Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
What's New in Kubernetes 1.33–1.37: Native Sidecars, In-Place Resize, preStop Sleep, Gateway API and Life After ingress-nginx
The changes in Kubernetes 1.33–1.37 that matter most to app developers are native sidecars (1.33), preStop sleep (1.34), in-place resize (1.35), user namespaces (1.36) and HPA tolerance (1.37). With real output we see a sidecar ignoring SIGTERM stretch a Job to 39 seconds, the externalIPs and Endpoints deprecations, KYAML, the ingress-nginx retirement and Gateway API v1.7.
Reading Old Kubernetes Manifests: dockershim, PodSecurityPolicy and Removed APIs (1.16–1.25)
Converting 2018–2021-era manifests takes more than changing apiVersion: apps/v1 requires a selector, kubectl convert writes the old defaults (infinite progressDeadlineSeconds, maxUnavailable: 1) into the manifest, and Ingress backends changed shape. With real output we see that the dockershim removal didn't affect Docker images, replace PodSecurityPolicy with Pod Security Admission and scan with pluto.
End to End: Taking a .NET + Angular App to Managed Kubernetes (AKS, EKS, GKE) and a Production Checklist
On managed Kubernetes the control plane stays with the provider; if you use node identity for image pulls and workload identity for cloud access, not a single cloud secret is left in the pipeline or the cluster. We cover AKS, EKS and GKE differences, an OIDC deploy-to-AKS workflow validated with actionlint, deprecated API clients that pluto can't see, and a production checklist as code that runs on kind.
Debugging in Kubernetes: CrashLoopBackOff, ImagePullBackOff, Pending and kubectl debug
Pod failures always follow the same order: read the symptom with get, the events with describe, the app's voice with logs --previous, and if needed bring an ephemeral container into a shell-less pod with kubectl debug. With real output we cover Pending, ImagePullBackOff, CrashLoopBackOff, OOMKilled and a port mismatch, a .NET process hanging as PID 1, and dotnet-dump killing a pod that runs near its limit.
Kubernetes Security: ServiceAccounts, RBAC, Pod Security Standards, securityContext and NetworkPolicy
Give every app its own ServiceAccount, don't mount the token unless needed, protect the namespace with restricted Pod Security Standards, and after a default deny NetworkPolicy open only the paths you need. With real kind output we test RBAC with kubectl auth can-i, catch the aspnet:10.0 image running as root, see what readOnlyRootFilesystem does to .NET Data Protection, try user namespaces and hit a default deny that forgot DNS.
Environments with Kustomize: Bases, Overlays, Image Tags and configMapGenerator
With Kustomize shared manifests live in a base, each environment writes only its differences in an overlay, and configMapGenerator's hash suffix triggers a rollout when config changes. With real output we share an HPA/PDB through a component, compare JSON Patch with strategic merge patch, run kustomize edit set image in CI, and watch commonLabels change a selector and take the service down through a half-finished apply.
Jobs, CronJobs and Workers: Running an EF Core Migration Bundle as a Job
Run EF Core migrations once, in a versioned Job at the start of the deploy, not in every replica's init container; in our test the EF Core 9+ migration lock did not stop concurrent init containers from racing. With real output we package the bundle in a chiseled image, tune backoffLimit and TTL, hit Job immutability, write a pipeline script that catches Complete/Failed, and set up a CronJob with timeZone.
Storage and Stateful Apps in Kubernetes: Volumes, PersistentVolumeClaims, StatefulSets and the Database Decision
If several replicas must write the same files, the answer is object storage, not a PVC; ReadWriteOnce means one node, not one pod. With real output we look at emptyDir sizeLimit eviction, StorageClasses and reclaim policy, PostgreSQL 18 on a StatefulSet (including the new PGDATA path), managed DB versus operator, and the ASP.NET Core Data Protection key ring breaking across replicas.
Scaling in Kubernetes: HPA, VPA, In-Place Resize, KEDA and PodDisruptionBudgets
HPA computes CPU percent against the container's request, not the node, and without a request it never scales. With real kind output we look at HPA v2 behavior settings, the .NET GC not seeing the new limit after an in-place resize and the GC.RefreshMemoryLimit fix, KEDA scale-to-zero on a RabbitMQ queue, a PodDisruptionBudget that locks a drain, and a topology spread trap.
Graceful Shutdown: SIGTERM, terminationGracePeriodSeconds, preStop and .NET HostOptions
When a pod is deleted, SIGTERM and removal from endpoints start at the same time with no synchronization; that race caused 23 to 26 errors in an otherwise correct rollout, and a 5-second preStop sleep action brought it to zero. With real output we watch .NET finish requests and BackgroundServices in order on SIGTERM, see how ShutdownTimeout and the grace period cut each other off, and why exec sleep fails in a chiseled image.
Resource Requests and Limits: QoS, OOMKilled, CPU Throttling and the .NET GC in Containers
A request tells the scheduler how much room to reserve and a limit tells the kernel a ceiling that can't be crossed; exceeding memory means OOMKilled, hitting the CPU limit means throttling. With real output we see a 500m limit drop .NET's ProcessorCount to 1 and turn Server GC off, the heap limit at 75 percent of the limit, managed OutOfMemoryException versus native OOMKilled, the GCHeapHardLimitPercent hex trap, throttling and quotas.
Kubernetes Health Probes: Startup, Liveness, Readiness and ASP.NET Core Health Checks
A startup probe waits for startup, liveness restarts a stuck process and readiness pulls a pod out of traffic; in ASP.NET Core tagged health checks give each probe its own endpoint. With real output we watch a 40-second warm-up fall into an endless restart loop under liveness, reach zero restarts with a startupProbe, see a database check in liveness cause four restarts per pod in two minutes, and do the math on probe timings.