Topic
Pod-to-pod connectivity, the flat pod network model, and how packets traverse pods and nodes in a Kubernetes cluster.
Solo's agentgateway runs Coraza as a shared extension, and the write-up's own warning is that a WAFPolicy without HeadersAndBody mode and a JSON body processor will pass every payload while looking healthy.
Reality
Written as separate entries, a country check and a model allowlist become alternatives, so a caller from a restricted jurisdiction gets through by naming an approved model, and the policy still reports Accepted and Attached.
Reality
AWS ends App Mesh support in September 2026. One team scored the replacements on weighted criteria, wrote a rollback for every step, and moved about 40 services in two phases with no outage.
Reality
A guide rebuilding browser OIDC login off ingress-nginx keeps its Gateway and HTTPRoute objects intact and hands the 401-to-302 step to two Traefik middlewares. Swap the controller and that half gets rewritten.
Reality
On a kind cluster where kube-proxy was never installed, Cilium 1.17.3 forwards Services with no KUBE-SERVICES chain at all, so the grep that returns 13 rules elsewhere returns nothing while the app stays up.
Reality
The release jumps two Gateway API minor versions to v1.6 and adds ExternalAuth, CORS filters, ListenerSets and non-HTTP route types. What is left of the case for a separate ingress tier is the annotations you cannot port.
Reality
Cilium 1.19 puts routing, mTLS and observability in one eBPF program per node, with a single Envoy per node for Layer 7. The 100 GB of RAM the post says that frees assumes 1,000 pods at the top of the sidecar range.
Reality
Helm charts and container images keep working after March 2026, but the patch stream stops, and the recommended replacement is a specification rather than software, so every team now picks its own controller.
Reality
Adyen traced sandbox setup failures on its big data clusters to a garbage collector that walks every tracked connection in order, which turns the table-size knob you raised for headroom into part of the fault.
Reality
In-place Pod resizing is GA and the kubelet can now issue pod certificates itself, but the fix for feature skew between control plane and nodes is still alpha. Read the removals list first.
Reality
One operator flipped Cilium to full kube-proxy replacement and woke at 2:47 AM to a SIEM ingesting zero events. The cluster was healthy. The evidence pipeline was not.
Reality
A dev.to walkthrough traces one packet from 10.244.1.5 to 10.244.2.5. The operationally useful part is not the hop count, it is which route table or outer header you get to read.
Reality