Infrastructure that fails safely.

Eviction is the kubelet reclaiming a node, not the scheduler rebalancing a cluster. Which pressure fired, why the victims look random, and why the pod lands straight back on the node that just threw it out.

A pod bound to 127.0.0.1 passes every check Kubernetes runs and answers none of your traffic. How to read the failure mode, the one test that halves the problem, and why a successful curl can be the strongest evidence you have a bug.

You change a value, helm upgrade succeeds, and nothing restarts. Why a ConfigMap edit is invisible to Kubernetes, how one annotation makes it visible, and the rollback semantics that trick does not give you.

Two fresh Linux kernel LPEs - Copy Fail and Dirty Frag - both turn an unprivileged pod into root on the node. The defense is a stack of boring controls you can turn on today.

httputil.ReverseProxy is 200 lines from production-grade. We add retries, circuit breaking and request tracing in one sitting.