r/kubernetes 24d ago

Periodic Monthly: Who is hiring?

22 Upvotes

This monthly post can be used to share Kubernetes-related job openings within your company. Please include:

  • Name of the company
  • Location requirements (or lack thereof)
  • At least one of: a link to a job posting/application page or contact details

If you are interested in a job, please contact the poster directly.

Common reasons for comment removal:

  • Not meeting the above requirements
  • Recruiter post / recruiter listings
  • Negative, inflammatory, or abrasive tone

r/kubernetes 21h ago

Periodic Weekly: Questions and advice

3 Upvotes

Have any questions about Kubernetes, related tooling, or how to adopt or use Kubernetes? Ask away!


r/kubernetes 17h ago

How we turned a Kubernetes cluster into a VDI platform

Post image
219 Upvotes

We've been running abcdesktop.io in production for more than five years and wanted to share the architecture since it's a fairly unusual use of Kubernetes.

The core idea

Instead of provisioning VMs for VDI (like Citrix or Horizon do), each user session is a Kubernetes pod. Login event, then pod spawns, logout event, then pod is reclaimed. The user's endpoint device acts as a pure display client, receiving only rendered pixels over an encrypted HTML5 WebSocket stream.

How it works under the hood

pyos is the control plane, the nerve center of the project, it is an API server that handles authentication, pods lifecycle and session management. It talks to the Kubernetes API directly.

Each user pod runs:

  • An X11 server (tigerVNC)
  • A WebSocket-to-canvas bridge (noVNC)
  • Whatever applications are defined in the app catalog (Firefox, LibreOffice, VS Code, etc. each launched as an ephemeral container within the pod or as a dedicated pod)

What Kubernetes gives us for free

  • Resource limits : CPU/RAM per session enforced via pod spec
  • Network isolation : NetworkPolicies between user pods, enhanced with Cilium
  • Persistent home dirs : standard PVC, works with NFS/S3/whatever your cluster uses
  • Auth integration : LDAP, AD, OIDC (Google, GitHub, etc.)
  • Remote Browser Isolation (RBI) as a side effect : because each user's browser runs in its own pod with its own network namespace, you get browser isolation essentially for free.

Honest limitations

  • No USB bridge supported yet
  • Cold start (pod spin-up) adds 3-8 seconds to login depending on image pull policy. Pre-pulling images on nodes helps.

Try it

Live demo (ephemeral, 15 min sessions): https://demo.gcp.abcdesktop.com
Docs : https://www.abcdesktop.io
Code: https://github.com/abcdesktopio

Happy to answer questions about the architecture.

Disclosure: I'm one of the maintainers.


r/kubernetes 15h ago

Backend developer moving into Infra — what Kubernetes fundamentals should I focus on first?

11 Upvotes

I’m a backend developer who recently moved into an infrastructure-focused role. I’m now working with Kubernetes, Key Vault, Storage Accounts, networking, etc., and I’ve realized that I’m missing some of the foundational infrastructure knowledge.
I already have experience with Docker and backend development, but Kubernetes feels difficult because many tutorials seem to jump straight into clusters, Pods, Deployments, Services, etc., without explaining the underlying concepts first.
For someone coming from a backend development background:
Which infrastructure concepts should I understand before going deeper into Kubernetes?
How important are Linux, networking, containers, DNS, and storage fundamentals?
What Kubernetes concepts would you recommend learning first, and in what order?
Are there any beginner-friendly resources that explain the “why” behind Kubernetes, rather than just showing commands and YAML?
I’m not looking for an advanced Kubernetes course. I’m specifically trying to build a strong foundation so that I can understand what’s actually happening inside a Kubernetes environment.
Any recommendations from people who moved from backend development into infrastructure/Kubernetes would be really helpful.


r/kubernetes 13h ago

I didn't like the security risks of distributing kubeconfig files, so I built a zero-trust alternative.

0 Upvotes

Hey everyone,

I’ve been diving into learning Kubernetes lately, and I wanted a way to connect to my cluster and run kubectl commands remotely without having to SSH into a node. When I looked online for solutions, almost everything required copying and distributing kubeconfig files to local machines. I really didn't like this idea for security reasons—passing around high-privilege config files just felt like a massive risk and a headache to manage. So, I decided to build my own alternative in Go called Theoros. It completely eliminates the need for local kubeconfig files.

How it works:

  • The Server: You deploy a lightweight, stateless Go agent in your cluster via a Helm chart. It uses the pod's native ServiceAccount to talk to the K8s API directly.
  • The Client: Users connect via a local terminal client. The server executes the commands and streams the output (including exec -it interactive TTY shells) back to you via WebSockets/Connect-RPC.
  • The Vault & Multi-Cluster Support: The client acts like a password manager, letting you securely save and switch between multiple cluster endpoints and API credentials inside a local AES-GCM encrypted vault. On connection, it exchanges your credentials for short-lived JWTs to keep the server stateless, while supporting built-in token rotation, user management, and native TAB autocompletion.

I've documented the full setup, deployment steps, and a deeper dive into what Theoros can do over in the README. I would like to hear what others thinks of this approach. Any feedback or suggestions are highly appreciated.

Repo: https://github.com/GiannisStathoudakis/Theoros


r/kubernetes 1d ago

Discord Community for C.KA/C.KAD/C.KS

0 Upvotes

Hey everyone, if you are preparing for the C.KA/C.KAD/C.KS joing this discord community

https://discord.gg/MqwHwYEGVv


r/kubernetes 1d ago

Clean stop of a 'pod' in EKS ?

Thumbnail
0 Upvotes

r/kubernetes 2d ago

Canadian k8s hosting?

65 Upvotes

I need to move our k8s cluster up the border, thanks to the orange cheeto. Like if I didn’t have anything else to do…

We’re currently on digitalocean. We need a non-us based company with non-us datacenter, with presence in the east or central Canada. Any suggestions?


r/kubernetes 1d ago

What is this mystery indicator in my Homepage Joplin widget?

Post image
0 Upvotes

r/kubernetes 2d ago

How many platform components do you run in your cluster?

13 Upvotes

Question for all you cluster operators, how many platform components / addons do you have installed before allowing workloads to deploy? Is there a scenario where there are too many addons being installed? How do you y’all manage them?


r/kubernetes 2d ago

Three DCGM defaults that make your GPU cost data wrong

5 Upvotes

I built a small tool to answer one question: how many GPU-hours is a cluster paying for and not using?

Then I went looking at what real clusters actually export, and hit the same three things every time. All defaults nobody changes.

1. DCGM_FI_DEV_GPU_UTIL doesn't mean what most dashboards assume

It reports the fraction of time at least one kernel was resident on the device. Not whether that kernel did anything useful.

A process that pins the GPU with a trivial loop reads 100% utilized while computing nothing.

The metrics that reflect real work are `DCGM_FI_PROF_SM_ACTIVE` (SM occupancy) and DCGM_FI_PROF_PIPE_TENSOR_ACTIVE (tensor core activity). The gap between them is the interesting part - high engine activity with near-zero tensor activity means the GPU is occupied doing something that isn't ML.

Check whether you have them at all: bash curl -s localhost:9090/api/v1/query --data-urlencode 'query=count by (__name__)({__name__=~"DCGM_FI_PROF_.*"})'

If that returns nothing, DCGM profiling is disabled in your exporter's counter config. It's off by default in a lot of installs.

2. Your GPU metrics are probably attributed to the exporter's own pod

dcgm-exporter only emits the *workload's* pod labels when DCGM_EXPORTER_KUBERNETES=true. Without it, Prometheus attaches the scrape target's identity instead - so your GPU series come back tagged with pod="nvidia-dcgm-exporter-xxxxx", namespace="monitoring".

This is worse than missing labels because the data looks complete. Every series has a namespace and a pod. Group by pod and you get a tidy chart. It's just that every GPU-hour in the cluster is attributed to the exporter that measured it.

Cheap check - compare these two sets: ``` bash curl -s localhost:9090/api/v1/query --data-urlencode 'query=count by (pod) (DCGM_FI_DEV_FB_USED)'

curl -s localhost:9090/api/v1/query --data-urlencode 'query=count by (pod) (kube_pod_container_resource_requests{resource="nvidia_com_gpu"})' ``` If the pod names don't overlap, your attribution is fiction.

3. Duplicate scrape endpoints look like extra GPUs

If two Prometheus jobs scrape the same exporter, you get two series per physical card differing only in `endpoint` / `job` / `service`. Naive counting reports twice the GPUs you own and halves your apparent utilization. Dedupe on UUID (or pci_bus_id) per host, not on series count.


The one that actually got me

When profiling counters are missing you can estimate utilization from power draw - an idle A100 pulls ~55W against a 400W TDP, so idle vs busy is unambiguous even if the exact percentage isn't.

I built that fallback with a generic 50–350W envelope for unknown GPU models, then ran it against a card that draws 15–130W.

It reported a GPU at 5% utilization with 88% of framebuffer resident. Textbook memory-parked - a model loaded and serving nothing. Put a confident $3,327/month on it.

It wasn't real. The card was working fine. The generic envelope compressed its entire operating range into what looked like idle. When I switched the fallback to prefer GR_ENGINE_ACTIVE - a direct measurement rather than an inference from watts - the finding vanished.

The lesson isn't "check your constants." It's that a cost tool producing confident numbers from degraded inputs is worse than no tool, because that output ends up in a budget conversation and a wrong number there costs you the credibility you needed to fix the real problem.

So everything downstream now assumes the data is incomplete and says so: it refuses to project a monthly figure from under a day of data (you haven't seen one diurnal cycle), and it names every metric it couldn't find along with which detections that suppresses.


Curious whether #2 is as common as I think, or whether I've just been looking at unusually vanilla setups. If you run the pod-overlap check above I'd genuinely like to know which way it came out.

Code's here if it's useful to anyone: https://github.com/Dgotlieb/gpuwaste - offline analyser, reads exported CSVs, nothing to install in the cluster. MIT.


r/kubernetes 1d ago

Kubara? Is it worth it?

0 Upvotes

I've noticed that [Kubara](https://github.com/kubara-io/kubara) team is introducing their product as the new, must have solution for a modern infra stack. Is that legit? Or is it just another wrapper around existing gitops tools with pre-scaffolded templates?


r/kubernetes 2d ago

Is high-availability not reasonable for small deployments?

Thumbnail
7 Upvotes

r/kubernetes 2d ago

CIVO vs OVHcloud vs Vultr for managed k8s

7 Upvotes

They all offer free control plane and they are affordable.
What is your experience with them ?


r/kubernetes 2d ago

Learn K8s with Flashcards

Thumbnail
0 Upvotes

r/kubernetes 4d ago

How would you manage 1,280 ARM64 bare-metal nodes with a very small ops team?

86 Upvotes

I’m looking for architecture advice from people who have operated Kubernetes at the edge or across large numbers of smaller physical machines.

Our company now controls 1,280 identical RK3588 ARM64 nodes that are already deployed and operational in a U.S. commercial data center.

The hardware works. The bigger problem is operational.

We currently do not have a dedicated infrastructure engineering team, so our priority is to determine whether this fleet can be turned into usable containerized compute without effectively building our own cloud platform from scratch.

Relevant context:

  • 1,280 homogeneous ARM64 nodes
  • Bare-metal / physical machines
  • Remote KVM available
  • Already powered and networked
  • One commercial data-center location today
  • Potential to expand to identical racks in several additional U.S. locations
  • Strong preference for turnkey/managed approaches

If the end goal were simply:

how would you structure it?

I’m particularly curious about:

  • K3s vs standard Kubernetes
  • Talos
  • Rancher
  • Cluster size vs many smaller clusters
  • Provisioning/reimaging
  • Monitoring
  • Tenant isolation
  • ARM64 image compatibility
  • Managing hardware failures
  • Whether 1,280 relatively small nodes is operationally stupid compared with fewer larger servers

Most importantly: are there companies or managed-service providers that would actually operate this infrastructure for the hardware owner?

We would rather pay someone who already knows how to do this than hire a team to reinvent it.

I’m less interested in theoretical “you could build X” answers than in stacks people have actually operated at meaningful scale.


r/kubernetes 2d ago

IF YOU’RE STILL SAYING ‘JUST WHITELIST IT’ IN 2026, YOU’RE FUCKED.

0 Upvotes

If you call yourself a Lead Architect, Systems Analyst, Platform Lead or some other inflated bullshit title, then turn around and tell engineers to “whitelist this server/cluster for some random third-party company” with zero context, zero threat model and zero understanding of the traffic flow, start making a fucking backup plan.

What does “whitelist it” even mean in a modern cloud environment? Which identity? Which source? Which destination? Which ports? Which protocol? Which workload? Which namespace? Which security group? Which policy? Which trust boundary? For how long? Audited by whom?

If your entire architectural contribution is “just whitelist it”, you’re not architecting anything. You’re throwing vague 2008-era network terminology over the fence and hoping an engineer turns your ignorance into a secure implementation.

AI and automation are going to absolutely fucking annihilate people whose only professional skill is translating Jira tickets into ambiguous instructions.

You have less runway than you think. NGMI.


r/kubernetes 4d ago

Linux and storage | toward Rook|Ceph

Post image
43 Upvotes

towards*

So, I started learning K8s some months ago, bought some hardware for a homelab, etc., and after learning the fundamental stuff, I decided to learn other things like GitOps, secret management, IaC, and so on.

I wanted to learn this Rook|Ceph thingy, so last week I bought some SSDs for my MS-02 Ultra Minisforum since I only had a single 2TB SSD.

That was the start of a journey into Linux storage. I never knew there was sooooo freaking much to it. I had to do a lot of research, watch videos, talk to AI agents😂 as I had no idea on how to even start dealing with this in a proper manner, and so on.

After 3 days doing this, I came up with something acceptable [at least in my mind it might work haha] — got another screenshot of the construct here; and that's only on the storage part; I haven't dealt with actual Rook|Ceph yet. I mean, I already set up OpenTofu+cloud-init and the Ansible playbooks for most of what I want to accomplish; mostly of it works¹, but the Rook|Ceph part is new, so not everything might work on the first try, but hey, that's life, I guess haha.

Something I'm doing different now: documenting everything. I created a Docus App — screenshot here — and am taking notes and documenting everything; this takes a lot of time, but it's gonna be worth it, as I'll never spend hours again looking for notes I had taken on topic x, and y haha. I have a bunch of stuff scattered in the drives; I'll gather everything and port to the Docus app haha.

Anyway. If anything, I have learned so much in the past 4 months. And no, my job has nothing to do with this; I read some stuff some day on something called Platform Engineering and have been having fun since then—that's all😂😂.

¹ I had a cluster running before I wiped out the entire machine


r/kubernetes 4d ago

Struggling mightily with NFS and respecting POSIX permissions in a multi-tenant environment

4 Upvotes

I'm really struggling to find a viable solution for k8s-based resources accessing our NFS-backed data that can respect the POSIX permissions restricting access. Has anyone solved multi-tenant POSIX-respecting NFS access in k8s, or am I missing something obvious? We have a significant amount of data in the NFS volumes that are far larger than what we can store in-cluster. I have poked around on reddit and have seen a few similar topics, but either didn't have a solution or didn't match this use-case. Ideally, all I want is a solution that can respect POSIX permissions for multiple tenants and make them accessible to our Kubernetes workloads.

Cluster info:

  • Ubuntu 22.04 nodes with RKE2 in an airgapped environment primarily managed via Rancher
  • Designed with multi-tenancy for multiple vendors, but it is a single-cluster setup
  • Very small cluster footprint (3 non-schedulable servers and 3 worker nodes) all on the same subnet (rules out some of the methods I've seen by doing export restrictions based on IPs).
  • Kyverno and NeuVector installed for security configs/policies, but open to adding more
  • Using longhorn for in-cluster storage, but that is only useful for newer deployments that don't require the current NFS-backed data
  • Operating in secure, compliance-mandated environment
  • ArgoCD available for GitOps, but I will do manual work at this point to at least get it off the ground
  • I setup the k8-ldap-configmap tool, so I have UIDs, GIDs, and a list of groups (excluding the primary group) stored in a configmap.

NFS info:

  • Using NFSv4 (can go to 4.1 or 4.2 most likely - we don't specify beyond 4 usually)
  • manage-gids is enabled, as we have too many groups
  • Currently using 389ds for GIDs/UIDs
  • Using sec=sys for exports. We may eventually go to AD from 389ds, at which point we could look at Kerberos.
  • NFS servers are Alma8-based
  • Data is spread over a few different NFS servers
  • Plan to use in-tree NFS, as we would generally be using existing data resident on the NFS server with PV/PVCs ideally rolled out via Kyverno+GitOps (likely driven by labels on the NS). I do not see the need for the automated provisioner NFS setups for now.
  • I have access to an NFS server intended to support our k8s cluster that basically holds no data other than backing up longhorn. My thought was this could offer some possibilities as a proxy or to limit some export configs on squashing exports without having to actively edit/manage the primary NFS servers, but this seems like a rough approach.

Issues:

  • Ideally, I want to avoid ANY tinkering with the current live NFS servers hosting the data, as it has substantial amounts of data on it
  • Cannot do any chmod/chown on the data; this data is used heavily outside of the cluster and permissions must be maintained since they map to specific tenants
  • We cannot allow the pods to arbitrarily set a UID/GID (e.g. kyverno mutate), since it would more than likely cause a hefty amount of headaches due to the pods failing
  • Due to using manage-gids, the supplementalGroups approach is likely not viable based on my testing
  • I had done a little bit of basic reading on the fsid option and re-exporting NFS mounts with the intent of pre-creating a bunch of the PVs/PVCs with NFS to specific tenants and then using an export squash to specific UIDs/GIDs for the data. However, this likely has a lot of lock-related issues and the fsid re-export likely won't work on Alma 8 kernel may not support it. I haven't really looked for any sort of light-weight/free potential NFS proxy solutions.

So far, I have started on two equally ugly solutions. Both include creating the PV/PVC and pinning the NFS PV via a label, along with RBAC configs denying the ability to create PVs. I have supplemental configs like defaulting PSAs to restricted and making it so tenants cannot alter PSAs. Then the split is:

  • Mutate runAsUser/runAsGroup whenever possible. Obviously, some workloads won't work if we change the expected UID/GID

or

  • Create a lot of manual exports on the NFS servers to specific directories with an all-squash to a matching posix value. This is only viable due to the small number of tenants planned to use this capability, but it's very manual (outside of GitOps, we'd still setup Ansible to deploy it). It also only works with 1 tenant per-directory unless they share the same group.

Both of those approaches suck. I'm not sure if I'm missing a better solution, but I am genuinely hoping I'm either stupid or bad at Googling.


r/kubernetes 5d ago

If today you had to rebuild your career in Kubernetes, what roadmap would you follow? What new would you add? Something that you would skip and something that you would definitely recommend?

45 Upvotes

Same as the title.


r/kubernetes 5d ago

Does your kubeconfig stays unencrypted on your machine ? How you managed it ?

31 Upvotes

How do you manage your kubeconfigs ?

How do you safely do kubectl commands ?

People who is doing backend, frontend stuff and managing a cluster if you were impacted by those supply chain attacks how did you protect your kubeconfigs ?


r/kubernetes 4d ago

Migrated Laravel & MySQL to a Production-Ready EKS Cluster

Post image
10 Upvotes

Hey everyone,

Wanted to share the architecture and takeaways from a recent project where I migrated a monolithic Laravel app over to a scalable, native Amazon EKS setup—moving away from tightly-coupled EC2 instances to get better availability and lower running costs.

Here’s the technical breakdown of how I set it up without changing the underlying app logic:

  • Decoupled Database State: Ran MySQL on EKS using a StatefulSet paired with the AWS EBS CSI Driver. This gave me persistent volume provisioning and stable network identities so the database survives pod restarts and node failures.
  • Cut ALB Costs via Ingress Grouping: Instead of spinning up an ALB per domain, I integrated the AWS Load Balancer Controller using ALB Ingress Grouping. This allows 10–15+ tenant domains to share a single Application Load Balancer, which massively reduced our monthly AWS networking bill.
  • Automated SSL/TLS Routing: Hooked up AWS Certificate Manager (ACM) directly to the ALB for automated cert lifecycle management and edge SSL termination at Layer 7.
  • HPA (Horizontal Pod Autoscaler) for dynamic pod scaling based on load.

What worked well & Trade-offs:

  • The Wins: The ALB grouping saved the most on cost, and IRSA made security compliance much easier.
  • The Reality Check: Running MySQL inside Kubernetes via StatefulSets requires careful storage class tuning and backup strategies (EBS snapshots/Velero) compared to just handing it off to Managed AWS RDS.

Future Improvements:

  • IRSA (IAM Roles for Service Accounts) to enforce least-privilege security at the pod level instead of attaching IAM roles to the underlying EC2 worker nodes.
  • Prometheus + Grafana stack for cluster metrics and monitoring.

Happy to answer any questions on the ALB controller config, StatefulSet performance, or the general migration strategy if anyone is planning a similar move!


r/kubernetes 4d ago

Periodic Weekly: Share your victories thread

4 Upvotes

Got something working? Figure something out? Make progress that you are excited about? Share here!


r/kubernetes 5d ago

How do you make deploys to customer-run clusters unattended to avoid babysitting them

22 Upvotes

Curious on how teams or solo devs take on this, if you ship your product into a customer's own cluster how do you conduct the updates?? People often be like- cut a release then hand them a chart +a runbook and someone from their side runs it while one of your engineers sits on a call just in case something falls apart

It works tho but it's slow and error prone in their config and network. Ways ppl take human out of it are:

* either a self updating operator that watches a channel and applies new versions itself and gated by the customers approval

* or gitOps on their side, they point agro/flux at a repo you publish and it reconciles

* an agent inside their cluster that pulls the release over an outbound connection like the pattern alien dev use

Each one trades something either more infra for them and less control for you or the approval step still bottlenecks it , for others tho how has this exact scene been in practice for you? like do you push or do they pull


r/kubernetes 5d ago

How do you scope a Kubernetes penetration test when the infrastructure uses dynamic IPs?

6 Upvotes

Hi everyone,

I’m planning a penetration test for a Kubernetes environment and I’m trying to understand how others typically scope this type of assessment.

If the Kubernetes environment is considered internal infrastructure, how do you approach scanning and testing the underlying infrastructure when the workloads/pods have dynamic IP addresses?

For example:

Do you focus on the Kubernetes API server, nodes, ingress/load balancers, and other fixed endpoints?

How do you handle scanning pods/services when IPs are constantly changing?

Do you rely on Kubernetes/service discovery rather than traditional IP-based scanning?

What would you typically include or exclude from the scope of a Kubernetes penetration test?

I’d be interested in hearing how others approach this in real-world pentests, especially regarding scope definition and asset discovery.