Kubernetes and Container Orchestration

Kubernetes is a runtime orchestrator, not a platform strategy. Treating it as the latter is how organizations end up with a healthy control plane and a system that still cannot deploy on a Friday afternoon. The articles in this collection separate what Kubernetes actually solves — pod scheduling, service discovery, declarative reconciliation — from what it leaves to the team around it: governance, identity, cost attribution, incident response.

Patterns content focuses on primitives that matter regardless of distribution. Workload Identity Federation as the replacement for long-lived service-account tokens. Pod Security Admission as the successor to PodSecurityPolicy that most clusters still pretend they migrated from. NetworkPolicy as the default rather than the exception, with the egress rules that catch the data-exfiltration paths most teams forget exist.

Control plane versus data plane is a recurring distinction. The control plane defines intent; the data plane runs the work; failures look identical from a kubectl get pods perspective and require entirely different responses. Articles cover where API server throttling, etcd object churn, and CNI plugin behavior become the limit rather than the workload itself.

Ecosystem maturity gets honest treatment. Service meshes solve real problems and introduce real failure modes; CRDs let an operator extend the API and let a misbehaving controller take down a namespace. The content names which extensions justify their operational cost in production and which look better in a conference talk than in an on-call rotation.

For AKS-specific operational content — node pool design, Azure CNI behavior, upgrade mechanics — see the AKS tag. This collection stays at the Kubernetes layer: the patterns and trade-offs that apply whether the cluster runs on Azure, on-premises, or somewhere in between.