DevOpsDreams

Gateway API vs Ingress: Why Modern Kubernetes Traffic Management Uses Attachment, Not Annotations Ingress is still valid, but it stopped evolving. Gateway API gives Kubernetes teams a cleaner resource model for shared edge infrastructure, richer routing, and safer multi-namespace ownership. TL;DR Gateway API is the practical successor to Kubernetes Ingress for teams that need more than host and path routing. Instead of collapsing infrastructure, TLS, and application routing into one resource plus controller-specific annotations, it separates concerns across GatewayClass, Gateway, and HTTPRoute. That gives platform teams explicit entry points, application teams structured routing rules, and both sides a safer attachment model for shared gateways. The result is better portability, clearer ownership, richer HTTP routing, and a migration path that does not require an all-at-once cutover. Gateway API separates infrastructure ownership from routing ownership, replacing annotation-heavy in...

Private Amazon EKS Clusters and Ingress Patterns: A Network Design Deep Dive Private EKS clusters fail when teams treat the private endpoint as the whole design. This deep dive covers API access, VPC endpoints, internal ALB/NLB ingress, private DNS, and operational failure modes. TL;DR Private Amazon EKS clusters are not just EKS clusters with the public endpoint disabled. They are VPC-bound operating environments where API access, node bootstrap, image pulls, IAM credential exchange, load balancer reconciliation, DNS, and operator access must all work without assuming public internet reachability. The reliable pattern is to separate control-plane access from workload ingress, keep nodes in private subnets, choose public, restricted-public-plus-private, or private-only API endpoints deliberately, expose applications through internal ALB/NLB or connected networks, and pre-build VPC endpoints, private DNS, and break-glass access before cutover. A private EKS design has four separate p...