Kube-Oddities - the quirks that keep Kubernetes interesting
summary
Sidecar containers are actually implemented as a special init with restartPolicy: Always, not a new field; Kubernetes resolves image references by SHA even if the human-readable tag differs so the tag can lie; configMap and secret volume keys use inconsistent names causing endless copy/paste bugs; memory-backed emptyDir can exhaust a node if containers lack limits; pod names aren’t in cluster DNS except via headless services (podname.service); token-request JWTs tied to a service account can be effectively non‑revocable; admission webhooks can take down the API server.
AI-written summary · about
chapters (13)
- 0:00Introduction to Kube-Oddities
- 2:35Sidecar containers quirks
- 6:04Image tags vs SHA confusion
- 7:49Pod volume naming inconsistency
- 8:50EmptyDir memory exhaustion risk
- 9:32Pod DNS and headless services
- 12:00Default DNS policy oddity
- 13:24Irrevocable credentials flaw
- 15:35RBAC escalate verb misuse
- 17:01Admission webhook dangers
- 19:07Containerd pod sandbox confusion
- 21:37Static manifests and hidden pods
- 25:29Resources and Q&A
related talks
33mMagic of Kubernetes Sidecar Injection: Present and Future - Anton Ovchinnikov
35m10 Weird Ways to Blow Up Your Kubernetes
29mThe Great Sidecar Debate
27mPragmatic Pod Patterns: Leveraging sidecar containers in Kubernetes
19mTalk Deep Dive
48mThe Path Less Traveled: Abusing Kubernetes Defaults
25mSidecars at Netflix: From Basic Injection to First Class Ci...
25mRelease the Kraken: Bring Sidecar Containers to Next Level