https://kukie.tech/tags/devops/Recent content in Devops on HistoryHugoko-krMon, 02 Nov 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-05-1/Mon, 02 Nov 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-05-1/Kubernetes networking abstractions from the inside of the cluster — why a Service object existing and traffic actually flowing are two different facts separated by controllers and a node datapath, what a StatefulSet fixes (ordinal names, PVC, DNS) and what it does not (Pod IP), why Endpoints became EndpointSlice and how to read ready·serving·terminating, port vs targetPort vs containerPort, what NodePort’s Cluster and Local policies trade, how to tell whether iptables, nftables or Cilium eBPF is carrying your Services, and why Headless and ExternalName are Services without a virtual IP.https://kukie.tech/posts/network-k8s-04-3/Fri, 30 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-04-3/Having a path is not the same as being allowed to use it — a three-Pod lab (diagnostic, Go web server, PostgreSQL) shows what a NetworkPolicy really is: a per-Pod, per-direction allow list where both the sender’s egress door and the receiver’s ingress door must open, allow rules only add up, an empty selector, an empty list and an empty rule mean three different things, a hyphen in YAML decides AND versus OR, and the standard API stops at the TCP port while Cilium’s Envoy can refuse a single HTTP path with a 403.https://kukie.tech/posts/network-k8s-04-2/Wed, 28 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-04-2/How a Pod reaches a Pod that keeps changing — a three-node kind lab with Cilium as a plain CNI, how a Service’s virtual IP is rewritten to a real Pod IP by node rules at PREROUTING and OUTPUT, why the iptables chain says 1/4·1/3·1/2 and spreads connections rather than requests, how db becomes db.cn4.svc.cluster.local and what CoreDNS does with it, where search and ndots multiply queries, and what dual-stack actually changes in Pod, Service and EndpointSlice fields.https://kukie.tech/posts/network-k8s-04-1/Mon, 26 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-04-1/The Kubernetes network model read from the room up — why a Pod gets one IP and shares it across containers, the three rules every CNI must satisfy and where NAT still lives, how a Pod IP is born in two steps and dies only with the Pod, what kubelet actually does when it probes, and the /24-vs-/32 choice that decides whether the host sees every packet.https://kukie.tech/posts/network-k8s-03-2/Wed, 21 Oct 2026 10:00:00 +0900https://kukie.tech/posts/network-k8s-03-2/How a container’s room gets out — Docker’s network modes compared with real namespace numbers, inside/outside pairing by @ifN, docker0 joined to the NIC by routing and NAT, CNM vs CNI and one CNI plugin call, VXLAN overlay, and one Go server knocked on from four places: another container, the host, another machine, and a container sharing its room.https://kukie.tech/posts/network-k8s-03-1/Wed, 21 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-03-1/What a container actually is on an Ubuntu VM — three problems that VMs and containers each solve, the runtime stack from dockerd and kubelet down to runC, why runC vanishes and containerd-shim stays as the parent, the six namespaces and one cgroup directory seen through /proc.https://kukie.tech/posts/network-k8s-02-2/Fri, 16 Oct 2026 21:00:00 +0900https://kukie.tech/posts/network-k8s-02-2/What the Linux kernel does to a packet between the door and the socket, measured on an Ubuntu VM — counting the five Netfilter hooks, reading one conntrack entry and its state changes, DNAT to a Service-like address with kube-proxy’s random rule, MASQUERADE out of a namespace, a node as a router, an external SYN meeting 0.0.0.0 vs 127.0.0.1, and where eBPF plugs in.https://kukie.tech/posts/network-k8s-02-1/Fri, 16 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-02-1/Inside the Linux kernel on an Ubuntu VM — a Python server under strace, the same socket seen from ss and /proc, why FD 4 comes back four times, interfaces as doors and lo as a mirror, veth pairs and a bridge built by hand, network namespaces as rooms, and nsenter into a Docker container’s room.https://kukie.tech/posts/kukie-infra-04/Wed, 14 Oct 2026 09:30:00 +0900https://kukie.tech/posts/kukie-infra-04/How a develop merge in each app repo becomes exactly one image in ECR — a role that can push to one repository only, a commit-SHA tag that never moves so the job checks before it builds, a build cache that silently never saved, and a digest a person still copies into the manifest by hand.https://kukie.tech/posts/kukie-infra-03/Wed, 14 Oct 2026 09:20:00 +0900https://kukie.tech/posts/kukie-infra-03/Standing up the EKS cluster on top of the comment-approved pipeline — a NAT instance that costs a quarter of the gateway, three applies to finish one plan, an input that leaks into the next plan, and ArgoCD installed once from outside with every other Application kept in Git.https://kukie.tech/posts/kukie-infra-02/Wed, 14 Oct 2026 09:10:00 +0900https://kukie.tech/posts/kukie-infra-02/Keeping a deploy robot from growing its own power — short-lived OIDC credentials instead of stored keys, a permissions boundary on every role it creates, permission and creation split into two PRs, and EKS access entries as one line in the cluster’s roster.https://kukie.tech/posts/kukie-infra-01/Wed, 14 Oct 2026 09:00:00 +0900https://kukie.tech/posts/kukie-infra-01/How a three-person team made Terraform changes go through review and a PR comment — the deploy-config repo split off like a parcel box, plan and apply as two different badges, and one saved plan applied exactly once.https://kukie.tech/posts/network-k8s-01-2/Mon, 12 Oct 2026 21:00:00 +0900https://kukie.tech/posts/network-k8s-01-2/The same packet leaves the host — why the subnet mask never travels, how default routes and BGP fill the routing tables, why ARP looks for the router’s MAC instead of the server’s, and how Service NAT and VXLAN rebuild all of it inside Kubernetes.https://kukie.tech/posts/network-k8s-01-1/Mon, 12 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-01-1/One curl request to a local Go server, captured on lo0 and taken apart byte by byte — layers and encapsulation, the TCP handshake and connection states, TLS 1.3 vs 1.2 with decryption, and UDP with ICMP rejections.https://kukie.tech/posts/kubernetes-patterns-29/Mon, 07 Sep 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-29/확장의 세 축 — 개수(HPA), 크기(VPA), 서버(CA). 내장은 HPA 하나뿐이고 숫자를 공급하는 쪽은 전부 설치한다는 것, 0에서 깨어나려면 Pod 앞에 문지기가 필요하다는 것, 그리고 서로 모르는 확장기들이 어떻게 맞물리는지까지.https://kukie.tech/posts/kubernetes-patterns-26/Fri, 04 Sep 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-26/API 서버로 가는 모든 요청은 인증·인가·어드미션 세 관문을 지난다. Role과 RoleBinding을 분리해 권한을 설계하고, ClusterRole의 범위는 정의가 아니라 바인딩이 정한다는 것까지.https://kukie.tech/posts/kubernetes-patterns-25/Wed, 02 Sep 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-25/Secret은 암호화가 아니라 인코딩이다. Sealed Secrets·External Secrets·sops로 Git 노출을 막고, CSI·사이드카 주입으로 클러스터에 아무것도 남기지 않는 방법.https://kukie.tech/posts/kubernetes-patterns-24/Mon, 31 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-24/NetworkPolicy와 Istio AuthorizationPolicy로 파드 간 통신을 제한하는 방법. 기본 차단에서 시작해 필요한 경로만 허용한다.https://kukie.tech/posts/kubernetes-patterns-23/Mon, 24 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-23/검사는 언젠가 뚫린다고 가정하고, securityContext 7종 세트로 프로세스를 최소 권한의 울타리에 가둔 뒤, PSS/PSA 정책으로 그 울타리를 클러스터 차원에서 강제하는 법.https://kukie.tech/posts/kubernetes-patterns-22/Fri, 21 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-22/큰 설정 파일에 빈칸을 뚫어 템플릿으로 만들고, Init 컨테이너 안의 Gomplate가 ConfigMap 값으로 빈칸을 채워 시작 시점에 완성본을 찍어내는 법.https://kukie.tech/posts/docker-01/Wed, 19 Aug 2026 09:00:00 +0900https://kukie.tech/posts/docker-01/How Docker persists data outside containers: bind mounts vs named and anonymous volumes, how each behaves on mount and removal, and the node_modules trick.https://kukie.tech/posts/kubernetes-patterns-21/Mon, 17 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-21/설정을 컨테이너 이미지로 굽는다 — Docker 볼륨 연결이 Kubernetes에서 막히는 이유, Init 컨테이너와 emptyDir로 우회하는 법, 그리고 이 번거로운 패턴을 정말 써야 하는 순간.https://kukie.tech/posts/kubernetes-patterns-20/Sat, 15 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-20/설정을 일급 리소스로 — ConfigMap과 Secret의 두 가지 소비 경로(환경 변수/볼륨), 핫 리로드와 드리프트의 명암, Base64가 보안이 아닌 이유, 그리고 immutable까지.https://kukie.tech/posts/kubernetes-patterns-19/Wed, 12 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-19/설정 외부화의 가장 단순한 수단, 환경 변수 — 기본값과 런타임 오버라이드 패턴부터 보안 한계와 불변성의 역설까지.https://kukie.tech/posts/kubernetes-patterns-18-1/Mon, 10 Aug 2026 21:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-18-1/Ambassador 패턴은 왜 요즘 잘 안 쓰일까 — 사이드카의 한계에서 출발해 Sidecarless 메시, CNI의 실체, eBPF까지. 하는 일은 그대로인데 프록시의 근무지만 이사 중이라는 이야기.https://kukie.tech/posts/kubernetes-patterns-18/Mon, 10 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-18/외부 세계의 복잡함을 내 앱에서 걷어내는 법 — Ambassador 패턴으로 메인 컨테이너가 localhost만 바라보며 비즈니스 로직에 집중하는 방식을 이해한다.https://kukie.tech/posts/kubernetes-patterns-17/Fri, 31 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-17/메인 앱을 건드리지 않고 외부 인터페이스를 통일하는 법 — Adapter 패턴으로 이질적인 컨테이너 시스템이 하나의 표준 얼굴을 갖는 방식을 이해한다.https://kukie.tech/posts/kubernetes-patterns-16/Wed, 29 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-16/컨테이너를 건드리지 않고 기능을 확장하는 법 — Sidecar 패턴으로 단일 목적 컨테이너들이 Pod 안에서 협력하는 방식을 이해한다.https://kukie.tech/posts/kubernetes-patterns-14/Fri, 24 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-14/앱이 자기 자신의 정보를 알아야 할 때 — Kubernetes Downward API로 Pod 메타데이터를 환경변수와 볼륨 파일로 주입하는 방법.https://kukie.tech/posts/kubernetes-patterns-13/Wed, 22 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-13/동적으로 배치되는 Pod를 내부/외부에서 안정적으로 찾아가는 방법 — ClusterIP, NodePort, LoadBalancer, Ingress까지.https://kukie.tech/posts/kubernetes-patterns-12/Mon, 20 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-12/고유하고 교체 불가능한 인스턴스로 구성된 스테이트풀 애플리케이션을 Kubernetes에서 운영하는 방법 — StatefulSet, Headless Service, PVC까지.https://kukie.tech/posts/kubernetes-patterns-11/Wed, 15 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-11/동일한 일시적 복제본으로 구성된 무상태 애플리케이션을 Kubernetes에서 운영하는 방법 — ReplicaSet, Service, PVC까지.https://kukie.tech/posts/k8s-operating-cluster/Tue, 14 Jul 2026 09:00:00 +0900https://kukie.tech/posts/k8s-operating-cluster/kubectl commands that change cluster state — rollout, delete, apply — walked through with a real failed deployment and rollback on a live cluster.https://kukie.tech/posts/k8s-kubectl-basics/Tue, 14 Jul 2026 09:00:00 +0900https://kukie.tech/posts/k8s-kubectl-basics/kubectl commands look like a random pile of subcommands until you split them into verbs and nouns — walked through with a real pending pod from a live cluster.https://kukie.tech/posts/kubernetes-patterns-10/Mon, 13 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-10/분산 환경에서 단 하나의 인스턴스만 활성화되도록 보장하는 방법 — Out-of-Application Locking부터 분산 락, PodDisruptionBudget까지.https://kukie.tech/posts/kubernetes-patterns-09/Fri, 10 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-09/DaemonSet ensures one Pod per node for infra daemons — nodeSelector, scheduling evolution from nodeName to nodeAffinity, and comparison with Static Pods.https://kukie.tech/posts/kubernetes-patterns-08/Tue, 07 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-08/Batch Job 패턴에 시간 차원을 더한 CronJob — schedule, concurrencyPolicy, startingDeadlineSeconds까지.https://kukie.tech/posts/kubernetes-patterns-07/Mon, 06 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-07/격리된 원자적 작업 단위를 안정적으로 실행하기 위한 Job 리소스 — completions, parallelism, Indexed Job까지.https://kukie.tech/posts/kubernetes-patterns-06/Thu, 02 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-06/How the Kubernetes scheduler assigns Pods to nodes using predicates, priorities, node affinity, pod affinity, taints and tolerations for optimal placement.https://kukie.tech/posts/kubernetes-patterns-05/Wed, 01 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-05/How Kubernetes communicates lifecycle events to containers via SIGTERM, SIGKILL, postStart, preStop hooks, and init containers for graceful startup and shutdown.https://kukie.tech/posts/kubernetes-patterns-04/Mon, 29 Jun 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-04/A deep dive into Kubernetes Health Probe pattern: Process Health Check, Liveness Probe, and Readiness Probe for building self-healing cloud-native applications.