Node Pressure Evictions: When the Kubelet Starts Killing
Why the kubelet evicts pods before the kernel OOM killer wakes up, how thresholds and priority decide victims, and how I tuned our eviction noise away.
Read the postconndeck blog
Writing about local-first Kubernetes operations: security posture, fleet drift, GUI plus TUI workflows, and verifiable releases. No telemetry, no login, no data leaves your device.
Liveness, Readiness, Startup Probes: What I Actually Set
The liveness, readiness, and startup probe setup I ship in production, why naive liveness probes cause restart storms, and how I tune health checks.
Read the postTaints and Tolerations in Production: Beyond NoSchedule
A production guide to taints and tolerations: NoSchedule vs PreferNoSchedule vs NoExecute, dedicated node pools, and the tolerationSeconds trap.
Read the postKubernetes Network Policies: Start With Default Deny
Why default-deny comes first with Kubernetes NetworkPolicies, the DNS and egress breakage that follows, and the CNI gotchas nobody warns you about.
Read the postkubectl Contexts and KUBECONFIG: Taming Multi-Cluster
How I manage kubeconfigs across dozens of clusters: KUBECONFIG merging, context naming, namespace defaults, and avoiding wrong-cluster deploys.
Read the postManaging a Fleet of Clusters Without Losing Track of Reality
From 2 clusters to 20: kubeconfig hygiene, fleet-wide visibility, and GitOps per cluster. The patterns that keep multi-cluster from becoming multi-chaos.
Read the postUpgrading Kubernetes Without Downtime or Drama
Kubernetes upgrades don't have to be scary. Version skew rules, drain and PDB discipline, deprecation hunting, and how managed vs self-managed changes the job.
Read the postSLOs for Kubernetes Services: Alerting on What Actually Matters
Stop paging on CPU and start paging on burn rate. A practical guide to SLOs, error budgets, and multi-window alerts for Kubernetes services.
Read the postKubernetes Cost Optimization: Finding the Idle Half of Your Cluster
Most clusters run 30-50% idle because requests don't match reality. A practical walkthrough of requests vs usage, OpenCost, right-sizing, and spot nodes.
Read the postkubectl debug: Ephemeral Containers Changed How I Troubleshoot
kubectl debug with ephemeral containers fixes the oldest problem in Kubernetes troubleshooting: distroless images with no shell. Distroless and node debugging.
Read the postkube-prometheus-stack: Monitoring That Won’t Page You at 3AM
kube-prometheus-stack gets you 90% of the way there and pages you for the wrong 10%. How I tune alerts, add recording rules, and keep cardinality under control.
Read the postSupply Chain Security: Sigstore, SLSA, and What’s Actually Practical
A pragmatic take on supply chain security: cosign keyless signing, signature verification at admission, SBOMs that get used, and SLSA without ceremony.
Read the post