Minor nit: in the diagram labeled "the flow of a DNS query in Kubernetes," it says a DNS query is a syscall. That is incorrect: DNS lookups happen in userspace, not the kernel.<p>This is usually by calling a library function in libc, but sometimes not. For example, most programs written in Go (such as Kubernetes itself) use their own resolver instead of <a href="https://www.man7.org/linux/man-pages/man3/getaddrinfo.3.html" rel="nofollow">https://www.man7.org/linux/man-pages/man3/getaddrinfo.3.html</a> (or its predecessor, <a href="https://www.man7.org/linux/man-pages/man3/gethostbyname.3.html" rel="nofollow">https://www.man7.org/linux/man-pages/man3/gethostbyname.3.ht...</a>). This can lead to "fun" issues where the behavior between resolvers diverges, such as <a href="https://github.com/golang/go/issues/15419">https://github.com/golang/go/issues/15419</a>.