https://lukehebert.com/category/cloud-platform/Recent content in Cloud-Platform on Luke HebertHugoen-usThu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-default-dns-server-ec2/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-default-dns-server-ec2/Explains how the AWS default DNS server works for EC2 instances within a VPC, including the special 169.254.169.253 address and the CIDR-based resolver IP.https://lukehebert.com/post/aws-instance-metadata/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-instance-metadata/An overview of the AWS EC2 Instance Metadata Service (IMDS), including its link-local address and the difference between IMDSv1 and IMDSv2 access.https://lukehebert.com/post/aws-user-data-address/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-user-data-address/Explains how to access AWS EC2 user data from within an instance using the instance metadata service. Covers the metadata endpoint, a curl example, and where the user data script is stored on Linux and Windows.https://lukehebert.com/post/understanding-how-pods-talk-in-kubernetes-networks-dns/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/understanding-how-pods-talk-in-kubernetes-networks-dns/A deep dive into how Kubernetes DNS resolves service names to IP addresses, covering A records, SRV records, search domains, and the full lookup path from pod to CoreDNS. Understanding this lifecycle is essential for debugging connectivity issues and designing resilient microservice architectures.https://lukehebert.com/post/practical-guide-to-gateway-api-2025/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/practical-guide-to-gateway-api-2025/A practical walkthrough of the Kubernetes Gateway API using the NGINX Gateway Controller, covering HTTP routing, TLS termination, traffic splitting, and multi-protocol support. The concepts are implementation-agnostic and apply across any Gateway API-compatible controller.https://lukehebert.com/post/kubernetes-kustomize/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-kustomize/Kustomize is a native Kubernetes configuration management tool that enables declarative, template-free customization of Kubernetes objects using YAML files. It supports hierarchical base-and-overlay structures, targeted patches, and built-in generation of ConfigMaps and Secrets.https://lukehebert.com/post/kubernetes-networking/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-networking/An overview of the ports and protocols required by Kubernetes control plane and worker nodes. Includes guidance on overriding default port configurations in strict network environments.https://lukehebert.com/post/nginx-ingress-controller/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/nginx-ingress-controller/A practical guide to installing and configuring the Ingress-Nginx Controller in Kubernetes, covering Helm and kubectl methods, cloud-provider annotations, and local testing workflows.https://lukehebert.com/post/encrypting-secrets/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/encrypting-secrets/Kubernetes Secrets use base64 encoding rather than true encryption, so their safety depends on surrounding practices like encryption at rest and access controls. This post covers best practices, built-in protections, and alternatives like Helm Secrets or HashiCorp Vault.https://lukehebert.com/post/creating-a-tls-secret-in-kubernetes/Tue, 12 Aug 2025 00:00:00 +0000https://lukehebert.com/post/creating-a-tls-secret-in-kubernetes/Create a TLS secret from a certificate and key pair, then deploy a webhook server that mounts that secret to serve HTTPS on port 8443.https://lukehebert.com/post/kubernetes-efs-storage-iam-role/Sat, 09 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-efs-storage-iam-role/A practical guide to provisioning EFS filesystems and wiring them into Kubernetes via the AWS EFS CSI driver, IAM roles, and standard storage manifests. Covers StorageClass, PVCs, Deployments, and StatefulSets for shared, elastic storage.https://lukehebert.com/post/kubernetes-s3-storage-iam-role/Sat, 09 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-s3-storage-iam-role/A practical guide to mounting S3 buckets as volumes in Kubernetes pods using the AWS S3 CSI driver, including IAM role setup, StorageClass configuration, and deployment examples.https://lukehebert.com/post/kubernetes-s3-storage-access-key-secrete-key/Sat, 09 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-s3-storage-access-key-secrete-key/A guide to deploying S3 object storage in Kubernetes using the AWS S3 CSI driver, covering credential setup, StorageClass definition, PVC creation, and volume mounting in pods and deployments.https://lukehebert.com/post/kubernetes-cluster-components/Thu, 29 May 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-cluster-components/An overview of the key components that make up a Kubernetes cluster, covering both the control plane and worker nodes. Understanding these pieces is essential for operating and troubleshooting a Kubernetes environment.https://lukehebert.com/post/aws-eip-elastic-ip-assignment-script/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/aws-eip-elastic-ip-assignment-script/A lightweight bash script that automatically allocates and assigns an Elastic IP to an EC2 instance at launch using User Data, eliminating the need for manual IP management.https://lukehebert.com/post/aws-vpc-structure/Tue, 18 Jan 2022 00:00:00 +0000https://lukehebert.com/post/aws-vpc-structure/A visual walkthrough of the core networking components that make up an Amazon VPC, from subnets and gateways to security groups and route tables. Understanding how these pieces interact is essential for designing secure, well-segmented cloud networks.https://lukehebert.com/post/structure-of-an-iam-policy/Tue, 18 Jan 2022 00:00:00 +0000https://lukehebert.com/post/structure-of-an-iam-policy/An overview of how AWS IAM policies are structured, including the six policy types and the key elements of a policy document. Learn how to apply the principle of least privilege when defining permissions.https://lukehebert.com/post/hive-bundle-logs/Thu, 19 Aug 2021 00:00:00 +0000https://lukehebert.com/post/hive-bundle-logs/Hive bundle logs in a cloud data warehouse are stored under a predictable S3 path. Knowing where to look saves time when troubleshooting query performance or diagnosing failed jobs.https://lukehebert.com/post/aws-arn-structure/Thu, 29 Jul 2021 00:00:00 +0000https://lukehebert.com/post/aws-arn-structure/Every AWS resource is uniquely identified by an Amazon Resource Name (ARN) used in IAM policies, API calls, and resource references. This post breaks down the standard ARN format into its individual components for easy reading and construction.https://lukehebert.com/post/aws-volume-juggling-for-impaired-nodes-and-node-health-check/Wed, 28 Jul 2021 00:00:00 +0000https://lukehebert.com/post/aws-volume-juggling-for-impaired-nodes-and-node-health-check/A practical guide to diagnosing impaired EC2 instances by detaching and reattaching EBS root volumes to a rescue instance. Covers the full workflow from stopping the impaired node to restoring it to normal service.