#k8s — Public Fediverse posts

Памятник kubelet, Kubernetes != CRI

У обычной ноды Kubernetes жёсткий потолок в 110 подов (формально настраиваемый kubelet-флаг --max-pods , но поднимать его руками не рекомендуется даже апстримом: упирается в размер Pod CIDR на ноду, и выше 110 Kubernetes просто не валидируют, так что на практике это потолок дефакто), плюс налог на каждый контейнер: containerd или CRI-O (справедливости ради, у CRI-O ~20 МБ, но на хост, и около 1 МБ на под), ~20 МБ containerd-shim на каждый контейнер, а сам CRI добавляет заметный delay в операциях. На мощном железе это заставляет выбирать между недоутилизацией и гипервизорным слоем (KubeVirt, Kata) с его собственным налогом на microVM. На слабых VPS стандартный стек тяжёл ещё даже до первого workload: kubelet + containerd + kube-proxy + CNI — это уже 300-600+ МБ RSS прежде, чем в кластере появится хоть один рабочий под. У меня была мечта: Kubernetes + systemd. Я начал свой путь не зная куда это приведет, проект за время разработки сменил 7 разных направлений, думаю я нашел главную цель: освобождение Kubernetes. Результат на двух моих машинах (Xeon E5-2690 v4 + Intel N150): 1772 пода, 33 ноды, 2.5 миллиона запросов под нагрузкой с нулём ошибок и медианой 257 мкс . RSS демона — 365 МБ (замер от 04.04.26, сейчас уже ниже) на 1660 подов (~225 КБ на под). Дальше расскажу, что такое Periapsis, как у меня появилась эта идея и что уже работает.

https://habr.com/ru/articles/1058526/

#kubernetes #systemd #Periapsis #k8s

Security Tip: Harden your containers with read-only filesystems. 🛡️ Most containers don't need to write to their root filesystem during runtime. By using the --read-only flag in Docker or K8s, you create a massive hurdle for attackers. If they exploit a service, they won't be able to download tools or modify system files. Stay updated on the latest vulnerabilities: https://cvedatabase.com #InfoSec #CyberSecurity #ContainerSecurity #K8s #CVE

[Перевод] Защита CI/CD для open source-проекта: запираем зависимости

Команда VK Cloud перевела второй пост из серии трёх частей о том, как Cilium укрепляет свой CI/CD-конвейер. Первая часть рассказывала про управление доступом: кто может запускать сборки и какой CI-код разрешено исполнять. Этот пост про уровень зависимостей: какой код эти сборки подтягивают и как мы убеждаемся, что его не подделали.

https://habr.com/ru/companies/vktech/articles/1057736/

#vk_cloud #supply_chain #защита_зависимостей #open_source #управление_зависимостями #github_actions #renovate #sha_pinning #kubernetes #k8s

New Kubernetes Alpha Release

:kubernetes: v1.37.0-alpha.3 :kubernetes:

https://github.com/kubernetes/kubernetes/releases/tag/v1.37.0-alpha.3

#Kubernetes #k8s #kube

New Kubernetes Alpha Release

:kubernetes: v1.37.0-alpha.3 :kubernetes:

https://github.com/kubernetes/kubernetes/releases/tag/v1.37.0-alpha.3

#Kubernetes #k8s #kube

"Container-aware GOMAXPROCS" https://go.dev/blog/container-aware-gomaxprocs #golang #k8s #yolops 🫠

"Container-aware GOMAXPROCS" https://go.dev/blog/container-aware-gomaxprocs #golang #k8s #yolops 🫠

Save your #linux #devsecops #devops #developers #sysadmin nerves and also your servers with #safeline a very powerful #docker #k8s based firewall FREE to use more https://safeline.valtersit.com Join the installation video coming soon.

https://safeline.valtersit.com Official CyberServal Links: Free Trial for
Official Website: https://ly.cyberserval.tech/mJffFlB
How to Install: https://docs.waf.chaitin.com/en/GetStarted/Deploy
Live Demo: https://demo.waf.chaitin.com:9443/statistics
Join the Discord: https://discord.gg/dy3JT7dkmY

Has anyone tested Coraza as a WAF in Kubernetes? I switched to the traefik-modsecurity-plugin because roughly 50–75% of all HTTP/2 traffic was returning HTTP 500.

#Kubernetes #k8s #k3s #traefik #waf #coraza #modsecurity

$ cmd
k8s: millicpu
$ hiuh?
k8s: millicpu
$ a bit I guess?
$ Wait, I just need max 150 Mb network
k8s: MILLICPU!!11!!

and the shitshow continues

#k8s

einen #vintage #raspi1 heute mit #nerves zum leben erweckt. ich habe einen #k8s cluster in einer alten Postkiste und der kleine #raspi soll dort die Lüftersteuerung, powercycling der nodes, LED #blinkenlights und bisschen Datensammlung (Temp, Luftfeuchte, Lufttemperatur am Eingag der Lüfter und am Ausgang erfassen und für prometheus vorbereiten). Schöne Sache, um den ersten #Pi mit ein bisschen #elixir und #nerves neues Leben zu verpassen. gerade eben zum ersten mal via #ssh eingeloggt. NICE!

einen #vintage #raspi1 heute mit #nerves zum leben erweckt. ich habe einen #k8s cluster in einer alten Postkiste und der kleine #raspi soll dort die Lüftersteuerung, powercycling der nodes, LED #blinkenlights und bisschen Datensammlung (Temp, Luftfeuchte, Lufttemperatur am Eingag der Lüfter und am Ausgang erfassen und für prometheus vorbereiten). Schöne Sache, um den ersten #Pi mit ein bisschen #elixir und #nerves neues Leben zu verpassen. gerade eben zum ersten mal via #ssh eingeloggt. NICE!

I am slightly delighted that I obviously had some influence on choosing a CNI and possibly also accompany that team.. :)
#cilium #k8s

Логи, бэкапы, образы, артефакты: где мы используем S3 внутри Рег.облака

Привет, Хабр! На связи Игорь Шишкин, я руковожу отделом разработки облачной платформы Рег.облака. Когда инженеру нужно где-то сложить данные, первая мысль — взять диск побольше. Но внутри нашей инфраструктуры почти всё, что растет и читается параллельно, давно переехало в S3: логи, метрики, бэкапы баз, образы контейнеров, артефакты сборок. Диск остался только там, где он по-настоящему незаменим. В этой статье я расскажу, где именно мы используем объектное хранилище и почему в каждом из этих мест выбрали именно его, а не диск.

https://habr.com/ru/companies/runity/articles/1054318/

#регоблако #s3 #s3server #s3хранилище #k8s #kubernetes #логи #бэкап #метрики #артефакты

I spent the morning learning Kubernetes. I setup Grafana, Prometheus, node exporters, and migrated my Rackpad container from Docker to K8s. Everything green, zero restarts. Not bad for a first try.

#Kubernetes #K8s #Grafana #Prometheus #Rackpad #homelab #selfhosting

Got the gateway + http route working.
Lots of little pitfalls for me, like I have default deny policies but also stupid ones like typos 😅

Yeah, probably AI could have been a speedup.

BUT. I would not have learned much. And that's the point for me. How can I validate anything without having a real understanding? And that's where we're obviously heading to. Systems nobody can validate.

#k8s #cilium #gateway #ai

Got the gateway + http route working.
Lots of little pitfalls for me, like I have default deny policies but also stupid ones like typos 😅

Yeah, probably AI could have been a speedup.

BUT. I would not have learned much. And that's the point for me. How can I validate anything without having a real understanding? And that's where we're obviously heading to. Systems nobody can validate.

#k8s #cilium #gateway #ai

My summer vacation starts soon. And my brain is spinning and accumulating stuff I could do. Move my hosted server to a better one finally.. I pay both for well over a year :/ Catch up with current development of #k8s, #cilium, #flux, #proxmox, move to Gateway API, #kanidm replication as it got more important. Document all that.. trying to get away from Google photos, but it's complicated with huge shared albums.. and that's just some ideas.. and only IT.

After talos/k8s Upgrade, Cilium is now at 1.20.0-pre.2 no problem with that too 😎
Now trying to go from Ingress to Gateway API.
I want certs, and so after a long time let træfik traffic manage this, had to use cert-manager.
- Crash loops starting up (default deny prohibited access to Cluster API)
- still no certs (propagation checks failed also network policy)
- still failed... 🤯 (My local firewall does not allow access to any DNS outside.. added a few exceptions)
Certs 🎉
#cilium #k8s #upgrade

@flameeyes
Thank you for sharing this insight.

Please tell your instance admin, to fix their IPv6 as well. As federation for IPv6 is broken/not possible due to their #K8S setup.

#IPv6

@flameeyes
Thank you for sharing this insight.

Please tell your instance admin, to fix their IPv6 as well. As federation for IPv6 is broken/not possible due to their #K8S setup.

#IPv6

#ngrok: we want to make visual and interactive content about #kubernetes We didn't want to create and maintain infrastructure for spinning up real clusters, so we decided to create a browser-based #simulator instead. The hope and dream is that this will make it possible for us (and you!) to create interactive Kubernetes content that lives for a long time, because the maintenance burden is much smaller.

#k8s #webernetes #ts #typescript
https://github.com/ngrok/webernetes

#ngrok: we want to make visual and interactive content about #kubernetes We didn't want to create and maintain infrastructure for spinning up real clusters, so we decided to create a browser-based #simulator instead. The hope and dream is that this will make it possible for us (and you!) to create interactive Kubernetes content that lives for a long time, because the maintenance burden is much smaller.

#k8s #webernetes #ts #typescript
https://github.com/ngrok/webernetes

One of the least painful upgrade experiences.
I had a rather neglected talos cluster (talos 1.10.5, k8s 1.33.2) upgrading was just flawless. Multiple steps 1.11, 1.12 etc. Same procedure for k8s.
Took just a few talosctl calls and waiting, now at 1.13.5/1.36.2.
#talos #siderolabs #k8s #upgrade

Security Tip: Implement read-only root filesystems for your containers. 🛡️ Most applications don't need to write to the system root. By enforcing a read-only filesystem (e.g., --read-only in Docker or readOnlyRootFilesystem: true in Kubernetes), you limit an attacker's ability to achieve persistence. Use temporary volumes for specific write paths. Stay updated at https://cvedatabase.com #InfoSec #ContainerSecurity #Docker #K8s

Yesterday, I presented how to run MariaDB Server on Kubernetes using the MariaDB Operator during the DB Mastery Series about MariaDB & MySQL on Kubernetes. My slides are available at: https://speakerdeck.com/lefred/running-mariadb-server-on-kubernetes-discover-how-to-run-mariadb-in-kubernetes-using-the-mariadb-operator 🦭 ☸️ #MariaDB #k8s

Yesterday, I presented how to run MariaDB Server on Kubernetes using the MariaDB Operator during the DB Mastery Series about MariaDB & MySQL on Kubernetes. My slides are available at: https://speakerdeck.com/lefred/running-mariadb-server-on-kubernetes-discover-how-to-run-mariadb-in-kubernetes-using-the-mariadb-operator 🦭 ☸️ #MariaDB #k8s

New Kubernetes Alpha Release

:kubernetes: v1.37.0-alpha.2 :kubernetes:

https://github.com/kubernetes/kubernetes/releases/tag/v1.37.0-alpha.2

#Kubernetes #k8s #kube

New Kubernetes Alpha Release

:kubernetes: v1.37.0-alpha.2 :kubernetes:

https://github.com/kubernetes/kubernetes/releases/tag/v1.37.0-alpha.2

#Kubernetes #k8s #kube

Any Kubernetes self hosting Mastodon folks having problems with LibreTranslate?

I had to rebuild my cluster this week and I can't get either the raw manifest or the Helm version to run well, it randomly crashes/restarts the pod with no error messages.

#k8s #kubernete #mastoadmin

Any Kubernetes self hosting Mastodon folks having problems with LibreTranslate?

I had to rebuild my cluster this week and I can't get either the raw manifest or the Helm version to run well, it randomly crashes/restarts the pod with no error messages.

#k8s #kubernete #mastoadmin

I'm so excited to share #GitOps at the #Louisville #dotNET #meetup. It isn't just a #Kubernetes thing. We'll see both an #OnPrem GitOps build and #ArgoCD deploying #containers into #k8s. Come join us in-person or virtually: https://www.meetup.com/louisville-dotnet/, slides: https://robrich.org/slides/gitops/ code: https://github.com/robrich/gitops

I'm so excited to share #GitOps at the #Louisville #dotNET #meetup. It isn't just a #Kubernetes thing. We'll see both an #OnPrem GitOps build and #ArgoCD deploying #containers into #k8s. Come join us in-person or virtually: https://www.meetup.com/louisville-dotnet/, slides: https://robrich.org/slides/gitops/ code: https://github.com/robrich/gitops

CVSS 10.0 in Google Config Connector — still unpatched.

Any K8s namespace user can become GCP Org Owner with 3 lines of YAML. Google's engineer said "Nice catch!" Then VRP called it "working as intended."

Their defense contradicts their own documentation.

The Register: https://www.theregister.com/security/2026/06/18/google-told-researcher-nice-catch-then-denied-bug-bounty-for-flaw-it-still-hasnt-fixed/5258076

Full writeup + video PoC: https://olearysec.com/research/config-connector-authorization-bypass

#infosec #cloudsecurity #gcp #kubernetes #bugbounty #vulnerability #google #k8s #iam #cybersecurity

KDash 2.0 is out. The Kubernetes terminal dashboard now does more than watch.

- Delete, edit, scale, restart, cordon, port-forward, all from the TUI
- Action menu with confirm prompts
- New themes + live switching

Built in Rust 🦀

https://github.com/kdash-rs/kdash

#Kubernetes #Rust #k8s #DevOps

The recent #Nix meetup in #Amsterdam covered the 26.05 release and featured a talk about #k8s and nix. There was also Pizza and drinks sponsored by the NixOS foundation.

https://www.meetup.com/amsterdam-nix-meetup/events/313868610/

Today's #CloudOps / #DevOps challange: A developer who build a frankenstein #k8s implementation , has his last day before he drops a hearty fuck you to the rest of us and leaves the company forever.

My question

Can we just rebuild everything he built so its "built" the right way?

Am I that asshole for asking this?

Opinions.

#developer #iac #terraform #infrastructure #kubernetes #sre #python #golang

New Kubernetes Release

:kubernetes: v1.33.13 :kubernetes:

https://github.com/kubernetes/kubernetes/releases/tag/v1.33.13

#Kubernetes #k8s #kube

New Kubernetes Release

:kubernetes: v1.36.2 :kubernetes:

https://github.com/kubernetes/kubernetes/releases/tag/v1.36.2

#Kubernetes #k8s #kube

New Kubernetes Release

:kubernetes: v1.35.6 :kubernetes:

https://github.com/kubernetes/kubernetes/releases/tag/v1.35.6

#Kubernetes #k8s #kube

New Kubernetes Release

:kubernetes: v1.34.9 :kubernetes:

https://github.com/kubernetes/kubernetes/releases/tag/v1.34.9

#Kubernetes #k8s #kube

New Kubernetes Alpha Release

:kubernetes: v1.37.0-alpha.1 :kubernetes:

https://github.com/kubernetes/kubernetes/releases/tag/v1.37.0-alpha.1

#Kubernetes #k8s #kube