Blog
Thoughts on engineering, design, and building great products.
Sign Every Certificate by Hand with cfssl
The core of 'from scratch': use cfssl to create three CAs (Kubernetes, etcd, front-proxy) then sign all the certificates for each component — apiserver with a full SAN, a kubelet per worker with special CN/O, controller-manager, scheduler, kube-proxy, the etcd client, and the service-account key pair. Each one done individually, each field correct, then verify the trust chain.
Stand Up Six EC2 Machines and Prepare the OS
The first hands-on article: stand up a dedicated VPC on AWS with six EC2 machines (1 load balancer, 3 controllers, 2 workers), assign fixed private IPs, then prepare the OS — hostname, /etc/hosts, kernel modules, sysctl, disable swap — and install the kubectl and cfssl tooling. All done step by step, run for real.
PKI and TLS: Why a Cluster Needs So Many Certificates
A Kubernetes cluster needs a dozen certificates and three separate CAs. This article explains the PKI/TLS model underpinning every connection in the cluster: who the CA signs for, how two-way mTLS works, and one easily-forgotten point — the CN and O fields in a certificate are the very identity and RBAC group the api-server trusts.
Kubernetes Architecture, Up Close: Loops, Watches and the API Server
Going deeper than the familiar control plane / node diagram: where the control loop runs, how list-watch lets components coordinate without knowing each other, why everything goes through the api-server, and which stages a kubectl apply command passes through before the container runs.
Why Build Kubernetes by Hand, and What We're Going to Build
Series opener: 'from scratch' means creating every certificate by hand, bootstrapping every binary, wiring pod networking yourself — no kubeadm, no scripts. Why this long road makes Kubernetes click faster, how we'll stand up an HA cluster, then use it as a lab to deep-dive every Kubernetes concept.
Capstone: Deploy a Complete Application and Wrap Up the Series
Tying it all together: a multi-component application (a multi-replica frontend + a database with storage) deployed onto minikube end to end, using Deployment, Service, ConfigMap/Secret, PVC, Ingress, probes and resources. Then clean up the cluster, wrap up the journey and suggest where to go next.
Observe and Debug: logs, exec, describe, events
When a pod won't run, you need to know where to look. This article drills the everyday debugging skillset through two real failures — ImagePullBackOff and CrashLoopBackOff: read describe/events to learn why, logs to see what the app says, exec to inspect inside, and the dashboard for the big picture.