Zufar's Notes

GHCR rate-limits 40k/minutes

Zufar Dhiyaulhaq — Wed, 16 Sep 2026 00:00:00 +0000

GHCR rate-limits 40k/minutes

GitHub Container Registry throttles pulls per namespace, namespace is the organization or user that owns the image. Every pull of every image under one owner draws from a single bucket. Cross the limit and pulls start failing with 429 Too Many Requests (TOOMANYREQUESTS).

k3s leaves the control plane schedulable, so taint it

Zufar Dhiyaulhaq — Sat, 12 Sep 2026 00:00:00 +0000

k3s leaves the control plane schedulable, so taint it

k3s does not taint its server nodes. Unlike a kubeadm cluster, a k3s control-plane node has no node-role.kubernetes.io/control-plane:NoSchedule, so it is schedulable and ordinary workloads land on it. On my Pi cluster I found regular pods sharing the control-plane node with the k3s server.

Alibaba NLB disabled zone, PrivateLink getting blackholed

Zufar Dhiyaulhaq — Thu, 10 Sep 2026 00:00:00 +0000

Alibaba NLB disabled zone, PrivateLink getting blackholed

On Alibaba Cloud PrivateLink, take the NLB out of one zone and the endpoint in the other account can keep sending traffic into that dead zone. The endpoint's DNS record for the zone is not pulled, and the traffic blackholes.

Alibaba Cloud has regional disks, and Kubernetes can use them

Zufar Dhiyaulhaq — Mon, 07 Sep 2026 00:00:00 +0000

Alibaba Cloud has regional disks, and Kubernetes can use them

A regional ESSD disk on Alibaba Cloud replicates data synchronously across zones in the same region, so the volume survives a single zone going down. I only just learned you can back a Kubernetes PersistentVolume with one, which gives a stateful workload real cross-zone durability.

Alibaba PrivateLink zones cascade from the NLB

Zufar Dhiyaulhaq — Mon, 07 Sep 2026 00:00:00 +0000

Alibaba PrivateLink zones cascade from the NLB

On Alibaba Cloud PrivateLink you do not choose an endpoint's zones freely. Zones flow one way, from the load balancer outward, and each layer can only use the zones the layer beneath it already has.

kubectl debug attaches an ephemeral container

Zufar Dhiyaulhaq — Sun, 06 Sep 2026 00:00:00 +0000

kubectl debug attaches an ephemeral container

When a pod has no shell (distroless or scratch), you can still get inside it with an ephemeral container instead of rebuilding the image:

bash kubectl debug -it <pod> --image=busybox:1.36 --target=<container>