity (databases), DaemonSet for things that must run on every node (log agents), Job/CronJob for run-then-done tasks. This article runs each type for real and shows when to use which.
Resource Requests/Limits and Autoscaling (HPA)
Every pod has to state how much CPU/RAM it wants — that's how the scheduler places pods correctly and the cluster doesn't fall over because one pod hogs everything. Once declared, the HorizontalPodAutoscaler raises and lowers replica count with load. This article generates real load and watches HPA scale from 1 up to many pods.