Posts on History

Kukie Serving.03 ServedModel Operator

Tue, 03 Nov 2026 10:00:00 +0900

Building kukie-oven, a Go operator that turns one ServedModel into a PVC, a download Job and a vLLM Deployment — the reconcile order, two server-side-apply field managers, telling someone else’s object from a leftover, Helm and GHCR packaging, an EBS CSI role limited by a tag boundary, and the first real run on an L40S: Ready in 14 minutes 11 seconds with no manual step.

Kukie Serving.02 GPU Add-on Design

Tue, 03 Nov 2026 09:00:00 +0900

Why an external LLM API plan became a Helm add-on for users’ GPU clusters — quality and cost numbers behind the pivot, three layers split by required permissions, a chart with per-layer switches and a preflight job, the measurement-to-429 loop, an honest comparison with KubeAI and LiteLLM, and what is built versus still planned.

Kukie GitOps.05 Isolating Helm Rendering

Tue, 03 Nov 2026 03:00:00 +0900

Running customer Helm charts in a dedicated pod — why it left the shared agent, what helm reads from a chart, process limits, matching Argo CD’s render conditions, and a NetworkPolicy controller that had been off all along.

Kukie GitOps.04 Finding Helm Values

Tue, 03 Nov 2026 02:00:00 +0900

Finding which values key controls a rendered field in 21 public Helm charts — judging keys by marker rendering, narrowing candidates, why 18 of 209 fields were missed, comparing code with an LLM on five charts, and what a single render costs.

Kukie GitOps.03 Merge Approval

Tue, 03 Nov 2026 01:00:00 +0900

From an approval click to a merged pull request — rechecking file blobs and base before merging, the missing server route that left a card spinning, recording the merge first, separating the response from sync watching after a CloudFront 504, and replacing a stale AI answer with a code-written sentence.

Kukie GitOps.02 Pull Requests from Chat

Tue, 03 Nov 2026 00:00:00 +0900

From a chat request to an opened pull request — verifying GitHub App install callbacks, deciding between PR and kubectl per resource, steering the LLM with ModelRetry and a one-line history memo instead of prompts, code-chosen edits for plain YAML and Kustomize, and render comparison against an expected result.

Kukie GitOps.01 Reading GitOps Clusters

Mon, 02 Nov 2026 09:00:00 +0900

Before a chat-driven kubectl change gets silently reverted — a measured selfHeal revert in about six seconds, detecting ArgoCD-managed resources from tracking-id and instance labels, warn-then-allow approval cards, the real scope of a cluster-admin connection role, and the read-only views built on Application resources.

Network & K8s.05-1 Stable Names, Moving Pods

Mon, 02 Nov 2026 09:00:00 +0900

Kubernetes networking abstractions from the inside of the cluster — why a Service object existing and traffic actually flowing are two different facts separated by controllers and a node datapath, what a StatefulSet fixes (ordinal names, PVC, DNS) and what it does not (Pod IP), why Endpoints became EndpointSlice and how to read ready·serving·terminating, port vs targetPort vs containerPort, what NodePort’s Cluster and Local policies trade, how to tell whether iptables, nftables or Cilium eBPF is carrying your Services, and why Headless and ExternalName are Services without a virtual IP.

Network & K8s.04-3 Who May Knock

Fri, 30 Oct 2026 09:00:00 +0900

Having a path is not the same as being allowed to use it — a three-Pod lab (diagnostic, Go web server, PostgreSQL) shows what a NetworkPolicy really is: a per-Pod, per-direction allow list where both the sender’s egress door and the receiver’s ingress door must open, allow rules only add up, an empty selector, an empty list and an empty rule mean three different things, a hyphen in YAML decides AND versus OR, and the standard API stops at the TCP port while Cilium’s Envoy can refuse a single HTTP path with a 403.

Network & K8s.04-2 A Name Becomes a Door

Wed, 28 Oct 2026 09:00:00 +0900

How a Pod reaches a Pod that keeps changing — a three-node kind lab with Cilium as a plain CNI, how a Service’s virtual IP is rewritten to a real Pod IP by node rules at PREROUTING and OUTPUT, why the iptables chain says 1/4·1/3·1/2 and spreads connections rather than requests, how db becomes db.cn4.svc.cluster.local and what CoreDNS does with it, where search and ndots multiply queries, and what dual-stack actually changes in Pod, Service and EndpointSlice fields.

Network & K8s.04-1 One IP per Room

Mon, 26 Oct 2026 09:00:00 +0900

The Kubernetes network model read from the room up — why a Pod gets one IP and shares it across containers, the three rules every CNI must satisfy and where NAT still lives, how a Pod IP is born in two steps and dies only with the Pod, what kubelet actually does when it probes, and the /24-vs-/32 choice that decides whether the host sees every packet.

Kukie Serving.01 Baseline on One L40S

Mon, 26 Oct 2026 02:00:00 +0900

Measuring how many concurrent requests one NVIDIA L40S serves within a latency SLA before building a GPU cluster — the SLA draft as TTFT and inter-token latency, a single g6e.xlarge with two stop guards, a measurement script split from the server so it can run as a Kubernetes Job, results for four open models, why MoE models outrun a dense 27B on memory bandwidth, KV cache FP8 for 20% more headroom, and two review fixes.

Kukie Infra.11 Ephemeral Runners and Apply on CodeBuild

Thu, 22 Oct 2026 21:00:00 +0900

Three days after the self-hosted runner went live, the weak point it shipped with turned into an incident — terraform apply moved to a throwaway CodeBuild runner, a leftover review buffer re-posted one PR’s comment into later reviews, the fix that gives every job its own container with a registration token minted by a GitHub App, Claude Code baked into the image after the installer started returning 429, and the docker.sock risk that is still left.

Kukie Infra.10 Hosting Cluster Isolation

Thu, 22 Oct 2026 09:00:00 +0900

Isolating other people’s code on a shared EKS hosting cluster — why gVisor over plain containers, Fargate or per-team nodes, why Cilium replaces the default VPC CNI while the cluster is still empty, how the node bootstrap installs a pinned and checksummed gVisor that fails closed, the missing gvisor-bin directory that broke the first apply, and the app domain and __Host- cookie that keep user apps away from the dashboard.

Network & K8s.03-2 The Ways Out

Wed, 21 Oct 2026 10:00:00 +0900

How a container’s room gets out — Docker’s network modes compared with real namespace numbers, inside/outside pairing by @ifN, docker0 joined to the NIC by routing and NAT, CNM vs CNI and one CNI plugin call, VXLAN overlay, and one Go server knocked on from four places: another container, the host, another machine, and a container sharing its room.

Network & K8s.03-1 A Process in a Room

Wed, 21 Oct 2026 09:00:00 +0900

What a container actually is on an Ubuntu VM — three problems that VMs and containers each solve, the runtime stack from dockerd and kubelet down to runC, why runC vanishes and containerd-shim stays as the parent, the six namespaces and one cgroup directory seen through /proc.

Kukie Infra.09 Self-hosted Actions Runner

Mon, 19 Oct 2026 19:00:00 +0900

Moving CI off GitHub-hosted runners after the organization ran out of included minutes — one spot EC2 instance with no inbound access, runners registered with a one-hour token sent over SSM, the key pair and long polling behind every job, the tools the image had to add back, why public repositories stay out, and the weak points that lead to the next post.

Kukie Infra.08 Stack Notice Callback

Mon, 19 Oct 2026 15:00:00 +0900

Removing the step where customers type their AWS account number — a CloudFormation custom resource that mails the role ARN to an SNS topic, an SQS buffer, a server that treats the notice as a hint and proves it by assuming the role, and the replies, retries and open-mailbox risks that come with it.

Kukie Infra.07 Customer EKS Connection

Mon, 19 Oct 2026 13:00:00 +0900

Connecting a customer’s EKS cluster without taking any long-lived key — a per-team ExternalId against the confused deputy, a role template that can only register itself into chosen namespaces, the k* pattern that slipped past a kube-* deny, 15-minute tokens, and the address check that blocks private endpoints.

Network & K8s.02-2 The Packet's Way Through

Fri, 16 Oct 2026 21:00:00 +0900

What the Linux kernel does to a packet between the door and the socket, measured on an Ubuntu VM — counting the five Netfilter hooks, reading one conntrack entry and its state changes, DNAT to a Service-like address with kube-proxy’s random rule, MASQUERADE out of a namespace, a node as a router, an external SYN meeting 0.0.0.0 vs 127.0.0.1, and where eBPF plugs in.

Kukie Infra.06 CloudFormation to Terraform

Fri, 16 Oct 2026 13:00:00 +0900

Moving the VPC and Aurora that predated Terraform out of a CloudFormation stack — how fourteen resources split into two roots, the two apply roles built for them, and the IAM gaps that eight review rounds found before anything was applied.

Network & K8s.02-1 Before the Packet

Fri, 16 Oct 2026 09:00:00 +0900

Inside the Linux kernel on an Ubuntu VM — a Python server under strace, the same socket seen from ss and /proc, why FD 4 comes back four times, interfaces as doors and lo as a mirror, veth pairs and a bridge built by hand, network namespaces as rooms, and nsenter into a Docker container’s room.

Kukie Infra.05 ArgoCD in Kukie

Thu, 15 Oct 2026 16:00:00 +0900

What ArgoCD actually does in the Kukie dev cluster — the two repositories it reads, the GitHub App that lets it read them, the loop that turns a merge into cluster state, the controllers that take over after it, and the checks at the API server that decide what it may put in.

Kukie Infra.04 Image Pipeline to ECR

Wed, 14 Oct 2026 09:30:00 +0900

How a develop merge in each app repo becomes exactly one image in ECR — a role that can push to one repository only, a commit-SHA tag that never moves so the job checks before it builds, a build cache that silently never saved, and a digest a person still copies into the manifest by hand.

Kukie Infra.03 EKS and ArgoCD Bootstrap

Wed, 14 Oct 2026 09:20:00 +0900

Standing up the EKS cluster on top of the comment-approved pipeline — a NAT instance that costs a quarter of the gateway, three applies to finish one plan, an input that leaks into the next plan, and ArgoCD installed once from outside with every other Application kept in Git.

Kukie Infra.02 IAM Boundaries

Wed, 14 Oct 2026 09:10:00 +0900

Keeping a deploy robot from growing its own power — short-lived OIDC credentials instead of stored keys, a permissions boundary on every role it creates, permission and creation split into two PRs, and EKS access entries as one line in the cluster’s roster.

Kukie Infra.01 Terraform CD by PR Comment

Wed, 14 Oct 2026 09:00:00 +0900

How a three-person team made Terraform changes go through review and a PR comment — the deploy-config repo split off like a parcel box, plan and apply as two different badges, and one saved plan applied exactly once.

Network & K8s.01-2 Across the Network

Mon, 12 Oct 2026 21:00:00 +0900

The same packet leaves the host — why the subnet mask never travels, how default routes and BGP fill the routing tables, why ARP looks for the router’s MAC instead of the server’s, and how Service NAT and VXLAN rebuild all of it inside Kubernetes.

Network & K8s.01-1 Inside One Host

Mon, 12 Oct 2026 09:00:00 +0900

One curl request to a local Go server, captured on lo0 and taken apart byte by byte — layers and encapsulation, the TCP handshake and connection states, TLS 1.3 vs 1.2 with decryption, and UDP with ICMP rejections.

K8sPatterns.29 Elastic Scale

Mon, 07 Sep 2026 09:00:00 +0900

확장의 세 축 — 개수(HPA), 크기(VPA), 서버(CA). 내장은 HPA 하나뿐이고 숫자를 공급하는 쪽은 전부 설치한다는 것, 0에서 깨어나려면 Pod 앞에 문지기가 필요하다는 것, 그리고 서로 모르는 확장기들이 어떻게 맞물리는지까지.

K8sPatterns.26 Access Control

Fri, 04 Sep 2026 09:00:00 +0900

API 서버로 가는 모든 요청은 인증·인가·어드미션 세 관문을 지난다. Role과 RoleBinding을 분리해 권한을 설계하고, ClusterRole의 범위는 정의가 아니라 바인딩이 정한다는 것까지.

K8sPatterns.25 Secure Configuration

Wed, 02 Sep 2026 09:00:00 +0900

Secret은 암호화가 아니라 인코딩이다. Sealed Secrets·External Secrets·sops로 Git 노출을 막고, CSI·사이드카 주입으로 클러스터에 아무것도 남기지 않는 방법.

K8sPatterns.24 Network Segmentation

Mon, 31 Aug 2026 09:00:00 +0900

NetworkPolicy와 Istio AuthorizationPolicy로 파드 간 통신을 제한하는 방법. 기본 차단에서 시작해 필요한 경로만 허용한다.

K8sPatterns.23 Process Containment

Mon, 24 Aug 2026 09:00:00 +0900

검사는 언젠가 뚫린다고 가정하고, securityContext 7종 세트로 프로세스를 최소 권한의 울타리에 가둔 뒤, PSS/PSA 정책으로 그 울타리를 클러스터 차원에서 강제하는 법.

K8sPatterns.22 Configuration Template

Fri, 21 Aug 2026 09:00:00 +0900

큰 설정 파일에 빈칸을 뚫어 템플릿으로 만들고, Init 컨테이너 안의 Gomplate가 ConfigMap 값으로 빈칸을 채워 시작 시점에 완성본을 찍어내는 법.

Docker.01 Bind Mount vs Volume (Named / Anonymous)

Wed, 19 Aug 2026 09:00:00 +0900

How Docker persists data outside containers: bind mounts vs named and anonymous volumes, how each behaves on mount and removal, and the node_modules trick.

K8sPatterns.21 Immutable Configuration

Mon, 17 Aug 2026 09:00:00 +0900

설정을 컨테이너 이미지로 굽는다 — Docker 볼륨 연결이 Kubernetes에서 막히는 이유, Init 컨테이너와 emptyDir로 우회하는 법, 그리고 이 번거로운 패턴을 정말 써야 하는 순간.

K8sPatterns.20 Configuration Resource

Sat, 15 Aug 2026 09:00:00 +0900

설정을 일급 리소스로 — ConfigMap과 Secret의 두 가지 소비 경로(환경 변수/볼륨), 핫 리로드와 드리프트의 명암, Base64가 보안이 아닌 이유, 그리고 immutable까지.

K8sPatterns.19 EnvVar Configuration

Wed, 12 Aug 2026 09:00:00 +0900

설정 외부화의 가장 단순한 수단, 환경 변수 — 기본값과 런타임 오버라이드 패턴부터 보안 한계와 불변성의 역설까지.

K8sPatterns.18.5 Sidecarless & eBPF

Mon, 10 Aug 2026 21:00:00 +0900

Ambassador 패턴은 왜 요즘 잘 안 쓰일까 — 사이드카의 한계에서 출발해 Sidecarless 메시, CNI의 실체, eBPF까지. 하는 일은 그대로인데 프록시의 근무지만 이사 중이라는 이야기.

K8sPatterns.18 Ambassador

Mon, 10 Aug 2026 09:00:00 +0900

외부 세계의 복잡함을 내 앱에서 걷어내는 법 — Ambassador 패턴으로 메인 컨테이너가 localhost만 바라보며 비즈니스 로직에 집중하는 방식을 이해한다.

K8sPatterns.17 Adapter

Fri, 31 Jul 2026 09:00:00 +0900

메인 앱을 건드리지 않고 외부 인터페이스를 통일하는 법 — Adapter 패턴으로 이질적인 컨테이너 시스템이 하나의 표준 얼굴을 갖는 방식을 이해한다.

K8sPatterns.16 Sidecar

Wed, 29 Jul 2026 09:00:00 +0900

컨테이너를 건드리지 않고 기능을 확장하는 법 — Sidecar 패턴으로 단일 목적 컨테이너들이 Pod 안에서 협력하는 방식을 이해한다.

K8sPatterns.14 Self-Awareness

Fri, 24 Jul 2026 09:00:00 +0900

앱이 자기 자신의 정보를 알아야 할 때 — Kubernetes Downward API로 Pod 메타데이터를 환경변수와 볼륨 파일로 주입하는 방법.

K8sPatterns.13 Service Discovery

Wed, 22 Jul 2026 09:00:00 +0900

동적으로 배치되는 Pod를 내부/외부에서 안정적으로 찾아가는 방법 — ClusterIP, NodePort, LoadBalancer, Ingress까지.

K8sPatterns.12 Stateful Service

Mon, 20 Jul 2026 09:00:00 +0900

고유하고 교체 불가능한 인스턴스로 구성된 스테이트풀 애플리케이션을 Kubernetes에서 운영하는 방법 — StatefulSet, Headless Service, PVC까지.

K8sPatterns.11 Stateless Service

Wed, 15 Jul 2026 09:00:00 +0900

동일한 일시적 복제본으로 구성된 무상태 애플리케이션을 Kubernetes에서 운영하는 방법 — ReplicaSet, Service, PVC까지.

Operating a Kubernetes Cluster: rollout, delete, apply

Tue, 14 Jul 2026 09:00:00 +0900

kubectl commands that change cluster state — rollout, delete, apply — walked through with a real failed deployment and rollback on a live cluster.

Reading a Kubernetes Cluster: config, get, describe, logs

Tue, 14 Jul 2026 09:00:00 +0900

kubectl commands look like a random pile of subcommands until you split them into verbs and nouns — walked through with a real pending pod from a live cluster.

K8sPatterns.10 Singleton Service

Mon, 13 Jul 2026 09:00:00 +0900

분산 환경에서 단 하나의 인스턴스만 활성화되도록 보장하는 방법 — Out-of-Application Locking부터 분산 락, PodDisruptionBudget까지.

K8sPatterns.09 Daemon Service

Fri, 10 Jul 2026 09:00:00 +0900

DaemonSet ensures one Pod per node for infra daemons — nodeSelector, scheduling evolution from nodeName to nodeAffinity, and comparison with Static Pods.

K8sPatterns.08 Periodic Job

Tue, 07 Jul 2026 09:00:00 +0900

Batch Job 패턴에 시간 차원을 더한 CronJob — schedule, concurrencyPolicy, startingDeadlineSeconds까지.

K8sPatterns.07 Batch Job

Mon, 06 Jul 2026 09:00:00 +0900

격리된 원자적 작업 단위를 안정적으로 실행하기 위한 Job 리소스 — completions, parallelism, Indexed Job까지.

Go.02 Predeclared Types and Declarations

Sun, 05 Jul 2026 09:00:00 +0900

Go’s predeclared types explained — literals, zero values, booleans, and why Go has 12 different numeric types.

K8sPatterns.06 Automated Placement

Thu, 02 Jul 2026 09:00:00 +0900

How the Kubernetes scheduler assigns Pods to nodes using predicates, priorities, node affinity, pod affinity, taints and tolerations for optimal placement.

K8sPatterns.05 Managed Lifecycle

Wed, 01 Jul 2026 09:00:00 +0900

How Kubernetes communicates lifecycle events to containers via SIGTERM, SIGKILL, postStart, preStop hooks, and init containers for graceful startup and shutdown.

K8sPatterns.04 Health Probe Pattern

Mon, 29 Jun 2026 09:00:00 +0900

A deep dive into Kubernetes Health Probe pattern: Process Health Check, Liveness Probe, and Readiness Probe for building self-healing cloud-native applications.

Go.01 Setting Up Your Go Development Environment

Sun, 28 Jun 2026 09:00:00 +0900

How to install Go, configure VS Code, and build your first Hello World program with essential tooling.

K8sPatterns.03 Declarative Deployment

Fri, 26 Jun 2026 09:00:00 +0900

How Kubernetes Deployment resource automates application upgrades and rollbacks through declarative strategies including RollingUpdate, Recreate, Blue-Green, and Canary.

K8sPatterns.02 Predictable Demands

Wed, 24 Jun 2026 09:00:00 +0900

How to declare resource requirements and runtime dependencies so Kubernetes can schedule and manage containers predictably.

K8sPatterns.01 Introduction

Mon, 22 Jun 2026 09:00:00 +0900

A beginner-friendly summary of Chapter 1 from Kubernetes Patterns — covering containers, pods, services, labels, annotations, and namespaces.

APS.10 Dijkstra, Bellman-Ford & Sliding Puzzle

Wed, 06 May 2026 09:00:00 +0900

Shortest path algorithms (Dijkstra, Bellman-Ford) and BFS-based state-space search illustrated with the sliding puzzle problem.

APS.06 Tarjan's SCC Algorithm

Tue, 14 Apr 2026 09:00:00 +0900

How a single depth-first walk unravels every cycle in a directed graph, without ever looking back.

APS.05 RMQ, Segment Tree, Sparse Table

Tue, 07 Apr 2026 09:00:00 +0900

From range minimum query to LCA in O(1): Segment Tree, Sparse Table, and Euler tour reduction.

APS.04 String Matching

Wed, 25 Mar 2026 09:00:00 +0900

From naïve O(nm) to KMP O(n+m): prefix function, rolling hash, and binary search on longest repeated substring.

APS.03 Geometric Problems

Wed, 18 Mar 2026 09:00:00 +0900

From cross product to convex hull: a complete walkthrough of CCW, line segment intersection, and the Monotone Chain algorithm.

[논문 리뷰] PyTorch: An Imperative Style, High-Performance Deep Learning Library

Mon, 16 Mar 2026 09:00:00 +0900

NeurIPS 2019에 발표된 PyTorch 원 논문 리뷰. Eager Execution 기반의 설계 철학과 autograd 구현, 그리고 왜 연구자들이 PyTorch에 열광했는지를 정리함.

Pythonic Codes

Wed, 11 Mar 2026 08:00:00 +0900

Python patterns picked up from coding tests — while loops, string immutability, switch alternatives, replace behavior, and list comprehensions

GPU Kernel Compiler: Triton and MLIR

Tue, 10 Mar 2026 10:00:00 +0900

MLIR 기반 GPU 커널 컴파일러인 Triton이 뭔지, CUDA랑 뭐가 다른지, 내부 구조는 어떻게 생겼는지 정리

Embedded System : MCU, Soc

Sun, 08 Mar 2026 10:00:00 +0900

임베디드 시스템, SOC/MCU 차이, ARM 아키텍처, 그리고 개발 계층이 어떻게 나뉘는지 정리

[Paper Review] MLIR: A Compiler Infrastructure for the End of Moore's Law

Thu, 05 Mar 2026 14:00:00 +0900

Chris Lattner가 Google에서 만든 MLIR 논문을 읽고 정리했음. “왜 LLVM 하나로는 안 되는가"라는 질문에서 시작해서, Dialect 기반의 다층 IR 설계가 어떻게 컴파일러 인프라의 새로운 패러다임을 열었는지를 다룸.

Beyond LLVM: Why MLIR

Thu, 05 Mar 2026 10:00:00 +0900

AI 가속기 컴파일러를 만들다 MLIR을 처음 마주쳤을 때의 이야기. “그냥 LLVM 쓰면 되는 거 아님?“이라는 질문에서 시작해서, 왜 MLIR이 필요한지를 직접 부딪히며 알게 된 과정을 정리한다.

블로그 카드 레이아웃 개선 과정

Wed, 04 Mar 2026 18:00:00 +0900

맥에서 멀쩡하던 카드 레이아웃이 윈도우 모니터에서 너무 크게 보이는 문제를 고치면서 구조 자체를 뜯어고친 과정을 정리함.

문제: 모니터마다 카드 크기가 달라짐

맥에서 볼 때는 카드 높이가 적당했는데, 윈도우 모니터로 보니 카드가 너무 커졌음. 원인은 카드 높이를 65vh로 잡아놨기 때문이었음. vh는 뷰포트 높이 기준이라 모니터가 크면 그냥 비례해서 커짐.

가로폭도 마찬가지였음. 그리드 컨테이너를 max-width: 90vw로 잡아놨는데, 27인치 모니터에서는 90vw가 엄청 넓어짐.

카드 높이 고정 시도

처음엔 vh를 픽셀로 바꾸는 것만 해봤음.

GitHub Pages 블로그 세팅 과정

Wed, 04 Mar 2026 12:00:00 +0900

Hugo + GitHub Pages로 블로그를 세팅하면서 겪은 문제들을 정리함.

CSS가 아예 안 먹히는 문제

처음 배포했을 때 스타일이 전혀 적용되지 않았음. Chrome 개발자도구를 열어보니 이런 에러가 있었음.

Failed to find a valid digest in the 'integrity' attribute for resource
'stylesheet.css' with computed SHA-256 integrity '...'.
The resource has been blocked.

SRI(Subresource Integrity) 해시 불일치 문제였음.

Hugo는 빌드할 때 CSS 파일의 SHA-256 해시를 계산해서 HTML의 integrity 속성에 자동으로 박아줌. 브라우저는 이 값을 실제 파일이랑 대조해서 위변조 여부를 검증하는데, 값이 다르면 보안상의 이유로 파일 로드를 차단함.