This article explains the Kubernetes scheduler's internal mechanisms for pod placement, including filtering, scoring, node selection, and pod deletion logic during scale-down.

More: https://ku.bz/lm3Cgdrd4

This week on Learn Kubernetes Weekly 143:

🤔 Can a Simple 4-Core, 16 GB RAM Machine Reach 1000 TPS?
🧢 Cap or no cap
🔙 Reclaiming Idle GPUs in Kubernetes: A Practical Approach (and a Call for Ideas!)
💰 How We Saved $1.22 Million Annually on GCP Costs in a Few Simple Steps
🕰️ Inside Kubernetes Scheduler: What really happens before your pod lands on a node

Read it now: https://learnkube.com/issues/143

⭐️ This newsletter is brought to you by LearnKube — get started on your Kubernetes journey through comprehensive online, in-person, or remote training https://learnkube.com/training

This post reverse-engineers an 80% cost reduction across a Kubernetes observability stack by replacing Prometheus/Thanos with VictoriaMetrics, enforcing OTEL standards, right-sizing workloads via VPA and bin-packing via MostAllocated.

More: https://ku.bz/zCCJVHkg9

Kubernetes Controller Sharding introduces a generic mechanism for distributing reconciliation tasks across multiple active controller instances, reducing watch-cache load through distinct sharding and labeling.

More: https://ku.bz/X39ysBMzr

Andrew Hillier, Co-Founder & CTO at Densify, discusses how AI workloads are increasingly running on Kubernetes.

He observes that while customers use some as-a-service offerings, many AI workloads are landing in Kubernetes, particularly inferencing with some training workloads. Andrew explains that cost optimization becomes even more critical when GPUs are involved. He highlights how optimization strategies differ by workload type: training might aim for 100% utilization, while inferencing requires better response times. Andrew emphasizes that properly setting GPU requests and limits is the essential starting point to avoid wasting expensive GPU resources.

Watch the full interview: https://ku.bz/V2YJFXVG3

This interview is a reaction to John McBride's episode https://ku.bz/wP6bTlrFs

Asif Awan Founder and CPO at StackGen shares a different perspective on Kubernetes automation.

Instead of focusing solely on automating processes, he advocates for creating abstraction layers that adapt to enterprise-specific workflows and organizational structures.

The key insight is that effective automation should work at the right level of abstraction where teams can benefit from it without having to learn new tools or languages.

Watch the full interview: https://ku.bz/_LmLdllKc

This interview is a reaction to Alexandre Souza's episode https://ku.bz/z2Vj9PBYh

This tutorial demonstrates how to build a Kubernetes mutating webhook in Rust using Axum and Rustls.

It creates an HTTP server that processes AdmissionReview requests and injects a sidecar proxy via JSONPatch.

More: https://ku.bz/z-CcQy3bS

Gordon Myers explains how Kubernetes implements JSON Patch, an industry standard for JSON object manipulation, in webhook configurations. He breaks down the three fundamental operations (add, remove, replace) and demonstrates how they transform JSON objects using dot notation paths.

The discussion explores practical examples, including modifying nested JSON lists and key-value pairs, while highlighting some unexpected behaviors in webhook response encoding.

Watch the full episode: https://ku.bz/Dmn93dd7M

Opsmate's SRE-powered LLM copilot helps users troubleshoot production issues using natural language commands.

More: https://ku.bz/XSfGMcs_w

John Platt, CTO at StormForge, explains why Kubernetes has become the preferred platform for training Large Language Models and running inference workloads.

He points to Kubernetes' core strengths of scalability, self-healing, and portability as key factors driving adoption for GPU-intensive AI workloads. John shares that organizations running their own models on Kubernetes can achieve up to 90% cost savings compared to using services like OpenAI, making it both technically advantageous and financially compelling for companies working with AI and machine learning technologies.

Watch the full interview: https://ku.bz/mt_lTMFwF

This interview is a reaction to John McBride's episode https://ku.bz/wP6bTlrFs

In Kubernetes, containers typically start with root privileges.

This happens because, by default, container processes run as UID 0 unless overridden. While convenient during development, it introduces unnecessary risk in production environments.

If an attacker compromises the container, root access increases the likelihood of privilege escalation to the host.

Our latest article "From Linux Primitives to Kubernetes Security Contexts" demystifies these concepts.

Read the full article: https://learnkube.com/security-contexts

Bhavani Indukuri, Staff Platform Engineer at Zscaler, explains that implementing observability tools is only the first step toward generating business value.

She emphasizes that collecting metrics, logs, and traces isn't enough - organizations must act on this data in a timely manner to meet SLAs and SLOs. The real business value comes from improving reliability and delivering dependable products to customers, making observability an actionable practice rather than just a data collection exercise.

Watch the full interview: https://ku.bz/Znfx9Z0-x

This interview is a reaction to Artem Lajko's episode https://ku.bz/9sGxhmm8s

This case study shows how Freshworks optimized Kubernetes scaling using Karpenter with real workload scenarios for cost and performance improvements.

It covers testing Karpenter response to EC2 spot interruptions and high pod/node counts.

More: https://ku.bz/1tj8M96kV

Alessandro from IBM Research how his team transformed their chaotic bare-metal clusters into a well-governed, self-service platform for AI and scientific workloads.

You will learn:

- How to implement GitOps workflows that reduce administrative burden while maintaining governance and visibility
- Practical policy enforcement strategies using Kyverno to prevent GPU monopolization, block interactive pod usage, and automatically inject scheduling constraints
- Fair resource sharing techniques with Kueue to manage scarce GPU resources across different hardware types

Watch (or listen to) it here: https://ku.bz/5sK7BFZ-8

🌟 This episode is brought to you by Testkube—the ultimate Continuous Testing Platform for Cloud Native applications. Scale fast, test continuously, and ship confidently https://ku.bz/lnxYK3s0L

With @Birthmarkb "Udinese Lead Press Officer" Farrell

helm diff plugin forecasts what a Helm upgrade or rollback would change by comparing the current cluster state to the proposed manifests.

More: https://ku.bz/XKgq07dSQ

This week on Learn Kubernetes Weekly 144:

✅ Modern Kubernetes: can we replace Helm?
💰 How We Saved 80% on Our Observability Bill!
🥷 Offensive Container Security: Techniques, Misconfigurations, and Attack Paths
💡 Scaling Kubernetes Smarter with Karpenter
✈️ ECR to OCIR: Event-driven Docker Image Updates

Read it now: https://learnkube.com/issues/144

⭐️ This newsletter is brought to you by Testkube — because if your app is Kubernetes-native, your testing should be too. Run any kind of test automation with the help of the platform built for it https://ku.bz/JqgJVcfRh

CK-X Simulator is a web-based, cross-platform training environment for Kubernetes certification exams (CKAD, CKA, CKS).

It offers smart evaluation, real-time verification, and comprehensive lab support.

More: https://ku.bz/c1SPrRcxP

This tutorial teaches how to implement SPIFFE/SPIRE for cloud-native workload identity management and integrate with Istio for mutual TLS and authorization policies.

More: https://ku.bz/HYVTDDcVz

Faire replaced its failing monolithic Jenkins CI with Buildkite on Kubernetes using poly-CI pipelines.

They split builds per service in a Kotlin monorepo, used filtered Gradle tasks, GitHub triggers, and Datadog metrics to scale horizontally.

More: https://ku.bz/vFdH0YTBy

This tutorial teaches how to build a custom Kubernetes controller with Kubebuilder to enforce a time-based pod quota system using a Custom Resource, annotations, and a ConfigMap.

More: https://ku.bz/nQlJBWNcX

Miguel Luna, Principal Product Manager at Elastic, discusses the importance of tailoring alerting strategies to specific use cases.

He emphasizes that while standard alerts for CPU, memory, and disk usage are fundamental, effective alerting requires understanding the context and criticality of each environment.

Miguel advises starting with a clear understanding of Service Level Agreements (SLAs) and Service Level Objectives (SLOs) to guide which metrics are critical to monitor.

Watch the full episode: https://ku.bz/WwS04jYvv