Kubernetes

📖 Series Navigation: ← Previous Chapter: Part 9 — Cookie vs. SessionStorage vs. LocalStorage | Series Hub Part 10: Envoy Gateway vs. Cilium eBPF Service Mesh: Kernel Performance & Layer 7 Governance Showdown Answer-first: Envoy Gateway excels as a North-South Edge API Gateway with dedicated Envoy pods for advanced L7 policies (WAF, JWT, rate limiting, AI token quotas). Cilium eBPF dominates East-West cluster networking by bypassing the TCP/IP stack via sockops and cutting 92% RAM with node-level Envoy daemons. The 2026 standard combines both. ...

Tech Radar: eBPF Zero-Trust Security for AI Agents with Tetragon 1.4 Answer-First: Granting tool-execution permissions to AI Agents dramatically expands the attack surface for Remote Code Execution (RCE) via Indirect Prompt Injection. Cilium Tetragon 1.4 leverages eBPF probes inside the Linux kernel to intercept unauthorized system calls (execve, socket, openat), executing in-kernel SIGKILL enforcement in under 15 microseconds before malicious payloads can spawn reverse shells or exfiltrate credentials. 1. The Emerging Threat Vector: Autonomous Agent Prompt Injection RCE In modern agentic architectures, autonomous agents are granted tool execution permissions across the host environment: ...

Tech Radar: NIST AI 600-1 & OWASP ASI01–ASI10 — Hardening Enterprise Agent Gateways in Kubernetes Answer-first: Deploying autonomous AI agent swarms into enterprise Kubernetes clusters demands a paradigm shift from Least Privilege to Least Agency. By unifying NIST AI 600-1 (the 12 GenAI Risk Categories across GOVERN/MAP/MEASURE/MANAGE) with the OWASP ASI Top 10 (2026 Agentic Security Standards), production architectures enforce a 4-tier defense: L7 Kubernetes Gateway API with CEL expressions for tool parameter sanitization, SPIFFE/SPIRE for ephemeral Non-Human Identity (NHI) mTLS attestation, and Cilium Tetragon eBPF for real-time Linux kernel syscall termination (SIGKILL < 15µs). ...

Go pprof in Kubernetes: Remote Profiling & Flame Graphs Answer-first: Remote Go pprof profiling in Kubernetes uses secure kubectl port-forwarding, continuous CPU/memory profile collection, and flame graph analysis to identify production goroutine leaks. You’ve instrumented your Go service with net/http/pprof, run go tool pprof locally against the development binary, and spotted the hot path in your flame graph. Then you deploy to Kubernetes and the bottleneck disappears — because the workload profile in Kubernetes differs from local testing (different request mix, connection pool pressure, GC behavior under actual memory pressure, scheduler interference from co-located pods). ...

Self-Hosting GraphHopper on Kubernetes with OSM Data Answer-first: Self-hosting GraphHopper routing engines on Kubernetes uses initContainers for S3 graph cache hydration, JVM heap tuning, and HPA auto-scaling to process heavy routing traffic. Sizing pods with 4GB off-heap memory and 1GB JVM heap for country-level OpenStreetMap data achieves sub-50ms routing queries while cutting commercial map API costs by over 95%. GraphHopper is arguably the most capable open-source routing engine available — it supports Contraction Hierarchies (CH) for sub-millisecond route queries, custom vehicle profiles, turn restrictions, and the full OpenStreetMap road network. The problem most teams encounter is not the algorithm; it is the operational challenge of running it in Kubernetes: loading a large OSM PBF file, sizing JVM memory correctly, handling the long CH pre-processing startup time, and updating map data without downtime. ...