This guide breaks down the ultimate architectural blueprint to solve cluster sprawl and deployment friction for good. By unifying the centralized governance of Rancher, the resource-saving isolation of virtual control planes (vCluster), and the advanced multi-stage pipeline automation of Kargo GitOps, this write-up touches on how to build a highly scalable, zero-touch infrastructure environment.

In this article, we will use Kubernetes Service Accounts and the TokenReview API to authenticate requests between two in-cluster services, then improve the setup with audience-bound projected Service Account tokens.

DCGM exporter tells you a GPU is hot. It won't tell you whose job is frying it. l9gpu closes the loop. One agent per node emits vendor-neutral OTLP with workload attribution baked in — Kubernetes pod, namespace, deployment; Slurm job, user, partition.

A native iOS and Android app for monitoring and managing Argo CD deployments from your phone.

Ballast is a Kubernetes operator that automatically right-sizes workload resource requests and limits based on real operational history. It is a more active alternative to Fairwinds Goldilocks: rather than suggesting changes, it applies them — at admission time and on running pods via in-place resize (Kubernetes 1.35+).

Cordium is a free and open source, self-hosted, identity-based sandbox platform built on Kubernetes and Octelium. Cordium is a general-purpose platform that provides isolated, reproducible isolated sandboxes for developers, AI agents, and automated workloads.

Most load-testing tools, however, were designed for a simpler world. They assume requests are independent, stateless, and interchangeable. But an AI agent doesn't work that way. This gap was the motivation behind OpenTelemetry (OTel) Trace Replay, a new capability in Inference Perf, the Kubernetes SIG tool for GenAI inference benchmarking.

The first is the KubeBuddy Headlamp plugin, which brings the full KubeBuddy check catalog (excluding the Cloud provider best practices) into Headlamp without touching your cluster configuration. The second is the Headlamp Theme Builder, a Headlamp plugin and browser-based design tool that turns your brand colours into a ready-to-install Headlamp theme plugin in minutes.

I tried a bunch on a separate EKS cluster, like HAProxy and Traefik, but eventually I landed on using Envoy Gateway since to me it felt like the most approachable and stable solution for our use case. Since I started the migration I made a respectable number of mistakes. These are my notes.

In this post, we'll walk through how we redesigned our Kubernetes-based PostgreSQL clusters for failover safety, how we balanced durability against latency, and what we learned while validating this approach through benchmarking and failure testing.

This is the problem helmsniff solves. It is a small, fast command line tool. It reads rendered Kubernetes manifests and writes a simple report. One row per Kubernetes object. One column per security check.

A few weeks ago I finally sat down and built it. This article is about what I built, what broke, and why I think Sveltos is one of the most underrated tools in the Kubernetes ecosystem right now.

В этом году главный сюжет — как меняется роль в эпоху AI. Смотрят на то, что уже автоматизируется, а что, наоборот, дорожает: пускают ли AI действовать в проде и где проходит граница доверия, добавляет ли сгенерированный код новых инцидентов, и что остается исключительно работой человека, когда рутину забирает машина. Отдельный блок про soft skills: какие навыки SRE-специалисты считают важными, в каких проседают и что не заменит AI.

Не обошли и человеческую цену надежности: сколько стоят дежурства по времени, деньгам и здоровью и на ком в команде реально концентрируется нагрузка.

Recently, I decided to migrate our Amazon EKS clusters (running version 1.35 on Bottlerocket OS) from the default AWS VPC CNI and kube-proxy over to Cilium. Migrating CNIs on a live cluster can be daunting, but by using a blue/green node pool strategy, the transition was seamless with zero disruption to our internal or external services.

This is a free, open checklist to help you deploy your applications to Kubernetes. No form, email, or download is required.

AegisBPF is an eBPF-based runtime security agent that monitors and blocks unauthorized file and network activity using Linux Security Modules (LSM).

A terminal based dashboard for Docker that monitors multiple hosts in real-time.

Polykube is a Kubernetes-native, GitOps-driven pattern for portable backend workloads. Desired state is delivered as Kubernetes resources, and reconciliation happens locally inside each member cluster.