Release Channel
Picking the stable channel does not opt you out of upgrading. It buys validation time — and the newest channel can sit outside the provider’s SLA.
-
-
There Is No Deny Rule: Isolation, Policy, and Upgrades on a Shared Cluster
Granting edit in a namespace grants every identity in it. A network policy with no plugin behind it does nothing, and the API will not tell you which.
-
Version Skew
A kubelet may be three minor versions behind the API server — but stay there and it must be upgraded before the control plane can move at all.
-
Network Policy
Policies are additive with no deny rules, both ends of a connection must allow it, and a default-deny egress rule blocks DNS until you allow that too.
-
Ephemeral by Default: Networking, Storage, and Staying Alive on Kubernetes
Access modes are matching hints, not enforcement. Requests are a scheduling claim, not usage. Exceeding CPU delays you; exceeding memory kills you.
-
Readiness Probe
Readiness stops traffic; liveness restarts the container. Putting a dependency check in the wrong one is how a slow service becomes an outage.
-
Nobody Is Running Your Manifest: How Kubernetes Reconciles Declared State
Your apply returned success and nothing happened. Nothing was running the manifest — a loop was, and ten minutes later it is still trying.
-
Label Selector
A selector that matches nothing is a valid query with an empty result. So the symptom of a typo is silence, not a validation error.
-
Control Loop
No participant in the chain knows whether the overall goal was met. So when nothing happens, the first question is which loop stopped making progress.
-
Desired State
A declaration has no return value and no completion event. What tells you whether it worked is the gap to actual state, and how long it has stayed open.