# K8s Published articles for K8s. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## 【kube-apiserver】Authentication：SA、Bearer、OIDC 边界 DevFeed: [【kube-apiserver】Authentication：SA、Bearer、OIDC 边界]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Authentication](), [Kubernetes](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [authz]() Tags: [api](), [apiserver](), [authentication](), [authorization](), [bearer-token](), [distributed](), [jwt](), [k8s](), [kubernetes](), [oidc](), [serviceaccount](), [v1-30-3]() ### AI overview This Chinese-language tutorial explains the kube-apiserver authentication chain in Kubernetes v1.30.3. It distinguishes X.509 certificates, ServiceAccount tokens, static and bootstrap tokens, OIDC JWTs, webhook authentication, and anonymous requests, and separates authentication failures such as 401 from storage-layer failures such as 503 or 504. ### Source excerpt 钉 K8s v1.30.3 的认证链：X509、SA token（bound token）、Bearer、OIDC、Webhook token、匿名用户；ServiceAccount bound token 与 TokenRequest 语义；apiserver 认证 flags 边界；401 与存储层故障的分列；AuthZ 路径见第 11 篇。 ## 【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列 DevFeed: [【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Authorization](), [Kubernetes](), [audit](), [API]() Tags: [403](), [admission](), [api](), [apiserver](), [audit](), [auth](), [authorization](), [authz](), [distributed](), [etcd](), [http](), [k8s](), [kubernetes](), [policy](), [post](), [rbac](), [subjectaccessreview](), [v1](), [v1-30-3](), [webhook]() ### AI overview This tutorial explains Kubernetes v1.30.3 authorization and auditing. It distinguishes the RBAC, Node, Webhook, and legacy ABAC authorizer paths; describes SAR and SSAR access checks; outlines audit policies and stages; and explains why user-facing 403 errors come from Kubernetes authorization rather than etcd permissions or Admission failures. ### Source excerpt 钉 K8s v1.30.3 的授权链：RBAC、Node、Webhook、ABAC（遗留）；SubjectAccessReview / SelfSubjectAccessReview 用法；Audit policy 四级；403 与 etcd 权限错误、Admission 拒绝的分列；不把 etcd 的 mTLS 错误写成 K8s RBAC 故障。 ## 【kube-apiserver】APF 与 max-in-flight：公平排队、504 与 etcd lag 分列 DevFeed: [【kube-apiserver】APF 与 max-in-flight：公平排队、504 与 etcd lag 分列]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [API](), [SRE](), [Linux]() Tags: [apf](), [api](), [apiserver](), [distributed](), [etcd](), [fairness](), [fairqueuing](), [flowcontrol](), [k8s](), [kubernetes](), [lag](), [max-in-flight](), [priority](), [timeout](), [v1-30-3]() ### AI overview This article explains how Kubernetes v1.30.3 protects kube-apiserver from overload through API Priority and Fairness (APF) and the older max-in-flight limits. It distinguishes 429 responses, APF queue timeouts that can produce 504 responses before storage is reached, etcd latency, and admission webhook delays, and describes APF's FlowSchema, PriorityLevelConfiguration, fair queuing, and shuffle sharding mechanisms. ### Source excerpt 钉 K8s v1.30.3 的 API Priority and Fairness（APF）：FlowSchema 匹配、PriorityLevelConfiguration 公平排队（SFVR）、与旧 max-in-flight flag 的共存关系；429/timeout/504 在 APF 排队、etcd_request_duration_seconds、Admission Webhook 三轴的分列；pkg/util/flowcontrol 路径；APF 与简单 max-in-flight 的运维复杂度争论。 ## 【etcd】写入路径深读：Txn、mod revision 与 quota/alarm DevFeed: [【etcd】写入路径深读：Txn、mod revision 与 quota/alarm]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-26T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [etcd](), [Back end](), [Raft](), [Remote Procedure Call (RPC)](), [maintenance]() Tags: [alarm](), [apiserver](), [applied-index](), [apply](), [batch](), [bbolt](), [committed-index](), [compaction](), [defrag](), [distributed](), [errcompacted](), [etcd](), [follower](), [k8s](), [kubernetes](), [mod-revision](), [nospace](), [quota](), [revision](), [txn](), [v3-5](), [v3-5-33]() ### AI overview This tutorial explains the etcd v3.5.33 write path from gRPC requests through Raft proposal, quota checks, MVCC apply, and ModRevision assignment. It also describes proposal backpressure, backend quota accounting, and how a NOSPACE alarm blocks writes while reads, deletes, and maintenance operations can continue. ### Source excerpt 走读 etcd v3.5.33 写入路径：raftRequest 背压、Txn compare/mod 与 ModRevision 分配、backend quota 与 NOSPACE alarm 如何把集群推入只读。 ## 【etcd】Lease 与 KeepAlive：TTL、checkpoint 与 Leader 切换 DevFeed: [【etcd】Lease 与 KeepAlive：TTL、checkpoint 与 Leader 切换]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-26T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [etcd](), [Raft](), [Kubernetes](), [Remote Procedure Call (RPC)]() Tags: [api](), [checkpoint](), [client](), [concurrency](), [distributed](), [etcd](), [follower](), [k8s](), [keepalive](), [kubernetes](), [lease](), [lessor](), [primary](), [raft](), [ttl](), [v3](), [v3-5-33](), [watch]() ### AI overview This article explains etcd v3.5.33 lease behavior, focusing on the lessor's primary, demote, and promote roles, the KeepAlive renewal path that normally bypasses Raft, lease checkpointing, and TTL changes during leader transitions. It also discusses implications for Kubernetes Node Leases and distributed locks. ### Source excerpt 钉 etcd v3.5.33 lessor 的 primary/demote/promote、KeepAlive 不经 Raft 的 Renew 路径、LeaseCheckpoint 与 Promote 时 TTL 展期，以及 Leader 切换对 Node Lease 的排障落格。 ## 【etcd】Watch 机制：watchableStore、synced/unsynced 与 ErrCompacted DevFeed: [【etcd】Watch 机制：watchableStore、synced/unsynced 与 ErrCompacted]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-26T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [etcd](), [Raft](), [Remote Procedure Call (RPC)](), [Kubernetes]() Tags: [apiserver](), [apply](), [compaction](), [distributed](), [errcompacted](), [etcd](), [io](), [k8s](), [kubernetes](), [lag](), [leader](), [lease](), [mvcc](), [notify](), [raft](), [range](), [restore](), [revision](), [rpc](), [v3-5](), [v3-5-33](), [watch](), [watchablestore]() ### AI overview This article examines the etcd v3.5.33 watchableStore implementation, including synced and unsynced watcher groups, victims caused by backpressure, Apply-time notification, historical synchronization, and the ErrCompacted client resynchronization boundary. It also discusses event ordering, follower watch progress, and interactions with Kubernetes apiserver watch caches. ### Source excerpt 钉 etcd v3.5.33 watchableStore 的 synced/unsynced/victims 三分法、Apply 后 notify 与历史追赶 syncWatchersLoop，以及 CompactRevision 触发 ErrCompacted 时的客户端重同步边界。 ## 【etcd】选型收束与开放问题：排除树与系列边界关闭 DevFeed: [【etcd】选型收束与开放问题：排除树与系列边界关闭]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-26T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [etcd](), [Raft](), [Kubernetes]() Tags: [apiserver](), [backup](), [compaction](), [distributed](), [etcd](), [exclusion-tree](), [foundationdb](), [guide](), [k8s](), [kubernetes](), [lease](), [open-questions](), [raft](), [selection](), [tikv](), [v3](), [v3-5-33](), [zookeeper]() ### AI overview This concluding article presents a mechanism-based decision tree for deciding when to retain etcd and when to migrate to TiKV or FoundationDB. It defines etcd's fit for small data sets with Watch and Lease dependencies, identifies disqualifying conditions such as quota pressure, sharding needs, cross-key transactions, Watch backpressure, and insufficient operational capacity, and clarifies the boundaries between related article series. ### Source excerpt 用机制排除树收束何时该留 etcd、何时迁 TiKV/FDB/ZK；回收 distributed/39、tikv-htap/18、foundationdb/18 的 etcd 叶；列出 Watch 背压、Lease+fencing、quota 迁移等开放问题；以 ADR 语言关闭续作边界。 ## 【etcd】读路径与一致性：ReadIndex、Serializable 与 Lease read DevFeed: [【etcd】读路径与一致性：ReadIndex、Serializable 与 Lease read]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-26T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [etcd](), [Raft](), [consensus algorithm](), [Kubernetes]() Tags: [consistency](), [distributed](), [etcd](), [follower](), [k8s](), [keepalive](), [kubernetes](), [lease](), [linearizable](), [raft](), [readindex](), [resourceversion](), [revision](), [serializable](), [ttl](), [v3-5](), [v3-5-33]() ### AI overview This tutorial explains read consistency in etcd v3.5.33. It distinguishes default linearizable reads using ReadIndex, local Serializable reads that may be stale on followers, and Lease RPC reads handled by the leader outside the Raft log. It also discusses leader changes, apply-index waiting, follower forwarding, MVCC history reads, and implications for Kubernetes apiserver clients. ### Source excerpt 分列 etcd v3.5.33 三种读语义：默认线性一致读的 ReadIndex 循环、Serializable 本地读、Raft ReadOnlyLeaseBased 与不经 Raft 的 Lease 路径；follower 读风险与 K8s 期望。 ## 【Istio 控制面】控制面全景：从 CRD 到 xDS 的翻译与推送内核 DevFeed: [【Istio 控制面】控制面全景：从 CRD 到 xDS 的翻译与推送内核]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-11T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [istio](), [Architecture & Design]() Tags: [ambient](), [control-plane](), [gateway-api](), [istio](), [istiod](), [k8s](), [kubernetes](), [network](), [pilot](), [service-mesh](), [sidecar](), [xds]() ### AI overview This first article in a 16-part series maps the Istio control plane's role between configuration inputs and proxy-side xDS consumption. It defines five analytical axes and uses Istio 1.30.3 as its version anchor, while outlining the series' scope and boundaries. ### Source excerpt 定位 Istio 控制面内核相对 Envoy 消费侧、Service Mesh 税文与 Gateway API 资源模型的缺口；给出五条坐标系、16 篇地图与本系列明确不写的范围，钉住 istiod 1.30.3 为主线。 ## Multi-region high availability for Kafka workloads with a single Stretch Cluster DevFeed: [Multi-region high availability for Kafka workloads with a single Stretch Cluster]() Original publisher: [Read original article]() Author: David Yu Published: 2026-08-11T00:00:00Z Content type: article Language: en Sources: [Redpanda]() Topics: [Kafka](), [Kubernetes](), [Availability](), [Replication](), [Raft](), [Resilience](), [stream-processing]() Tags: [clusters](), [k8s](), [kafka](), [raft](), [release](), [replication](), [resilience](), [stream-processing]() ### AI overview Redpanda Operator 26.2 introduces generally available Stretch Clusters, allowing one logical Redpanda cluster to span multiple Kubernetes clusters and regions. The release provides synchronous replication with Raft-based automatic failover, safer broker rolling restarts, Redpanda Connect pipelines as Kubernetes resources, and Gateway API support for Redpanda Console. ### Source excerpt Redpanda Operator 26.2 brings GA Stretch Clusters for multi-region replication, Redpanda Connect pipelines as K8s resources, Gateway API support, and safer rolling restarts. ## Platform engineering tools you NEED to know in 2026 DevFeed: [Platform engineering tools you NEED to know in 2026]() Original publisher: [Read original article]() Author: Mallory Haigh Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Backstage](), [engineering-culture](), [Kubernetes](), [API](), [Orchestration]() Tags: [api](), [architecture](), [culture](), [developers](), [engineering](), [guide](), [how-to](), [k8s](), [kubernetes](), [platform](), [platform-engineering](), [tools]() ### AI overview A strategic guide to platform engineering tools in 2026, emphasizing adoption, developer workflows, culture, product thinking, and architectural principles over tool installation or vendor marketing. It introduces a three-tier platform architecture and discusses backend orchestration through a unifying API, with examples including Backstage and Kubernetes. ### Source excerpt Platform engineering tools you need for 2026, framed by adoption-first thinking, three-tier architecture, and the must-know stack from K8s to AI. ## Technology Short Take 197 DevFeed: [Technology Short Take 197]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-06-19T14:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [networking](), [Artificial Intelligence](), [code security](), [Vulnerabilities](), [cloud security](), [Amazon Web Services](), [Kubernetes]() Tags: [ai](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [code-security](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [open-source](), [security](), [technology](), [vulnerabilities]() ### AI overview A commentary roundup covering radical network redesign at AWS, quantum computing's implications for encryption, AI's effects on certifications and code security, AI agent exploits, open-source vulnerabilities, Kubernetes resources, cloud operations, the AI bubble, and AWS IAM guidance. ### Source excerpt Welcome to Technology Short Take 197! I've been traveling for business for the last week, so this Technology Short Take has a tad fewer links than I typically include. Even so, I still have links on radical new network designs, the impacts of AI on code security, things beginners get wrong about AWS IAM, and more! Let's get into the content. Networking This story about a radical network redesign at AWS--along with this accompanying arXiv paper--was intriguing to me. I'm not a networking expert, but designing networks with quasi-random connections between endpoints definitely flies in the face of the traditional wisdom. I do wonder, though, if this is the sort of technology that only makes sense for the hyperscalers, and not for the rest of us. Doug Dawson provides a quick update on current encryption standards and what he terms the "pending encryption crisis" presented by quantum computing. It would appear that AI is affecting even Cisco's well-known industry certifications, as outlined by Daniel Dib. Security CodeRabbit shared the results of an analysis of PRs to open source projects showing that AI-written code produces ~1.7x more issues. Along the same lines, Jens Wessling of Veracode indicates that 45% of all AI-generated code samples contained OWASP Top 10 security vulnerabilities. Anyone who didn't expect seemingly-dangerous AI agent security exploits to appear hasn't been paying attention. Enterprise AI tools don't appear exempt, either. The complex interdependencies of open source software projects once again means that a single critical vulnerability threatens a much larger number of projects and tools. Cloud Computing/Cloud Management This is an older post, but the author recently updated it--check out Marcus Noble's recommended resources for Kubernetes newbies. I am not yet sure about pulumi do (direct operations for any cloud resource; see the Pulumi blog post about it). On one hand, I can see the utility in situations where you "just need a quick" whatever ## Technology Short Take 196 DevFeed: [Technology Short Take 196]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-05-22T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [networking](), [Cybersecurity](), [Linux](), [Terraform](), [Artificial Intelligence](), [Ansible](), [Large Language Model](), [Cloud](), [cURL](), [npm]() Tags: [ai](), [ansible](), [article](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [curl](), [cybersecurity](), [data-center](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [llms](), [networking](), [npm](), [oci](), [security](), [technologies](), [terraform]() ### AI overview Technology Short Take 196 is a curated list of articles about data center technologies, covering networking, servers and hardware, security, cloud management, operating systems, and applications. Topics include Ansible and IPSet, WireGuard and Headscale, a compromised Bitwarden CLI package on NPM, curl vulnerabilities, Terraform, AWS MCP Server, AI-assisted infrastructure as code, llama.cpp on Apple Silicon, Chrome's local AI model installation, Linux 7.0 and PostgreSQL, and Linux desktop voice typing. ### Source excerpt Welcome to Technology Short Take 196! Just in time for the US Memorial Day holiday, I am back with another list of articles related to various data center technologies like networking, security, operating systems, and applications. You will find articles on VPNs, Linux local privilege escalation (LPE) vulnerabilities, browser quirks and workarounds, the death of Terraform (again), and so much more. Enjoy your weekend reading! Networking Andrew Ward shares an Ansible role to block abusive subnets using IPSet. From this article on switching to WireGuard from Tailscale, I learned about Headscale (an open source implementation of the Tailscale control plane). Servers/Hardware Doug Dawson looks at some innovations that continue to improve computing power. Doug's article includes a few items I hadn't yet heard of. Security Bitwarden confirmed a compromise of its CLI package on NPM. First, we had CopyFail. Now we have Dirty Frag and Fragnesia. Daniel Stenberg talks about how Mythos found a single vulnerability--yes, just one--in curl. I don't really have words for this...security incident? That doesn't seem like the correct way to describe such a massive oversight, especially when you realize it happened to a cybersecurity agency. "Oops" doesn't even begin to describe it. Cloud Computing/Cloud Management Graham Gilbert insists Terraform is dead. I wonder what sorts of things the AWS MCP Server will make possible? William Collins argues in favor of AI through IaC rather than instead of it. I enjoyed this article. Collins indicates that while authoring IaC using LLMs is working rather well, managing infrastructure using LLMs is another story entirely. If you're at all interested in the intersection of LLMs and IaC, I'd add this to your reading list. Operating Systems/Applications Eric Sloof looks at using llama.cpp to run your own local, private AI stack on Apple Silicon. Mat Duggan examines his descent from artist to mercenary as a result of finding LLMs more useful than he exp ## Technology Short Take 195 DevFeed: [Technology Short Take 195]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-05-08T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [Artificial Intelligence](), [Large Language Model](), [Security](), [API keys](), [Automation](), [Kubernetes](), [networking](), [Ollama](), [Local AI]() Tags: [ai](), [api-keys](), [article](), [aws](), [blog](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [llm](), [networking](), [oci](), [ollama](), [security]() ### AI overview Technology Short Take 195 is a curated roundup of technology articles and posts, with an unplanned emphasis on AI and large language models. It covers API-key storage, AI tools and assistants, AI workflow automation, AI-agent security, Kubernetes security, networking, Ollama and local LLM experiments, Terraform versus OpenTofu, and cloud management. ### Source excerpt Welcome to Technology Short Take #195! It wasn't planned this way, but it seems like this Tech Short Take is heavily slanted toward AI/LLM-related articles and posts. Topics like security concerns around improper storage of API keys, how developers are using AI tools, spyware getting installed with AI assistants, and how AI/LLMs might be creating barriers to entry for new IT profesionals are all on tap this time around. I hope this unintentional focus doesn't prevent you from finding something useful! Networking Ivan Pepelnjak takes readers through the process of generating partial devices configurations with netlab. It's an older blog post, but it checks out--have a look at this walkthrough of Containerlab and Netlab. (Hat tip to Ivan for the link. Also, bonus points if you understood the reference at the start of this paragraph.) Ah, MTU issues...they don't go away if you migrate to Kubernetes. Security Sean Gallagher and Omid Mirzaei from Cisco Talos discuss how threat actors are misusing AI workflow automation. Before this article on vulnerability triage, I'd never heard of "brocards." Kelby Ludwig reminds folks that you don't want long-lived keys. Davi Ottenheimer tackles the claims about risk from Anthropic's Mythos preview. (Hint: the words "missing", "failed", "fluffy bunny", and "FUD" are involved.) William Collins reminds readers that they still need to pay attention to where they're storing sensitive data like API keys. Copy Fail has been making the rounds on lots of articles and blogs. Clément Nussbaumer looks at Copy Fail from the perspective of going from unprivileged Pod to root on a Kubernetes Node. Here's another one on Copy Fail, this time looking at blocking Copy Fail with Tetragon. Security is an arms race, and trying to secure AI agents is no different. The latest round in the race is a Falco project called Prempti. Cloud Computing/Cloud Management It's a good thing I came across this article about why friends don't let friends use Ollama. I had in ## Technology Short Take 194 DevFeed: [Technology Short Take 194]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-04-17T13:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [networking](), [Cryptography](), [Security](), [Vulnerabilities](), [eBPF](), [Kubernetes](), [Claude Code](), [TLS (Transport Layer Security)](), [ChaCha]() Tags: [article](), [aws](), [blog](), [cilium](), [claude-code](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [critical-infrastructure](), [cryptography](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [security](), [vulnerabilities]() ### AI overview Technology Short Take 194 curates data center technology links covering Reticulum, IPv6 networking, security exploits and vulnerabilities, TLS and QUIC diagrams, Kubernetes security, Claude Code advisories, AWS emulation, and developer tools. ### Source excerpt This is Technology Short Take #194, the latest in my semi-regular series of posts sharing data center technology-related links and articles from around the web. What have I gathered for readers this time? Key topics in Tech Short Take 194 include a new cryptography-based network stack, a look at why folks are revolting against AI, and an in-depth comparison of microVM technologies. On to the content! Networking This is cool. Longtime reader Todd Smith pointed me to Reticulum, a new cryptography-based network stack. Todd also spent some time messing around with Reticulum and shared his findings in two blog posts: first, an initial/introductory post, followed by a post sharing his experience with some Reticulum experiments. Scott Hogg examines building an IPv6 training and testing lab. Security eBPF is taking hold in security exploits, like the tool named "BPFdoor" that is penetrating critical infrastructure networks. Paul Meyer discusses reproducing and mitigating BadAML, an ACPI-based attack vector that can be used to potentially gain access to confidential VMs. Meyer admits that the model in the article assumes the attacker has full control over the host, at which point I would assume "game over" and move on. This site provides not only an illustrated TLS 1.2 connection diagram, but also offers diagrams for QUIC, DTLS, and TLS 1.3 (see the links in the upper right corner). Rory McCune continues his series on unpatchable Kubernetes vulnerabilities. David Chisnall posted a scathing analysis of Mythos on Mastodon (hat tip to Bruce Davie for boosting it into my timeline), and shared a link to an advisory on critical command injection vulnerabilities in Claude Code. Cloud Computing/Cloud Management I recently found this alternative to LocalStack for AWS emulation. How to hide regions and services in the AWS console is a useful thing to know about. Operating Systems/Applications Chris Down breaks down the differences between zswap and zram. Micah Kepe introduces his new ## 【分布式系统百科】分布式 KV 存储对比：etcd、TiKV 与 FoundationDB DevFeed: [【分布式系统百科】分布式 KV 存储对比：etcd、TiKV 与 FoundationDB]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-04-13T00:00:00Z Content type: comparison Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [etcd](), [Raft](), [Kubernetes]() Tags: [bbolt](), [boltdb](), [compaction](), [coreos](), [distributed](), [distributed-systems](), [errcompacted](), [etcd](), [go](), [k8s](), [kubernetes](), [lease](), [mmap](), [mvcc](), [raft](), [readindex](), [revision](), [single-raft-group](), [ssd](), [v3](), [wal](), [watch]() ### AI overview This Chinese-language comparison examines etcd, TiKV, and FoundationDB as distributed key-value stores for metadata. It focuses on architecture, implementation, performance, and limitations, with detailed coverage of etcd's single Raft group, MVCC, Watch, Lease, bbolt storage engine, linearizable reads, compaction, and defragmentation. ### Source excerpt 一个典型的架构评审场景：团队需要一个分布式键值存储来承载新系统的元数据。候选方案三个----etcd、TiKV、FoundationDB。三者都提供强一致性保证，都经过大规模生产验证，但设计目标截然不同。选错了，轻则性能不达标，重则数据丢失后无法恢复。这篇文章从架构、实现、性能和局限四个维度，把三个系统拆开来看。 ## Technology Short Take 193 DevFeed: [Technology Short Take 193]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-04-03T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [networking](), [Security](), [GitHub Actions](), [GitOps](), [ingress-nginx](), [Docker](), [litellm](), [Large Language Model]() Tags: [aws](), [blog-post](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [github-actions](), [gitops](), [go](), [iac](), [ingress-nginx](), [k8s](), [kubernetes](), [linux](), [litellm](), [networking](), [oci](), [security](), [technology]() ### AI overview Technology Short Take 193 is a curated roundup of data center technology links covering networking, IPv4 address space, consumer-router regulation, servers and hardware, security incidents involving Trivy and software supply chains, Ingress-NGINX migration, GitOps, local LLMs, and infrastructure management. ### Source excerpt Welcome to Technology Short Take #193! I know it has only been a couple weeks since the last Tech Short Take, but I am guessing that readers won't really mind another one. Here is my latest collection of articles and posts about data center-related technologies. Enjoy! Networking Brian Linkletter shares his 2026 list of network simulators and emulators. (Hat tip to Ivan P. for the link.) Emmanuel Vitus brings to light a battle over IPv4 address space and the control of the regional internet registries. Doug Dawson discusses the recent FCC ban on consumer-grade routers and the potential impacts to industry and ISPs. Servers/Hardware RIP Mac Pro. I had a "classic Mac Pro" (2012 era) for a long time, and I loved that system. (I even ran Linux on it for a while.) It is a shame to see it go. I mentioned on social media (Mastodon/Bluesky) that I recently purchased all the hardware for a new PC build. It'll be part PC/part home server, as I look to expand the type and scope of services that I self-host. Don't be surprised if a few articles emerge out of this. Security Trivy's GitHub Actions were compromised by attackers, leading to the exposure of CI/CD secrets. This post on the Socket blog has more details, and Rose Security has a write-up that provides more details on how a typosquatted domain and a fake version tag were involved. At least one other software supply chain exploit has been tracked back to the Trivy compromise: the Python litellm module on PyPI steals credentials. The Docker side of the Trivy compromise is shared in detail in this Docker blog post. Cloud Computing/Cloud Management Looking for some help in migrating away from Ingress-NGINX? This announcement of Ingress2Gateway 1.0 might be just what you are seeking. The FluxCD team published a post discussing Morgan Stanley's "Stairway to GitOps" presentation, which describes the firm's five-year journey from push-based pipelines to a self-service GitOps platform. Although I am not an AI fanboy, I do recogni ## Kubernetes 网络深度系列 DevFeed: [Kubernetes 网络深度系列]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-04-03T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [Linux](), [eBPF](), [VXLAN](), [gateway](), [nginx](), [traefik](), [Grafana]() Tags: [ebpf](), [gateway](), [grafana](), [index](), [k8s](), [kubernetes](), [linux](), [net-11](), [networking](), [nginx](), [return](), [series](), [service-mesh](), [traefik](), [vxlan]() ### AI overview A Chinese tutorial series explains Kubernetes networking from the Linux network stack through virtual devices, routing, tunnels, eBPF, CNI plugins, Services, security policies, service discovery, traffic management, performance tuning, and troubleshooting. It includes packet captures, code, and kernel-source references, with comparisons of major CNI and ingress approaches. ### Source excerpt 从 Linux 网络栈的第一个字节到多集群联邦网络的最后一跳----用代码、抓包和内核源码把 Kubernetes 网络讲透 ## Talking About Pulumi and Network Automation DevFeed: [Talking About Pulumi and Network Automation]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-24T14:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [Infrastructure as code](), [Network](), [Automation](), [Python]() Tags: [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [network-automation](), [networking](), [oci](), [podcast](), [pulumi](), [python](), [security]() ### AI overview The article introduces a Network Automagic podcast episode about Pulumi, its infrastructure-as-code model using general-purpose programming languages, and its potential role in network automation. It specifically discusses using Pulumi with Python for network automation tasks. ### Source excerpt Heard about Pulumi, but aren't sure what it is? Maybe you know a little bit about Pulumi--like that it does infrastructure as code (IaC), but using general purpose programming languages--and you're wondering where it fits in a larger automation framework? Or maybe you're a network engineer just starting to dabble in network automation, and you're wondering if this Pulumi thing is something you should check out. If any of these apply to you, then the latest Network Automagic podcast episode is right up your alley. I recently had the opportunity to join Steinn Bjarnarson and Urs Baumann for an episode of Network Automagic. The focus of our discussion--although I will say we diverged a bit here and there--was on Pulumi, what it is, and whether it fits into a larger network automation framework. After all, if you can use general purpose programming languages like Python with Pulumi, why not just use Pulumi in a Python program that also does network automation stuff? All in all, recording the podcast with Steinn and Urs was great fun, and I hope that the final product ends up being helpful for folks. There's a variety of ways to listen in on the episode: Via the Network Automagic web site Via the Network Automagic channel on YouTube (here is a link to the specific episode) Via Spotify Via Apple Podcasts As you can see, there are plenty of options to listen (and a few that I didn't include--check the Network Automagic web site for more!). Thanks to Steinn and Urs for having me on the show! ## Technology Short Take 192 DevFeed: [Technology Short Take 192]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-20T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [Network](), [Security](), [iOS](), [Kubernetes](), [AWS Lambda](), [GrapheneOS](), [Web](), [Cloud]() Tags: [article](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [ios](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [privacy](), [security](), [technology]() ### AI overview Technology Short Take 192 is a curated roundup of links about data center technology. It covers autonomous network engineering with Claude, an iOS exploit kit, Kubernetes security and Gateway API support in AWS Load Balancer Controller, AWS Lambda containers, container security for autonomous agents, software migration, GrapheneOS hardware prospects, Windows 12 reporting, and Linux. ### Source excerpt Welcome to Technology Short Take #192! Who's interested in some links to data center technology-related articles and posts? If that's you, you're in the right place. Here's hoping you find something useful! Networking Interested in an autonomous network engineering agent powered by Claude? (Hat tip to Russ S. for sending this my way.) Security Google's Threat Intelligence Group recently published some details around Coruna, an iOS exploit kit targeting a range of iOS versions and equipped with a number of potential exploits. As an example of one of the challenges around "default" secuity settings, Rory McCune highlights the fact that MicroK8s does not enable role-based access control. Bryce Kerley explains Web PKI--the infrastructure that powers secure connections on the modern Web. Mike Masnick writes about the massive surveillance stack hiding inside the "age verification" checks. Cloud Computing/Cloud Management I've had this article on AWS Lambda for the containers developer sitting in my read queue since first publication in 2023. (Sorry, Massimo.) I finally got around to reading it--really reading it, not just skimming it--and I found it to be helpful in helping me get a better grasp on Lambda. The AWS Load Balancer Controller recently gained support for Kubernetes Gateway API. This allows Kubernetes administrators to use AWS ALBs or NLBs for Gateway resources, and eliminates annotation-based configuration in favor of Custom Resource Definitions (CRDs). Operating Systems/Applications While using containers is certainly a step forward in securing autonomous agents--such as what NanoClaw is doing--I don't think it's enough on its own. Helpful, yes, but there is still more to do. Am I wrong? Does Gentoo's migration from GitHub to Codeberg--obstensibly due to Microsoft's AI emphasis--signal a turning point? The recent announcement of a partnership between Motorola and GrapheneOS opens the possibility for the privacy-focused smartphone OS to arrive on new hardware platfor ## Using Mitmproxy to Observe kubectl Traffic DevFeed: [Using Mitmproxy to Observe kubectl Traffic]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-04T22:30:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [Kubernetes](), [kubectl](), [Linux](), [Ubuntu](), [Authentication](), [Network](), [macOS](), [Amazon Web Services]() Tags: [apt](), [authentication](), [aws](), [certificates](), [cilium](), [cli](), [cloud](), [cni](), [commands](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubectl](), [kubernetes](), [linux](), [macos](), [networking](), [oci](), [security](), [tutorial](), [ubuntu]() ### AI overview This tutorial explains how to use mitmproxy to observe traffic between kubectl and the Kubernetes API Server. It describes the tested Linux and Ubuntu environment, notes that the commands should work similarly on macOS, and discusses extracting client certificates from a Kubeconfig file for certificate-based authentication. ### Source excerpt When I first started learning Kubernetes, I had the idea that observing the network traffic between a client system using kubectl and the Kubernetes API Server would be a useful thing to do. The source of the idea is unclear; I am unsure why I thought this would be useful as a learning tool. Regardless, I continued on with learning Kubernetes and never really pursued this idea--until this week. I found it can be a useful troubleshooting technique, but I will leave it up to you to determine if it is a useful learning technique. In this post, I will show you how to observe kubectl traffic using mitmproxy. This technique is inspired by/informed by Ahmet Alp Balkan's similarly-named blog post from 2019. Unfortunately, I found the instructions there to be incomplete (most likely just due to the passage of time and continued evolution of the tools involved). I used the following tools and environments in my testing: The tests were conducted on a Linux system running Ubuntu 24.04.4. The commands should work similarly on macOS. Mitmproxy was installed from the Ubuntu repositories using apt. kubectl version 1.33.3 was used to communicate to a self-managed cluster on AWS (in other words, not Amazon EKS) running Kubernetes 1.32.9. The cluster was bootstrapped using kubeadm. I wouldn't expect any major/significant differences with other versions of kubectl or Kubernetes. I was using a client certificate to authenticate to Kubernetes. It's unclear to me how this might work--if it works at all--with alternate authentication mechanisms. Prepare Client Certificates Before you can start mitmproxy, you'll first need to extract the client certificates from the Kubeconfig file. A couple of ways exist to do this; a blog post of mine from 2022 contains what I believe is the easiest way. The method involves yq (to extract information from the Kubeconfig) and base64 (to decode the client certificate and client key). Refer to the linked blog post for full details. First, extract the client cer ## Running the Azure CLI in a Container DevFeed: [Running the Azure CLI in a Container]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-02T13:00:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [Azure](), [Docker](), [Containers](), [Command-line interface](), [Python](), [configuration]() Tags: [aws](), [azure](), [cilium](), [cli](), [cloud](), [cni](), [configuration](), [container](), [containers](), [cri-o](), [devops](), [docker](), [docker-container](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [python](), [security](), [ssh]() ### AI overview This article examines running the Azure CLI in a container. It finds that the standard Docker command works for an interactive shell, but using an alias from the current shell requires persisting Azure configuration and SSH keys. Running as root can also create files with root ownership, potentially requiring a custom image; the author therefore returns to using a Python virtual environment. ### Source excerpt Like perhaps some readers, I am quite particular about what gets installed on my systems. I try to keep my systems as "clean" as possible, doing my best to avoid tools that have an extensive list of dependencies that must be installed and updated. Where that isn't possible--such as with the Azure CLI, which has a massive number of Python modules that are required in order for the tool to function--I will use various isolation mechanisms. For the Azure CLI, that's typically been a Python virtual environment. Somewhat recently, though, I had an idea to try using a container. In this post, I'll share what worked and what did not work when trying to run the Azure CLI in a container. First, though, a disclaimer: I am not an Azure expert, nor am I a Python expert. I know enough to get by. If I share something here that's incorrect, please contact me and constructively show me my errors so that I can fix them. Before I started down this path, I was sure this would be a slam dunk. I mean, this is what containers are for, right? If you do some web searches for running the Azure CLI in a container, you'll find articles that give you this command line: docker run -it mcr.microsoft.com/azure-cli (Note that this assumes you are using Docker instead of something like Podman.) This does work, as long as you're willing to operate in an interactive shell in the container. I was looking for something a bit different: I wanted to create an alias for az that executed the container in my current shell instead of putting me into a separate shell inside the container. Something like this, for example: alias az="docker container run --rm mcr.microsoft.com/azure-cli az" I quickly found that you need to map in your Azure configuration directory from outside the container, or your configuration won't persist. (In theory you could remove the --rm parameter and keep the container around.) Now the docker command in your alias starts to look like this: docker container run --rm -v ${HOME}/.azure:/r ## Technology Short Take 191 DevFeed: [Technology Short Take 191]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-02-27T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [networking](), [Ansible](), [Security](), [Infrastructure as code](), [Artificial Intelligence](), [Large Language Model](), [Containers](), [VXLAN]() Tags: [ai](), [ansible](), [aws](), [blog](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [gre](), [iac](), [k8s](), [kubernetes](), [linux](), [llm](), [network-automation](), [networking](), [oci](), [security](), [vxlan]() ### AI overview Technology Short Take 191 is a curated collection of commentary and links covering networking, network automation, security, cloud management, containers, operating systems, applications, AI adoption, and software vulnerabilities. ### Source excerpt Welcome to Technology Short Take #191! This is my semi-regular collection of links related to technology disciplines, including networking, security, cloud computing, storage, and programming/development. I hope that I've managed to curate an interesting and useful set of links for readers. Enjoy! Networking I learned a new acronym from Ivan Pepelnjak in his article on "not so passive" OPSFv2 interfaces in Cisco IOS/XR: QDS (Quick and Dirty Solution). I am totally using that from now on. Via Ivan (hat tip to my colleague Russ for pointing me in this direction), I also learned that all is not well in network automation land with Ansible. Although some parts of it are apparently now resolved, this does raise questions about the viability of Ansible for network automation. Doug Dawson talks about the new Amazon Eero Signal, a cellular backup to a primary broadband connection for users using their Eero mesh systems. I agree with Doug--the pricing seems high to me. I generally like the Eero devices, although there have been times when I really could use a bit more control over the settings. Security The APNIC blog features a guest article discussing the use of tunneling protocols to infiltrate networks. The article specifically discusses Generic Routing Encapsulation (GRE) and Virtual Extensible LAN (VXLAN). It's worth a read if your network uses either of these technologies. Cloud Computing/Cloud Management Somewhere along the way I missed the CDK deprecation announcement. If I am not mistaken, this leaves Pulumi as the only cloud-independent IaC tool that lets you use a general purpose programming language. Managing dependencies between containers can be difficult at times; this blog post by Nicolas Fränkel introduced me to wait4x, a tool one can use to help simplify these types of situations. Operating Systems/Applications I appreciated reading Mitchell Hashimoto's AI adoption journey. I feel it does provide a more realistic approach to how someone in a role like his m ## Keycloak 26.5.3 released DevFeed: [Keycloak 26.5.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-02-10T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [JSON Web Tokens](), [Security](), [Authentication](), [upgrade](), [migration](), [Kubernetes](), [Mocha](), [Quarkus](), [ci](), [Hibernate](), [YAML]() Tags: [2025](), [authentication](), [authorization](), [ci](), [hibernate](), [idm](), [jwt](), [k8s](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [node-js](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso](), [upgrade](), [yaml]() ### AI overview Keycloak 26.5.3 is a February 10, 2026 release that includes security fixes for JWT authorization grants, invitation JWTs, identity-provider ownership checks, and other resolved issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ Enhancements #45892 Upgrade minikube for CI tests operator Bugs #44379 Node.js admin client does not refresh tokens admin/client-js #45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus #45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus #45677 Hibernate Validator is enabled by default when not used dist/quarkus #45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite #45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci #45755 Broken YAML indentation in operator rolling updates doc docs #45780 Remove fatal log messages from `ConsistentHash` [Next page]()