Programming, architecture, application development, message queues, middleware, databases, containerization, big data, image processing, machine learning, AI, personal growth.
This article explains how Kubernetes leverages the Linux kernel security mechanisms Seccomp, AppArmor, and SELinux together with Pod Security Standards and the built‑in admission controller to enforce fine‑grained security policies for container workloads in cloud‑native environments.
This article explains how kube-proxy and CNI plugins cooperate within a Kubernetes cluster to translate Service ClusterIP requests into real Pod IPs, detailing the Netfilter, iptables/ipvs rule configuration, overlay networking modes, and the emerging proxy‑free approaches using eBPF.
This article explains the architecture, components, and operational flow of a CSI driver using NFS as a concrete example, covering CSI fundamentals, sidecar containers, dynamic volume provisioning, pod creation, and the role of the Linux VFS in exposing remote storage to applications.
This article explains the Open Container Initiative (OCI) standards—Image-spec, Distribution-spec, and Runtime-spec—detailing how code is built into OCI images, pushed to registries, and executed via Kubernetes components such as kubelet, containerd/CRI‑O, and runc or kata‑containers, ensuring portable, interoperable containers.
This article explains how the kubectl command interacts with the Kubernetes control plane, detailing one‑way HTTPS requests and two‑way WebSocket communications, and walks through the full execution flow of a kubectl exec command across kube‑api‑server, kubelet, and the CRI runtime.
This article explains the fundamentals of DNS, its role as an application‑layer protocol, and how Kubernetes generates and manages each pod's /etc/resolv.conf through kubelet, covering nameserver, search, ndots options, dnsPolicy choices, and custom dnsConfig examples.
This article explains Kubernetes' container networking fundamentals, covering the basic network requirements, IPAM implementation with node CIDR allocation, Linux veth and bridge mechanisms, overlay solutions like VXLAN, and the role of BGP for cross‑cluster pod reachability.
When a new Pod is created, Kubelet coordinates with the CRI and CNI components to set up the sandbox, configure networking, pull images, create and start containers, using gRPC calls and command‑line interactions, with details varying across container runtimes such as containerd, cri‑o, and Docker.
This article explains how Kubernetes manages inbound traffic using Ingress and the newer Gateway API, compares their features and limitations, provides YAML examples for Ingress, GatewayClass, Gateway, and Route resources, and discusses the future direction of traffic management in cloud‑native environments.
This article explains in detail how an HTTP request moves from a user’s device through Wi‑Fi, routers, modems, ISP NAT devices, and finally reaches the application server, illustrating each OSI layer and the transformations that occur along the way.
