Picking an Ingress Controller: nginx vs Traefik vs ALB
An honest ingress-nginx vs Traefik vs AWS ALB comparison from running all three in production: config model, performance, operational pain, and who should pick which.
Read the postconndeck blog
Writing about local-first Kubernetes operations: security posture, fleet drift, GUI plus TUI workflows, and verifiable releases. No telemetry, no login, no data leaves your device.
Forbidden: Debugging RBAC Without Handing Out cluster-admin
RBAC Forbidden errors decode completely if you read them. Use kubectl auth can-i, impersonation, and bindings to grant exactly what's missing.
Read the postYour Pod Is Stuck in Pending: The Actual Checklist
Pod stuck in Pending? Run the real checklist: kubectl describe events, 0/N nodes available reasons, taints and tolerations, resource requests, and unbound PVCs.
Read the postOOMKilled: Debugging Memory Limits Without Guessing
OOMKilled and exit code 137 mean the kernel killed your container. Learn to read Last State, separate cgroup OOM kills from eviction, and find the actual leak.
Read the postNode NotReady at 2AM: A Recovery Walkthrough
A node went NotReady at 2AM. Triage kubelet, disk pressure, and network partitions, then decide when to cordon, drain, or wait.
Read the postImagePullBackOff: Every Cause I’ve Actually Hit
ImagePullBackOff has four real causes: bad tags, registry auth, rate limits, and network. Learn to read the pull error and fix the right one.
Read the postDNS Works on My Laptop: CoreDNS Failures in Kubernetes
In-cluster DNS failing while your laptop resolves fine? Debug ndots:5 query amplification, the UDP conntrack race, CoreDNS health, and scaling, step by step.
Read the postThe Day Our Staging Cluster Ran Out of IP Addresses
Pods stuck in ContainerCreating, cryptic CNI errors, and a /24 subnet with zero free IPs. A war story about why 'just staging' still needs capacity planning.
Read the postInside the Kubernetes Scheduler: Why Your Pods Land Where They Do
A deep dive into kube-scheduler internals: filtering vs scoring, topology spread math, PriorityClass preemption, scheduler profiles, and why the descheduler exists.
Read the postkubectl apply Is Lying to You (and What to Do About It)
kubectl apply says 'configured' and you believe it. Here's why declared YAML and real cluster state drift apart, and how to actually close the loop.
Read the postGKE Autopilot Internals: What Google Actually Runs for You
How GKE Autopilot actually works under the abstraction: per-pod billing vs node provisioning, compute classes, upgrade mechanics, and where it quietly costs 2x.
Read the postGitOps Is a Discipline, Not a Tool
Installing ArgoCD doesn't make you a GitOps shop. Here's why the tool changes nothing until the team agrees to stop running kubectl apply from their laptops.
Read the post