# Networks
All Networks notes →What is Istio
CNCF-graduated (July 2023) service mesh — sidecar model plus the newer sidecar-less ambient mode (stable since 1.24), now extending into AI traffic via the Gateway API Inference Extension and 2026's Ambient Multicluster beta.
What is a Reverse Proxy (NGINX)
Forward vs reverse proxy, and NGINX as the canonical implementation — event-driven architecture, core proxy capabilities, its config model, and the 2026 shift toward NGINX Gateway Fabric as a Kubernetes Gateway API implementation.
What is Envoy
CNCF-graduated L7 proxy built at Lyft — the de facto data plane for service mesh (Istio, Linkerd's predecessor lineage) — now extending into AI traffic via Envoy AI Gateway, which reached v1.0 with a native MCP Gateway in 2026.
OSI Layer Model (L1-L7)
What L1 through L7 actually mean, why 'L7 gateway' and 'L4 load balancer' are load-bearing terms in system design interviews, and why this numbering is unrelated to the pipeline's own Layer 1/2/3 architecture labels.
Protocol Inventory
Every protocol referenced across the telemetry ingestion pipeline design, plus a general L7-termination reference table for the broader 'design an API gateway / load balancer' interview question.
HTTP/2 vs HTTP/1.1
Why the ingestion gateway prefers HTTP/2 (multiplexed gRPC) over HTTP/1.1 — connection reuse, binary framing, and header compression at 100K+ agent fan-in.
gRPC
What gRPC actually is underneath the shorthand this design uses it for — call shapes, status-code backpressure, deadline propagation, and the connection-level load-balancing gotcha at 100K+ agent fan-in.
TLS Offload
Terminating TLS at the ingestion frontier instead of in every backend pod — why it's a Layer 1 responsibility, what it costs in defense-in-depth, and how mTLS re-encryption closes the gap.
# Infrastructure Platform Engineering
All Infrastructure Platform Engineering notes →1 — Networking Fundamentals
Covers cloud networking fundamentals — VPC/VNet design, subnetting, routing, and DNS as the base layer of the infrastructure platform.
2 — Enterprise Network Architecture
Designs enterprise network architecture — hub-spoke topology, transit networks, shared services, and segmentation for multi-tenant platforms.
3 — Connectivity
Covers hybrid and cross-cloud connectivity options — VPN, ExpressRoute, Direct Connect, PrivateLink, and service endpoints.
4 — Network Security
Covers network security controls for the platform — firewalls, NSGs/security groups, load balancers, WAF, and DDoS protection.
# Kubernetes
All Kubernetes notes →1 — Kubernetes Networking Model
Why the flat 'every Pod gets a routable IP, no NAT' contract is what lets Kubernetes treat networking as a pluggable implementation detail instead of a per-app concern.
2 — CNI Architecture
CNI is a thin exec-based plugin contract, not a networking stack itself — which is why Calico, Cilium, and Flannel can implement wildly different dataplanes (iptables, eBPF, VXLAN) behind the same interface.
3 — Services
A Service is a stable virtual IP backed by an ever-changing Endpoints/EndpointSlice list — the abstraction exists precisely because Pod IPs are ephemeral and cannot be a load-balancing target.
4 — kube-proxy
kube-proxy doesn't proxy traffic in the IPVS/iptables modes — it only programs kernel-level NAT rules on each node, so a kube-proxy crash doesn't break existing connections, only new rule updates.
5 — CoreDNS
CoreDNS resolves Service names by querying the API server, not by watching iptables — so a Service can be DNS-resolvable milliseconds before kube-proxy has actually wired up a route to it.
6 — Ingress
The Ingress resource is a portable schema with no built-in implementation — every annotation you add to make it actually do something ties you to one specific controller, quietly breaking portability.
7 — Gateway API
Gateway API splits the single Ingress object into role-scoped resources (GatewayClass, Gateway, HTTPRoute) specifically so platform teams and app teams can own different layers without stepping on each other's config.
8 — Network Policies
NetworkPolicy is default-permissive until the first policy selects a Pod — the moment you write one ingress rule for a Pod, all other traffic to it is implicitly denied, which is a common outage-by-surprise.
9 — Service Mesh Overview
A service mesh moves retries, mTLS, and traffic shaping out of application code into a sidecar proxy — trading a real latency and operational-complexity cost for uniform policy enforcement across every service.
# System Design
All System Design notes →Chapter 1 — Network Fundamentals
TCP, UDP, QUIC, and the HTTP/1.1 to HTTP/2 to HTTP/3 evolution, and which transport trade-off each protocol is actually optimizing for.
Chapter 2 — RPC: REST, GraphQL, gRPC
The trade-offs between REST, GraphQL, gRPC, and ConnectRPC for service-to-service and client-facing APIs at scale.
Chapter 3 — Load Balancing
L4 vs. L7 load balancing, anycast routing, and global load balancing as the layer that decides which failures are invisible to callers.
Chapter 4 — CDN & Edge Caching
Edge compute, cache hierarchy design, and cache invalidation as the hardest of the "two hard problems" at global scale.
Protocol Termination at the Ingestion Frontier
What actually happens where the wire protocol ends — TCP/TLS handoff, HTTP/2 frame demux, gRPC message decode, protobuf deserialization — and why L4 vs L7 termination and connection-lifecycle tuning are the load-bearing decisions here, not the crypto itself.