Oluwatosin Oladayo Aramide

How my bare-metal k8s cluster gets cloud-style LoadBalancer IPs: Cilium allocates a VIP, every node advertises it over eBGP to the NX-OS leaves, and the fabric ECMPs traffic into the cluster. Full walk from IPAM pool to leaf routing table.

One Linux box, a pile of QEMU VMs, and a bridge per cable. Sizing the host, the overcommit that makes it affordable, image conventions, and driving it all from the API.

A firmware setting decides whether each ConnectX port wakes up speaking Ethernet or native InfiniBand. My cards run both at once, and the same verbs binaries push bytes over either. One mstconfig line to change your NIC's religion.

A build series: from an empty hypervisor to a real app on a routed VXLAN/EVPN fabric with Kubernetes and Cilium BGP, every config shown. Part 1 is the map: the whole architecture, the addressing plan, and why BGP runs at literally every layer.

RDMA bypasses the kernel, so tcpdump captures nothing while the port counters swallow gigabytes. The NIC itself can mirror the port though, and from the host that owns the PF you can watch every byte your SR-IOV guests exchange.

Palo Alto's docs offer two Active/Active redundancy models: floating IPs or route-based with BGP. My pair runs both simultaneously, one per side, because the real question isn't which model fits your firewalls. It's what the neighbor on each interface can speak.

IPoIB gives your IB fabric an IP address so ordinary sockets code just works. On a 10G link it even matches verbs on bandwidth. The CPU counter and the latency numbers tell the real story of what that convenience costs.

PAN-OS config-sync makes an Active/Active pair feel like one firewall, until NAT teaches you otherwise. Two commit failures, the per-device rule pattern that survives sync, and the exact boundary between what the pair shares and what each box must own.

InfiniBand forwards nothing until one process has walked the fabric, addressed every port, and programmed every route. A deep look at opensm on a live SR-IOV fabric: sweeps, LIDs, partitions, virt_enabled, and why a VF can never be the boss.