# CNI Published articles for CNI. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Cilium 1.20: Gateway API ExternalAuth, TCPRoute/UDPRoute, ENI IPAM for IPv6, and more DevFeed: [Cilium 1.20: Gateway API ExternalAuth, TCPRoute/UDPRoute, ENI IPAM for IPv6, and more]() Original publisher: [Read original article]() Author: Nico Vibert and Donia Chaiehloudj, Cilium Published: 2026-09-14T10:45:49Z Content type: article Language: en Sources: [Cloud Native Computing Foundation]() Topics: [Cilium](), [Open Source](), [API](), [networking](), [Kubernetes](), [Amazon Web Services](), [eBPF](), [VPC](), [nginx]() Tags: [2026](), [api](), [authentication](), [authorization](), [aws](), [blog](), [cilium](), [cloud](), [cni](), [ebpf](), [google](), [ingress-nginx](), [ipv4](), [ipv6](), [kubernetes](), [microsoft](), [network](), [networking](), [nginx](), [open-source](), [release]() ### AI overview Cilium 1.20 expands Gateway API support with ExternalAuth, CORS filters, ListenerSets, TCPRoute, and UDPRoute. The release also introduces extensible datapath plugins, advances networking standardization with Kubernetes, and adds beta IPv6 support for AWS ENI IPAM. ### Source excerpt Cilium 1.20, the second major open source Cilium release of 2026 after Cilium 1.19, is finally here. Three themes stand out in this release: Thank you to every contributor, reviewer and maintainer who made Cilium 1.20... ## The Default Deny Dilemma: A Practical Guide to Kubernetes Network Policies DevFeed: [The Default Deny Dilemma: A Practical Guide to Kubernetes Network Policies]() Original publisher: [Read original article]() Author: Wellingtone Luvonga Published: 2026-09-08T03:00:00Z Content type: tutorial Language: en Sources: [CYBERTEC PostgreSQL | Services & Support]() Topics: [Kubernetes](), [Network](), [Security](), [Zero Trust](), [Architecture & Design]() Tags: [blog](), [cni](), [container](), [guide](), [how-to](), [ingress](), [kubernetes](), [network](), [network-security](), [postgersql](), [security](), [test](), [yaml](), [zero-trust]() ### AI overview A hands-on lab for implementing zero-trust network segmentation in Kubernetes with NetworkPolicies. It demonstrates default-deny rules, label-based ingress and egress permissions, DNS access, external API restrictions, and traffic validation in a three-tier frontend, backend, and PostgreSQL architecture enforced by Calico. ### Source excerpt This blog is a deep walkthrough about network policies in Kubernetes, read to know more. The post The Default Deny Dilemma: A Practical Guide to Kubernetes Network Policies appeared first on CYBERTEC PostgreSQL | Services & Support. ## Cellular Network Infrastructure - August 2026 Osmocom CNI releases DevFeed: [Cellular Network Infrastructure - August 2026 Osmocom CNI releases]() Original publisher: [Read original article]() Author: pespin Published: 2026-08-20T15:47:26Z Content type: release Language: en Sources: [Open Source Mobile Communications: News]() Topics: [releases](), [Software](), [Vulnerabilities](), [Debian](), [Ubuntu](), [gnu linux]() Tags: [2026](), [bug](), [changelog](), [cni](), [debian](), [gnu-linux](), [issue](), [network](), [releases](), [security-vulnerabilities](), [tracker](), [ubuntu](), [update](), [version]() ### AI overview The Osmocom project released version 202608 of its Cellular Network Infrastructure software, covering components including OsmoTRX, OsmoBTS, OsmoPCU, OsmoBSC, OsmoMGW, OsmoMSC, OsmoHLR, OsmoSGSN, OsmoGGSN, OsmoSTP, and OsmoSIPConnector. The release includes several months of changes, with new features, extensive bug fixes, and fixes for multiple security vulnerabilities. An osmo-mgw 1.16.1 patch release corrected a Debian dependency issue. ### Source excerpt The Osmocom project has released new version 202608 of the CNI (Cellular Network Infrastructure) software, including OsmoTRX, OsmoBTS, OsmoPCU, OsmoBSC, OsmoMGW, OsmoMSC, OsmoHLR, OsmoSGSN, OsmoGGSN, OsmoSTP, OsmoSIPConnector, and others. Those new tagged/released versions contain up to 6-8 months of work since the previous versions released through December 2025 and February 2026. Some projects already got some intermediate releases since then. This set of releases contain some new features, but mostly lots of bug fixing, including multiple fixes for security vulnerabilities. See below for more detailed information. You can find pre-compiled binary packages of our latest release for a variety of Debian and Ubuntu GNU/Linux versions at Binary Packages. UPDATE: A new osmo-mgw patch release 1.16.1 was made on top of release 1.16.0 in order to fix a debian/control typo which was creating a dependency issue. Versions of newly released projects¶ Project Version Changelog libasn1c 0.9.39 https://gitea.osmocom.org/cellular-infrastructure/libasn1c/src/tag/0.9.39/debian/changelog libsmpp34 1.14.6 https://gitea.osmocom.org/cellular-infrastructure/libsmpp34/src/tag/1.14.6/debian/changelog libosmo-asn1-tcap 0.3.0 https://gitea.osmocom.org/ss7-in-c/libosmo-asn1-tcap/src/tag/0.3.0/debian/changelog libosmocore 1.14.2 https://gitea.osmocom.org/osmocom/libosmocore/src/tag/1.14.2/debian/changelog libosmo-netif 1.8.0 https://gitea.osmocom.org/osmocom/libosmo-netif/src/tag/1.8.0/debian/changelog libosmo-abis 2.2.0 https://gitea.osmocom.org/osmocom/libosmo-abis/src/tag/2.2.0/debian/changelog libosmo-pfcp 0.7.0 https://gitea.osmocom.org/osmocom/libosmo-pfcp/src/tag/0.7.0/debian/changelog libosmo-sigtran, osmo-stp 2.3.0 https://gitea.osmocom.org/osmocom/libosmo-sigtran/src/tag/2.3.0/debian/changelog osmo-e1d 0.8.0 https://gitea.osmocom.org/retronetworking/osmo-e1d/src/tag/0.7.1/debian/changelog osmo-pcap 0.8.1 https://gitea.osmocom.org/osmocom/osmo-pcap/src/tag/0.8.1/debian/changelog osmo ## Deploying IPv6-first EKS on AWS: What Still Doesn't Work, and What It Saves DevFeed: [Deploying IPv6-first EKS on AWS: What Still Doesn't Work, and What It Saves]() Original publisher: [Read original article]() Author: Spiro Stathakis Published: 2026-08-14T08:57:28Z Content type: article Language: en Sources: [RIPE Labs]() Topics: [Amazon Elastic Kubernetes Service](), [Amazon Web Services](), [VPC](), [networking](), [cloud-infrastructure](), [Kubernetes]() Tags: [2026](), [amazon](), [amazon-elastic-kubernetes-service](), [aws](), [cni](), [competition](), [cost](), [ip](), [ipv4](), [ipv6](), [kubernetes](), [nat](), [networking](), [networks](), [vpc]() ### AI overview A field report on deploying an IPv6-first Amazon Elastic Kubernetes Service platform on AWS. It explains how IPv6 pods, VPC networking, and an egress-only Internet gateway reduce dependence on NAT gateways and public IPv4 addresses, while legacy IPv4-only dependencies such as databases, payment APIs, and container registries still impose compatibility requirements and costs. ### Source excerpt In this field report on IPv6-first Amazon Elastic Kubernetes Service (EKS), the isp6 team shares which dependencies still drag IPv4 back in, what they learnt from /28s, and why the saving is large but not automatic. ## Inside Cilium CNI: solving mysterious Kubernetes pod setup timeouts DevFeed: [Inside Cilium CNI: solving mysterious Kubernetes pod setup timeouts]() Original publisher: [Read original article]() Author: Adyen Published: 2026-07-13T09:17:40Z Content type: article Language: en Sources: [Adyen Tech]() Topics: [Cilium](), [Kubernetes](), [Kubernetes networking](), [networking](), [eBPF](), [Latency](), [hdfs](), [Apache Spark](), [big-data](), [cpu]() Tags: [big-data](), [cilium](), [cni](), [cpu](), [data](), [devops](), [ebpf](), [hdfs](), [kubernetes](), [kubernetes-networking](), [latency](), [spark](), [speed](), [tracing]() ### AI overview An Adyen engineer investigates Cilium CNI timeouts that prevented new Kubernetes pods from starting. The article attributes the issue to sequential connection-tracking-table garbage collection, which became a bottleneck under workloads involving HDFS, Trino, and short-lived Spark jobs. ### Source excerpt By Jorrick Sleijster - Senior Data Platform Engineer, Adyen I was fully aware a year ago that a single configuration line could break the Kubernetes networking stack. But if they told me that leftovers from Kubernetes pods which terminated hours prior could block new ones from starting, I would have thought they were joking. In high-performance networking, 35 seconds is a lifetime. This was the latency required to iterate through our connection tracking table of 7 million entries at a maximum speed of 200,000 entries per second. At our 16-million-entry peak, this sequential lookup could take up to 80 seconds, leading to Cilium CNI timeouts preventing new pods from starting on affected nodes. We uncovered this linear-time behavior at Adyen by tracing syscalls, inspecting codebases, and analyzing eBPF internals. This investigation revealed how our varied workloads turned the connection tracking table's garbage collection algorithm into a critical bottleneck. Our setup: why we're different At Adyen, we run Cilium CNI across all our 100+ Kubernetes clusters. When we switched from Calico to Cilium, we knew we'd face challenges adapting it to our production workloads. Our production big data Kubernetes clusters have a unique usage pattern compared to the other Kubernetes environments within Adyen: Data extraction from HDFS. Our infrastructure relies on more than 500 datanodes. Trino represents one of our most demanding HDFS workloads, processing analytical queries against data stored on HDFS. Due to the distributed nature of HDFS, each file you download requires a new connection to any of these 500 nodes. Therefore, during peak hours, a single pod can produce approximately 50,000 connections every minute. Pod churn. Many pods we spawn on the Kubernetes cluster run batch jobs, such as Spark jobs. They stay around for anywhere from a second to a couple of hours. Wide variety of workloads. Some workloads are very CPU-intensive, like Spark pods executing complex joins and tra ## Technology Short Take 197 DevFeed: [Technology Short Take 197]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-06-19T14:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [networking](), [Artificial Intelligence](), [code security](), [Vulnerabilities](), [cloud security](), [Amazon Web Services](), [Kubernetes]() Tags: [ai](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [code-security](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [open-source](), [security](), [technology](), [vulnerabilities]() ### AI overview A commentary roundup covering radical network redesign at AWS, quantum computing's implications for encryption, AI's effects on certifications and code security, AI agent exploits, open-source vulnerabilities, Kubernetes resources, cloud operations, the AI bubble, and AWS IAM guidance. ### Source excerpt Welcome to Technology Short Take 197! I've been traveling for business for the last week, so this Technology Short Take has a tad fewer links than I typically include. Even so, I still have links on radical new network designs, the impacts of AI on code security, things beginners get wrong about AWS IAM, and more! Let's get into the content. Networking This story about a radical network redesign at AWS--along with this accompanying arXiv paper--was intriguing to me. I'm not a networking expert, but designing networks with quasi-random connections between endpoints definitely flies in the face of the traditional wisdom. I do wonder, though, if this is the sort of technology that only makes sense for the hyperscalers, and not for the rest of us. Doug Dawson provides a quick update on current encryption standards and what he terms the "pending encryption crisis" presented by quantum computing. It would appear that AI is affecting even Cisco's well-known industry certifications, as outlined by Daniel Dib. Security CodeRabbit shared the results of an analysis of PRs to open source projects showing that AI-written code produces ~1.7x more issues. Along the same lines, Jens Wessling of Veracode indicates that 45% of all AI-generated code samples contained OWASP Top 10 security vulnerabilities. Anyone who didn't expect seemingly-dangerous AI agent security exploits to appear hasn't been paying attention. Enterprise AI tools don't appear exempt, either. The complex interdependencies of open source software projects once again means that a single critical vulnerability threatens a much larger number of projects and tools. Cloud Computing/Cloud Management This is an older post, but the author recently updated it--check out Marcus Noble's recommended resources for Kubernetes newbies. I am not yet sure about pulumi do (direct operations for any cloud resource; see the Pulumi blog post about it). On one hand, I can see the utility in situations where you "just need a quick" whatever ## Technology Short Take 196 DevFeed: [Technology Short Take 196]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-05-22T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [networking](), [Cybersecurity](), [Linux](), [Terraform](), [Artificial Intelligence](), [Ansible](), [Large Language Model](), [Cloud](), [cURL](), [npm]() Tags: [ai](), [ansible](), [article](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [curl](), [cybersecurity](), [data-center](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [llms](), [networking](), [npm](), [oci](), [security](), [technologies](), [terraform]() ### AI overview Technology Short Take 196 is a curated list of articles about data center technologies, covering networking, servers and hardware, security, cloud management, operating systems, and applications. Topics include Ansible and IPSet, WireGuard and Headscale, a compromised Bitwarden CLI package on NPM, curl vulnerabilities, Terraform, AWS MCP Server, AI-assisted infrastructure as code, llama.cpp on Apple Silicon, Chrome's local AI model installation, Linux 7.0 and PostgreSQL, and Linux desktop voice typing. ### Source excerpt Welcome to Technology Short Take 196! Just in time for the US Memorial Day holiday, I am back with another list of articles related to various data center technologies like networking, security, operating systems, and applications. You will find articles on VPNs, Linux local privilege escalation (LPE) vulnerabilities, browser quirks and workarounds, the death of Terraform (again), and so much more. Enjoy your weekend reading! Networking Andrew Ward shares an Ansible role to block abusive subnets using IPSet. From this article on switching to WireGuard from Tailscale, I learned about Headscale (an open source implementation of the Tailscale control plane). Servers/Hardware Doug Dawson looks at some innovations that continue to improve computing power. Doug's article includes a few items I hadn't yet heard of. Security Bitwarden confirmed a compromise of its CLI package on NPM. First, we had CopyFail. Now we have Dirty Frag and Fragnesia. Daniel Stenberg talks about how Mythos found a single vulnerability--yes, just one--in curl. I don't really have words for this...security incident? That doesn't seem like the correct way to describe such a massive oversight, especially when you realize it happened to a cybersecurity agency. "Oops" doesn't even begin to describe it. Cloud Computing/Cloud Management Graham Gilbert insists Terraform is dead. I wonder what sorts of things the AWS MCP Server will make possible? William Collins argues in favor of AI through IaC rather than instead of it. I enjoyed this article. Collins indicates that while authoring IaC using LLMs is working rather well, managing infrastructure using LLMs is another story entirely. If you're at all interested in the intersection of LLMs and IaC, I'd add this to your reading list. Operating Systems/Applications Eric Sloof looks at using llama.cpp to run your own local, private AI stack on Apple Silicon. Mat Duggan examines his descent from artist to mercenary as a result of finding LLMs more useful than he exp ## Technology Short Take 195 DevFeed: [Technology Short Take 195]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-05-08T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [Artificial Intelligence](), [Large Language Model](), [Security](), [API keys](), [Automation](), [Kubernetes](), [networking](), [Ollama](), [Local AI]() Tags: [ai](), [api-keys](), [article](), [aws](), [blog](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [llm](), [networking](), [oci](), [ollama](), [security]() ### AI overview Technology Short Take 195 is a curated roundup of technology articles and posts, with an unplanned emphasis on AI and large language models. It covers API-key storage, AI tools and assistants, AI workflow automation, AI-agent security, Kubernetes security, networking, Ollama and local LLM experiments, Terraform versus OpenTofu, and cloud management. ### Source excerpt Welcome to Technology Short Take #195! It wasn't planned this way, but it seems like this Tech Short Take is heavily slanted toward AI/LLM-related articles and posts. Topics like security concerns around improper storage of API keys, how developers are using AI tools, spyware getting installed with AI assistants, and how AI/LLMs might be creating barriers to entry for new IT profesionals are all on tap this time around. I hope this unintentional focus doesn't prevent you from finding something useful! Networking Ivan Pepelnjak takes readers through the process of generating partial devices configurations with netlab. It's an older blog post, but it checks out--have a look at this walkthrough of Containerlab and Netlab. (Hat tip to Ivan for the link. Also, bonus points if you understood the reference at the start of this paragraph.) Ah, MTU issues...they don't go away if you migrate to Kubernetes. Security Sean Gallagher and Omid Mirzaei from Cisco Talos discuss how threat actors are misusing AI workflow automation. Before this article on vulnerability triage, I'd never heard of "brocards." Kelby Ludwig reminds folks that you don't want long-lived keys. Davi Ottenheimer tackles the claims about risk from Anthropic's Mythos preview. (Hint: the words "missing", "failed", "fluffy bunny", and "FUD" are involved.) William Collins reminds readers that they still need to pay attention to where they're storing sensitive data like API keys. Copy Fail has been making the rounds on lots of articles and blogs. Clément Nussbaumer looks at Copy Fail from the perspective of going from unprivileged Pod to root on a Kubernetes Node. Here's another one on Copy Fail, this time looking at blocking Copy Fail with Tetragon. Security is an arms race, and trying to secure AI agents is no different. The latest round in the race is a Falco project called Prempti. Cloud Computing/Cloud Management It's a good thing I came across this article about why friends don't let friends use Ollama. I had in ## Technology Short Take 194 DevFeed: [Technology Short Take 194]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-04-17T13:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [networking](), [Cryptography](), [Security](), [Vulnerabilities](), [eBPF](), [Kubernetes](), [Claude Code](), [TLS (Transport Layer Security)](), [ChaCha]() Tags: [article](), [aws](), [blog](), [cilium](), [claude-code](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [critical-infrastructure](), [cryptography](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [security](), [vulnerabilities]() ### AI overview Technology Short Take 194 curates data center technology links covering Reticulum, IPv6 networking, security exploits and vulnerabilities, TLS and QUIC diagrams, Kubernetes security, Claude Code advisories, AWS emulation, and developer tools. ### Source excerpt This is Technology Short Take #194, the latest in my semi-regular series of posts sharing data center technology-related links and articles from around the web. What have I gathered for readers this time? Key topics in Tech Short Take 194 include a new cryptography-based network stack, a look at why folks are revolting against AI, and an in-depth comparison of microVM technologies. On to the content! Networking This is cool. Longtime reader Todd Smith pointed me to Reticulum, a new cryptography-based network stack. Todd also spent some time messing around with Reticulum and shared his findings in two blog posts: first, an initial/introductory post, followed by a post sharing his experience with some Reticulum experiments. Scott Hogg examines building an IPv6 training and testing lab. Security eBPF is taking hold in security exploits, like the tool named "BPFdoor" that is penetrating critical infrastructure networks. Paul Meyer discusses reproducing and mitigating BadAML, an ACPI-based attack vector that can be used to potentially gain access to confidential VMs. Meyer admits that the model in the article assumes the attacker has full control over the host, at which point I would assume "game over" and move on. This site provides not only an illustrated TLS 1.2 connection diagram, but also offers diagrams for QUIC, DTLS, and TLS 1.3 (see the links in the upper right corner). Rory McCune continues his series on unpatchable Kubernetes vulnerabilities. David Chisnall posted a scathing analysis of Mythos on Mastodon (hat tip to Bruce Davie for boosting it into my timeline), and shared a link to an advisory on critical command injection vulnerabilities in Claude Code. Cloud Computing/Cloud Management I recently found this alternative to LocalStack for AWS emulation. How to hide regions and services in the AWS console is a useful thing to know about. Operating Systems/Applications Chris Down breaks down the differences between zswap and zram. Micah Kepe introduces his new ## Technology Short Take 193 DevFeed: [Technology Short Take 193]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-04-03T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [networking](), [Security](), [GitHub Actions](), [GitOps](), [ingress-nginx](), [Docker](), [litellm](), [Large Language Model]() Tags: [aws](), [blog-post](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [github-actions](), [gitops](), [go](), [iac](), [ingress-nginx](), [k8s](), [kubernetes](), [linux](), [litellm](), [networking](), [oci](), [security](), [technology]() ### AI overview Technology Short Take 193 is a curated roundup of data center technology links covering networking, IPv4 address space, consumer-router regulation, servers and hardware, security incidents involving Trivy and software supply chains, Ingress-NGINX migration, GitOps, local LLMs, and infrastructure management. ### Source excerpt Welcome to Technology Short Take #193! I know it has only been a couple weeks since the last Tech Short Take, but I am guessing that readers won't really mind another one. Here is my latest collection of articles and posts about data center-related technologies. Enjoy! Networking Brian Linkletter shares his 2026 list of network simulators and emulators. (Hat tip to Ivan P. for the link.) Emmanuel Vitus brings to light a battle over IPv4 address space and the control of the regional internet registries. Doug Dawson discusses the recent FCC ban on consumer-grade routers and the potential impacts to industry and ISPs. Servers/Hardware RIP Mac Pro. I had a "classic Mac Pro" (2012 era) for a long time, and I loved that system. (I even ran Linux on it for a while.) It is a shame to see it go. I mentioned on social media (Mastodon/Bluesky) that I recently purchased all the hardware for a new PC build. It'll be part PC/part home server, as I look to expand the type and scope of services that I self-host. Don't be surprised if a few articles emerge out of this. Security Trivy's GitHub Actions were compromised by attackers, leading to the exposure of CI/CD secrets. This post on the Socket blog has more details, and Rose Security has a write-up that provides more details on how a typosquatted domain and a fake version tag were involved. At least one other software supply chain exploit has been tracked back to the Trivy compromise: the Python litellm module on PyPI steals credentials. The Docker side of the Trivy compromise is shared in detail in this Docker blog post. Cloud Computing/Cloud Management Looking for some help in migrating away from Ingress-NGINX? This announcement of Ingress2Gateway 1.0 might be just what you are seeking. The FluxCD team published a post discussing Morgan Stanley's "Stairway to GitOps" presentation, which describes the firm's five-year journey from push-based pipelines to a self-service GitOps platform. Although I am not an AI fanboy, I do recogni ## Talking About Pulumi and Network Automation DevFeed: [Talking About Pulumi and Network Automation]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-24T14:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [Infrastructure as code](), [Network](), [Automation](), [Python]() Tags: [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [network-automation](), [networking](), [oci](), [podcast](), [pulumi](), [python](), [security]() ### AI overview The article introduces a Network Automagic podcast episode about Pulumi, its infrastructure-as-code model using general-purpose programming languages, and its potential role in network automation. It specifically discusses using Pulumi with Python for network automation tasks. ### Source excerpt Heard about Pulumi, but aren't sure what it is? Maybe you know a little bit about Pulumi--like that it does infrastructure as code (IaC), but using general purpose programming languages--and you're wondering where it fits in a larger automation framework? Or maybe you're a network engineer just starting to dabble in network automation, and you're wondering if this Pulumi thing is something you should check out. If any of these apply to you, then the latest Network Automagic podcast episode is right up your alley. I recently had the opportunity to join Steinn Bjarnarson and Urs Baumann for an episode of Network Automagic. The focus of our discussion--although I will say we diverged a bit here and there--was on Pulumi, what it is, and whether it fits into a larger network automation framework. After all, if you can use general purpose programming languages like Python with Pulumi, why not just use Pulumi in a Python program that also does network automation stuff? All in all, recording the podcast with Steinn and Urs was great fun, and I hope that the final product ends up being helpful for folks. There's a variety of ways to listen in on the episode: Via the Network Automagic web site Via the Network Automagic channel on YouTube (here is a link to the specific episode) Via Spotify Via Apple Podcasts As you can see, there are plenty of options to listen (and a few that I didn't include--check the Network Automagic web site for more!). Thanks to Steinn and Urs for having me on the show! ## Technology Short Take 192 DevFeed: [Technology Short Take 192]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-20T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [Network](), [Security](), [iOS](), [Kubernetes](), [AWS Lambda](), [GrapheneOS](), [Web](), [Cloud]() Tags: [article](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [ios](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [privacy](), [security](), [technology]() ### AI overview Technology Short Take 192 is a curated roundup of links about data center technology. It covers autonomous network engineering with Claude, an iOS exploit kit, Kubernetes security and Gateway API support in AWS Load Balancer Controller, AWS Lambda containers, container security for autonomous agents, software migration, GrapheneOS hardware prospects, Windows 12 reporting, and Linux. ### Source excerpt Welcome to Technology Short Take #192! Who's interested in some links to data center technology-related articles and posts? If that's you, you're in the right place. Here's hoping you find something useful! Networking Interested in an autonomous network engineering agent powered by Claude? (Hat tip to Russ S. for sending this my way.) Security Google's Threat Intelligence Group recently published some details around Coruna, an iOS exploit kit targeting a range of iOS versions and equipped with a number of potential exploits. As an example of one of the challenges around "default" secuity settings, Rory McCune highlights the fact that MicroK8s does not enable role-based access control. Bryce Kerley explains Web PKI--the infrastructure that powers secure connections on the modern Web. Mike Masnick writes about the massive surveillance stack hiding inside the "age verification" checks. Cloud Computing/Cloud Management I've had this article on AWS Lambda for the containers developer sitting in my read queue since first publication in 2023. (Sorry, Massimo.) I finally got around to reading it--really reading it, not just skimming it--and I found it to be helpful in helping me get a better grasp on Lambda. The AWS Load Balancer Controller recently gained support for Kubernetes Gateway API. This allows Kubernetes administrators to use AWS ALBs or NLBs for Gateway resources, and eliminates annotation-based configuration in favor of Custom Resource Definitions (CRDs). Operating Systems/Applications While using containers is certainly a step forward in securing autonomous agents--such as what NanoClaw is doing--I don't think it's enough on its own. Helpful, yes, but there is still more to do. Am I wrong? Does Gentoo's migration from GitHub to Codeberg--obstensibly due to Microsoft's AI emphasis--signal a turning point? The recent announcement of a partnership between Motorola and GrapheneOS opens the possibility for the privacy-focused smartphone OS to arrive on new hardware platfor ## Using Mitmproxy to Observe kubectl Traffic DevFeed: [Using Mitmproxy to Observe kubectl Traffic]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-04T22:30:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [Kubernetes](), [kubectl](), [Linux](), [Ubuntu](), [Authentication](), [Network](), [macOS](), [Amazon Web Services]() Tags: [apt](), [authentication](), [aws](), [certificates](), [cilium](), [cli](), [cloud](), [cni](), [commands](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubectl](), [kubernetes](), [linux](), [macos](), [networking](), [oci](), [security](), [tutorial](), [ubuntu]() ### AI overview This tutorial explains how to use mitmproxy to observe traffic between kubectl and the Kubernetes API Server. It describes the tested Linux and Ubuntu environment, notes that the commands should work similarly on macOS, and discusses extracting client certificates from a Kubeconfig file for certificate-based authentication. ### Source excerpt When I first started learning Kubernetes, I had the idea that observing the network traffic between a client system using kubectl and the Kubernetes API Server would be a useful thing to do. The source of the idea is unclear; I am unsure why I thought this would be useful as a learning tool. Regardless, I continued on with learning Kubernetes and never really pursued this idea--until this week. I found it can be a useful troubleshooting technique, but I will leave it up to you to determine if it is a useful learning technique. In this post, I will show you how to observe kubectl traffic using mitmproxy. This technique is inspired by/informed by Ahmet Alp Balkan's similarly-named blog post from 2019. Unfortunately, I found the instructions there to be incomplete (most likely just due to the passage of time and continued evolution of the tools involved). I used the following tools and environments in my testing: The tests were conducted on a Linux system running Ubuntu 24.04.4. The commands should work similarly on macOS. Mitmproxy was installed from the Ubuntu repositories using apt. kubectl version 1.33.3 was used to communicate to a self-managed cluster on AWS (in other words, not Amazon EKS) running Kubernetes 1.32.9. The cluster was bootstrapped using kubeadm. I wouldn't expect any major/significant differences with other versions of kubectl or Kubernetes. I was using a client certificate to authenticate to Kubernetes. It's unclear to me how this might work--if it works at all--with alternate authentication mechanisms. Prepare Client Certificates Before you can start mitmproxy, you'll first need to extract the client certificates from the Kubeconfig file. A couple of ways exist to do this; a blog post of mine from 2022 contains what I believe is the easiest way. The method involves yq (to extract information from the Kubeconfig) and base64 (to decode the client certificate and client key). Refer to the linked blog post for full details. First, extract the client cer ## Running the Azure CLI in a Container DevFeed: [Running the Azure CLI in a Container]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-02T13:00:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [Azure](), [Docker](), [Containers](), [Command-line interface](), [Python](), [configuration]() Tags: [aws](), [azure](), [cilium](), [cli](), [cloud](), [cni](), [configuration](), [container](), [containers](), [cri-o](), [devops](), [docker](), [docker-container](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [python](), [security](), [ssh]() ### AI overview This article examines running the Azure CLI in a container. It finds that the standard Docker command works for an interactive shell, but using an alias from the current shell requires persisting Azure configuration and SSH keys. Running as root can also create files with root ownership, potentially requiring a custom image; the author therefore returns to using a Python virtual environment. ### Source excerpt Like perhaps some readers, I am quite particular about what gets installed on my systems. I try to keep my systems as "clean" as possible, doing my best to avoid tools that have an extensive list of dependencies that must be installed and updated. Where that isn't possible--such as with the Azure CLI, which has a massive number of Python modules that are required in order for the tool to function--I will use various isolation mechanisms. For the Azure CLI, that's typically been a Python virtual environment. Somewhat recently, though, I had an idea to try using a container. In this post, I'll share what worked and what did not work when trying to run the Azure CLI in a container. First, though, a disclaimer: I am not an Azure expert, nor am I a Python expert. I know enough to get by. If I share something here that's incorrect, please contact me and constructively show me my errors so that I can fix them. Before I started down this path, I was sure this would be a slam dunk. I mean, this is what containers are for, right? If you do some web searches for running the Azure CLI in a container, you'll find articles that give you this command line: docker run -it mcr.microsoft.com/azure-cli (Note that this assumes you are using Docker instead of something like Podman.) This does work, as long as you're willing to operate in an interactive shell in the container. I was looking for something a bit different: I wanted to create an alias for az that executed the container in my current shell instead of putting me into a separate shell inside the container. Something like this, for example: alias az="docker container run --rm mcr.microsoft.com/azure-cli az" I quickly found that you need to map in your Azure configuration directory from outside the container, or your configuration won't persist. (In theory you could remove the --rm parameter and keep the container around.) Now the docker command in your alias starts to look like this: docker container run --rm -v ${HOME}/.azure:/r ## Technology Short Take 191 DevFeed: [Technology Short Take 191]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-02-27T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [networking](), [Ansible](), [Security](), [Infrastructure as code](), [Artificial Intelligence](), [Large Language Model](), [Containers](), [VXLAN]() Tags: [ai](), [ansible](), [aws](), [blog](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [gre](), [iac](), [k8s](), [kubernetes](), [linux](), [llm](), [network-automation](), [networking](), [oci](), [security](), [vxlan]() ### AI overview Technology Short Take 191 is a curated collection of commentary and links covering networking, network automation, security, cloud management, containers, operating systems, applications, AI adoption, and software vulnerabilities. ### Source excerpt Welcome to Technology Short Take #191! This is my semi-regular collection of links related to technology disciplines, including networking, security, cloud computing, storage, and programming/development. I hope that I've managed to curate an interesting and useful set of links for readers. Enjoy! Networking I learned a new acronym from Ivan Pepelnjak in his article on "not so passive" OPSFv2 interfaces in Cisco IOS/XR: QDS (Quick and Dirty Solution). I am totally using that from now on. Via Ivan (hat tip to my colleague Russ for pointing me in this direction), I also learned that all is not well in network automation land with Ansible. Although some parts of it are apparently now resolved, this does raise questions about the viability of Ansible for network automation. Doug Dawson talks about the new Amazon Eero Signal, a cellular backup to a primary broadband connection for users using their Eero mesh systems. I agree with Doug--the pricing seems high to me. I generally like the Eero devices, although there have been times when I really could use a bit more control over the settings. Security The APNIC blog features a guest article discussing the use of tunneling protocols to infiltrate networks. The article specifically discusses Generic Routing Encapsulation (GRE) and Virtual Extensible LAN (VXLAN). It's worth a read if your network uses either of these technologies. Cloud Computing/Cloud Management Somewhere along the way I missed the CDK deprecation announcement. If I am not mistaken, this leaves Pulumi as the only cloud-independent IaC tool that lets you use a general purpose programming language. Managing dependencies between containers can be difficult at times; this blog post by Nicolas Fränkel introduced me to wait4x, a tool one can use to help simplify these types of situations. Operating Systems/Applications I appreciated reading Mitchell Hashimoto's AI adoption journey. I feel it does provide a more realistic approach to how someone in a role like his m ## Technology Short Take 190 DevFeed: [Technology Short Take 190]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-02-06T13:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [networking](), [DDoS](), [Azure](), [Security](), [Windows](), [Cloud](), [Encryption](), [Git](), [Open Source](), [Terraform](), [Linux](), [macOS]() Tags: [2026](), [article](), [aws](), [azure](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [ddos](), [devops](), [docker](), [git](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [macos](), [markdown](), [networking](), [oci](), [open-source](), [security](), [technology](), [terraform](), [windows]() ### AI overview Technology Short Take 190 is a curated roundup of technical reading on networking, solar-storm effects on satellites, hardware, DDoS attacks against Microsoft Azure, Windows encryption, cloud management, Git tools, Terraform and OpenTofu, hosted email, Linux, macOS, and Markdown. ### Source excerpt Welcome to Technology Short Take #190! This is the first Tech Short Take of 2026, and it has been nearly three months (wow!) since the last one. I can't argue that I fell off the blogging bandwagon over the end of 2025 and early 2026. I won't get into all the reasons why (if you're interested then feel free to reach out and I'll fill you in). Enough about me--let's get to the technical content! Here's hoping you find something useful. Networking Here's a little something on the lighter side about what causes network outages. As the lead-in to this article on Starlink's performance during a solar superstorm says, "It's not science fiction." Solar storms can have a real impact on Earth, and satellites in low-Earth orbit (LEO) are not exempt from that impact. Servers/Hardware William Lam reviews the Mini PC and SFF (small form factor) hardware announcements from CES 2026. Security The scale of DDoS attacks continues to grow, as evidenced by this report of a 15 Tbps attack on Microsoft Azure. Microsoft having the ability to give away your Windows PC's data encryption key is horrifying. Cloud Computing/Cloud Management While doing some reading on Terragrunt, I also came across this open source tool for performing operations against multiple Git repositories. I don't have a use case for it, but it is cool! While on the topic of Terragrunt: let me say that I appreciate the work that went into their online docs! From what I've read so far, they are well-written, clear, concise, and informative. Well done! And while still on the topic of Terragrunt: it was this article from Axel Mendoza on why they use Terragrunt over Terraform/OpenTofu that sent me down the Terragrunt rabbit hole. The most recent installation of Ricardo Sueiras' AWS open source newsletter pointed me to a couple of tools that look really handy: s3sh (available from GitHub) and taws (also available from GitHub). Nick Buraglio has a great comparison of hosted email options. Operating Systems/Applications Howard ## Setting up a VPC Route Server with Pulumi DevFeed: [Setting up a VPC Route Server with Pulumi]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-01-28T13:00:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [VPC](), [Amazon Web Services](), [BGP](), [GitHub](), [Code]() Tags: [aws](), [bgp](), [cilium](), [cli](), [cloud](), [cni](), [code](), [containers](), [cri-o](), [devops](), [docker](), [github](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [security](), [tutorial](), [vpc]() ### AI overview A tutorial on using Pulumi to create and configure an AWS VPC Route Server for BGP-learned route injection. It covers creating the Route Server, associating it with a VPC, creating an endpoint for BGP peering, handling an explicit dependency between components, and propagating learned routes to a VPC route table. ### Source excerpt If you need to work with BGP in your AWS VPCs--so that BGP-learned routes can be injected into a VPC route table--then you will likely need a VPC Route Server. While you could set up a VPC Route Server manually, what's the fun in that? In this post, I will walk you through a Pulumi program that will set up a VPC Route Server. Afterward, I will discuss some ways you could check the functionality of the VPC Route Server to show that it is indeed working as expected. To make things as easy as possible, I have added a simple Pulumi program to my GitHub "learning-tools" repository in the aws/vpc-route-server directory. This program sets up a VPC Route Server and its associated components for you, and I will walk through this program in this blog post. The first step is creating the VPC Route Server itself. The VPC Route Server has no prerequisities, and the primary configuration needed is setting the ASN (Autonomous System Number) the Route Server should use: rs, err := vpc.NewRouteServer(ctx, "rs", &vpc.RouteServerArgs{ AmazonSideAsn: pulumi.Int(65534), Tags: pulumi.StringMap{ "Name": pulumi.String("rs"), "Project": pulumi.String("vpc-route-server"), }, }) Next, you will need to associate the Route Server with a VPC. This requires a VPC ID, as you might expect; this ID could come from a configuration value passed in by the user, or from a VPC created earlier in this or another Pulumi program. rsa, err := vpc.NewRouteServerVpcAssociation(ctx, "rsa", &vpc.RouteServerVpcAssociationArgs{ RouteServerId: rs.ID(), VpcId: pulumi.String(userSuppliedVpcId), }) With that association in place, the next component is a Route Server Endpoint. This endpoint is created in a subnet, and will have an IP address assigned from that subnet. This IP address is what your BGP peer will use to establish a peering relationship to exchange routes. rse, err := vpc.NewRouteServerEndpoint(ctx, "rse", &vpc.RouteServerEndpointArgs{ RouteServerId: rs.RouteServerId, SubnetId: pulumi.String(userSuppliedPriv ## Technology Short Take 189 DevFeed: [Technology Short Take 189]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2025-10-31T13:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [networking](), [Exploit](), [Security](), [Kubernetes](), [Multi-tenancy](), [evpn](), [GitLab](), [VXLAN](), [Cloud](), [Hardware](), [migration]() Tags: [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [digital-ocean](), [docker](), [evpn](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [migration](), [multi-tenancy](), [networking](), [oci](), [open-source](), [security](), [technology](), [terraform](), [vulnerabilities](), [vxlan]() ### AI overview A collection of links covering data center technologies, including EVPN/VXLAN networking, Xeon 6 server availability, the VMScape exploit, F5 appliance vulnerabilities, a Red Hat GitLab breach, multi-tenant Kubernetes, cloud migration, Pulumi resource hooks, and Terraform-related AWS tag management. ### Source excerpt Welcome to Technology Short Take #189, Halloween Edition! OK, you caught me--this Tech Short Take is not scary. I'll try harder next year. In the meantime, enjoy this collection of links about data center-related technologies. Although this installation is lighter on content than I would prefer, I am publishing anyway in the hopes of trying to get back to a somewhat-regular cadence. Here's hoping you find something useful and informative! Networking Kevin Myers dissects EVPN/VXLAN interoperability with MicroTik and IP Infusion. Ivan Pepelnjak has a new project: open source EVPN/VXLAN labs. I plan to tackle these myself in the near future! Servers/Hardware Kevin Houston takes a look at the availability of Xeon 6 CPUs across blade server vendors. Security Security researchers recently published some research on a new microarchitectural exploit called "VMScape." The TL;DR on VMScape is that it allows hypervisor information to leak from a malicious VM. Oops! Olivier Lambert has a write-up that explains why the Xen hypervisor is not affected by this exploit. (Side note: be sure to read the comments--Olivier shares some useful information there.) The leaking of source code for F5 appliances by a "nation-state affiliated cyber threat actor" has lead the CISA to call on all federal agencies to mitigate vulnerabilities in F5 appliances due to "an imminent threat to federal networks using F5 devices and software." That's not good. In early October of this year, Red Hat confirmed the breach of one of its GitLab instances, leading to the theft of nearly 570GB of data across 28,000 repositories. Oof. Cloud Computing/Cloud Management Iain Smart reviews some common exploit paths when trying to build multi-tenant Kubernetes clusters. As Iain says, multi-tenancy is hard. Digital Society discusses their migration off AWS and Digital Ocean to Hetzner. Just this past week I learned of Pulumi's resource hooks, a feature made available back in June of this year. Hrittik Roy discusses vClus ## Posts from the Past, October 2025 DevFeed: [Posts from the Past, October 2025]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2025-10-22T18:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [Amazon Elastic Kubernetes Service](), [Kubernetes](), [Amazon Web Services](), [Infrastructure as code](), [Azure]() Tags: [2025](), [amazon-elastic-kubernetes-service](), [ansible](), [aws](), [azure](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [japan](), [k8s](), [kubernetes](), [kubernetes-clusters](), [linux](), [networking](), [oci](), [openstack](), [security](), [vagrant]() ### AI overview A retrospective roundup revisiting the author's Kubernetes, cloud infrastructure, and container-related posts published in October across several years. It highlights work involving Pulumi, Amazon EKS, Bottlerocket OS, Azure Kubernetes Service, Cluster API, AWS, kubeadm, Ansible, Vagrant, and OpenStack. ### Source excerpt Every now and then, I publish one of these "Posts from the Past" articles that looks back on content I've created and posted over the life of this site. This year marks 20 years of content--I can hardly believe it! Don't worry, though; you won't have to go through 20 years of past posts. Here is a selection of posts from mid- to late October over the last decade or so. I hope you find something useful, informative, or at least entertaining! October 2024 Last year I shared information on how to use Pulumi to stand up an Amazon Elastic Kubernetes Service (EKS) cluster with Bottlerocket OS on the Kubernetes nodes--without using any higher-level Pulumi components. October 2022 In 2022, after getting irritated with what I felt was a poor user experience when accessing Azure Kubernetes Service (AKS) clusters created with Pulumi, I published this post on how to change the Kubeconfig file for a more streamlined user experience. October 2021 Cluster API is the name of the game for multiple posts in October 2021. First I wrote this article on kustomize transformer configurations for Cluster API v1beta1 (so that you can use kustomize to manipulate Cluster API manifests), followed up later that month with an article on influencing Cluster API AMI selection. I also touched upon using the external (out of tree) cloud provider for AWS that month, a topic I am revisiting soon as I explore integrating Talos Linux with AWS. October 2020 More Cluster API content--this time discussing IaC considerations for Cluster API (think things like integrating workload clusters with existing AWS workloads or services). October 2019 In October 2019 I explored using jk to programmatically create Kubernetes manifests, and discussed how to use kustomize with kubeadm configuration files. October 2018 Plenty of articles discuss the use of kubeadm to bootstrap Kubernetes clusters (including a few I wrote!), but what of talking about using kubeadm to stand up an etcd cluster? I've got you covered! October 2 ## Using Git Pre-Commit Hooks DevFeed: [Using Git Pre-Commit Hooks]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2025-10-20T15:00:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [Git](), [Markdown](), [Bash](), [Script]() Tags: [aws](), [bash](), [cilium](), [cli](), [cloud](), [cni](), [code](), [containers](), [cri-o](), [devops](), [docker](), [git](), [git-commit](), [git-hook](), [go](), [hooks](), [iac](), [k8s](), [kubernetes](), [lint](), [linux](), [markdown](), [networking](), [oci](), [script](), [security](), [tests]() ### AI overview This tutorial explains Git pre-commit hooks and demonstrates using one to run Markdownlint on staged Markdown files before a commit. It notes that a non-zero hook exit status aborts the commit and presents a Bash implementation based on the author's site. ### Source excerpt A while ago I wrote an article about linting Markdown files with markdownlint. In that article, I presented the use case of linting the Markdown source files for this site. While manually running linting checks is fine--there are times and situations when this is appropriate and necessary--this is the sort of task that is ideally suited for a Git pre-commit hook. In this post, I'll discuss Git pre-commit hooks in the context of using them to run linting checks. Before moving on, a disclaimer: I am not an expert on Git hooks. This post shares my limited experience and provides an example based on what I use for this site. I have no doubt that my current implementation will improve over time as my knowledge and experience grow. What is a Git Hook? As this page explains, a hook is a program "you can place in a hooks directory to trigger actions at certain points in git's execution." Generally, a hook is a script of some sort. Git supports different hooks that get invoked in response to specific actions in Git; in this particular instance, I'm focusing on the pre-commit hook. This hook gets invoked by git-commit (i.e., the user running a git commit command) and allows users to perform a series of checks or tests before actually making a commit. If the pre-commit script exits with a non-zero status, then Git aborts the commit. Using a Pre-Commit Hook to Lint Markdown For my use case, I wanted to run Markdownlint to lint the Markdown files (as described in the previous article on linting Markdown) before the commit. To do that, I came up with the following script: #!/usr/bin/env bash MDLINT="/usr/local/bin/markdownlint" for file in $(git diff --cached --name-only --diff-filter=ACM | grep "\.md"); do if ! $MDLINT "$file"; then echo "Lint check failed on file '$file'." echo "Run markdownlint to identify the errors and try again." exit 1 fi done To make this script active as a pre-commit hook, you must name it pre-commit, you must place it into Git's hook directory (which defa ## Future-Proof Your AKS Cluster with Strategic IP Address Planning DevFeed: [Future-Proof Your AKS Cluster with Strategic IP Address Planning]() Original publisher: [Read original article]() Author: Sumit Prasad Published: 2024-06-25T09:12:09Z Content type: tutorial Language: en Sources: [Myntra]() Topics: [Azure Kubernetes Service](), [Azure](), [Kubernetes](), [networking](), [configuration](), [Scalability]() Tags: [aks](), [azure](), [azure-kubernetes-service](), [cni](), [configuration](), [container-networking](), [ip-address-planning](), [kubernetes](), [kubernetes-scaling](), [load-balancer](), [networking](), [scalability]() ### AI overview This article explains IP address planning for Azure Kubernetes Service clusters using default Azure CNI networking. It compares static and dynamic IP allocation and describes how pod, node, and internal load balancer scaling affects subnet capacity and resource utilization. ### Source excerpt Scaling Kubernetes efficiently is an art that blends strategic planning with technical expertise. In Azure Kubernetes Service (AKS), mastering the allocation of IP addresses is crucial for ensuring seamless scalability and optimal performance. When configuring an AKS cluster with default Azure CNI networking, it's essential to address the nature of scaling Pods, Nodes, and internal LoadBalancer-type services. This blog delves into the intricate process of IP address planning, explicitly focusing on scaling Pods, Nodes, and Services in an AKS cluster. Discover how thoughtful IP management can prevent bottlenecks, optimize resource utilization, and pave the way for a robust production environment. Image Source: https://kubernetes.io/docs/images/kubernetes-cluster-network.svg We'll talk about two approaches to IP address planning in AKS: Static IP allocation and Dynamic IP allocation. Let us understand a bit about both, and then we will go deeper to understand each approach. Static IP Allocation: Suitable for predictable and stable environments where the maximum number of pods per node is known and does not change frequently. This approach can lead to IP wastage if the number of pods varies. Dynamic IP Allocation: Better for environments with varying workloads and dynamic scaling needs. It helps reduce IP wastage by allocating additional IPs only when necessary, but it requires careful subnet planning with a buffer to accommodate dynamic allocations. Static IP Allocation The default configuration in AKS uses static IP allocation based on the 'maximum number of pods per node' setting, counting all pods created from Deployments, Daemonsets, Statefulsets, or Jobs. The private subnet CIDR specified during node pool configuration assigns IP addresses to Pods, Nodes, and Load balancer type services for an internal network. It is essential to decide the "maximum pods per node" configuration and to have a dedicated subnet CIDR range before creating a node pool. AKS reserves th ## New Pluralsight Course - Deploying and Managing Azure Kubernetes Service (AKS) Networking DevFeed: [New Pluralsight Course - Deploying and Managing Azure Kubernetes Service (AKS) Networking]() Original publisher: [Read original article]() Author: Anthony Nocentino Published: 2022-05-31T00:00:00Z Content type: release Language: en Sources: [Kubernetes on Anthony Nocentino's Blog]() Topics: [Kubernetes](), [Azure](), [networking](), [Disaster Recovery](), [Cloud]() Tags: [aks](), [availability](), [azure](), [azure-kubernetes-service](), [cni](), [containers](), [disaster-recovery](), [failover](), [ingress](), [kubernetes](), [kubernetes-clusters](), [networking](), [pluralsight]() ### AI overview The article announces a new Pluralsight course on deploying and managing Azure Kubernetes Service (AKS) networking. The course covers AKS networking models, kubenet, Azure CNI, services, ingress controllers, application access, and disaster recovery design patterns. ### Source excerpt My new course "Deploying and Managing Azure Kubernetes Service (AKS) Networking" is now available on Pluralsight here! If you want to learn about the course, check out the trailer here, or if you're going to dive right in, check it out here! Azure Kubernetes Service is a platform-as-a-service that provides Kubernetes Services in the Azure Cloud. This course will teach you to design, configure, and manage networking, services, and disaster recovery in Azure Kubernetes Service. ## WireGuard for Kubernetes: Introducing Wormhole DevFeed: [WireGuard for Kubernetes: Introducing Wormhole]() Original publisher: [Read original article]() Author: info@goteleport.com (Kevin Nisbet) Published: 2019-04-29T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [Kubernetes](), [networking](), [Open Source](), [Virtual Private Network]() Tags: [cni](), [compliance](), [configuration](), [encryption](), [flannel](), [kubernetes](), [vpn]() ### AI overview Teleport introduces Wormhole, an open-source Kubernetes network plugin that combines flannel's simplicity with WireGuard-based encrypted networking. It uses the Kubernetes API to coordinate key exchange and configuration for a full-mesh encrypted network between cluster hosts. ### Source excerpt Announcing Teleport Wormhole, a new open source Kubernetes network plugin that combines the simplicity of flannel with encrypted networking from WireGuard.