Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Kubernetes Pods: Running a .NET Container, Lifecycle, Init Containers and Native Sidecars
A pod is the unit of execution for containers sharing one network; .NET 8+ images listen on 8080, chiseled images come non-root and shell-less, while the full aspnet image trips runAsNonRoot. With real output we look at pod phases, CrashLoopBackOff's doubling backoff, the limits of a wait-for-db init container, native sidecars (stable in 1.33) and why a sidecar that ignores SIGTERM stretches pod deletion by 30 seconds.
.NET Configuration with ConfigMaps and Secrets: Environment Variables, Volumes and Picking Up Changes
ConfigMaps and Secrets enter .NET configuration as environment variables (ConnectionStrings__Default) or as files in a volume; env and subPath mounts never update, directory mounts update in 10 to 80 seconds. Measured on kind, .NET 10's default watcher missed the ConfigMap change while the polling watcher caught it. We also cover the provider order trap, triggering rollouts, immutable ConfigMaps, base64 not being encryption and Angular's config.json.
Graceful Shutdown: SIGTERM, terminationGracePeriodSeconds, preStop and .NET HostOptions
When a pod is deleted, SIGTERM and removal from endpoints start at the same time with no synchronization; that race caused 23 to 26 errors in an otherwise correct rollout, and a 5-second preStop sleep action brought it to zero. With real output we watch .NET finish requests and BackgroundServices in order on SIGTERM, see how ShutdownTimeout and the grace period cut each other off, and why exec sleep fails in a chiseled image.
Scaling in Kubernetes: HPA, VPA, In-Place Resize, KEDA and PodDisruptionBudgets
HPA computes CPU percent against the container's request, not the node, and without a request it never scales. With real kind output we look at HPA v2 behavior settings, the .NET GC not seeing the new limit after an in-place resize and the GC.RefreshMemoryLimit fix, KEDA scale-to-zero on a RabbitMQ queue, a PodDisruptionBudget that locks a drain, and a topology spread trap.
Storage and Stateful Apps in Kubernetes: Volumes, PersistentVolumeClaims, StatefulSets and the Database Decision
If several replicas must write the same files, the answer is object storage, not a PVC; ReadWriteOnce means one node, not one pod. With real output we look at emptyDir sizeLimit eviction, StorageClasses and reclaim policy, PostgreSQL 18 on a StatefulSet (including the new PGDATA path), managed DB versus operator, and the ASP.NET Core Data Protection key ring breaking across replicas.
Jobs, CronJobs and Workers: Running an EF Core Migration Bundle as a Job
Run EF Core migrations once, in a versioned Job at the start of the deploy, not in every replica's init container; in our test the EF Core 9+ migration lock did not stop concurrent init containers from racing. With real output we package the bundle in a chiseled image, tune backoffLimit and TTL, hit Job immutability, write a pipeline script that catches Complete/Failed, and set up a CronJob with timeZone.
Kubernetes Security: ServiceAccounts, RBAC, Pod Security Standards, securityContext and NetworkPolicy
Give every app its own ServiceAccount, don't mount the token unless needed, protect the namespace with restricted Pod Security Standards, and after a default deny NetworkPolicy open only the paths you need. With real kind output we test RBAC with kubectl auth can-i, catch the aspnet:10.0 image running as root, see what readOnlyRootFilesystem does to .NET Data Protection, try user namespaces and hit a default deny that forgot DNS.
Debugging in Kubernetes: CrashLoopBackOff, ImagePullBackOff, Pending and kubectl debug
Pod failures always follow the same order: read the symptom with get, the events with describe, the app's voice with logs --previous, and if needed bring an ephemeral container into a shell-less pod with kubectl debug. With real output we cover Pending, ImagePullBackOff, CrashLoopBackOff, OOMKilled and a port mismatch, a .NET process hanging as PID 1, and dotnet-dump killing a pod that runs near its limit.