Building kukie-oven, a Go operator that turns one ServedModel into a PVC, a download Job and a vLLM Deployment — the reconcile order, two server-side-apply field managers, telling someone else’s object from a leftover, Helm and GHCR packaging, an EBS CSI role limited by a tag boundary, and the first real run on an L40S: Ready in 14 minutes 11 seconds with no manual step.
Why an external LLM API plan became a Helm add-on for users’ GPU clusters — quality and cost numbers behind the pivot, three layers split by required permissions, a chart with per-layer switches and a preflight job, the measurement-to-429 loop, an honest comparison with KubeAI and LiteLLM, and what is built versus still planned.
Running customer Helm charts in a dedicated pod — why it left the shared agent, what helm reads from a chart, process limits, matching Argo CD’s render conditions, and a NetworkPolicy controller that had been off all along.
Finding which values key controls a rendered field in 21 public Helm charts — judging keys by marker rendering, narrowing candidates, why 18 of 209 fields were missed, comparing code with an LLM on five charts, and what a single render costs.
From an approval click to a merged pull request — rechecking file blobs and base before merging, the missing server route that left a card spinning, recording the merge first, separating the response from sync watching after a CloudFront 504, and replacing a stale AI answer with a code-written sentence.
From a chat request to an opened pull request — verifying GitHub App install callbacks, deciding between PR and kubectl per resource, steering the LLM with ModelRetry and a one-line history memo instead of prompts, code-chosen edits for plain YAML and Kustomize, and render comparison against an expected result.
Before a chat-driven kubectl change gets silently reverted — a measured selfHeal revert in about six seconds, detecting ArgoCD-managed resources from tracking-id and instance labels, warn-then-allow approval cards, the real scope of a cluster-admin connection role, and the read-only views built on Application resources.
Kubernetes networking abstractions from the inside of the cluster — why a Service object existing and traffic actually flowing are two different facts separated by controllers and a node datapath, what a StatefulSet fixes (ordinal names, PVC, DNS) and what it does not (Pod IP), why Endpoints became EndpointSlice and how to read ready·serving·terminating, port vs targetPort vs containerPort, what NodePort’s Cluster and Local policies trade, how to tell whether iptables, nftables or Cilium eBPF is carrying your Services, and why Headless and ExternalName are Services without a virtual IP.
Having a path is not the same as being allowed to use it — a three-Pod lab (diagnostic, Go web server, PostgreSQL) shows what a NetworkPolicy really is: a per-Pod, per-direction allow list where both the sender’s egress door and the receiver’s ingress door must open, allow rules only add up, an empty selector, an empty list and an empty rule mean three different things, a hyphen in YAML decides AND versus OR, and the standard API stops at the TCP port while Cilium’s Envoy can refuse a single HTTP path with a 403.
How a Pod reaches a Pod that keeps changing — a three-node kind lab with Cilium as a plain CNI, how a Service’s virtual IP is rewritten to a real Pod IP by node rules at PREROUTING and OUTPUT, why the iptables chain says 1/4·1/3·1/2 and spreads connections rather than requests, how db becomes db.cn4.svc.cluster.local and what CoreDNS does with it, where search and ndots multiply queries, and what dual-stack actually changes in Pod, Service and EndpointSlice fields.
The Kubernetes network model read from the room up — why a Pod gets one IP and shares it across containers, the three rules every CNI must satisfy and where NAT still lives, how a Pod IP is born in two steps and dies only with the Pod, what kubelet actually does when it probes, and the /24-vs-/32 choice that decides whether the host sees every packet.
Measuring how many concurrent requests one NVIDIA L40S serves within a latency SLA before building a GPU cluster — the SLA draft as TTFT and inter-token latency, a single g6e.xlarge with two stop guards, a measurement script split from the server so it can run as a Kubernetes Job, results for four open models, why MoE models outrun a dense 27B on memory bandwidth, KV cache FP8 for 20% more headroom, and two review fixes.
Three days after the self-hosted runner went live, the weak point it shipped with turned into an incident — terraform apply moved to a throwaway CodeBuild runner, a leftover review buffer re-posted one PR’s comment into later reviews, the fix that gives every job its own container with a registration token minted by a GitHub App, Claude Code baked into the image after the installer started returning 429, and the docker.sock risk that is still left.
Isolating other people’s code on a shared EKS hosting cluster — why gVisor over plain containers, Fargate or per-team nodes, why Cilium replaces the default VPC CNI while the cluster is still empty, how the node bootstrap installs a pinned and checksummed gVisor that fails closed, the missing gvisor-bin directory that broke the first apply, and the app domain and __Host- cookie that keep user apps away from the dashboard.
How a container’s room gets out — Docker’s network modes compared with real namespace numbers, inside/outside pairing by @ifN, docker0 joined to the NIC by routing and NAT, CNM vs CNI and one CNI plugin call, VXLAN overlay, and one Go server knocked on from four places: another container, the host, another machine, and a container sharing its room.
What a container actually is on an Ubuntu VM — three problems that VMs and containers each solve, the runtime stack from dockerd and kubelet down to runC, why runC vanishes and containerd-shim stays as the parent, the six namespaces and one cgroup directory seen through /proc.
Moving CI off GitHub-hosted runners after the organization ran out of included minutes — one spot EC2 instance with no inbound access, runners registered with a one-hour token sent over SSM, the key pair and long polling behind every job, the tools the image had to add back, why public repositories stay out, and the weak points that lead to the next post.
Removing the step where customers type their AWS account number — a CloudFormation custom resource that mails the role ARN to an SNS topic, an SQS buffer, a server that treats the notice as a hint and proves it by assuming the role, and the replies, retries and open-mailbox risks that come with it.
Connecting a customer’s EKS cluster without taking any long-lived key — a per-team ExternalId against the confused deputy, a role template that can only register itself into chosen namespaces, the k* pattern that slipped past a kube-* deny, 15-minute tokens, and the address check that blocks private endpoints.
What the Linux kernel does to a packet between the door and the socket, measured on an Ubuntu VM — counting the five Netfilter hooks, reading one conntrack entry and its state changes, DNAT to a Service-like address with kube-proxy’s random rule, MASQUERADE out of a namespace, a node as a router, an external SYN meeting 0.0.0.0 vs 127.0.0.1, and where eBPF plugs in.
Moving the VPC and Aurora that predated Terraform out of a CloudFormation stack — how fourteen resources split into two roots, the two apply roles built for them, and the IAM gaps that eight review rounds found before anything was applied.
Inside the Linux kernel on an Ubuntu VM — a Python server under strace, the same socket seen from ss and /proc, why FD 4 comes back four times, interfaces as doors and lo as a mirror, veth pairs and a bridge built by hand, network namespaces as rooms, and nsenter into a Docker container’s room.
What ArgoCD actually does in the Kukie dev cluster — the two repositories it reads, the GitHub App that lets it read them, the loop that turns a merge into cluster state, the controllers that take over after it, and the checks at the API server that decide what it may put in.
How a develop merge in each app repo becomes exactly one image in ECR — a role that can push to one repository only, a commit-SHA tag that never moves so the job checks before it builds, a build cache that silently never saved, and a digest a person still copies into the manifest by hand.
Standing up the EKS cluster on top of the comment-approved pipeline — a NAT instance that costs a quarter of the gateway, three applies to finish one plan, an input that leaks into the next plan, and ArgoCD installed once from outside with every other Application kept in Git.
Keeping a deploy robot from growing its own power — short-lived OIDC credentials instead of stored keys, a permissions boundary on every role it creates, permission and creation split into two PRs, and EKS access entries as one line in the cluster’s roster.
How a three-person team made Terraform changes go through review and a PR comment — the deploy-config repo split off like a parcel box, plan and apply as two different badges, and one saved plan applied exactly once.
The same packet leaves the host — why the subnet mask never travels, how default routes and BGP fill the routing tables, why ARP looks for the router’s MAC instead of the server’s, and how Service NAT and VXLAN rebuild all of it inside Kubernetes.
One curl request to a local Go server, captured on lo0 and taken apart byte by byte — layers and encapsulation, the TCP handshake and connection states, TLS 1.3 vs 1.2 with decryption, and UDP with ICMP rejections.
확장의 세 축 — 개수(HPA), 크기(VPA), 서버(CA). 내장은 HPA 하나뿐이고 숫자를 공급하는 쪽은 전부 설치한다는 것, 0에서 깨어나려면 Pod 앞에 문지기가 필요하다는 것, 그리고 서로 모르는 확장기들이 어떻게 맞물리는지까지.
API 서버로 가는 모든 요청은 인증·인가·어드미션 세 관문을 지난다. Role과 RoleBinding을 분리해 권한을 설계하고, ClusterRole의 범위는 정의가 아니라 바인딩이 정한다는 것까지.
Secret은 암호화가 아니라 인코딩이다. Sealed Secrets·External Secrets·sops로 Git 노출을 막고, CSI·사이드카 주입으로 클러스터에 아무것도 남기지 않는 방법.
NetworkPolicy와 Istio AuthorizationPolicy로 파드 간 통신을 제한하는 방법. 기본 차단에서 시작해 필요한 경로만 허용한다.
검사는 언젠가 뚫린다고 가정하고, securityContext 7종 세트로 프로세스를 최소 권한의 울타리에 가둔 뒤, PSS/PSA 정책으로 그 울타리를 클러스터 차원에서 강제하는 법.
큰 설정 파일에 빈칸을 뚫어 템플릿으로 만들고, Init 컨테이너 안의 Gomplate가 ConfigMap 값으로 빈칸을 채워 시작 시점에 완성본을 찍어내는 법.
How Docker persists data outside containers: bind mounts vs named and anonymous volumes, how each behaves on mount and removal, and the node_modules trick.
설정을 컨테이너 이미지로 굽는다 — Docker 볼륨 연결이 Kubernetes에서 막히는 이유, Init 컨테이너와 emptyDir로 우회하는 법, 그리고 이 번거로운 패턴을 정말 써야 하는 순간.
설정을 일급 리소스로 — ConfigMap과 Secret의 두 가지 소비 경로(환경 변수/볼륨), 핫 리로드와 드리프트의 명암, Base64가 보안이 아닌 이유, 그리고 immutable까지.
설정 외부화의 가장 단순한 수단, 환경 변수 — 기본값과 런타임 오버라이드 패턴부터 보안 한계와 불변성의 역설까지.
Ambassador 패턴은 왜 요즘 잘 안 쓰일까 — 사이드카의 한계에서 출발해 Sidecarless 메시, CNI의 실체, eBPF까지. 하는 일은 그대로인데 프록시의 근무지만 이사 중이라는 이야기.
외부 세계의 복잡함을 내 앱에서 걷어내는 법 — Ambassador 패턴으로 메인 컨테이너가 localhost만 바라보며 비즈니스 로직에 집중하는 방식을 이해한다.
메인 앱을 건드리지 않고 외부 인터페이스를 통일하는 법 — Adapter 패턴으로 이질적인 컨테이너 시스템이 하나의 표준 얼굴을 갖는 방식을 이해한다.
컨테이너를 건드리지 않고 기능을 확장하는 법 — Sidecar 패턴으로 단일 목적 컨테이너들이 Pod 안에서 협력하는 방식을 이해한다.
앱이 자기 자신의 정보를 알아야 할 때 — Kubernetes Downward API로 Pod 메타데이터를 환경변수와 볼륨 파일로 주입하는 방법.
동적으로 배치되는 Pod를 내부/외부에서 안정적으로 찾아가는 방법 — ClusterIP, NodePort, LoadBalancer, Ingress까지.
고유하고 교체 불가능한 인스턴스로 구성된 스테이트풀 애플리케이션을 Kubernetes에서 운영하는 방법 — StatefulSet, Headless Service, PVC까지.
동일한 일시적 복제본으로 구성된 무상태 애플리케이션을 Kubernetes에서 운영하는 방법 — ReplicaSet, Service, PVC까지.
kubectl commands that change cluster state — rollout, delete, apply — walked through with a real failed deployment and rollback on a live cluster.
kubectl commands look like a random pile of subcommands until you split them into verbs and nouns — walked through with a real pending pod from a live cluster.
분산 환경에서 단 하나의 인스턴스만 활성화되도록 보장하는 방법 — Out-of-Application Locking부터 분산 락, PodDisruptionBudget까지.
DaemonSet ensures one Pod per node for infra daemons — nodeSelector, scheduling evolution from nodeName to nodeAffinity, and comparison with Static Pods.
Batch Job 패턴에 시간 차원을 더한 CronJob — schedule, concurrencyPolicy, startingDeadlineSeconds까지.
격리된 원자적 작업 단위를 안정적으로 실행하기 위한 Job 리소스 — completions, parallelism, Indexed Job까지.
Go’s predeclared types explained — literals, zero values, booleans, and why Go has 12 different numeric types.
How the Kubernetes scheduler assigns Pods to nodes using predicates, priorities, node affinity, pod affinity, taints and tolerations for optimal placement.
How Kubernetes communicates lifecycle events to containers via SIGTERM, SIGKILL, postStart, preStop hooks, and init containers for graceful startup and shutdown.
A deep dive into Kubernetes Health Probe pattern: Process Health Check, Liveness Probe, and Readiness Probe for building self-healing cloud-native applications.
How to install Go, configure VS Code, and build your first Hello World program with essential tooling.
How Kubernetes Deployment resource automates application upgrades and rollbacks through declarative strategies including RollingUpdate, Recreate, Blue-Green, and Canary.
How to declare resource requirements and runtime dependencies so Kubernetes can schedule and manage containers predictably.
A beginner-friendly summary of Chapter 1 from Kubernetes Patterns — covering containers, pods, services, labels, annotations, and namespaces.
Shortest path algorithms (Dijkstra, Bellman-Ford) and BFS-based state-space search illustrated with the sliding puzzle problem.
How a single depth-first walk unravels every cycle in a directed graph, without ever looking back.
From range minimum query to LCA in O(1): Segment Tree, Sparse Table, and Euler tour reduction.
From naïve O(nm) to KMP O(n+m): prefix function, rolling hash, and binary search on longest repeated substring.
From cross product to convex hull: a complete walkthrough of CCW, line segment intersection, and the Monotone Chain algorithm.
NeurIPS 2019에 발표된 PyTorch 원 논문 리뷰. Eager Execution 기반의 설계 철학과 autograd 구현, 그리고 왜 연구자들이 PyTorch에 열광했는지를 정리함.
Python patterns picked up from coding tests — while loops, string immutability, switch alternatives, replace behavior, and list comprehensions
MLIR 기반 GPU 커널 컴파일러인 Triton이 뭔지, CUDA랑 뭐가 다른지, 내부 구조는 어떻게 생겼는지 정리
임베디드 시스템, SOC/MCU 차이, ARM 아키텍처, 그리고 개발 계층이 어떻게 나뉘는지 정리
Chris Lattner가 Google에서 만든 MLIR 논문을 읽고 정리했음. “왜 LLVM 하나로는 안 되는가"라는 질문에서 시작해서, Dialect 기반의 다층 IR 설계가 어떻게 컴파일러 인프라의 새로운 패러다임을 열었는지를 다룸.
AI 가속기 컴파일러를 만들다 MLIR을 처음 마주쳤을 때의 이야기. “그냥 LLVM 쓰면 되는 거 아님?“이라는 질문에서 시작해서, 왜 MLIR이 필요한지를 직접 부딪히며 알게 된 과정을 정리한다.
맥에서 멀쩡하던 카드 레이아웃이 윈도우 모니터에서 너무 크게 보이는 문제를 고치면서 구조 자체를 뜯어고친 과정을 정리함. 문제: 모니터마다 카드 크기가 달라짐 맥에서 볼 때는 카드 높이가 적당했는데, 윈도우 모니터로 보니 카드가 너무 커졌음. 원인은 카드 높이를 65vh로 잡아놨기 때문이었음. vh는 뷰포트 높이 기준이라 모니터가 크면 그냥 비례해서 커짐. 가로폭도 마찬가지였음. 그리드 컨테이너를 max-width: 90vw로 잡아놨는데, 27인치 모니터에서는 90vw가 엄청 넓어짐. 카드 높이 고정 시도 처음엔 vh를 픽셀로 바꾸는 것만 해봤음. ...
Hugo + GitHub Pages로 블로그를 세팅하면서 겪은 문제들을 정리함. CSS가 아예 안 먹히는 문제 처음 배포했을 때 스타일이 전혀 적용되지 않았음. Chrome 개발자도구를 열어보니 이런 에러가 있었음. Failed to find a valid digest in the 'integrity' attribute for resource 'stylesheet.css' with computed SHA-256 integrity '...'. The resource has been blocked. SRI(Subresource Integrity) 해시 불일치 문제였음. Hugo는 빌드할 때 CSS 파일의 SHA-256 해시를 계산해서 HTML의 integrity 속성에 자동으로 박아줌. 브라우저는 이 값을 실제 파일이랑 대조해서 위변조 여부를 검증하는데, 값이 다르면 보안상의 이유로 파일 로드를 차단함. ...