CloudNative

Your Kubernetes rollback is lying

The PagerDuty alert screams. The new release, born just minutes ago with such promising release notes, is coughing up blood in production. The team’s Slack channel is a frantic mess of flashing red emojis. Someone, summoning the voice of a panicked adult, yells the magic word: “ROLLBACK!”

And so, Helm, our trusty tow-truck operator, rides in with a smile, waving its friendly green check marks. The dashboards, those silent accomplices, beam with the serene glow of healthy metrics. Kubernetes probes, ever so polite, confirm that the resurrected pods are, in fact, “breathing.”

Then, production face-plants. Hard.

The feeling is like putting a cartoon-themed bandage on a burst water pipe and then wondering, with genuine surprise, why the living room has become a swimming pool. This article is the autopsy of those “perfect” rollbacks. We’re going to uncover why your monitoring is a pathological liar, how network traffic becomes a double agent, and what to do so that the next time Helm gives you a thumbs-up, you can actually believe it.

A state that refuses to time-travel

The first, most brutal lie a rollback tells you is that it can turn back time. A helm rollback is like the “rewind” button on an old VCR remote; it diligently rewinds the tape (your YAML manifests), but it has absolutely no power to make the actors on screen younger.

Your application’s state is one of those stubborn actors.

While your ConfigMaps and Secrets might dutifully revert to their previous versions, your data lives firmly in the present. If your new release included a database migration that added a column, rolling back the application code doesn’t magically make that column disappear. Now your old code is staring at a database schema from the future, utterly confused, like a medieval blacksmith being handed an iPad.

The same goes for PersistentVolumeClaims, external caches like Redis, or messages sitting in a Kafka queue. The rollback command whispers sweet nothings about returning to a “known good state,” but it’s only talking about itself. The rest of your universe has moved on, and it refuses to travel back with you.

The overly polite doorman

The second culprit in our investigation is the Kubernetes probe. Think of the readinessProbe as an overly polite doorman at a fancy party. Its job is to check if a guest (your pod) is ready to enter. But its definition of “ready” can be dangerously optimistic.

Many applications, especially those running on the JVM, have what we’ll call a “warming up” period. When a pod starts, the process is running, the HTTP port is open, and it will happily respond to a simple /health check. The doorman sees a guest in a tuxedo and says, “Looks good to me!” and opens the door.

What the doorman doesn’t see is that this guest is still stretching, yawning, and trying to remember where they are. The application’s caches are cold, its connection pools are empty, and its JIT compiler is just beginning to think about maybe, possibly, optimizing some code. The first few dozen requests it receives will be painfully slow or, worse, time out completely.

So while your readinessProbe is giving you a green light, your first wave of users is getting a face full of errors. For these sleepy applications, you need a more rigorous bouncer.

A startupProbe is that bouncer. It gives the app a generous amount of time to get its act together before even letting the doorman (readiness and liveness probes) start their shift.

# This probe gives our sleepy JVM app up to 5 minutes to wake up.
livenessProbe:
  httpGet:
    path: /health/live
    port: 8080
  initialDelaySeconds: 15
  periodSeconds: 20
readinessProbe:
  httpGet:
    path: /health/ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 10
startupProbe:
  httpGet:
    path: /health/ready
    port: 8080
  # Kubelet will try 30 times with a 10-second interval (300 seconds).
  # If the app isn't ready by then, the pod will be restarted.
  failureThreshold: 30
  periodSeconds: 10

Without it, your rollback creates a fleet of pods that are technically alive but functionally useless, and Kubernetes happily sends them a flood of unsuspecting users.

Traffic, the double agent

And that brings us to our final suspect: the network traffic itself. In a modern setup using a service mesh like Istio or Linkerd, traffic routing is a sophisticated dance. But even the most graceful dancer can trip.

When you roll back, a new ReplicaSet is created with the old pod specification. The service mesh sees these new pods starting up, asks the doorman (readinessProbe) if they’re good to go, gets an enthusiastic “yes!”, and immediately starts sending them a percentage of live production traffic.

This is where all our problems converge. Your service mesh, in its infinite efficiency, has just routed 50% of your user traffic to a platoon of sleepy, confused pods that are trying to talk to a database from the future.

Let’s look at the evidence. This VirtualService, which we now call “The 50/50 Disaster Splitter,” was routing traffic with criminal optimism.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: checkout-api-vs
  namespace: prod-eu-central
spec:
  hosts:
    - "checkout.api.internal"
  http:
    - route:
        - destination:
            host: checkout-api-svc
            subset: v1-stable
          weight: 50 # 50% to the (theoretically) working pods
        - destination:
            host: checkout-api-svc
            subset: v1-rollback
          weight: 50 # 50% to the pods we just dragged from the past

The service mesh isn’t malicious. It’s just an incredibly efficient tool that is very good at following bad instructions. It sees a green light and hits the accelerator.

A survival guide that won’t betray you

So, you’re in the middle of a fire, and the “break glass in case of emergency” button is a lie. What do you do? You need a playbook that acknowledges reality.

Step 0: Breathe and isolate the blast radius

Before you even think about rolling back, stop the bleeding. The fastest way to do that is often at the traffic level. Use your service mesh or ingress controller to immediately shift 100% of traffic back to the last known good version. Don’t wait for new pods to start. This is a surgical move that takes seconds and gives you breathing room.

Step 1: Declare an incident and gather the detectives

Get the right people on a call. Announce that this is not a “quick rollback” but an incident investigation. Your goal is to understand why the release failed, not just to hit the undo button.

Step 2: Perform the autopsy (while the system is stable)

With traffic safely routed away from the wreckage, you can now investigate. Check the logs of the failed pods. Look at the database. Is there a schema mismatch? A bad configuration? This is where you find the real killer.

Step 3: Plan the counter-offensive (which might not be a rollback)

Sometimes, the safest path forward is a roll forward. A small hotfix that corrects the issue might be faster and less risky than trying to force the old code to work with a new state. A rollback should be a deliberate, planned action, not a panic reflex. If you must roll back, do it with the knowledge you’ve gained from your investigation.

Step 4: The deliberate, cautious rollback

If you’ve determined a rollback is the only way, do it methodically.

Scale down the broken deployment:
kubectl scale deployment/checkout-api –replicas=0
Execute the Helm rollback:
helm rollback checkout-api 1 -n prod-eu-central
Watch the new pods like a hawk: Monitor their logs and key metrics as they come up. Don’t trust the green check marks.
Perform a Canary Release: Once the new pods look genuinely healthy, use your service mesh to send them 1% of the traffic. Then 10%. Then 50%. Then 100%. You are now in control, not the blind optimism of the automation.

The truth will set you free

A Kubernetes rollback isn’t a time machine. It’s a YAML editor with a fancy title. It doesn’t understand your data, it doesn’t appreciate your app’s need for a morning coffee, and it certainly doesn’t grasp the nuances of traffic routing under pressure.

Treating a rollback as a simple, safe undo button is the fastest way to turn a small incident into a full-blown outage. By understanding the lies it tells, you can build a process that trusts human investigation over deceptive green lights. So the next time a deployment goes sideways, don’t just reach for the rollback lever. Reach for your detective’s hat instead.

Confessions of a recovering GitOps addict

There’s a moment in every tech trend’s lifecycle when the magic starts to wear off. It’s like realizing the artisanal, organic, free-range coffee you’ve been paying eight dollars for just tastes like… coffee. For me, and many others in the DevOps trenches, that moment has arrived for GitOps.

We once hailed it as the silver bullet, the grand unifier, the one true way. Now, I’m here to tell you that the romance is over. And something much more practical is taking its place.

The alluring promise of a perfect world

Let’s be honest, we all fell hard for GitOps. The promise was intoxicating. A single source of truth for our entire infrastructure, nestled right in the warm, familiar embrace of Git. Pull Requests became the sacred gates through which all changes must pass. CI/CD pipelines were our holy scrolls, and tools like ArgoCD and Flux were the messiahs delivering us from the chaos of manual deployments.

It was a world of perfect order. Every change was audited, every state was declared, and every rollback was just a git revert away. It felt clean. It felt right. It felt… professional. For a while, it was the hero we desperately needed.

The tyranny of the pull request

But paradise had a dark side, and it was paved with endless YAML files. The first sign of trouble wasn’t a catastrophic failure, but a slow, creeping bureaucracy that we had built for ourselves.

Need to update a single, tiny secret? Prepare for the ritual. First, the offering: a Pull Request. Then, the prayer for the high priests (your colleagues) to grant their blessing (the approval). Then, the sacrifice (the merge). And finally, the tense vigil, watching ArgoCD’s sync status like it’s a heart monitor, praying it doesn’t flatline.

The lag became a running joke. Your change is merged… but has it landed in production? Who knows! The sync bot seems to be having a bad day. When everything is on fire at 2 AM, Git is like that friend who proudly tells you, “Well, according to my notes, the plan was for there not to be a fire.” Thanks, Git. Your record of intent is fascinating, but I need a fire hose, not a historian.

We hit our wall during what should have been a routine update.

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: auth-service
spec:
  replicas: 3
  template:
    spec:
      containers:
      - name: auth-service-container
        image: our-app:v1.12.4
        envFrom:
        - secretRef:
            name: production-credentials

A simple change to the production-credentials secret required updating an encrypted file, PR-ing it, and then explaining in the commit message something like, “bumping secret hash for reasons”. Nobody understood it. Infrastructure changes started to require therapy sessions just to get merged.

And then, the tools fought back

When a system creates more friction than it removes, a rebellion is inevitable. And the rebels have arrived, not with pitchforks, but with smarter, more flexible tools.

First, the idea that developers should be fluent in YAML began to die. Internal Developer Platforms (IDPs) like Backstage and Port started giving developers what they always wanted: self-service with guardrails. Instead of wrestling with YAML syntax, they click a button in a portal to provision a database or spin up a new environment. Git becomes a log of what happened, not a bottleneck to make things happen.

Second, we remembered that pushing things can be good. The pull-based model was trendy, but let’s face it: push is immediate. Push is observable. We’ve gone back to CI pipelines pushing manifests directly into clusters, but this time they’re wearing body armor.

# This isn't your old wild-west kubectl apply
# It's a command wrapped in an approval system, with observability baked in.
deploy-cli --service auth-service --env production --approve

The change is triggered precisely when we want it, not when a bot feels like syncing. Finally, we started asking a radical question: why are we describing infrastructure in a static markup language when we could be programming it? Tools like Pulumi and Crossplane entered the scene. Instead of hundreds of lines of YAML, we’re writing code that feels alive.

import * as aws from "@pulumi/aws";

// Create an S3 bucket with versioning enabled.
const bucket = new aws.s3.Bucket("user-uploads-bucket", {
    versioning: {
        enabled: true,
    },
    acl: "private",
});

Infrastructure can now react to events, be composed into reusable modules, and be written in a language with types and logic. YAML simply can’t compete with that.

A new role for the abdicated king

So, is GitOps dead? No, that’s just clickbait. But it has been demoted. It’s no longer the king ruling every action; it’s more like a constitutional monarch, a respected elder statesman.

It’s fantastic for auditing, for keeping a high-level record of intended state, and for infrastructure teams that thrive on rigid discipline. But for high-velocity product teams, it’s become a beautifully crafted anchor when what we need is a motor.

We’ve moved from “Let’s define everything in Git” to “Let’s ship faster, safer, and saner with the right tools for the job.”

Our current stack is a hybrid, a practical mix of the old and new:

Backstage to abstract away complexity for developers.
Push-based pipelines with strong guardrails for immediate, observable deployments.
Pulumi for typed, programmable, and composable infrastructure.
Minimal GitOps for what it does best: providing a clear, auditable trail of our intentions.

GitOps wasn’t a mistake; it was the strict but well-meaning grandparent of infrastructure management. It taught us discipline and the importance of getting approval before touching anything important. But now that we’re grown up, that level of supervision feels less like helpful guidance and more like having someone watch over your shoulder while you type, constantly asking, “Are you sure you want to save that file?” The world is moving on to flexibility, developer-first platforms, and code you can read without a decoder ring. If you’re still spending your nights appeasing the YAML gods with Pull Request sacrifices for trivial changes… you’re not just living in the past, you’re practically a fossil.

August 17, 2025 by Fernando SRE Cloud stuff DevOps stuff SRE stuff

When docker compose stopped being magic

There was a time, not so long ago, when docker-compose up felt like performing a magic trick. You’d scribble a few arcane incantations into a YAML file and, poof, your entire development stack would spring to life. The database, the cache, your API, the frontend… all humming along obediently on localhost. Docker Compose wasn’t just a tool; it was the trusty Swiss Army knife in every developer’s pocket, the reliable friend who always had your back.

Until it didn’t.

Our breakup wasn’t a single, dramatic event. It was a slow fade, the kind of awkward drifting apart that happens when one friend grows and the other… well, the other is perfectly happy staying exactly where they are. It began with small annoyances, then grew into full-blown arguments. We eventually realized we were spending more time trying to fix our relationship with YAML than actually building things.

So, with a heavy heart and a sigh of relief, we finally said goodbye.

The cracks begin to show

As our team and infrastructure matured, our reliable friend started showing some deeply annoying habits. The magic tricks became frustratingly predictable failures.

Our services started giving each other the silent treatment. The networking between containers became as fragile and unpredictable as a Wi-Fi connection on a cross-country train. One moment they were chatting happily, the next they wouldn’t be caught dead in the same virtual network.
It was worse at keeping secrets than a gossip columnist. The lack of native, secure secret handling was, to put it mildly, a joke. We were practically writing passwords on sticky notes and hoping for the best.
It developed a severe case of multiple personality disorder. The same docker-compose.yml file would behave like a well-mannered gentleman on one developer’s machine, a rebellious teenager in staging, and a complete, raving lunatic in production. Consistency was not its strong suit.
The phrase “It works on my machine” became a ritualistic chant. We’d repeat it, hoping to appease the demo gods, but they are a fickle bunch and rarely listened. We needed reliability, not superstition.

We had to face the truth. Our old friend just couldn’t keep up.

Moving on to greener pastures

The final straw was the realization that we had become full-time YAML therapists. It was time to stop fixing and start building again. We didn’t just dump Compose; we replaced it, piece by piece, with tools that were actually designed for the world we live in now.

For real infrastructure, we chose real code

For our production and staging environments, we needed a serious, long-term commitment. We found it in the AWS Cloud Development Kit (CDK). Instead of vaguely describing our needs in YAML and hoping for the best, we started declaring our infrastructure with the full power and grace of TypeScript.

We went from a hopeful plea like this:

# docker-compose.yml
services:
  api:
    build: .
    ports:
      - "8080:8080"
    depends_on:
      - database
  database:
    image: "postgres:14-alpine"

To a confident, explicit declaration like this:

// lib/api-stack.ts
import * as cdk from 'aws-cdk-lib';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ecs_patterns from 'aws-cdk-lib/aws-ecs-patterns';

// ... inside your Stack class
const vpc = /* your existing VPC */;
const cluster = new ecs.Cluster(this, 'ApiCluster', { vpc });

// Create a load-balanced Fargate service and make it public
new ecs_patterns.ApplicationLoadBalancedFargateService(this, 'ApiService', {
  cluster: cluster,
  cpu: 256,
  memoryLimitMiB: 512,
  desiredCount: 2, // Let's have some redundancy
  taskImageOptions: {
    image: ecs.ContainerImage.fromRegistry("your-org/your-awesome-api"),
    containerPort: 8080,
  },
  publicLoadBalancer: true,
});

It’s reusable, it’s testable, and it’s cloud-native by default. No more crossed fingers.

For local development, we found a better roommate

Onboarding new developers had become a nightmare of outdated README files and environment-specific quirks. For local development, we needed something that just worked, every time, on every machine. We found our perfect new roommate in Dev Containers.

Now, we ship a pre-configured development environment right inside the repository. A developer opens the project in VS Code, it spins up the container, and they’re ready to go.

Here’s the simple recipe in .devcontainer/devcontainer.json:

{
  "name": "Node.js & PostgreSQL",
  "dockerComposeFile": "docker-compose.yml", // Yes, we still use it here, but just for this!
  "service": "app",
  "workspaceFolder": "/workspace",

  // Forward the ports you need
  "forwardPorts": [3000, 5432],

  // Run commands after the container is created
  "postCreateCommand": "npm install",

  // Add VS Code extensions
  "extensions": [
    "dbaeumer.vscode-eslint",
    "esbenp.prettier-vscode"
  ]
}

It’s fast, it’s reproducible, and our onboarding docs have been reduced to: “1. Install Docker. 2. Open in VS Code.”

To speak every Cloud language, we hired a translator

As our ambitions grew, we needed to manage resources across different cloud providers without learning a new dialect for each one. Crossplane became our universal translator. It lets us manage our infrastructure, whether it’s on AWS, GCP, or Azure, using the language we already speak fluently: the Kubernetes API.

Want a managed database in AWS? You don’t write Terraform. You write a Kubernetes manifest.

# rds-instance.yaml
apiVersion: database.aws.upbound.io/v1beta1
kind: RDSInstance
metadata:
  name: my-production-db
spec:
  forProvider:
    region: eu-west-1
    instanceClass: db.t3.small
    masterUsername: admin
    allocatedStorage: 20
    engine: postgres
    engineVersion: "14.5"
    skipFinalSnapshot: true
    # Reference to a secret for the password
    masterPasswordSecretRef:
      namespace: crossplane-system
      name: my-db-password
      key: password
  providerConfigRef:
    name: aws-provider-config

It’s declarative, auditable, and fits perfectly into a GitOps workflow.

For the creative grind, we got a better workflow

The constant cycle of code, build, push, deploy, test, repeat for our microservices was soul-crushing. Docker Compose never did this well. We needed something that could keep up with our creative flow. Skaffold gave us the instant gratification we craved.

One command, skaffold dev, and suddenly we had:

Live code syncing to our development cluster.
Automatic container rebuilds and redeployments when files change.
A unified configuration for both development and production pipelines.

No more editing three different files and praying. Just code.

The slow fade was inevitable

Docker Compose was a fantastic tool for a simpler time. It was perfect when our team was small, our application was a monolith, and “production” was just a slightly more powerful laptop.

But the world of software development has moved on. We now live in an era of distributed systems, cloud-native architecture, and relentless automation. We didn’t just stop using Docker Compose. We outgrew it. And we replaced it with tools that weren’t just built for the present, but are ready for the future.

August 6, 2025 by Fernando SRE Cloud stuff DevOps stuff SRE stuff

If your Kubernetes YAML looks Like hieroglyphics, this post is for you

It all started, as most tech disasters do, with a seductive whisper. “Just describe your infrastructure with YAML,” Kubernetes cooed. “It’ll be easy,” it said. And we, like fools in a love story, believed it.

At first, it was a beautiful romance. A few files, a handful of lines. It was elegant. It was declarative. It was… manageable. But entropy, the nosy neighbor of every DevOps team, had other plans. Our neat little garden of YAML files soon mutated into a sprawling, untamed jungle of configuration.

We had 12 microservices jostling for position, spread across 4 distinct environments, each with its own personality quirks and dark secrets. Before we knew it, we weren’t writing infrastructure anymore; we were co-authoring a Byzantine epic in a language seemingly designed by bureaucrats with a fetish for whitespace.

The question that broke the camel’s back

The day of reckoning didn’t arrive with a server explosion or a database crash. It came with a question. A question that landed in our team’s Slack channel with the subtlety of a dropped anvil, courtesy of a junior engineer who hadn’t yet learned to fear the YAML gods.

“Hey, why does our staging pod have a different CPU limit than prod?”

Silence. A deep, heavy, digital silence. The kind of silence that screams, “Nobody has a clue.”

What followed was an archaeological dig into the fossil record of our own repository. We unearthed layers of abstractions we had so cleverly built, peeling them back one by one. The trail led us through a hellish labyrinth:

We started at deployment.yaml, the supposed source of all truth.
That led us to values.yaml, the theoretical source of all truth.
From there, we spelunked into values.staging.yaml, where truth began to feel… relative.
We stumbled upon a dusty patch-cpu-emergency.yaml, a fossil from a long-forgotten crisis.
Then we navigated the dark forest of custom/kustomize/base/deployment-overlay.yaml.
And finally, we reached the Rosetta Stone of our chaos: an argocd-app-of-apps.yaml.

The revelation was as horrifying as finding a pineapple on a pizza: we had declared the same damn value six times, in three different formats, using two tools that secretly despised each other. We weren’t managing the configuration. We were performing a strange, elaborate ritual and hoping the servers would be pleased.

That’s when we knew. This wasn’t a configuration problem. It was an existential crisis. We were, without a doubt, deep in YAML Hell.

The tools that promised heaven and delivered purgatory

Let’s talk about the “friends” who were supposed to help. These tools promised to be our saviors, but without discipline, they just dug our hole deeper.

Helm, the chaotic magician

Helm is like a powerful but slightly drunk magician. When it works, it pulls a rabbit out of a hat. When it doesn’t, it sets the hat on fire, and the rabbit runs off with your wallet.

The Promise: Templating! Variables! A whole ecosystem of charts!

The Reality: Debugging becomes a form of self-torment that involves piping helm template into grep and praying. You end up with conditionals inside your templates that look like this:

image:
  repository: {{ .Values.image.repository | quote }}
  tag: {{ .Values.image.tag | default .Chart.AppVersion }}
  pullPolicy: {{ .Values.image.pullPolicy | default "IfNotPresent" }}

This looks innocent enough. But then someone forgets to pass image.tag for a specific environment, and you silently deploy :latest to production on a Friday afternoon. Beautiful.

Kustomize the master of patches

Kustomize is the “sensible” one. It’s built into kubectl. It promises clean, layered configurations. It’s like organizing your Tupperware drawer with labels.

The Promise: A clean base and tidy overlays for each environment.

The Reality: Your patch files quickly become a mystery box. You see this in your kustomization.yaml:

patchesStrategicMerge:
  - increase-replica-count.yaml
  - add-resource-limits.yaml
  - disable-service-monitor.yaml

Where are these files? What do they change? Why does disable-service-monitor.yaml only apply to the dev environment? Good luck, detective. You’ll need it.

ArgoCD, the all-seeing eye (that sometimes blinks)

GitOps is the dream. Your Git repo is the single source of truth. No more clicking around in a UI. ArgoCD or Flux will make it so.

The Promise: Declarative, automated sync from Git to cluster. Rollbacks are just a git revert away.

The Reality: If your Git repo is a dumpster fire of conflicting YAML, ArgoCD will happily, dutifully, and relentlessly sync that dumpster fire to production. It won’t stop you. One bad merge, and you’ve automated a catastrophe.

Our escape from YAML hell was a five-step sanity plan

We knew we couldn’t burn it all down. We had to tame the beast. So, we gathered the team, drew a line in the sand, and created five commandments for configuration sanity.

1. We built a sane repo structure

The first step was to stop the guesswork. We enforced a simple, predictable layout for every single service.

├── base/
│   ├── deployment.yaml
│   ├── service.yaml
│   └── configmap.yaml
└── overlays/
    ├── dev/
    │   ├── kustomization.yaml
    │   └── values.yaml
    ├── staging/
    │   ├── kustomization.yaml
    │   └── values.yaml
    └── prod/
        ├── kustomization.yaml
        └── values.yaml

This simple change eliminated 80% of the “wait, which file do I edit?” conversations.

2. One source of truth for values

This was a sacred vow. Each environment gets one values.yaml file. That’s it. We purged the heretics:

values-prod-final.v2.override.yaml
backup-of-values.yaml
donotdelete-temp-config.yaml

If a value wasn’t in the designated values.yaml for that environment, it didn’t exist. Period.

3. We stopped mixing Helm and Kustomize

You have to pick a side. We made a rule: if a service requires complex templating logic, use Helm. If it primarily needs simple overlays (like changing replica counts or image tags per environment), use Kustomize. Using both on the same service is like trying to write a sentence in two languages at once. It’s a recipe for suffering.

4. We render everything before deploying

Trust, but verify. We added a mandatory step in our CI pipeline to render the final YAML before it ever touches the cluster.

# For Helm + Kustomize setups
helm template . --values overlays/prod/values.yaml | \
kustomize build | \
kubeval -

This simple script does three magical things:

It validates that the output is syntactically correct YAML.
It lets us see exactly what is about to be applied.
It has completely eliminated the “well, that’s not what I expected” class of production incidents.

5. We built a simple config CLI

To make the right way the easy way, we built a small internal CLI tool. Now, instead of navigating the YAML jungle, an engineer simply runs:

$ ops-cli config generate --app=user-service --env=prod

This tool:

Pulls the correct base templates and overlay values.
Renders the final, glorious YAML.
Validates it against our policies.
Shows the developer a diff of what will change in the cluster.
Saves lives and prevents hair loss.

YAML is now a tool again, not a trap.

The afterlife is peaceful

YAML didn’t ruin our lives. We did, by refusing to treat it with the respect it demands. Templating gives you incredible power, but with great power comes great responsibility… and redundancy, and confusion, and pull requests with 10,000 lines of whitespace changes. Now, we treat our YAML like we treat our application code. We lint it. We test it. We render it. And most importantly, we’ve built a system that makes it difficult to do the wrong thing. It’s the institutional equivalent of putting childproof locks on the kitchen cabinets. A determined toddler could probably still get to the cleaning supplies, but it would require a conscious, frustrating effort. Our system doesn’t make us smarter; it just makes our inevitable moments of human fallibility less catastrophic. It’s the guardrail on the scenic mountain road of configuration. You can still drive off the cliff, but you have to really mean it. Our infrastructure is no longer a hieroglyphic. It’s just… configuration. And the resulting boredom is a beautiful thing.

August 3, 2025 by Fernando SRE Cloud stuff DevOps stuff Kubernetes SRE stuff

Why Kubernetes Ingress feels outdated and Gateway API is stepping up

Kubernetes has transformed container orchestration, rapidly pushing the boundaries of scalability and flexibility. Yet some core components haven’t evolved as gracefully. Kubernetes Ingress is a prime example; it’s beginning to feel like using an old flip phone when everyone else has moved on to smartphones.

What’s driving this shift away from the once-reliable Ingress, and why are more Kubernetes professionals turning to Gateway API?

The rise and limits of Kubernetes Ingress

When Kubernetes introduced Ingress, its appeal lay in its simplicity. Its job was straightforward: route HTTP and HTTPS traffic into Kubernetes clusters predictably. Like traffic lights at a busy intersection, it provided clear and reliable outcomes: set paths and hostnames, and your Ingress controller (NGINX, Traefik, or others) took care of the rest.

However, as Kubernetes workloads grew more complex, this simplicity became restrictive. Teams began seeking advanced capabilities such as canary deployments, complex traffic management, support for additional protocols, and finer control. Unfortunately, Ingress remained static, forcing teams to rely on cumbersome vendor-specific customizations.

Why Ingress now feels outdated

Ingress still performs adequately, but managing it becomes increasingly cumbersome as complexity rises. It’s comparable to owning a reliable but outdated vehicle; it gets you to your destination but lacks modern conveniences. Here’s why Ingress feels out-of-date:

Limited protocol support – Only HTTP and HTTPS are supported natively. If your applications require gRPC, TCP, or UDP, you’re out of luck.
Vendor lock-in with annotations – Advanced routing features and authentication mechanisms often require vendor-specific annotations, locking you into particular solutions.
Rigid permission models – Managing shared control across multiple teams is complicated and inefficient, similar to having a single TV remote for an entire household.
No evolutionary path – Ingress will remain stable but static, unable to evolve as the Kubernetes ecosystem demands greater flexibility.

Gateway API offers a modern alternative

Gateway API isn’t merely an upgraded Ingress; it’s a fundamental rethink of how Kubernetes handles external traffic. It cleanly separates roles and responsibilities, streamlining interactions between network administrators, platform teams, and developers. Think of it as a well-run restaurant: chefs, managers, and servers each have clear roles, ensuring smooth and efficient operation.

Additionally, Gateway API supports multiple protocols, including gRPC, TCP, and UDP, natively. This eliminates reliance on awkward annotations and vendor lock-in, resembling an upgrade from single-purpose appliances to versatile multi-function tools that adapt smoothly to emerging needs.

When Gateway API becomes essential

Gateway API won’t suit every situation, but specific scenarios benefit from its use. Consider these questions:

Do your applications require sophisticated traffic handling, like canary deployments or traffic mirroring?
Are your services utilizing protocols beyond HTTP and HTTPS?
Is your Kubernetes cluster shared among multiple teams, each needing distinct control?
Do you seek portability across cloud providers and wish to avoid vendor lock-in?
Do you often desire modern features that are unavailable through traditional Ingress?

Answering “yes” to any of these indicates that Gateway API isn’t just helpful, it’s essential.

Deciding to move forward

Ingress isn’t entirely obsolete. For straightforward HTTP/HTTPS routing for smaller services, it remains effective. But as soon as your needs scale up, involve complex traffic management, or require clear team boundaries, Gateway API becomes the superior choice.

Technology continuously advances, and your infrastructure must evolve with it. Gateway API isn’t a futuristic solution; it’s already here, enhancing your Kubernetes deployments with greater intelligence, flexibility, and manageability.

When better tools appear, upgrading isn’t merely sensible, it’s crucial. Gateway API represents precisely this meaningful advancement, ensuring your Kubernetes environment remains robust, adaptable, and ready for whatever comes next.

June 26, 2025 by Fernando SRE Cloud stuff DevOps stuff Kubernetes SRE stuff

GKE key advantages over other Kubernetes platforms

Exploring the world of containerized applications reveals Kubernetes as the essential conductor for its intricate operations. It’s the common language everyone speaks, much like how standard shipping containers revolutionized global trade by fitting onto any ship or truck. Many cloud providers offer their own managed Kubernetes services, but Google Kubernetes Engine (GKE) often takes center stage. It’s not just another Kubernetes offering; its deep roots in Google Cloud, advanced automation, and unique optimizations make it a compelling choice.

Let’s see what sets GKE apart from alternatives like Amazon EKS, Microsoft AKS, and self-managed Kubernetes, and explore why it might be the most robust platform for your cloud-native ambitions.

Google’s inherent Kubernetes expertise

To truly understand GKE’s edge, we need to look at its origins. Google didn’t just adopt Kubernetes; they invented it, evolving it from their internal powerhouse, Borg. Think of it like learning a complex recipe. You could learn from a skilled chef who has mastered it, or you could learn from the very person who created the dish, understanding every nuance and ingredient choice. That’s GKE.

This “creator” status means:

Direct, Unfiltered Expertise: GKE benefits directly from the insights and ongoing contributions of the engineers who live and breathe Kubernetes.
Early Access to Innovation: GKE often supports the latest stable Kubernetes features before competitors can. It’s like getting the newest tools straight from the workshop.
Seamless Google Cloud Synergy: The integration with Google Cloud services like Cloud Logging, Cloud Monitoring, and Anthos is incredibly tight and natural, not an afterthought.

How Others Compare:

While Amazon EKS and Microsoft AKS are capable managed services, they don’t share this native lineage. Self-managed Kubernetes, whether on-premises or set up with tools like kops, places the full burden of upgrades, maintenance, and deep expertise squarely on your shoulders.

The simplicity of Autopilot fully managed Kubernetes

GKE offers a game-changing operational model called Autopilot, alongside its Standard mode (which is more akin to EKS/AKS where you manage node pools). Autopilot is like hiring an expert event planning team that also handles all the setup, catering, and cleanup for your party, leaving you to simply enjoy hosting. It offers a truly serverless Kubernetes experience.

Key benefits of Autopilot:

Zero Node Management: Google takes care of node provisioning, scaling, and all underlying infrastructure concerns. You focus on your applications, not the plumbing.
Optimized Cost Efficiency: You pay for the resources your pods actually consume, not for idle nodes. It’s like only paying for the electricity your appliances use, not a flat fee for being connected to the grid.
Built-in Enhanced Security: Security best practices are automatically applied and managed by Google, hardening your clusters by default.

How others compare:

EKS and AKS require you to actively manage and scale your node pools. Self-managed clusters demand significant, ongoing operational efforts to keep everything running smoothly and securely.

Unified multi-cluster and multi-cloud operations with Anthos

In an increasingly distributed world, managing applications across different environments can feel like juggling too many balls. GKE’s integration with Anthos, Google’s hybrid and multi-cloud platform, acts as a master control panel.

Anthos allows for:

Centralized command: Manage GKE clusters alongside those on other clouds like EKS and AKS, and even your on-premises deployments, all from a single viewpoint. It’s like having one universal remote for all your different entertainment systems.
Consistent policies everywhere: Apply uniform configurations and security policies across all your environments using Anthos Config Management, ensuring consistency no matter where your workloads run.
True workload portability: Design for flexibility and avoid vendor lock-in, moving applications where they make the most sense.

How Others Compare:

EKS and AKS generally lack such comprehensive, native multi-cloud management tools. Self-managed Kubernetes often requires integrating third-party solutions like Rancher to achieve similar multi-cluster oversight, adding complexity.

Sophisticated networking and security foundations

GKE comes packed with unique networking and security features that are deeply woven into the platform.

Networking highlights:

Global load balancing power: Native integration with Google’s global load balancer means faster, more scalable, and more resilient traffic management than many traditional setups.
Automated certificate management: Google-managed Certificate Authority simplifies securing your services.
Dataplane V2 advantage: This Cilium-based networking stack provides enhanced security, finer-grained policy enforcement, and better observability. Think of it as upgrading your building’s basic security camera system to one with AI-powered threat detection and detailed access logs.

Security fortifications:

Workload identity clarity: This is a more secure way to grant Kubernetes service accounts access to Google Cloud resources. Instead of managing static, exportable service account keys (like having physical keys that can be lost or copied), each workload gets a verifiable, short-lived identity, much like a temporary, auto-expiring digital pass.
Binary authorization assurance: Enforce policies that only allow trusted, signed container images to be deployed.
Shielded GKE nodes protection: These nodes benefit from secure boot, vTPM, and integrity monitoring, offering a hardened foundation for your workloads.

How Others Compare:

While EKS and AKS leverage AWS and Azure security tools respectively, achieving the same level of integration, Kubernetes-native security often requires more manual configuration and piecing together different services. Self-managed clusters place the entire burden of security hardening and ongoing vigilance on your team.

Smart cost efficiency and pricing structure

GKE’s pricing model is competitive, and Autopilot, in particular, can lead to significant savings.

No control plane fees for Autopilot: Unlike EKS, which charges an hourly fee per cluster control plane, GKE Autopilot clusters don’t have this charge. Standard GKE clusters have one free zonal cluster per billing account, with a small hourly fee for regional clusters or additional zonal ones.
Sustained use discounts: Automatic discounts are applied for workloads that run for extended periods.
Cost-Saving VM options: Support for Preemptible VMs and Spot VMs allows for substantial cost reductions for fault-tolerant or batch workloads.

How Others Compare:

EKS incurs control plane costs on top of node costs. AKS offers a free control plane but may not match GKE’s automation depth, potentially leading to other operational costs.

Optimized for AI ML and Big Data workloads

For teams working with Artificial Intelligence, Machine Learning, or Big Data, GKE offers a highly optimized environment.

Seamless GPU and TPU access: Effortless provisioning and utilization of GPUs and Google’s powerful TPUs.
Kubeflow integration: Streamlines the deployment and management of ML pipelines.
Strong BigQuery ML and Vertex AI synergy: Tight compatibility with Google’s leading data analytics and AI platforms.

How Others Compare:

EKS and AKS support GPUs, but native TPU integration is a unique Google Cloud advantage. Self-managed setups require manual configuration and integration of the entire ML stack.

Why GKE stands out

Choosing the right Kubernetes platform is crucial. While all managed services aim to simplify Kubernetes operations, GKE offers a unique blend of heritage, innovation, and deep integration.

GKE emerges as a firm contender if you prioritize:

A truly hands-off, serverless-like Kubernetes experience with Autopilot.
The benefits of Google’s foundational Kubernetes expertise and rapid feature adoption.
Seamless hybrid and multi-cloud capabilities through Anthos.
Advanced, built-in security and networking designed for modern applications.

If your workloads involve AI/ML, and big data analytics, or you’re deeply invested in the Google Cloud ecosystem, GKE provides an exceptionally integrated and powerful experience. It’s about choosing a platform that not only manages Kubernetes but elevates what you can achieve with it.

June 5, 2025 by Fernando SRE Cloud stuff DevOps stuff Kubernetes SRE stuff

Integrate End-to-End testing for robust cloud native pipelines

We expect daily life to run smoothly. Our cars start instantly, our coffee brews perfectly, and streaming services play without a hitch. Similarly, today’s digital users have zero patience for software hiccups. To meet these expectations, many businesses now build cloud-native applications, highly scalable, flexible, and agile software. However, while our construction materials have changed, the need for sturdy, reliable software has only grown stronger. This is where End-to-End (E2E) testing comes in, verifying entire user workflows to ensure every software component seamlessly works together.

In this article, you’ll see practical ways to embed E2E tests effectively into your Continuous Integration and Continuous Delivery (CI/CD) pipelines, turning complexity into clarity.

Navigating the challenges of cloud-native testing

Traditional software testing was like assembling a static puzzle on a stable surface. Cloud-native testing, however, feels more like putting together a puzzle on a moving vehicle, every piece constantly shifts.

Complex microservice coordination

Cloud-native apps are often built with multiple microservices, each operating independently. Think of these as specialized workers collaborating on a complex project. If one worker stumbles, the whole project suffers. Microservices require precise coordination, making it tricky to identify and fix issues quickly.

Short-lived and shifting environments

Containers and Kubernetes create ephemeral, constantly changing environments. They’re like pop-up stores appearing briefly and disappearing overnight. Managing testing in these environments means handling dynamic URLs and quickly changing configurations, a challenge comparable to guiding customers to a food truck that relocates every day.

The constant quest for good test data

In dynamic environments, consistently managing accurate test data can feel impossible. It’s akin to a chef who finds their pantry randomly restocked every few minutes. Having fresh and relevant ingredients consistently ready becomes a monumental challenge.

Integrating quality directly into your CI/CD pipeline

Incorporating E2E tests into CI/CD is like embedding precision checkpoints directly onto an assembly line, catching problems as soon as they appear rather than after the entire product is built.

Early detection saves the day

Embedding E2E tests acts like multiple smoke detectors installed throughout a building rather than just one centrally located. Issues get pinpointed rapidly, preventing small problems from becoming massive headaches. Tools like Datadog Synthetic or Cypress allow parallel execution, speeding up the testing process dramatically.

Stopping errors before users see them

Failed E2E tests automatically halt deployments, ensuring faulty code doesn’t reach customers. Imagine a vigilant gatekeeper preventing defective products from leaving the factory, this is exactly how integrated E2E tests protect software quality.

Rapid recovery and reduced downtime

Frequent and targeted testing significantly reduces Mean Time To Repair (MTTR). If a recipe tastes off, testing each ingredient individually makes it easy to identify the problematic one swiftly.

Testing advanced deployment methods

E2E tests validate sophisticated deployment strategies like canary or blue-green deployments. They’re comparable to taste-testing new recipes with select diners before serving them to a broader audience.

Strategies for reliable E2E tests in cloud environments

Conducting E2E tests in the cloud is like performing a sensitive experiment outdoors where weather conditions (network latency, traffic spikes) constantly change.

Fighting flakiness in dynamic conditions

Cloud environments often introduce unpredictable elements, network latency, resource contention, and transient service issues. It’s similar to trying to have a detailed conversation in a loud environment; messages can easily be missed.

Robust test locators

Build your tests to find UI elements using multiple identifiers. If the primary path is blocked, alternate paths ensure your tests remain reliable. Think of it like knowing multiple routes home in case one road gets closed.

Intelligent automatic retries

Implement automatic retries for tests that intermittently fail due to transient issues. Just like retrying a phone call after a bad connection, automated retries ensure temporary problems don’t falsely indicate major faults.

Stability matters for operations

Flaky tests create unnecessary alerts, causing teams to lose confidence in their testing suite. SREs need reliable signals, like a fire alarm that only triggers for genuine fires, not burned toast.

Real-Life integration, an example of a QuickCart application

Imagine assembling a complex Lego model, verifying each piece as it’s added.

E-Commerce application scenario

Consider “QuickCart,” a hypothetical cloud-native e-commerce application with services for product catalog, user accounts, shopping cart, and order processing.

Critical user journey

An essential E2E scenario: a user logs in, searches products, adds one to the cart, and proceeds toward checkout. This represents a common user experience path.

CI/CD pipeline workflow

When a developer updates the Shopping Cart service:

The CI/CD pipeline automatically builds the service.
The E2E test suite runs the crucial “Add to Cart” test before deploying to staging.
Test results dictate the next steps:
- Pass: Change promoted to staging.
- Fail: Deployment halted; team immediately notified.

This ensures a broken cart never reaches customers.

Choosing the right tools and automation

Selecting testing tools is like equipping a kitchen: the right tools significantly ease the task.

Popular E2E frameworks

Tools such as Cypress, Selenium, Playwright, and Datadog Synthetics each bring unique strengths to the table, making it easier to choose one that fits your project’s specific needs. Cypress excels with developer experience, allowing quick test creation. Selenium is unbeatable for extensive cross-browser testing. Playwright offers rapid execution ideal for fast-paced environments. Datadog Synthetics integrates seamlessly into monitoring systems, swiftly identifying potential problems.

Smooth integration with CI/CD

These tools work well with CI/CD platforms like Jenkins, GitLab CI, GitHub Actions, or Azure DevOps, orchestrating your automated tests efficiently.

Configurable and adaptable

Adjusting tests between environments (dev, staging, prod) is as simple as tweaking a base recipe, with minimal effort, and maximum adaptability.

Enhanced observability and detailed reporting

Observability and detailed reporting are the navigational instruments of your testing universe. Tools like Prometheus, Grafana, Datadog, or New Relic highlight test failures and offer valuable context through logs, metrics, and traces. Effective observability reduces downtime and stress, transforming complex debugging from tedious guesswork into targeted, effective troubleshooting.

The path to continuous confidence

Embedding E2E tests into your cloud-native CI/CD pipeline is like learning to cook with cast iron pans. Initial skepticism and maintenance worries soon give way to reliably delicious outcomes. Quick feedback, fewer surprises, and less midnight stress transform software cycles into satisfying routines.

Great software doesn’t happen overnight, it’s carefully seasoned and consistently refined. Embrace these strategies, and software quality becomes not just attainable but deliciously predictable.

May 18, 2025 by Fernando SRE DevOps stuff SRE stuff

Unlock speed and safety in Kubernetes with CSI volume cloning

Think of your favorite recipe notebook. You’d love to tweak it for a new dish but you don’t want to mess up the original. So, you photocopy it, now you’re free to experiment. That’s what CSI Volume Cloning does for your data in Kubernetes. It’s a simple, powerful tool that changes how you handle data in the cloud. Let’s break it down.

What is CSI and why should you care?

The Container Storage Interface (CSI) is like a universal adapter for your storage needs in Kubernetes. Before it came along, every storage provider was a puzzle piece that didn’t quite fit. Now, CSI makes them snap together perfectly. This matters because your apps, whether they store photos, logs, or customer data, rely on smooth, dependable storage.

Why do volumes keep things running

Apps without state are neat, but most real-world tools need to remember things. Picture a diary app: if the volume holding your entries crashes, those memories vanish. Volumes are the backbone that keep your data alive, and cloning them is your insurance policy.

What makes volume cloning special

Cloning a volume is like duplicating a key. You get an exact copy that works just as well as the original, ready to use right away. In Kubernetes, it’s a writable replica of your data, faster than a backup, and more flexible than a snapshot.

Everyday uses that save time

Here’s how cloning fits into your day-to-day:

Testing Made Easy – Clone your production data in seconds and try new ideas without risking a meltdown.
Speedy Pipelines – Your CI/CD setup clones a volume, runs its tests, and tosses the copy, no cleanup is needed.
Recovery Practice – Test a backup by cloning it first, keeping the original safe while you experiment.

How it all comes together

To clone a volume in Kubernetes, you whip up a PersistentVolumeClaim (PVC), think of it as placing an order at a deli counter. Link it to the original PVC, and you’ve got your copy. Check this out:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: cloned-volume
spec:
  storageClassName: standard
  dataSource:
    name: original-volume
    kind: PersistentVolumeClaim
    apiGroup: ""
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi

Run that, and cloned-volume is ready to roll.

Quick checks before you clone

Not every setup supports cloning, it’s like checking if your copier can handle double-sided pages. Make sure your storage provider is on board, and keep both PVCs in the same namespace. The original also needs to be good to go.

Does your provider play nice?

Big names like AWS EBS, Google Persistent Disk, Azure Disk, and OpenEBS support cloning but double-check their manuals. It’s like confirming your coffee maker can brew espresso.

Why this skill pays off

Data is the heartbeat of your apps. Cloning gives you speed, safety, and freedom to experiment. In the fast-moving world of cloud-native tech, that’s a serious edge.

The bottom line

Next time you need to test a wild idea or recover data without sweating, CSI Volume Cloning has your back. It’s your quick, reliable way to duplicate data in Kubernetes, think of it as your cloud safety net.

May 13, 2025 by Fernando SRE DevOps stuff Kubernetes

Kubernetes networking bottlenecks explained and resolved

Your Kubernetes cluster is humming along, orchestrating containers like a conductor leading an orchestra. Suddenly, the music falters. Applications lag, connections drop, and users complain. What happened? Often, the culprit hides within the cluster’s intricate communication network, causing frustrating bottlenecks. Just like a city’s traffic can grind to a halt, so too can the data flow within Kubernetes, impacting everything that relies on it.

This article is for you, the DevOps engineer, the cloud architect, the platform administrator, and anyone tasked with keeping Kubernetes clusters running smoothly. We’ll journey into the heart of Kubernetes networking, uncover the common causes of these slowdowns, and equip you with the knowledge to diagnose and resolve them effectively. Let’s turn that traffic jam back into a superhighway.

The unseen traffic control, Kubernetes networking, and CNI

At the core of every Kubernetes cluster’s communication lies the Container Network Interface, or CNI. Think of it as the sophisticated traffic management system for your digital city. It’s a crucial plugin responsible for assigning IP addresses to pods and managing how data packets navigate the complex connections between them. Without a well-functioning CNI, pods can’t talk, services become unreachable, and the system stutters.

Several CNI plugins act as different traffic control strategies:

Flannel: Often seen as a straightforward starting point, using overlay networks. Good for simpler setups, but can sometimes act like a narrow road during rush hour.
Calico: A more advanced option, known for high performance and robust network policy enforcement. Think of it as having dedicated express lanes and smart traffic signals.
Weave Net: A user-friendly choice for multi-host networking, though its ease of use might come with a bit more overhead, like adding extra toll booths.

Choosing the right CNI isn’t just a technical detail; it’s fundamental to your cluster’s health, depending on your needs for speed, complexity, and security.

Spotting the digital traffic jam, recognizing network bottlenecks

How do you know if your Kubernetes network is experiencing a slowdown? The signs are usually clear, though sometimes subtle:

Increased latency: Applications take noticeably longer to respond. Simple requests feel sluggish.
Reduced throughput: Data transfer speeds drop, even if your nodes seem to have plenty of CPU and memory.
Connection issues: You might see frequent timeouts, dropped connections, or intermittent failures for pods trying to communicate.

It feels like hitting an unexpected gridlock on what should be an open road. Even minor network hiccups can cascade, causing significant delays across your applications.

Unmasking the culprits, common causes for Bottlenecks

Network bottlenecks don’t appear out of thin air. They often stem from a few common culprits lurking within your cluster’s configuration or resources:

CNI Plugin performance limits: Some CNIs, especially simpler overlay-based ones like Flannel in certain configurations, have inherent throughput limitations. Pushing too much traffic through them is like forcing rush hour traffic onto a single-lane country road.
Node resource starvation: Packet processing requires CPU and memory on the worker nodes. If nodes are starved for these resources, the CNI can’t handle packets efficiently, much like an underpowered truck struggling to climb a steep hill.
Configuration glitches: Incorrect CNI settings, mismatched MTU (Maximum Transmission Unit) sizes between nodes and pods, or poorly configured routing rules can create significant inefficiencies. It’s like having traffic lights horribly out of sync, causing jams instead of flow.
Scalability hurdles: As your cluster grows, especially with high pod density per node, you might exhaust available IP addresses or simply overwhelm the network paths. This is akin to a city intersection completely gridlocked because far too many vehicles are trying to pass through simultaneously.

The investigation, diagnosing the problem systematically

Finding the exact cause requires a methodical approach, like a detective gathering clues at a crime scene. Don’t just guess; investigate:

Start with kubectl: This is your primary investigation tool. Examine pod statuses (kubectl get pods -o wide), check logs (kubectl logs <pod-name>), and test basic connectivity between pods (kubectl exec <pod-name> — ping <other-pod-ip>). Are pods running? Can they reach each other? Are there revealing error messages?
Deploy monitoring tools: You need visibility. Tools like Prometheus for metrics collection and Grafana for visualization are invaluable. They act as your network’s vital signs monitor.
Track key network metrics: Focus on the critical indicators:
- Latency: How long does communication take between pods, nodes, and external services?
- Packet loss: Are data packets getting dropped during transmission?
- Throughput: How much data is flowing through the network compared to expectations?
- Error rates: Are network interfaces reporting errors?

Analyzing these metrics helps pinpoint whether the issue is widespread or localized, related to specific nodes or applications. It’s like a mechanic testing different systems in a car to isolate the fault.

Paving the way for speed, proven solutions, and best practices

Once you’ve diagnosed the bottleneck, it’s time to implement solutions. Think of this as upgrading the city’s infrastructure to handle more traffic smoothly:

Choose the right CNI for the job: If your current CNI is hitting limits, consider migrating to a higher-performance option better suited for heavy workloads or complex network policies, such as Calico or Cilium. Evaluate based on benchmarks and your specific traffic patterns.
Optimize CNI configuration: Dive into the settings. Ensure the MTU is configured correctly across your infrastructure (nodes, pods, underlying network). Fine-tune routing configurations specific to your CNI (e.g., BGP peering with Calico). Small tweaks here can yield significant improvements.
Scale your infrastructure wisely: Sometimes, the nodes themselves are the bottleneck. Add more CPU or memory to existing nodes, or scale out by adding more nodes to distribute the load. Ensure your underlying network infrastructure can handle the increased traffic.
Tune overlay networks or go direct: If using overlay networks (like VXLAN used by Flannel or some Calico modes), ensure they are tuned correctly. For maximum performance, explore direct routing options where packets go directly between nodes without encapsulation, if supported by your CNI and infrastructure (e.g., Calico with BGP).

Success stories, from gridlock to open roads

The theory is good, but the results matter. Consider a team battling high latency in a densely packed cluster running Flannel. Diagnosis pointed to overlay network limitations. By migrating to Calico configured with BGP for more direct routing, they drastically cut latency and improved application responsiveness.

In another case, intermittent connectivity issues plagued a cluster during peak loads. Monitoring revealed CPU saturation on specific worker nodes handling heavy network traffic. Upgrading these nodes with more CPU resources immediately stabilized connectivity and boosted packet processing speeds. These examples show that targeted fixes, guided by proper diagnosis, deliver real performance gains.

Keeping the traffic flowing

Tackling Kubernetes networking bottlenecks isn’t just about fixing a technical problem; it’s about ensuring the reliability and scalability of the critical services your cluster hosts. A smooth, efficient network is the foundation upon which robust applications are built.

Just as a well-managed city anticipates and manages traffic flow, proactively monitoring and optimizing your Kubernetes network ensures your digital services remain responsive and ready to scale. Keep exploring, and keep learning, advanced CNI features and network policies offer even more avenues for optimization. Remember, a healthy Kubernetes network paves the way for digital innovation.

May 4, 2025 by Fernando SRE DevOps stuff Kubernetes SRE stuff

The essentials of Cloud Native software development

Cloud native development is not just about moving applications to the cloud. It represents a shift in how software is designed, built, deployed, and operated. It enables systems to be more scalable, resilient, and adaptable to change, offering a competitive edge in a fast-evolving digital landscape.

This approach embraces the core principles of modern software engineering, making full use of the cloud’s dynamic nature. At its heart, cloud-native development combines containers, microservices, continuous delivery, and automated infrastructure management. The result is a system that is not only robust and responsive but also efficient and cost-effective.

Understanding the Cloud Native foundation

Cloud native applications are designed to run in the cloud from the ground up. They are built using microservices: small, independent components that perform specific functions and communicate through well-defined APIs. These components are packaged in containers, which make them portable across environments and consistent in behavior.

Unlike traditional monoliths, which can be rigid and hard to scale, microservices allow teams to build, test, and deploy independently. This improves agility, fault tolerance, and time to market.

Containers bring consistency and portability

Containers are lightweight units that package software along with its dependencies. They help developers avoid the classic “it works on my machine” problem, by ensuring that software runs the same way in development, testing, and production environments.

Tools like Docker and Podman, along with orchestration platforms like Kubernetes, have made container management scalable and repeatable. While Docker remains a popular choice, Podman is gaining traction for its daemonless architecture and enhanced security model, making it a compelling alternative for production environments. Kubernetes, for example, can automatically restart failed containers, balance traffic, and scale up services as demand grows.

Microservices enhance flexibility

Splitting an application into smaller services allows organizations to use different languages, frameworks, and teams for each component. This modularity leads to better scalability and more focused development.

Each microservice can evolve independently, deploy at its own pace, and scale based on specific usage patterns. This means resources are used more efficiently and updates can be rolled out with minimal risk.

Scalability meets demand dynamically

Cloud native systems are built to scale on demand. When user traffic increases, new instances of a service can spin up automatically. When demand drops, those resources can be released.

This elasticity reduces costs while maintaining performance. It also enables companies to handle unpredictable traffic spikes without overprovisioning infrastructure. Tools and services such as Auto Scaling Groups (ASG) in AWS, Virtual Machine Scale Sets (VMSS) in Azure, Horizontal Pod Autoscalers in Kubernetes, and Google Cloud’s Managed Instance Groups play a central role in enabling this dynamic scaling. They monitor resource usage and adjust capacity in real time, ensuring applications remain responsive while optimizing cost.

Automation and declarative APIs drive efficiency

One of the defining features of cloud native development is automation. With infrastructure as code and declarative APIs, teams can provision entire environments with a few lines of configuration.

These tools, such as Terraform, Pulumi, AWS CloudFormation, Azure Resource Manager (ARM) templates, and Google Cloud Deployment Manager, Google Cloud Deployment Manager, reduce manual intervention, prevent configuration drift, and make environments reproducible. They also enable continuous integration and continuous delivery (CI/CD), where new features and bug fixes are delivered faster and more reliably.

Advantages that go beyond technology

Adopting a cloud native approach brings organizational benefits as well:

Faster Time to Market: Teams can release features quickly thanks to independent deployments and automation.
Lower Operational Costs: Elastic infrastructure means you only pay for what you use.
Improved Reliability: Systems are designed to be resilient to failure and easy to recover.
Cross-Platform Portability: Containers allow applications to run anywhere with minimal changes.

A simple example with Kubernetes and Docker

Let’s say your team is building an online bookstore. Instead of creating a single large application, you break it into services: one for handling users, another for managing books, one for orders, and another for payments. Each of these runs in a separate container.

You deploy these containers using Kubernetes. When many users are browsing books, Kubernetes can automatically scale up the books service. If the orders service crashes, it is automatically restarted. And when traffic is low at night, unused services scale down, saving costs.

This modular, automated setup is the essence of cloud native development. It lets teams focus on delivering value, rather than managing infrastructure.

Cloud Native success

Cloud native is not a silver bullet, but it is a powerful model for building modern applications. It demands a cultural shift as much as a technological one. Teams must embrace continuous learning, collaboration, and automation.

Organizations that do so gain a significant edge, building software that is not only faster and cheaper, but also ready to adapt to the future.

If your team is beginning its journey toward cloud native, start small, experiment, and iterate. The cloud rewards those who learn quickly and adapt with confidence.

April 21, 2025 by Fernando SRE Cloud stuff DevOps stuff SRE stuff