Notes on distributed systems, Kubernetes, reverse proxies, and Zero Trust security.
Inside a cluster, 'where is service B' is answered by a layered system: a Service object, a DNS name served by CoreDNS, a control loop tracking healthy pods, and kube-proxy turning a virtual IP into a real one. Here is how each piece fits, with examples, and how it extends to external service registries.
Service discovery has two families of answers: plain DNS and a dedicated registry like Consul, etcd, or xDS. They look interchangeable on a diagram. They are not. Here is what each one actually guarantees, the options in each camp, and how to choose.
I gave a talk at RSA Conference 2026 called 'Beyond Zero Trust: Continuous Validation for Modern Enterprise Security.' This is the argument I made on stage, the pushback I got from the room, and what I am taking back to the code.
The bottleneck is not throughput — it is managing tens of thousands of simultaneous connections without blocking, without ballooning memory, and without dropping a request. Here is how ATS, HAProxy, and Envoy each solve that problem, and the tradeoffs each approach carries.
Every load balancing algorithm encodes a silent assumption about what equal distribution means. Understanding that assumption is what lets you pick the right one — and recognize when the default is working against you.