https://kukie.tech/tags/kubernetes/Recent content in Kubernetes on HistoryHugoko-krTue, 03 Nov 2026 03:00:00 +0900https://kukie.tech/posts/kukie-gitops-05/Tue, 03 Nov 2026 03:00:00 +0900https://kukie.tech/posts/kukie-gitops-05/Running customer Helm charts in a dedicated pod — why it left the shared agent, what helm reads from a chart, process limits, matching Argo CD’s render conditions, and a NetworkPolicy controller that had been off all along.https://kukie.tech/posts/kukie-gitops-01/Mon, 02 Nov 2026 09:00:00 +0900https://kukie.tech/posts/kukie-gitops-01/Before a chat-driven kubectl change gets silently reverted — a measured selfHeal revert in about six seconds, detecting ArgoCD-managed resources from tracking-id and instance labels, warn-then-allow approval cards, the real scope of a cluster-admin connection role, and the read-only views built on Application resources.https://kukie.tech/posts/network-k8s-05-1/Mon, 02 Nov 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-05-1/Kubernetes networking abstractions from the inside of the cluster — why a Service object existing and traffic actually flowing are two different facts separated by controllers and a node datapath, what a StatefulSet fixes (ordinal names, PVC, DNS) and what it does not (Pod IP), why Endpoints became EndpointSlice and how to read ready·serving·terminating, port vs targetPort vs containerPort, what NodePort’s Cluster and Local policies trade, how to tell whether iptables, nftables or Cilium eBPF is carrying your Services, and why Headless and ExternalName are Services without a virtual IP.https://kukie.tech/posts/network-k8s-04-3/Fri, 30 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-04-3/Having a path is not the same as being allowed to use it — a three-Pod lab (diagnostic, Go web server, PostgreSQL) shows what a NetworkPolicy really is: a per-Pod, per-direction allow list where both the sender’s egress door and the receiver’s ingress door must open, allow rules only add up, an empty selector, an empty list and an empty rule mean three different things, a hyphen in YAML decides AND versus OR, and the standard API stops at the TCP port while Cilium’s Envoy can refuse a single HTTP path with a 403.https://kukie.tech/posts/network-k8s-04-2/Wed, 28 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-04-2/How a Pod reaches a Pod that keeps changing — a three-node kind lab with Cilium as a plain CNI, how a Service’s virtual IP is rewritten to a real Pod IP by node rules at PREROUTING and OUTPUT, why the iptables chain says 1/4·1/3·1/2 and spreads connections rather than requests, how db becomes db.cn4.svc.cluster.local and what CoreDNS does with it, where search and ndots multiply queries, and what dual-stack actually changes in Pod, Service and EndpointSlice fields.https://kukie.tech/posts/network-k8s-04-1/Mon, 26 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-04-1/The Kubernetes network model read from the room up — why a Pod gets one IP and shares it across containers, the three rules every CNI must satisfy and where NAT still lives, how a Pod IP is born in two steps and dies only with the Pod, what kubelet actually does when it probes, and the /24-vs-/32 choice that decides whether the host sees every packet.https://kukie.tech/posts/network-k8s-03-2/Wed, 21 Oct 2026 10:00:00 +0900https://kukie.tech/posts/network-k8s-03-2/How a container’s room gets out — Docker’s network modes compared with real namespace numbers, inside/outside pairing by @ifN, docker0 joined to the NIC by routing and NAT, CNM vs CNI and one CNI plugin call, VXLAN overlay, and one Go server knocked on from four places: another container, the host, another machine, and a container sharing its room.https://kukie.tech/posts/network-k8s-03-1/Wed, 21 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-03-1/What a container actually is on an Ubuntu VM — three problems that VMs and containers each solve, the runtime stack from dockerd and kubelet down to runC, why runC vanishes and containerd-shim stays as the parent, the six namespaces and one cgroup directory seen through /proc.https://kukie.tech/posts/network-k8s-02-2/Fri, 16 Oct 2026 21:00:00 +0900https://kukie.tech/posts/network-k8s-02-2/What the Linux kernel does to a packet between the door and the socket, measured on an Ubuntu VM — counting the five Netfilter hooks, reading one conntrack entry and its state changes, DNAT to a Service-like address with kube-proxy’s random rule, MASQUERADE out of a namespace, a node as a router, an external SYN meeting 0.0.0.0 vs 127.0.0.1, and where eBPF plugs in.https://kukie.tech/posts/network-k8s-02-1/Fri, 16 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-02-1/Inside the Linux kernel on an Ubuntu VM — a Python server under strace, the same socket seen from ss and /proc, why FD 4 comes back four times, interfaces as doors and lo as a mirror, veth pairs and a bridge built by hand, network namespaces as rooms, and nsenter into a Docker container’s room.https://kukie.tech/posts/kukie-infra-05/Thu, 15 Oct 2026 16:00:00 +0900https://kukie.tech/posts/kukie-infra-05/What ArgoCD actually does in the Kukie dev cluster — the two repositories it reads, the GitHub App that lets it read them, the loop that turns a merge into cluster state, the controllers that take over after it, and the checks at the API server that decide what it may put in.https://kukie.tech/posts/kukie-infra-03/Wed, 14 Oct 2026 09:20:00 +0900https://kukie.tech/posts/kukie-infra-03/Standing up the EKS cluster on top of the comment-approved pipeline — a NAT instance that costs a quarter of the gateway, three applies to finish one plan, an input that leaks into the next plan, and ArgoCD installed once from outside with every other Application kept in Git.https://kukie.tech/posts/kukie-infra-01/Wed, 14 Oct 2026 09:00:00 +0900https://kukie.tech/posts/kukie-infra-01/How a three-person team made Terraform changes go through review and a PR comment — the deploy-config repo split off like a parcel box, plan and apply as two different badges, and one saved plan applied exactly once.https://kukie.tech/posts/network-k8s-01-2/Mon, 12 Oct 2026 21:00:00 +0900https://kukie.tech/posts/network-k8s-01-2/The same packet leaves the host — why the subnet mask never travels, how default routes and BGP fill the routing tables, why ARP looks for the router’s MAC instead of the server’s, and how Service NAT and VXLAN rebuild all of it inside Kubernetes.https://kukie.tech/posts/network-k8s-01-1/Mon, 12 Oct 2026 09:00:00 +0900https://kukie.tech/posts/network-k8s-01-1/One curl request to a local Go server, captured on lo0 and taken apart byte by byte — layers and encapsulation, the TCP handshake and connection states, TLS 1.3 vs 1.2 with decryption, and UDP with ICMP rejections.https://kukie.tech/posts/kubernetes-patterns-29/Mon, 07 Sep 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-29/확장의 세 축 — 개수(HPA), 크기(VPA), 서버(CA). 내장은 HPA 하나뿐이고 숫자를 공급하는 쪽은 전부 설치한다는 것, 0에서 깨어나려면 Pod 앞에 문지기가 필요하다는 것, 그리고 서로 모르는 확장기들이 어떻게 맞물리는지까지.https://kukie.tech/posts/kubernetes-patterns-26/Fri, 04 Sep 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-26/API 서버로 가는 모든 요청은 인증·인가·어드미션 세 관문을 지난다. Role과 RoleBinding을 분리해 권한을 설계하고, ClusterRole의 범위는 정의가 아니라 바인딩이 정한다는 것까지.https://kukie.tech/posts/kubernetes-patterns-25/Wed, 02 Sep 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-25/Secret은 암호화가 아니라 인코딩이다. Sealed Secrets·External Secrets·sops로 Git 노출을 막고, CSI·사이드카 주입으로 클러스터에 아무것도 남기지 않는 방법.https://kukie.tech/posts/kubernetes-patterns-24/Mon, 31 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-24/NetworkPolicy와 Istio AuthorizationPolicy로 파드 간 통신을 제한하는 방법. 기본 차단에서 시작해 필요한 경로만 허용한다.https://kukie.tech/posts/kubernetes-patterns-23/Mon, 24 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-23/검사는 언젠가 뚫린다고 가정하고, securityContext 7종 세트로 프로세스를 최소 권한의 울타리에 가둔 뒤, PSS/PSA 정책으로 그 울타리를 클러스터 차원에서 강제하는 법.https://kukie.tech/posts/kubernetes-patterns-22/Fri, 21 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-22/큰 설정 파일에 빈칸을 뚫어 템플릿으로 만들고, Init 컨테이너 안의 Gomplate가 ConfigMap 값으로 빈칸을 채워 시작 시점에 완성본을 찍어내는 법.https://kukie.tech/posts/kubernetes-patterns-21/Mon, 17 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-21/설정을 컨테이너 이미지로 굽는다 — Docker 볼륨 연결이 Kubernetes에서 막히는 이유, Init 컨테이너와 emptyDir로 우회하는 법, 그리고 이 번거로운 패턴을 정말 써야 하는 순간.https://kukie.tech/posts/kubernetes-patterns-20/Sat, 15 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-20/설정을 일급 리소스로 — ConfigMap과 Secret의 두 가지 소비 경로(환경 변수/볼륨), 핫 리로드와 드리프트의 명암, Base64가 보안이 아닌 이유, 그리고 immutable까지.https://kukie.tech/posts/kubernetes-patterns-19/Wed, 12 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-19/설정 외부화의 가장 단순한 수단, 환경 변수 — 기본값과 런타임 오버라이드 패턴부터 보안 한계와 불변성의 역설까지.https://kukie.tech/posts/kubernetes-patterns-18-1/Mon, 10 Aug 2026 21:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-18-1/Ambassador 패턴은 왜 요즘 잘 안 쓰일까 — 사이드카의 한계에서 출발해 Sidecarless 메시, CNI의 실체, eBPF까지. 하는 일은 그대로인데 프록시의 근무지만 이사 중이라는 이야기.https://kukie.tech/posts/kubernetes-patterns-18/Mon, 10 Aug 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-18/외부 세계의 복잡함을 내 앱에서 걷어내는 법 — Ambassador 패턴으로 메인 컨테이너가 localhost만 바라보며 비즈니스 로직에 집중하는 방식을 이해한다.https://kukie.tech/posts/kubernetes-patterns-17/Fri, 31 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-17/메인 앱을 건드리지 않고 외부 인터페이스를 통일하는 법 — Adapter 패턴으로 이질적인 컨테이너 시스템이 하나의 표준 얼굴을 갖는 방식을 이해한다.https://kukie.tech/posts/kubernetes-patterns-16/Wed, 29 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-16/컨테이너를 건드리지 않고 기능을 확장하는 법 — Sidecar 패턴으로 단일 목적 컨테이너들이 Pod 안에서 협력하는 방식을 이해한다.https://kukie.tech/posts/kubernetes-patterns-14/Fri, 24 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-14/앱이 자기 자신의 정보를 알아야 할 때 — Kubernetes Downward API로 Pod 메타데이터를 환경변수와 볼륨 파일로 주입하는 방법.https://kukie.tech/posts/kubernetes-patterns-13/Wed, 22 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-13/동적으로 배치되는 Pod를 내부/외부에서 안정적으로 찾아가는 방법 — ClusterIP, NodePort, LoadBalancer, Ingress까지.https://kukie.tech/posts/kubernetes-patterns-12/Mon, 20 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-12/고유하고 교체 불가능한 인스턴스로 구성된 스테이트풀 애플리케이션을 Kubernetes에서 운영하는 방법 — StatefulSet, Headless Service, PVC까지.https://kukie.tech/posts/kubernetes-patterns-11/Wed, 15 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-11/동일한 일시적 복제본으로 구성된 무상태 애플리케이션을 Kubernetes에서 운영하는 방법 — ReplicaSet, Service, PVC까지.https://kukie.tech/posts/k8s-operating-cluster/Tue, 14 Jul 2026 09:00:00 +0900https://kukie.tech/posts/k8s-operating-cluster/kubectl commands that change cluster state — rollout, delete, apply — walked through with a real failed deployment and rollback on a live cluster.https://kukie.tech/posts/k8s-kubectl-basics/Tue, 14 Jul 2026 09:00:00 +0900https://kukie.tech/posts/k8s-kubectl-basics/kubectl commands look like a random pile of subcommands until you split them into verbs and nouns — walked through with a real pending pod from a live cluster.https://kukie.tech/posts/kubernetes-patterns-10/Mon, 13 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-10/분산 환경에서 단 하나의 인스턴스만 활성화되도록 보장하는 방법 — Out-of-Application Locking부터 분산 락, PodDisruptionBudget까지.https://kukie.tech/posts/kubernetes-patterns-09/Fri, 10 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-09/DaemonSet ensures one Pod per node for infra daemons — nodeSelector, scheduling evolution from nodeName to nodeAffinity, and comparison with Static Pods.https://kukie.tech/posts/kubernetes-patterns-08/Tue, 07 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-08/Batch Job 패턴에 시간 차원을 더한 CronJob — schedule, concurrencyPolicy, startingDeadlineSeconds까지.https://kukie.tech/posts/kubernetes-patterns-07/Mon, 06 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-07/격리된 원자적 작업 단위를 안정적으로 실행하기 위한 Job 리소스 — completions, parallelism, Indexed Job까지.https://kukie.tech/posts/kubernetes-patterns-06/Thu, 02 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-06/How the Kubernetes scheduler assigns Pods to nodes using predicates, priorities, node affinity, pod affinity, taints and tolerations for optimal placement.https://kukie.tech/posts/kubernetes-patterns-05/Wed, 01 Jul 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-05/How Kubernetes communicates lifecycle events to containers via SIGTERM, SIGKILL, postStart, preStop hooks, and init containers for graceful startup and shutdown.https://kukie.tech/posts/kubernetes-patterns-04/Mon, 29 Jun 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-04/A deep dive into Kubernetes Health Probe pattern: Process Health Check, Liveness Probe, and Readiness Probe for building self-healing cloud-native applications.https://kukie.tech/posts/kubernetes-patterns-03/Fri, 26 Jun 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-03/How Kubernetes Deployment resource automates application upgrades and rollbacks through declarative strategies including RollingUpdate, Recreate, Blue-Green, and Canary.https://kukie.tech/posts/kubernetes-patterns-02/Wed, 24 Jun 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-02/How to declare resource requirements and runtime dependencies so Kubernetes can schedule and manage containers predictably.https://kukie.tech/posts/kubernetes-patterns-01/Mon, 22 Jun 2026 09:00:00 +0900https://kukie.tech/posts/kubernetes-patterns-01/A beginner-friendly summary of Chapter 1 from Kubernetes Patterns — covering containers, pods, services, labels, annotations, and namespaces.https://kukie.tech/wiki/admission-webhook/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/admission-webhook/API 서버가 객체를 저장하기 직전, 외부 HTTP 서버에 물어보는 확장 지점. 요청을 고치거나 거부할 수 있다.https://kukie.tech/wiki/apiversion/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/apiversion/쿠버네티스 매니페스트 첫 줄에 오는 필드. 그룹과 버전 두 조각으로 이루어진다.https://kukie.tech/wiki/argocd/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/argocd/Git 에 적힌 쿠버네티스 객체를 클러스터에 맞춰 넣는 GitOps 도구. Application · AppProject 라는 객체 종류를 추가해 무엇을 어디에 넣을지 정한다.https://kukie.tech/wiki/cilium/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/cilium/eBPF 로 Pod 네트워크와 네트워크 정책, 서비스 로드 밸런싱, 통신 관측을 처리하는 CNI 플러그인. Hubble 로 누가 어디로 통신했고 왜 막혔는지 기록한다.https://kukie.tech/wiki/cni/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/cni/컨테이너가 만들어질 때 네트워크를 붙이는 방법을 정한 규격. 런타임이 플러그인 실행 파일을 부르고, 플러그인이 Pod 안에 인터페이스와 IP·경로를 만든다.https://kukie.tech/wiki/crd/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/crd/쿠버네티스에 새 리소스 종류를 추가하는 방법. kubectl 로 다룰 수 있는 나만의 kind 를 만든다.https://kukie.tech/wiki/cri/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/cri/kubelet 과 컨테이너 런타임 사이의 규격(CRI)과, 그 규격을 구현한 대표 런타임(containerd). 실제 컨테이너는 그 아래 runc 가 만든다.https://kukie.tech/wiki/etcd/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/etcd/쿠버네티스가 모든 클러스터 데이터를 담아두는 키-값 저장소. 여기 없는 것은 클러스터에 없는 것이다.https://kukie.tech/wiki/gvisor/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/gvisor/컨테이너 앱의 시스템 콜을 호스트 커널 대신 받아 처리하는 사용자 공간 커널. 컨테이너가 호스트 커널을 직접 건드리지 못하게 하는 샌드박스 런타임이다.https://kukie.tech/wiki/imds/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/imds/EC2 인스턴스가 자기 정보와 IAM 역할 자격 증명을 읽어 오는 링크 로컬 주소 169.254.169.254 의 서비스. 컨테이너가 이 주소에 닿으면 노드의 AWS 권한을 가져갈 수 있다.https://kukie.tech/wiki/kubelet/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/kubelet/모든 노드에서 도는 에이전트. PodSpec 을 받아 그대로 만들어 놓고, 그 상태를 계속 유지한다.https://kukie.tech/wiki/persistent-volume/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/persistent-volume/저장소의 실체(PV)와 요청서(PVC)를 나눠 둔 구조. 앱은 얼마나 필요한지만 말하고 어디서 오는지는 모른다.https://kukie.tech/wiki/probe/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/probe/kubelet 이 컨테이너 상태를 확인하는 세 가지 검사. 실패했을 때 벌어지는 일이 각각 다르다.https://kukie.tech/wiki/service/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/service/죽고 살아나며 IP가 바뀌는 Pod 앞에 두는 고정 주소. 타입에 따라 어디까지 도달할 수 있는지가 달라진다.https://kukie.tech/wiki/sidecar/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/sidecar/앱 옆에 붙어 공통 잡일을 대신하는 컨테이너. 앱 코드를 고치지 않고 기능을 얹는 방법이다.https://kukie.tech/wiki/vxlan/Mon, 01 Jan 0001 00:00:00 +0000https://kukie.tech/wiki/vxlan/Ethernet 프레임을 UDP 패킷에 통째로 넣어 IP 망 너머로 나르는 터널 기술. 24비트 VNI 로 가상 망을 구분하고, 쿠버네티스 CNI 가 노드 사이를 잇는 데 쓴다.