The complete Platform Ops archive: practical deep-dives, architecture, commands, and production troubleshooting.
No truncated homepage list and no hidden scroll area. The complete published archive lives here.
mTLS identity that turns policy into a statement about services rather than subnets, the AuthorizationPolicy default that flips one workload to deny while its neighbours stay open, retries that multiply through a call graph, and the trace headers your application still has to forward itself.
What a sidecar mesh actually buys and what it costs, the four Envoy objects every mesh CRD renders into, what service discovery adds on top of kube-dns, and the Service port name that silently disables every L7 feature.
Pod Security rolled out with warn before enforce, the removed API that takes workloads with it on upgrade, the difference between an etcd snapshot and a real backup, and the three cluster failures that stay silent until they are outages.
The HPA algorithm in one line and the missing resource request that silently disables it, VPA as a measuring tool before it is an actuator, why the two fight on CPU, and the single pod that pins a node against every scale-down.
Taints as the node's veto and the NoExecute effect that evicts what is already running, affinity as the pod's request, the topologyKey that gives anti-affinity its meaning, and why Pending is always a filtering result you can read verbatim.
ConfigMaps that update in place except when they do not, Secrets that are encoded rather than encrypted, namespaces that isolate far less than people assume, and RBAC's one rule — purely additive, no deny — that explains every access surprise.
ReplicaSets and why a stuck rollout is legible, DaemonSets and the update strategy that silently never rolls, Jobs and CronJobs that pile up on their own schedule, and the liveness probe that turns a dependency blip into a restart storm.
Monitoring that is half switched off by default, LogQL that returns before it times out, the four security gates and which one refused you, and the upgrade that stops on one PodDisruptionBudget — with the pre-upgrade checks that prevent the bad ones.
Routes and the four TLS modes, OVN-Kubernetes and the MTU fault everybody misdiagnoses, NetworkPolicy isolation that silently blinds monitoring, storage binding and access modes, and the CSI chain where each stage fails in a different log.
What the distribution adds on top of Kubernetes — the Cluster Version Operator ownership chain, projects and the project template, the operator pattern under CVO and OLM, MachineConfig, SCC admission, image streams and etcd — each with the failure mode it actually produces and how to triage it.
190 terms across 15 categories — fundamentals, permissions, processes, networking, storage, security, monitoring and troubleshooting — searchable in one place, with standalone deep-dive pages for the terms that need one.
A runbook, not a tutorial — high load and CPU, memory and OOM, disk and I/O, network, and boot failures, each with the commands to run and what their output means.
systemd internals, kernel and sysctl tuning, namespaces and cgroups, performance profiling, and LVM.
Filesystem hierarchy, users and permissions, package management, process basics, and shell scripting.
Severity classification, the Incident Commander role, blameless postmortems, and action-item follow-through that actually closes.
Jenkins and GitLab CI, GitOps with ArgoCD and Flux, security gates, canary and blue-green rollouts, and secrets management.
Prometheus and Grafana, Loki and ELK, Jaeger and OpenTelemetry, and SLO burn-rate alerting that pages you for the right reasons.
PV and PVC, StorageClasses, CSI driver internals, StatefulSets, and a backup and DR strategy that's been tested.
32 error types across 5 layers — Pod, Worker Node, Cluster, API Server and OpenShift — each with the production fix.
Control plane, worker nodes, storage, CSI, PersistentVolumes, QoS classes and scheduling — with diagrams.
Six architecture diagrams covering Pod networking, CNI plugins, Ingress, NetworkPolicy and CoreDNS.