All topics
Networking
Packets, conntrack, load balancers and the paths between services. 2 posts
- Incident
79% NXDOMAIN: How ndots:5 Turned One Queue Worker Into a DNS Flood
Three node-local DNS caches were pinned at their CPU limit while CoreDNS looked bored. The cause was a resolver option most people never set, multiplied by 75 replicas on three oversized nodes. A full walk from resolv.conf to packet capture to node-pool design.
23 minKubernetesDNSNetworking - Design
Exactly 100, Not 101: Distributed Rate Limiting with Envoy and Redis
Per-tenant quotas for internal APIs, enforced across many instances, on VMs and Kubernetes, on x86 and ARM. Why we picked Envoy over Kong, Caddy and a managed WAF, how descriptors really compose, how we proved a 100-per-hour quota lets exactly 100 through, and the sidecar plumbing that made it a one-line opt-in.
16 minNetworkingKubernetesPlatform