LevelUp your I.T skills for the ever evolving job market

Gain practical real-world and in-demand experience with LevelUp I.T.'s articles, examples, labs, public and private repos!

Featured posts

Active/Active Firewalls the Routing Way: Palo Alto, BGP, and a 3-Second Hold Timer

Two Palo Altos, both forwarding, no floating IPs: eBGP to the N9K border pair and ECMP does the rest. Then a failover test found 90 seconds of silence, BFD refused to help, and the live re-test revealed that recovery, not failure, is where packets go to die.

7 min read

infiniband verbs banner, hand-drawn excalidraw style: green RNIC chip icon

Skip the Kernel: InfiniBand Verbs in Five Minutes

One Adapter, Many Tenants: InfiniBand Partitions and SR-IOV, From the Firmware to the Wire

Routing Kubernetes into a CLOS fabric with Cilium BGP

Building a Self-Healing OpenShift Platform for AI Inference - and an Agent to Watch It

Join now

Courses

Mastering BGP

Mastering BGP delves into its architectural strengths: reliability (TCP foundation, keepalives), stability (MAI, dampening, route refresh), scalability (reflection, confederations, selective propagation), and flexibility (policy-driven, path attributes, communities).

Mastering IS-IS

IS-IS, a robust link-state routing protocol, is key for scalable networks. This series demystifies IS-IS from its Layer 2 operations, NSAP addressing, and hierarchical design to advanced traffic engineering with practical Juniper configurations. Master IS-IS for high-performance network designs.

Network Automation with GO

Hello and welcome to "Network Automation with Go," a blog series designed for network engineers and developers. We'll explore how Go's speed, concurrency, and simplicity can help you build powerful, efficient, and scalable network automation solutions. Get ready to level up your skills!

View all

Join now

Active/Active Firewalls the Routing Way: Palo Alto, BGP, and a 3-Second Hold Timer

7 min read

The Cable Decides: Why My 200G-Capable Ports Run at 10G

Two ConnectX-6 ports that can do HDR. A DAC with 100G printed on the label. An InfiniBand link that trained at 10 gigabits. Your fabric's speed is written in a tiny EEPROM inside the cable, and it does not care what the label says.

3 min read

macvlan vs SR-IOV: Kernel Children vs Silicon Children

Both slice one NIC into many. SR-IOV carves PCI devices in silicon; macvlan stacks netdevs in the kernel. Labbed side by side on the same node: 57.8 Gb/s that costs a full CPU core, isolation modes that mirror IB partitions, and the two absences that decide it.

3 min read

Skip the Kernel: InfiniBand Verbs in Five Minutes

A short nugget on the RDMA verbs API: the four objects every application allocates, the path a work request travels, why one-sided operations leave the remote CPU asleep, and why the same API drives RoCEv2 over Ethernet.

3 min read

One Adapter, Many Tenants: InfiniBand Partitions and SR-IOV, From the Firmware to the Wire

A hands-on walkthrough of InfiniBand multi-tenancy on real hardware: one ConnectX-6 port split into four SR-IOV virtual functions, five VMs sorted into two P_Key partitions, and the isolation proven on the wire with packet captures and hardware state.

18 min read

Routing Kubernetes into a CLOS fabric with Cilium BGP

A Service can be green in Kubernetes and still unreachable from the next rack over. Here is how I let Cilium speak BGP so a service IP becomes a real route, ECMP across an EVPN/VXLAN fabric all the way to the edge. Stop bridging, start advertising.

6 min read

Building a Self-Healing OpenShift Platform for AI Inference - and an Agent to Watch It

A full build log of a production-shaped OpenShift 4.22 platform that runs local AI inference: a Nexus vPC fabric, an HA Palo Alto firewall pair, an agent-based install, a complete day-2 stack, and the n8n plus local-LLM agent that watches every layer and pages me on Telegram with a fix.

19 min read

Local-first AI, with Claude as the escape hatch: building lfllm on a Mac

Run any local LLM for the routine work, then auto-escalate to Claude Opus when local stalls. One OpenAI-compatible endpoint, bearer-auth-gated, LAN-exposable. The full build: configs, terminal output, eleven tests, and a Claude Code wrapper.

16 min read

Understanding the Cilium Datapath: How Packets Actually Move Between Pods

I traced every packet path through Cilium's datapath: veth pairs, eBPF hooks, native routing with auto injection, static routes, live BGP with FRR and ECMP, VXLAN encapsulation, and Geneve. Four kind clusters, real tcpdump captures, all from my lab.

12 min read

Designing a RoCEv2 Backend Fabric for a 4,000-GPU B200 Cluster

A practical redesign of a 4,000-GPU B200 cluster using RoCEv2 over Ethernet. This companion dives into lossless fabric engineering, BGP underlay, congestion control, and real-world trade-offs versus InfiniBand at hyperscale.

39 min read

Kubernetes Meets the Data Center: Cilium BGP, FRR Leaf-Spine Fabric, and Role-Based L3/L7 Policy Enforcement

I built a leaf-spine data center fabric, connected it to Kubernetes with Cilium BGP, exposed services through LoadBalancer VIPs, enforced L3/L7 policy, and traced the end-to-end data path with Hubble, from client request to pod response.

16 min read

How to Simulate Multicluster Kubernetes Locally: Regions, Failover, and Cross-Cluster Traffic with Kind.

Step-by-step tutorial for running a multicluster Kubernetes setup locally using Kind. Covers regional LoadBalancer routing, cross-cluster connectivity, failover simulation, and rolling updates across three clusters.

13 min read

How to Train a Private AI That Knows Everything Your Organisation Knows

Your organisation's knowledge is locked in PDFs and documents nobody has time to read. This guide shows you how to train a private AI on that material, run it on your own machine, and query it like a senior expert who never sleeps.

20 min read

Agents in Production Without the Cloud: An AI Agent Stack on Kubernetes

A practical walkthrough of building a sovereign AI agent stack on Kubernetes using open-source tools. Model inference, memory, tooling, and observability run entirely on-premises, keeping prompts, telemetry, and data inside infrastructure without relying on external AI APIs.

15 min read

End-to-End TLS Termination with Kubernetes Ingress

Kubernetes Ingress gives you host-based routing and TLS termination through a single external IP. This walkthrough covers Contour, self-signed certs, and validating HTTPS load balancing on a Kind cluster from scratch.

9 min read

Subscribe to LevelUp I.T. newsletter and stay updated.

Don't miss anything. Get all the latest posts delivered straight to your inbox. It's free!