kubernetes

How a public draft helps reconstruct a causal chain, expose hidden dependencies, and define the guarantees of an engineering solution.

How an article moves through two repositories, where CI ends, and which part of delivery belongs to Flux.

Why CI could not block Flux after a direct push and how a Merge Request with auto-merge moved validation before the watched branch.

How to turn ticket histories and chat discussions into documentation, checks, and automation that engineers can reuse.

An authorization error from kubectl exec often looks illogical: cannot create resource "pods/exec" The Pod already exists. The command does not create another Pod or modify its specification. get or update might therefore seem like the expected permission, but Kubernetes checks for create. The reason is that RBAC describes Kubernetes API operations, not the literal meaning of kubectl commands. exec is a separate subresource kubectl exec does not operate directly on the pods resource. It calls the pods/exec subresource: ...

A green Ready status and a correct node configuration are not the same guarantee. I ran into that distinction while standardizing kubelet settings across several node classes in a Kubernetes cluster I operated. Each class had a configuration baseline stored in Git. It defined resource reservations, eviction thresholds, and image garbage collection settings. Kubernetes reported the nodes as Ready, yet a separate check found that the local /var/lib/kubelet/config.yaml on some of them no longer matched the expected file. ...

Troubleshooting an unstable Kubernetes node caused by an exhausted inotify watchers limit.

An overview of the processes that consume inotify watchers and why this Linux limit should be part of infrastructure capacity planning.