Today I Learned — one small thing at a time, newest first.
GitHub Container Registry throttles pulls per namespace, namespace is the organization or user that owns the image. Every pull of every image under one owner draws from a single bucket. Cross the limit and pulls start failing with 429 Too Many Requests (TOOMANYREQUESTS).
k3s does not taint its server nodes. Unlike a kubeadm cluster, a k3s control-plane node has no node-role.kubernetes.io/control-plane:NoSchedule, so it is schedulable and ordinary workloads land on it. On my Pi cluster I found regular pods sharing the control-plane node with the k3s server.
On Alibaba Cloud PrivateLink, take the NLB out of one zone and the endpoint in the other account can keep sending traffic into that dead zone. The endpoint's DNS record for the zone is not pulled, and the traffic blackholes.
A regional ESSD disk on Alibaba Cloud replicates data synchronously across zones in the same region, so the volume survives a single zone going down. I only just learned you can back a Kubernetes PersistentVolume with one, which gives a stateful workload real cross-zone durability.
On Alibaba Cloud PrivateLink you do not choose an endpoint's zones freely. Zones flow one way, from the load balancer outward, and each layer can only use the zones the layer beneath it already has.
When a pod has no shell (distroless or scratch), you can still get inside it
with an ephemeral container instead of rebuilding the image: