gw-09 — References

The Netflix angle (named in the JD)

• Managing Netflix's Compute with Kubernetes and Dynamic… — the Titus→Kubernetes story; custom scheduling/controllers; running fleets on K8s. (Search the Netflix TechBlog / KubeCon talks.)
• Container Runtime Customization at Netflix (NRI & OCI Hooks) — containerd NRI + OCI hooks to customize per-pod networking/storage/ sidecars while staying K8s-compatible. https://github.com/containerd/nri
• Titus: Introducing Containers to the Netflix Cloud — ACM Queue. https://queue.acm.org/detail.cfm?id=3158370

Specs & docs

• CNI spec — the plugin contract (ADD/DEL/CHECK, IPAM). https://github.com/containernetworking/cni/blob/main/SPEC.md
• Kubernetes networking docs — the cluster network model, Services, EndpointSlices, DNS, NetworkPolicy. https://kubernetes.io/docs/concepts/services-networking/
• kube-proxy modes (iptables / IPVS) and the dataplane comparison.
• OCI runtime spec — hooks (createRuntime, prestart, etc.). https://github.com/opencontainers/runtime-spec

CNI implementations to study

• Cilium (eBPF dataplane, replaces kube-proxy, L3–L7 NetworkPolicy, Hubble observability). https://github.com/cilium/cilium
• Calico (native routing / BGP, policy). AWS VPC CNI (real VPC IPs, no overlay). flannel (simple VXLAN overlay).

Debugging & background

• Networking and Kubernetes (O'Reilly) — the end-to-end packet path.
• Brendan Gregg / eBPF resources — bpftrace, tcpdump, tracing the kernel network path.
• Articles on conntrack exhaustion and kube-proxy iptables scaling (common production incidents).

Tooling

• kubectl get endpointslices, kubectl get svc -o wide — see membership.
• nsenter / ip netns — enter a pod's netns; ip a, ip route.
• iptables-save | grep <svc> / ipvsadm -Ln — read kube-proxy rules.
• conntrack -L / sysctl net.netfilter.nf_conntrack_{count,max}.
• cilium monitor, hubble observe — eBPF dataplane visibility.

Cross-lab dependencies

• Upstream: gw-01/gw-05 (drain), gw-04 (membership/conntrack), gw-08 (control plane watches the K8s API).
• Downstream: gw-10 (CRDs/operators on the same API machinery), gw-12 (running the fleet on K8s, NRI/OCI).