kubeadm the deliberate way: a load-balanced control-plane endpoint before anything else, stacked etcd split across leaf pairs, no kube-proxy by design, and the NotReady checkpoint that makes Part 8 make sense.

One golden image, one netplan file per node: LACP bonds into the vPC pairs, out-of-band management, the virtio link-speed trap that silently breaks 802.3ad, and the switch side of every bond.

Wiring Active/Active firewalls into the fabric: four eBGP sessions, thirteen prefixes up and one default down, device-bound NAT, two DNAT pinholes for all inbound traffic, and the vPC SVI timer lesson.

VXLAN tunnels between loopbacks, EVPN as the directory, anycast gateways everywhere, and the route-target auto trap that silently empties eBGP fabrics. With the complete overlay configs for all twelve switches.

Twelve switches become a fabric: loopbacks, /31s, jumbo MTU, and eBGP as the only routing protocol. Plus the promised look inside a vPC leaf pair, and the three-command verification that proves the underlay.

How my bare-metal k8s cluster gets cloud-style LoadBalancer IPs: Cilium allocates a VIP, every node advertises it over eBGP to the NX-OS leaves, and the fabric ECMPs traffic into the cluster. Full walk from IPAM pool to leaf routing table.

One Linux box, a pile of QEMU VMs, and a bridge per cable. Sizing the host, the overcommit that makes it affordable, image conventions, and driving it all from the API.

A firmware setting decides whether each ConnectX port wakes up speaking Ethernet or native InfiniBand. My cards run both at once, and the same verbs binaries push bytes over either. One mstconfig line to change your NIC's religion.

A build series: from an empty hypervisor to a real app on a routed VXLAN/EVPN fabric with Kubernetes and Cilium BGP, every config shown. Part 1 is the map: the whole architecture, the addressing plan, and why BGP runs at literally every layer.

RDMA bypasses the kernel, so tcpdump captures nothing while the port counters swallow gigabytes. The NIC itself can mirror the port though, and from the host that owns the PF you can watch every byte your SR-IOV guests exchange.

Palo Alto's docs offer two Active/Active redundancy models: floating IPs or route-based with BGP. My pair runs both simultaneously, one per side, because the real question isn't which model fits your firewalls. It's what the neighbor on each interface can speak.

IPoIB gives your IB fabric an IP address so ordinary sockets code just works. On a 10G link it even matches verbs on bandwidth. The CPU counter and the latency numbers tell the real story of what that convenience costs.

PAN-OS config-sync makes an Active/Active pair feel like one firewall, until NAT teaches you otherwise. Two commit failures, the per-device rule pattern that survives sync, and the exact boundary between what the pair shares and what each box must own.

InfiniBand forwards nothing until one process has walked the fabric, addressed every port, and programmed every route. A deep look at opensm on a live SR-IOV fabric: sweeps, LIDs, partitions, virt_enabled, and why a VF can never be the boss.

Two Palo Altos, both forwarding, no floating IPs: eBGP to the N9K border pair and ECMP does the rest. Then a failover test found 90 seconds of silence, BFD refused to help, and the live re-test revealed that recovery, not failure, is where packets go to die.