Skip to content

Instantly share code, notes, and snippets.

View aojea's full-sized avatar

Antonio Ojea aojea

View GitHub Profile
aojea /
Last active May 1, 2024 20:29
Poor man container/ network namespaces

Useful for troubleshooing network namespaces problems without having to create containers and the additional functionality


netns_add ns1
netns_add ns2

ping -c 2
PING ( 56(84) bytes of data.
aojea /
Last active April 22, 2024 05:03
kube-proxy nftables and iptables vs a Service with 100k endpoints

kube-proxy nftables and iptables vs a Service with 100k endpoints


Iptables performance is limited mainly by two reasons:

The kernel community moved to nftables as replacement of iptables, with the goal of removing the existing performance bottlenecks. Kubernetes has decided to implement a new nftables proxy because of this and another reasons explained in more detail in the corresponding KEP and during the Kubernetes Contributor Summit in Chicago 2023 on the session [Iptables, end of

  1. Deploy the backends with the number of replicas we desire (we can always use kubectl later to scale up or down)
kubectl apply -f backend.yaml
  1. I recommend use the ClusterIP the Service and not depend on DNS since we just want to test the IP traffic
kubectl get service
aojea /
Last active April 13, 2024 14:52
Kubernetes DNS: Headless services with large number of endpoints

Kubernetes DNS at scale

It seems that is a common practice in HPC and AI/ML environments that use MPI applications to populate a hosts files with all the nodes on the cluster and copy it over all the nodes, ref

It is my observation that in Kubernetes, Headless Services are used to implement this Service Discovery This is very handy because it allows to reference a pod by hostname without having to copy over a generace /etc/hosts.

There must also be an A record of the following form for each ready endpoint with hostname of and IPv4 address . If there are multiple IPv4 addresses for a given hostname, then there must be one such A record returned for each IP.

aojea / daemonset.yaml
Created December 3, 2023 16:18
Daemonset to reconcile nodes ethtool configuration
# See for more options
apiVersion: apps/v1
kind: DaemonSet
name: node-ethtool
namespace: kube-system
k8s-app: node-ethtool-config
aojea / features.diff
Last active November 27, 2023 14:07
Kubernetes features evolution
diff --git a/cmd/genfeatures/genfeatures.go b/cmd/genfeatures/genfeatures.go
new file mode 100644
index 00000000000..953305e2715
--- /dev/null
+++ b/cmd/genfeatures/genfeatures.go
@@ -0,0 +1,43 @@
+Copyright 2023 The Kubernetes Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
aojea / hostport_deployment.yaml
Created October 19, 2023 10:46
hostport udp pods
apiVersion: apps/v1
kind: Deployment
name: server-deployment
app: MyApp
replicas: 2
aojea /
Last active December 27, 2023 02:41
Kubernetes ServiceCIDR KEP-1880
aojea /
Created September 11, 2023 18:10
Obtain coredump from an application
kubectl get pods -A -o wide | grep dns
kube-system   kube-dns-5bfd847c64-bkkhf                           4/4     Running   0             80m    gke-vanilla-default-pool-ddebe65c-pkzw   <none>           <none>
kubectl debug -n kube-system -it kube-dns-5bfd847c64-bkkhf --image=busybox:1.28 --target=dnsmasq
Targeting container "dnsmasq". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
Defaulting debug container name to debugger-qz6cb.
If you don't see a command prompt, try pressing enter.
aojea / service_selector.yaml
Created August 27, 2023 19:05
Service selector
apiVersion: v1
kind: Pod
name: job1
job-name: "job1"
job-index: "0"
hostNetwork: true