Kubernetes

Overview “Hope for the best, prepare for the worst.” In Kubernetes production environments, disaster recovery is the last line of defense. Whether it’s etcd corruption, accidental deletion, node failure, or even entire cluster loss, having a solid backup and recovery strategy is critical. This article systematically covers K8s disaster recovery—from etcd backup and restore, Velero full-cluster backup, PV data backup, to cross-cluster recovery and disaster recovery architecture design. Based on Kubernetes v1....

Overview Autoscaling is one of Kubernetes’ most attractive capabilities—scale up when traffic arrives, scale down when it leaves, ensuring service quality while controlling costs. But “automatic” doesn’t mean “mindless.” Poorly configured autoscaling can cause: delayed scaling leading to service degradation, aggressive scale-down disrupting long connections, and flapping scaling wasting resources. K8s autoscaling consists of three layers plus an event-driven extension: Layer Component Scaling Dimension Trigger Pod horizontal HPA Pod replica count CPU/memory/custom metrics Pod vertical VPA Pod resource quotas CPU/memory historical usage Node Cluster Autoscaler Node count Pending Pods Event-driven KEDA Pod replica count Event sources (Kafka/Redis/…) Based on Kubernetes v1....

Overview A Kubernetes Operator is a pattern that packages the operational knowledge of a specific application (like deployment, scaling, backup, recovery) into automated controller software. Instead of manually editing YAML or running kubectl commands, Operators monitor custom resources and automatically reconcile the cluster toward the desired state. This guide provides a deep dive into Operator development—from CRD design principles and Controller reconciliation loops to operator-sdk/kubebuilder hands-on development, testing, and release....

Overview Capacity planning is a core SRE responsibility. The Google SRE Book treats capacity planning as “proactive work,” emphasizing data-driven forecasting over experience-based guessing. A team without capacity planning either gets crushed by traffic during peaks or wastes significant resource costs during valleys. This article systematically covers capacity planning engineering practices across four dimensions: metric collection, data modeling, Kubernetes elastic scaling configuration, and pitfall avoidance. For a systematic methodology on capacity planning, see Google SRE Book - Capacity Planning and its discussion of capacity planning and cascading failures....

Troubleshooting Path kubectl get pods → check status kubectl describe pod → check Events kubectl logs → check logs Common Pod States State Meaning Common Cause Pending Not scheduled Insufficient resources, scheduling constraints CrashLoopBackOff Crash loop App error, config issue ImagePullBackOff Image pull failed Image not found, auth failure OOMKilled Out of memory Memory limit too low CrashLoopBackOff Most common issue. Troubleshooting steps: # Check previous crash logs kubectl logs <pod> --previous # Check exit code kubectl get pod <pod> -o jsonpath='{....

Overview The default Kubernetes security posture can be summed up in one word: open. The default ServiceAccount has broad API access (depending on version and PSP configuration), Pods run as root, containers can mount the host filesystem, and the network is fully open. This “default open” design lowers the barrier to entry but creates significant security risks in production. This article covers RBAC permission models, ServiceAccount management, Pod Security Standards, SecurityContext, NetworkPolicies, and audit logging—systematically explaining K8s security hardening practices....

Overview The Kubernetes scheduler is one of the most critical control plane components—it decides which node each Pod runs on. Scheduling quality directly impacts cluster resource utilization, application performance, and reliability. Understanding how the scheduler works is fundamental to effective K8s production operations. This article systematically covers the scheduling flow, filter-and-score mechanism, affinity, taints and tolerations, priority and preemption, and custom schedulers. Based on Kubernetes v1.30. Reference: Kubernetes Scheduler Documentation...

Four Core Requirements of the Kubernetes Networking Model The Kubernetes networking model is built on four core requirements. Understanding them is the foundation for mastering K8s networking. According to the official Kubernetes networking model documentation, these four requirements form the cornerstone of cluster network communication. 1. Pod-to-Pod Communication K8s requires that all Pods can communicate directly via IP without NAT (Network Address Translation). This means: Each Pod has its own IP address Pod-to-Pod communication uses real Pod IPs, without NAT translation Regardless of which Node a Pod is scheduled on, the Pod-to-Pod network remains flat and reachable This is the most fundamental design decision in the K8s networking model....

Overview Kubernetes Service provides Layer 4 load balancing, but in production, most web applications need Layer 7 routing capabilities: domain-based virtual hosting, path-based routing, TLS termination, and canary deployments. Ingress is K8s’s abstraction for Layer 7 routing, and the Ingress Controller is the concrete implementation of this abstraction. Choosing an Ingress Controller is not a small decision—it sits at the entry point of all external traffic. A wrong choice or misconfiguration can impact the availability of the entire cluster’s services....

Overview kubectl is the most commonly used tool for Kubernetes administrators, yet most people only use 20% of its capabilities. You type kubectl get pods -n production dozens of times a day without realizing a single alias can cut the keystrokes in half. When problems arise, you only know kubectl describe and kubectl logs, unaware that krew plugins can troubleshoot network, resource, and certificate issues with a single command. This article systematically covers the kubectl productivity toolchain — from aliases to plugins to interactive tools — to double your daily K8s operation efficiency....