Kubernetes

Requests and limits look like the same knob, but they do completely different jobs. One controls scheduling, the other controls enforcement — and for memory, enforcement means a kill. Here is the mental model, the .NET memory angle, and the traps that cost me real debugging time.

A request travels through six hops before it hits your container — DNS, load balancer, Ingress, Service, Pod, Container. Here is the full path, what each hop does, and why tracing it in your head makes debugging a 503 much faster.

Push and pull both deploy to Kubernetes, but they flip the direction of trust. Pull moves cluster credentials out of CI, makes drift visible, and turns Git into the cluster audit log. Here is the difference, what actually changes, and what pull does not solve.

Workload Identity replaces shared client secrets with per-pod OIDC tokens. Here is the mental model that finally clicked for me, plus the four pieces you need to wire it up on AKS.

Workload Identity gives every pod its own Azure identity. So why are we still passing connection strings around? Here is how I dropped them for SQL, Storage, and Service Bus — using DefaultAzureCredential and a single pattern.