#kubernetes
Just heard about https://sofka.rs/. It's a k9s alternative written in Rust. Going to try it out in the next few weeks.
Kyverno Chainsaw: declarative end-to-end testing for Kubernetes
https://jorijn.com/en/blog/kyverno-chainsaw-declarative-kubernetes-end-to-end-testing/
Air-gapped Kubernetes deployments: why Zarf wins
https://jorijn.com/en/blog/zarf-airgapped-kubernetes-delivery/
Why most Kubernetes backup strategies don't survive real disaster recovery
https://jorijn.com/en/blog/why-kubernetes-backup-strategies-dont-survive-disaster-recovery/
Kubernetes 1.36 quietly buried one of the worst RBAC patterns in production
https://jorijn.com/en/blog/kubernetes-1-36-fine-grained-kubelet-authz-buries-nodes-proxy/
FinOps for Kubernetes: when "it works" isn't enough
https://jorijn.com/en/blog/finops-for-kubernetes-when-it-works-isnt-enough/
Kyverno graduated: what CNCF top-level status means for Kubernetes policy
https://jorijn.com/en/blog/kyverno-cncf-graduation-kubernetes-policy/
User namespaces graduated stable in Kubernetes 1.36: pod-level isolation without gVisor
https://jorijn.com/en/blog/kubernetes-user-namespaces-pod-isolation-without-gvisor/
Kubestronaut update:
CKA, CKAD, KCNA, KCSA done. I felt that KCSA was harder than anticipated, so taking a few weeks to prepare for CKS.
https://www.credly.com/users/jorijn-schrijvershof/badges#credly
Purchased the Kubestronaut bundle two weeks back at #kubecon. Got 94% on CKAD and 95% on KCNA. Tomorrow: KCSA; Thursday: CKA; and CKS next week.
CKA & CKS are probably a bit harder, so expecting lower scores there.
Playing around with the Gateway API this evening, in preparation for the stopping of Ingress NGINX. Pretty cool implementation, I'm a fan.
Went with the Cilium Envoy approach for now, since we're already running Cilium at most clusters.
Built a Mastodon observability stack over the weekend for toot.community:
Grafana dashboards (web/sidekiq/streaming/edge), VictoriaMetrics rules, SLOs & alerts. The ultimate goal was to get meaningful symptom (user-facing) alerts and to learn about Jsonnet and Grafonnet.
Will publish the repository under https://github.com/toot-community after I find some time to polish things up later this week.
#devops #victoriametrics #mastoadmin #kubernetes #tootcommunity
Might as well bite the bullet and migrate directly to Gateway API. I suspect Kubernetes will eventually deprecate the Ingress resource too, since Gateway API offers that and more.
To the maintainers: Huge thanks for all your time maintaining this project all this time.
https://www.kubernetes.dev/blog/2025/11/12/ingress-nginx-retirement/
Hey @dansup - if you want to get @pixelfed up and running on #kubernetes and do some scaling magic, hit me up. I know a thing or two about handling lots of traffic.
Also, congratulations on the app launch! 🚀
Something that caught me off guard recently: With native #Kubernetes NetworkPolicy resources with #Cilium, you can't select Kubernetes resources by CIDR range. If you need to allow certain traffic to lets say, the API server originating from a Pod, this is not possible by default.
Luckily, there's a flag: https://docs.cilium.io/en/stable/security/policy/language/#selecting-nodes-with-cidr-ipblock
Unfortunately, due to backwards compatibility, they can't make this the default behavior.
Discussion: https://github.com/cilium/cilium/issues/20550
For the first time in my #DevOps career, I can finally produce a #Kubernetes NetworkPolicy without having to look up its spec.
Is there a badge, or a special level to be earned here? 🐳
I recently took a break from the Fediverse, and as a result I lost most of my contacts.
I'm trying to rebuild my network of people to follow, and interact with.
If you're into #Kubernetes, #DevOps, #Kubernetes or #Running, please consider boosting this post and/or following me. 🙏
Spending the morning on https://kyverno.io/policies/. Lots of ready to use best-practices.
#Kyverno #Kubernetes #DevOps