Blog

Migrating a Kubernetes-deployed nginx proxy that dispatches HTTPS traffic by header value to a GCP global external Application Load Balancer using Internet NEGs and URL-map header matches.

Kubernetes canary deployment patterns: running v1 and v2 pods side by side with traffic split by replica count, header-based tenant targeting via Istio VirtualService and NGINX Ingress annotations, backward-compatible schema changes for shared databases, and rollback via traffic shift.

How cert-manager issues Let's Encrypt certificates in Kubernetes: the Certificate to CertificateRequest to Order to Challenge lifecycle, the temporary HTTP-01 solver pod, Service and Ingress, the internal self-check, and finalization back to a TLS Secret. Covers both HTTP-01 and DNS-01 ClusterIssuer setup.

Recovering a Kubernetes PersistentVolumeClaim stuck in Terminating state. Covers inspecting pvc-protection and external-provisioner finalizers, DeletionTimestamp, ClaimRef mismatches, and the field-selector query that surfaces the Pod or volume attachment still holding the mount.

Everyday kubectl and Helm reference on Debian 12. Covers apt repository setup for both tools, Helm chart operations such as values export and chart archive unpack, and other snippets I reach for from muscle memory.