Today I Learned — one small thing at a time, newest first.
You do not have to edit every deployment to put a sidecar annotation on your workloads. Istio's injector can stamp a fixed annotation onto every pod it injects, from one place in the mesh config: values.sidecarInjectorWebhook.injectedAnnotations.
Istio's usual rule is that a pod annotation overrides the mesh default. The sidecar injector's injectedAnnotations is the exception: when the mesh config and a pod set the same annotation, the mesh-wide value wins.
You can create custom request/response Header in Istio via VirtualService. apart from static value, we can use Envoy's command operators on headers.request.set and headers.response.set. the same %XXX% you use in access logs, so you can add connection metadata onto a request without writing an EnvoyFilter.
GitHub Container Registry throttles pulls per namespace, namespace is the organization or user that owns the image. Every pull of every image under one owner draws from a single bucket. Cross the limit and pulls start failing with 429 Too Many Requests (TOOMANYREQUESTS).
k3s does not taint its server nodes. Unlike a kubeadm cluster, a k3s control-plane node has no node-role.kubernetes.io/control-plane:NoSchedule, so it is schedulable and ordinary workloads land on it. On my Pi cluster I found regular pods sharing the control-plane node with the k3s server.
On Alibaba Cloud PrivateLink, take the NLB out of one zone and the endpoint in the other account can keep sending traffic into that dead zone. The endpoint's DNS record for the zone is not pulled, and the traffic blackholes.
A regional ESSD disk on Alibaba Cloud replicates data synchronously across zones in the same region, so the volume survives a single zone going down. I only just learned you can back a Kubernetes PersistentVolume with one, which gives a stateful workload real cross-zone durability.
On Alibaba Cloud PrivateLink you do not choose an endpoint's zones freely. Zones flow one way, from the load balancer outward, and each layer can only use the zones the layer beneath it already has.
When a pod has no shell (distroless or scratch), you can still get inside it
with an ephemeral container instead of rebuilding the image: