Engineer Replaces kube-proxy with eBPF in Homelab, Triggers 6-Hour Monitoring Blackout

·2 views

A Kubernetes engineer running a four-node bare-metal homelab cluster upgraded Cilium from version 1.15 to 1.16 and enabled full eBPF-based kube-proxy replacement by flipping a single configuration flag. The change appeared successful at first, with all pods reporting healthy status, but at 2:47 AM an alert revealed that the SIEM had stopped receiving any network flow or Kubernetes audit log data. The root cause was that the eBPF datapath bypasses the iptables and conntrack layers that the security monitoring stack depended on to capture traffic. The engineer, who works with managed Kubernetes at Siemens professionally, documented the incident as a cautionary account of how replacing a core networking component can silently blind observability and security tooling. The episode highlights a broader gap in official documentation around eBPF adoption: tools built for the traditional netfilter universe do not automatically carry over into an eBPF-managed datapath.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Apache Kafka: what it is, when to use it, and its key trade-offs

Apache Kafka is an open-source distributed messaging system that stores data streams in a durable, ordered, and fault-tolerant manner. Messaging platforms like Kafka allow multiple systems to exchange information asynchronously through an intermediary, without services calling each other directly. Kafka stands out from traditional brokers such as RabbitMQ and SQS because messages persist after being consumed, making it well suited for high-volume, real-time scenarios like e-commerce order processing and IoT sensor networks. Among its main advantages are high throughput, real-time processing, resilience, and support for multiple simultaneous consumers. However, Kafka can be overkill for low-traffic applications and carries a steep learning curve along with significant configuration and operational complexity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Anthropic Engineer Advises Deleting Claude.md Files as Opus 5 Needs Far Fewer Instructions

Boris Cherny, the engineer behind Claude Code, told a Y Combinator audience that users should periodically delete their CLAUDE.md files, custom skills, and hooks to let Opus 5 demonstrate its improved capabilities. Anthropic itself removed over 80% of Claude Code's internal system prompt before shipping the new model, having found that most instructions were compensating for limitations in earlier versions that no longer exist. Cherny explained that Anthropic used a line-by-line ablation process to determine which prompt instructions still carried weight and which had become redundant scaffolding. Opus 5's broader instruction retrieval, built-in self-verification, and long-horizon task handling mean that instruction files tuned for Claude 4.x can behave erratically on the newer model even without any changes by the user. Developers are advised to audit existing instruction files, as much of their content likely addressed past model weaknesses rather than encoding genuinely necessary guidance.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Insufficient source content to generate a reliable headline

The source material provided does not contain enough article text to produce an accurate, factual summary. Only metadata such as the article URL, Hacker News comments link, and engagement metrics were included. Reproducing or inferring claims without the full article content would risk fabricating facts. Please provide the complete article text for proper summarization.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer audited a 5.5 GB AI dataset by downloading less than 1% of it

A developer discovered a 5.5 GB Chinese astrology AI training dataset on a popular repository and grew suspicious when the sample count of 518,400 matched a perfect nested loop formula rather than real observations. Using HTTP range requests, they downloaded only 48 MB — about 0.8% of the total — by fetching the ZIP central directory and targeted file shards. The audit revealed that the dataset's 781 data shards appeared algorithmically generated rather than empirically collected. More strikingly, a proprietary content library explicitly excluded from the open-source GitHub repo was found bundled inside the release archive, buried nearly 6 GB deep where few would look. The case highlights both a practical technique for sampling large archives cheaply and a cautionary note about assuming release contents match what a repository publicly discloses.

0 comments Read more at DEV Community