Kapil Agrawal

Kapil Agrawal

@netops2devops.net

Kubernetes platform Security Engineer by profession. Also a recovering network engineer. Open source exuberant. Fan of open standards. Spends way too much time in homelab

248 followers1K following164 posts

I miss those days from early to mid 2000s when compute was still somewhat of a scarce commodity and developers had to understand and learn the whole stack incl. the hardware side to squeeze the most out of it. #ai #enshittification

Devs would write code that forced them to think about every byte of memory allocation. Those were the golden days before the enshittification of the internet. Lesson : More doesn’t always compute to good (in terms of quality)

That awkward moment when you reject someone's low effort drive by MR filled with AI slop in your open source project and then they turn around and stalk your LinkedIN profile 😂 #FOSS #AI #Slop

My grandma's ISP provides her router with #IPv6 by default. Every device in her wireless network has a unique routable address. She doesn't even know or care about what IPv6 is. Let that sink in.

xan@xan.lol

when you go to someone's house and they don't support IPv6 🤢🤢🤢

I’ve spent over a decade mostly working in on-prem environment (with some public cloud) building private cloud using Openstack, Kubernetes. I’m now working on a project where I’m forced to use AWS and I am starting to resent their closed lock in ecosystem.

argghhh! Working with struct tags in #Go can be such a pain sometimes 😫 specially when frameworks decide to use their own custom tags for validation. VSCode does not autocomplete those damn struct tags! If someone has better ideas I am all ears.

Been writing #Go for a year now, I always questioned the validity of generics and wondered why they were so controversial. I have finally stumbled upon my first use case where using generics actually makes sense to maintain compile time type safety while reducing boilerplate. It finally clicked!

I spent MOST of my #kubecon talking to all the project maintainers, contributors at the project pavilion trying to learn about different CNCF projects, challenges they face etc. Here are the projects I feel most enthusiastic about for the next year 1. Cilium 2. Falco 3. Inspektor Gadget

View full thread

topics for subsequent posts: - IPv6 address planning to run #cilium in native routing with cluster pool vs. multi-pool ipam. - Cilium BGP control plane with LB IPAM and GatewayAPI for ingress - Predictable egress IP without using an egress gateway (aka no SNAT/masquerading) Stay tuned ;)

Kapil Agrawal reposted

Case study: ESnet’s success with Cilium demonstrates that IPv6-only Kubernetes deployments are not only viable, but also work exceptionally well at government scale. This has provided a blueprint for other national laboratories facing similar mandates. Read more: www.cncf.io/case-studies...

cncf.ioESnet (Energy Sciences Network)ESnet, the data circulatory system for the U.S. Department of Energy faced high operational overhead from running individual VMs for a single containerized application with no unified observability…

Really looking forward to this event! #kubernetes #cilium #ipv6 #kubecon

Cilium@cilium.io

Join ESnet's Kapil Agrawal at #CiliumCon to hear how his team built an IPv6-first #Kubernetes environment using #Cilium for networking. Expect lessons learned on routing, scaling, and simplifying operations from deploying without IPv4. 🔗 colocatedeventsna2025.sched.com/event/28D0g/...

I have never been a professional C/C++ programmer by trade and maybe that's why I don't understand this but after doing some beginner level exercises with #rust I don't get all the fuss around how borrower/checker rules make it complicated. Sure, it feels lot more verbose. Even more than #go

Say what you may but as far as readability goes I don't find #rust to be nearly as intuitive or readable as #go .. It's so easy to be productive with go after spending just a week dabbling with basics. I don't think I can say the same for rust but I suspect it's just a matter of practice 😅

Critical thinking, curiosity and the drive to go deeper into the stack to learn something in & out appears to be diminishing as engineers become more dependent on AI generated content. People who were once "engineers" are now becoming "operators"

After struggling with embedding Rego inside YAML on top of having to write constraint template, then a constraint file just to create 1 basic admission policy, I am switching teams from #Gatekeeper to #Kyverno and as it turns out ..

View full thread

#Kyverno also has this super awesome feature to generate new objects (like NetworkPolicy) during admission review which is definitely not a thing in Gatekeeper from what I can tell.

After struggling with embedding Rego inside YAML on top of having to write constraint template, then a constraint file just to create 1 basic admission policy, I am switching teams from #Gatekeeper to #Kyverno and as it turns out ..

the policy I was trying to write already comes ready made in #Kyverno policy library and it's less than 20 lines of YAML!! kyverno.io/policies/oth... As much as I love #OPA the developer experience around using it with gatekeeper is a bit rough (IMO).

kyverno.ioNamespace ProtectionCases where RBAC may be applied at a higher level and where Namespace-level protections may be necessary can be accomplished with a separate policy. For example, one may want to protect creates, updat...

Upcoming changes in #Cilium 1.18.0 will bring significant improvements for operating #Kubernetes in #IPv6 only networks! One big ticket item is that now you can use the default tunnel mode with an IPv6 only underlay. I shared my configs in GitHub issue comments github.com/cilium/ciliu...

github.comSupport tunneling over IPv6 · Issue #17240 · cilium/ciliumBug report Hello. First of all, thank you for an amazing product. I am trying to configure an IPv6 only kubernetes network(, which means that all the interfaces on my node are not given ipv4 addres...