Tag · 12 posts
A Go controller switches an approved Kubernetes webhook to Ignore after repeated failures and restores its policy after recovery. Admission continues, but requests still pay the webhook timeout.
A mutating webhook gives a Tekton build step and Docker-in-Docker sidecar one Pod-level resource budget, then verifies the limits in node cgroups.
An out-of-tree kube-scheduler plugin that reserves node capacity across a Tekton PipelineRun's full lifetime, closing a gap none of Tekton's own coschedule modes cover on their own.
Closing the series: what six parts proved, the two scaling questions still untested, and the remaining exec-probe and production-kernel boundaries.
Correlating socket syscalls and kubelet probe attempts into the merged timeline, then fixing a real cgroup-attribution bug that left most of those events unresolved.
How the profiler retains pod-startup evidence after deletion, verified by reconstructing a deleted three-pod Tekton PipelineRun with `--timeline`.