Kube Builders

How do you secure a Kubernetes node deployed in a grocery store or a farm? Mauro Morales explains the approach behind Spectro Cloud's Kairos project: convert traditional Linux distributions into immutable, image-based systems where packages can't be installed, and drift is nearly eliminated. For high-security edge deployments, they layer on trusted boot — combining secure boot, TPM measurements, and user data encryption to create a system that is almost unhackable. The key insight: minimal attack surface plus trusted components is the sweet spot for node security. Watch the full interview: https://ku.bz/8cpgjFfjn This interview is a reaction to Mircea-Pavel Anton's episode https://ku.bz/LnzSW4BxY

MatrixHub is a self-hosted model registry you can run in place of Hugging Face, caching weights once and serving them quickly to many GPU nodes, including air-gapped networks. More: https://ku.bz/6ty6V-QR3

This guide shows you how to implement chaos engineering on Amazon EKS using AWS Fault Injection Service to simulate CPU stress and pod terminations while monitoring resilience via ADOT and Grafana. More: https://ku.bz/cGJ0nyxxS

What emerging Kubernetes tools are experts paying attention to right now? Bart Farrell from KubeFM looks back across 100+ KubeFM conversations to surface the tools guests kept mentioning, including Karpenter, Dapr, Argo CD, Kagent, Agent Gateway, OpenTelemetry, KRO, KCP, KubeVirt, Kueue, Kyverno, Headlamp, KEDA, Crossplane, KServe, ACK, and more.

This case study shows how Netflix moved millions of batch jobs from its homegrown queueing system to Kueue, without the people submitting those jobs noticing any change. More: https://ku.bz/3WtH2Fml9

l9gpu is a GPU telemetry agent that emits OpenTelemetry metrics with workload attribution built in, so you can see which pod, team or Slurm job is using each NVIDIA, AMD or Intel GPU. More: https://ku.bz/JCtj79Xms

This week on Learn Kubernetes Weekly 198: 🏗️ Data Lakehouse: Infrastructure 🔭 What the Popularity of Emerging Tools Tells Us About Kubernetes' Future ⚡ Kafka on Kubernetes: Performance Lessons for Any Disk-Heavy Data Service 🌐 To Centralise or Not to Centralise: The Questions That Shaped the Kubernetes CODECO Federated Architecture 🚨 Your AI Just Deleted the Wrong Deployment. Now What? Read it now: https://kube.today/issues/198 ⭐️ This newsletter is brought to you by LearnKube — master Kubernetes with hands-on training designed for engineers who want to learn the smart way https://ku.bz/hypSbyc-V

This case study shows how EXANTE replaced manual Saturday releases with a fully automated GitLab CI + Flux + Jira pipeline across 60+ Django modules, 7 GKE environments, and 30+ services to meet fintech regulatory audit requirements. More: https://ku.bz/8BHV_JGB8

This case study shows how one team ran LiteLLM as a single gateway to many model providers on EKS, kept it highly available, and managed the whole thing with ArgoCD. More: https://ku.bz/YKJG9_NH_

Introducing Kube Signals: the new KubeFM show that turns keynote trends into direct conversations with the speakers shaping them. For episode one, Brian Teller sits down with Saiyam Pathak from vCluster after his KubeCon India keynote on AI factories. They examine why the GPU beneath the model is becoming a platform-engineering problem. They discuss: - Why whole-GPU allocation wastes capacity - How DRA, HAMI, MIG, and MPS enable sharing - What Kubernetes must learn to support AI factories Watch the full episode: https://ku.bz/4QZDqrnf- This episode is sponsored by LearnKube. Download the free book, The Technical Guide to Kubernetes Rightsizing, to understand what Prometheus and Grafana cannot tell you about safely reducing requests and limits.

GROOT is a Go CLI that collects Kubernetes logs and cluster context into one archive, with preflight checks, config profiles and archive summaries so you can attach a single file to a ticket. More: https://ku.bz/rXWYbrY1S

Niels Claeys, Lead data engineer & partner at Dataminded, breaks down the hidden resource overhead in Kubernetes clusters and explains how default scheduling strategies can significantly impact cost efficiency for batch processing workloads. He explains that Kubernetes node overhead consists of two main components: node-level reservations for the operating system and eviction thresholds, plus daemon set overhead from cluster management tools. Using a concrete example, he shows how a 16GB RAM node only provides about 14GB of actual memory to running jobs. Watch the full episode: https://ku.bz/hGRfkzDJW

🚀 We just published The Technical Guide to Kubernetes Rightsizing in the Age of AI. The guide follows the complete rightsizing process, from collecting metrics to applying changes safely in production. - It explains how requests and limits affect scheduling and Linux resource controls. - It examines how application runtimes change CPU and memory behavior. - It also shows how KRR and VPA turn historical data into recommendations. The book also examines where AI can help: collecting evidence, explaining recommendations, drafting policy, and carrying approved changes across systems without breaking prod. Thank you to Gulcan and @danielepolencic for the research, experiments, writing, and illustrations behind this book. Download the complete guide for free: https://learnkube.com/kubernetes-rightsizing

Kubernetes is not difficult because there are too many commands. It is difficult because networking, scheduling, deployments, storage, autoscaling, and security interact in ways that are hard to see. Our live Advanced Kubernetes course connects those pieces into one practical mental model. The next online course runs on 10, 11, 17, and 18 September. - Four days of live instruction - 60% hands-on labs - Small classes - Lifetime access to the material and private Slack Joining individually? https://learnkube.com/online-advanced-september-2026 Need several engineers to build the same baseline? We also deliver private training around your platform, workloads, and goals: https://learnkube.com/corporate-training

This case study covers migrating a live k3s cluster from a flat network to a VLAN architecture, including an etcd quorum loss caused by moving too many nodes at once and the recovery steps using k3s server --cluster-reset. More: https://ku.bz/Yxmxk1dbc

Tanat Lokejaroenlarb, Staff Site Reliability Engineer @ Adevinta, explains the operational challenges his team faced managing over 2,500 Kubernetes nodes across 30 clusters using EKS Managed Node Groups and Cluster Autoscaler. He details how the tight coupling between control plane and nodes made version upgrades brittle and noisy, while instance inflexibility created constant maintenance overhead. Watch the full episode: https://ku.bz/T6hDSWYhb

Vitalii Horbachov, Staff Software Engineer at Agoda, explains how Apple's transition to Silicon processors exposed critical flaws in their macOS virtualization approach. He details their original complex architecture that ran Linux on Mac Minis with kubelet, then used QEMU to virtualize macOS on top, creating multiple problematic layers. Vitalii provides insight into the performance penalties and stability issues of their layered virtualization approach, and how a major hardware shift can expose fundamental architectural weaknesses in production infrastructure. Watch the full episode: https://ku.bz/q_JS76SvM

Goldpinger is a monitoring tool that runs as a DaemonSet and makes inter-pod calls to test connectivity. More: https://ku.bz/D_P9JG76K

Delivery tooling matters most when it makes software delivery easier to understand. Devin Allen points to Argo CD and Octopus Deploy as tools he watches because they make automated delivery more visible. The value is not just shipping faster. It is knowing what changed, why something failed, and how delivery behaves inside the organization. Watch the full interview: https://ku.bz/8lKHj1C5d

Pumba lets you kill, pause, and stress containers while injecting network delays, packet loss, and corruption. You can deploy it as a DaemonSet for cluster-wide chaos engineering. More: https://ku.bz/qcvwrrzn0