AWS EKS Cluster Scaled to 8 Nodes Live Under k6 Load Test With Karpenter and HPA

·1 views

A hands-on experiment tested whether an AWS EKS cluster running Google's Online Boutique (11 microservices) could handle large-scale traffic using Kubernetes autoscaling tools. HorizontalPodAutoscalers (HPA) were configured for 10 services with CPU and memory targets, while Karpenter replaced the fixed node group to enable dynamic node provisioning. A k6 load test ramped up to 3,000 virtual users in-cluster, causing replica counts to climb across multiple services as CPU and memory thresholds were crossed. The cluster's node count grew from 2 to 8 at peak load, with Karpenter provisioning new EC2 instances in response to pending pods, then consolidating back to 2 nodes once the test ended. A key finding was that metrics-server must be verified before relying on HPA, as its absence causes HPA to silently fail rather than report an error.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

From Hookswitch to Grave

Article URL: https://computer.rip/2026-06-14-hookswitch-to-grave.html Comments URL: https://news.ycombinator.com/item?id=49559901 Points: 3 # Comments: 0

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How DNS Actually Works on Ubuntu 26.04: A Deep Dive into Two Layers

A developer conducted a detailed investigation into DNS resolution on a fresh Ubuntu 26.04 server, tracing a name lookup from application to answering server. DNS on Ubuntu operates in two distinct layers: the C library's name lookup, which checks /etc/hosts first via /etc/nsswitch.conf, and the systemd-resolved stub resolver listening on 127.0.0.53. Systemd-resolved acts as a local caching resolver that forwards queries to upstream DNS servers learned per network interface from DHCP or Netplan configuration. Tools like dig and nslookup bypass the first layer entirely, which explains why they can return different results than ping or curl. Key practical takeaways include using resolvectl to inspect upstream servers and query results, editing Netplan rather than resolv.conf for upstream changes, and understanding split DNS for per-domain routing used by tools like Tailscale's MagicDNS.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Nginx add_header Duplicates Headers Instead of Overriding, Silently Breaking Security

A developer discovered a critical misconfiguration after deploying a baseline of security headers across nginx virtual hosts intended to protect apps that set none of their own. Within an hour, production responses showed duplicate and contradictory headers — for example, both X-Frame-Options: DENY from the app and SAMEORIGIN from the baseline appearing simultaneously. Browsers receiving conflicting directives for the same header treat it as absent entirely, meaning the stricter app-level setting was effectively nullified. The root cause was a misunderstanding of nginx's add_header directive, which always appends rather than replaces existing headers and cannot conditionally check upstream responses. The developer resolved the issue using nginx map directives on upstream header variables, since add_header offers no built-in conditional or override logic.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Finds Four Silent Bugs Sharing One Root Cause: Unverified Assertions

A software developer documented a day of debugging across four repositories on September 2, 2026, uncovering 22 commits that all traced back to the same underlying flaw: systems confidently reporting states that were never actually verified. Among the issues found were a compliance control marked green based on a redaction trait that was applied to no model, a kitchen display hiding paid orders, a dashboard showing a high success rate alongside visible failures, and a service worker serving outdated CSS. Most critically, password hashes were being written into an immutable audit log retained for a year, with no way to retract them — prompting their outright exclusion rather than masking. The developer concluded that generated evidence must be tested for reachability, and that silent wrong values are far more dangerous than thrown errors because they provide no signal that anything is wrong.

0 comments Read more at DEV Community