# Kubernetes clusters Published articles for Kubernetes clusters. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Securing kubectl on Remote Kubernetes Clusters Without Static Credentials or VPNs DevFeed: [Securing kubectl on Remote Kubernetes Clusters Without Static Credentials or VPNs]() Original publisher: [Read original article]() Author: info@goteleport.com (Steven Martin) Published: 2026-07-17T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Kubernetes](), [Kubernetes clusters](), [k3s](), [Network](), [Networks]() Tags: [best-practices](), [clusters](), [credentials](), [firewalls](), [how-to](), [infrastructure](), [k3s](), [kubectl](), [kubernetes](), [kubernetes-clusters](), [network](), [networks](), [remote]() ### AI overview A guide to securing kubectl access to remote Kubernetes clusters running on distributed edge devices. It explains how NAT, firewalls, kubeconfig sprawl, and static credentials create access and security risks, and discusses avoiding publicly exposed API servers and VPN-related operational challenges. ### Source excerpt Learn how to secure Kubernetes access across remote fleets without creating risk. ## How Microsoft is governing thousands of Kubernetes clusters without manual intervention DevFeed: [How Microsoft is governing thousands of Kubernetes clusters without manual intervention]() Original publisher: [Read original article]() Author: Adrian Bridgwater Published: 2026-05-07T22:07:21Z Content type: article Language: en Sources: [Kubernetes Overview, News and Trends | The New Stack]() Topics: [Kubernetes](), [Microsoft](), [GitOps](), [Artificial Intelligence](), [Inference](), [observability]() Tags: [ai](), [cloud-native-ecosystem](), [declarative](), [gitops](), [inference](), [kubecon-cloudnativecon-eu-2026](), [kubernetes](), [kubernetes-clusters](), [microsoft](), [observability](), [platform-engineering](), [podcast](), [post](), [sponsor-microsoft](), [sponsored-post](), [video]() ### AI overview The article examines how Microsoft addresses the operational challenges of governing thousands of Kubernetes clusters across on-premises, cloud, and edge environments. It describes limitations of single-cluster GitOps assumptions, including multi-cluster routing, secret synchronization, and unified observability, especially as distributed AI inference workloads increase. ### Source excerpt Kubernetes is complicated; everybody knows it. Logically enough, Kubernetes deployed as a cluster of collected and coalesced instances at "fleet The post How Microsoft is governing thousands of Kubernetes clusters without manual intervention appeared first on The New Stack. ## Why Decoupling Databases from Kubernetes Clusters Improves Reliability DevFeed: [Why Decoupling Databases from Kubernetes Clusters Improves Reliability]() Original publisher: [Read original article]() Author: Zach Peirce Published: 2026-02-10T14:00:00Z Content type: article Language: en Sources: [DigitalOcean]() Topics: [Kubernetes](), [Database](), [Databases](), [Cloud](), [Inference](), [Persistence](), [Artificial Intelligence](), [Digital Ocean]() Tags: [ai](), [cloud](), [cloud-native](), [databases](), [digitalocean](), [inference](), [kubernetes](), [kubernetes-clusters](), [latency](), [mongodb](), [opensearch](), [persistence](), [postgresql](), [tech-stack-advice](), [valkey]() ### AI overview The article argues that stateful databases should generally be managed outside ephemeral Kubernetes clusters. It describes Kubernetes as the execution layer and managed databases as a stable memory layer for inference-oriented applications, citing resource contention and latency as key concerns. ### Source excerpt Kubernetes has won the cloud-native war for a reason: it's one of, if not the most powerful tool we have for scaling applications and ensuring they stay up when unexpected things happen. But as we move into the era of the Inference Cloud, we've fallen into a trap. We've become so enamored with "everything-as-code" that we're forcing our most sensitive data inside the cluster. At DigitalOcean, we see thousands of enterprises building on DigitalOcean Kubernetes (DOKS). The most successful ones have realized a counter-intuitive truth: To manage your Kubernetes clusters effectively, you must stop managing your databases inside them. Just because you can run your database in a container, doesn't mean you should. The Inference Cloud demands a new standard In 2026, the stakes have changed. We're no longer just scaling web services, we're scaling data-intensive inference workflows. AI-driven applications require massive bursts of compute and near-instant access to vector data, metadata, and user context. When your database competes for resources inside your Kubernetes cluster, your inference latency suffers. That's why DigitalOcean Managed Kubernetes and DigitalOcean Managed Databases (fully-managed PostgreSQL, MySQL, MongoDB, Caching for Valkey, and OpenSearch database services) are the two essential pillars of our inference cloud, working to solve this issue. Managed Kubernetes acts as the execution layer, while Managed Databases acts as the memory layer. Together, they deliver an attach-architecture that pairs high-performance compute with a stable, external data foundation. We will discuss this in more detail. The "stateful" friction Kubernetes was designed to be stateless-to kill, move, and restart pods at a moment's notice. For databases, this model is far from ideal. Databases are inherently stateful, and running systems like PostgreSQL or MongoDB inside a Kubernetes cluster introduces friction between the two, what is commonly referred to as the operational tax. Whe ## How Shopify uses SkyPilot to route machine-learning workloads across multi-cloud GPU clusters DevFeed: [How Shopify uses SkyPilot to route machine-learning workloads across multi-cloud GPU clusters]() Original publisher: [Read original article]() Author: Javier Moreno Published: 2026-01-26T14:49:55Z Content type: article Language: en Sources: [Shopify Engineering](), [Shopify Engineering - Shopify Engineering]() Topics: [skypilot](), [Cloud](), [Machine learning](), [InfiniBand]() Tags: [cloud](), [development](), [distributed-training](), [infiniband](), [kubernetes](), [kubernetes-clusters](), [multi-cloud](), [open-source](), [shopify](), [skypilot](), [yaml]() ### AI overview Shopify describes using SkyPilot to run machine-learning workloads across existing Kubernetes clusters on multiple clouds. A custom plugin routes jobs based on requested hardware and workload needs, while supporting multi-team management, cost tracking, fair scheduling, and policy enforcement. ### Source excerpt GPUs are annoying. Shopify uses SkyPilot to make them less so: one YAML file, multiple clouds, clean development ergonomics. ## Posts from the Past, October 2025 DevFeed: [Posts from the Past, October 2025]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2025-10-22T18:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [Amazon Elastic Kubernetes Service](), [Kubernetes](), [Amazon Web Services](), [Infrastructure as code](), [Azure]() Tags: [2025](), [amazon-elastic-kubernetes-service](), [ansible](), [aws](), [azure](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [japan](), [k8s](), [kubernetes](), [kubernetes-clusters](), [linux](), [networking](), [oci](), [openstack](), [security](), [vagrant]() ### AI overview A retrospective roundup revisiting the author's Kubernetes, cloud infrastructure, and container-related posts published in October across several years. It highlights work involving Pulumi, Amazon EKS, Bottlerocket OS, Azure Kubernetes Service, Cluster API, AWS, kubeadm, Ansible, Vagrant, and OpenStack. ### Source excerpt Every now and then, I publish one of these "Posts from the Past" articles that looks back on content I've created and posted over the life of this site. This year marks 20 years of content--I can hardly believe it! Don't worry, though; you won't have to go through 20 years of past posts. Here is a selection of posts from mid- to late October over the last decade or so. I hope you find something useful, informative, or at least entertaining! October 2024 Last year I shared information on how to use Pulumi to stand up an Amazon Elastic Kubernetes Service (EKS) cluster with Bottlerocket OS on the Kubernetes nodes--without using any higher-level Pulumi components. October 2022 In 2022, after getting irritated with what I felt was a poor user experience when accessing Azure Kubernetes Service (AKS) clusters created with Pulumi, I published this post on how to change the Kubeconfig file for a more streamlined user experience. October 2021 Cluster API is the name of the game for multiple posts in October 2021. First I wrote this article on kustomize transformer configurations for Cluster API v1beta1 (so that you can use kustomize to manipulate Cluster API manifests), followed up later that month with an article on influencing Cluster API AMI selection. I also touched upon using the external (out of tree) cloud provider for AWS that month, a topic I am revisiting soon as I explore integrating Talos Linux with AWS. October 2020 More Cluster API content--this time discussing IaC considerations for Cluster API (think things like integrating workload clusters with existing AWS workloads or services). October 2019 In October 2019 I explored using jk to programmatically create Kubernetes manifests, and discussed how to use kustomize with kubeadm configuration files. October 2018 Plenty of articles discuss the use of kubeadm to bootstrap Kubernetes clusters (including a few I wrote!), but what of talking about using kubeadm to stand up an etcd cluster? I've got you covered! October 2 ## Introducing Replik8s, a Modern Security Tool for Kubernetes DevFeed: [Introducing Replik8s, a Modern Security Tool for Kubernetes]() Original publisher: [Read original article]() Published: 2025-09-22T16:00:00Z Content type: release Language: en Sources: [Latacora]() Topics: [Kubernetes](), [Security](), [Kubernetes clusters](), [Open Source](), [Incident response](), [AI Agent]() Tags: [ai-agent](), [incident](), [incident-response](), [kubectl](), [kubernetes](), [kubernetes-clusters](), [mcp](), [other](), [security](), [security-tools](), [trivy]() ### AI overview Latacora introduces Replik8s, an open-source Kubernetes tool that snapshots cluster data, serves historical snapshots through a mirror API, supports kubectl and Trivy workflows, and provides query-based analysis for auditing and investigation. ### Source excerpt Introduction # Security tools are often designed to highlight specific issues by consuming APIs and applying predefined logic. Each tool implements its own data structures, storage formats, and evaluation logic. While effective in narrow contexts, this approach creates challenges for teams managing a diverse toolset. Moreover, most tools are optimized to fetch only the data needed for specific findings, limiting their utility in broader contexts such as incident response or historical analysis. ## Distribute Your Argo CD Applications to Different Kubernetes Clusters Using Application Sets DevFeed: [Distribute Your Argo CD Applications to Different Kubernetes Clusters Using Application Sets]() Original publisher: [Read original article]() Author: Kostis Kapelonis Published: 2025-06-17T10:44:02Z Content type: tutorial Language: en Sources: [Codefresh]() Topics: [argo-cd](), [Kubernetes]() Tags: [applications](), [applicationset](), [argo](), [argo-cd](), [argo-cd-kubernetes](), [article](), [best-practices](), [clusters](), [how-to](), [kubernetes](), [kubernetes-clusters](), [series]() ### AI overview This guide explains how to use Argo CD ApplicationSets to distribute multiple applications across multiple Kubernetes clusters. It covers cluster selection, environment-specific settings, cluster labels, and combining the Git and Cluster generators. ### Source excerpt In the previous article in this series, we explained how Argo CD application Sets work and how to use them for organizing your applications in different environments or groups. We received a lot of positive feedback from our readers, and many teams now use the associated Git repository as a starting point for their own [...] The post Distribute Your Argo CD Applications to Different Kubernetes Clusters Using Application Sets appeared first on Codefresh. ## Why Environments Beat Clusters For Dev Experience DevFeed: [Why Environments Beat Clusters For Dev Experience]() Original publisher: [Read original article]() Author: Kostis Kapelonis Published: 2025-06-02T08:41:54Z Content type: article Language: en Sources: [Codefresh]() Topics: [Development](), [Kubernetes](), [Platform Engineering](), [Cloud]() Tags: [cloud](), [continuous-deployment](), [developers](), [devops](), [gitops](), [kubernetes](), [kubernetes-clusters](), [platform](), [product-and-tools]() ### AI overview This article argues that Kubernetes tooling has matured enough to handle many routine cluster operations, allowing teams to focus more on application developers and their experience. It contrasts environments with clusters as a way to frame developer needs. ### Source excerpt The cloud ecosystem has reached a turning point. Tools for operators/administrators are now mature and can handle most day-to-day operations that deal with Kubernetes clusters. Finally, we can turn our focus to application developers and their needs. If you look at all the Kubernetes tools available, you'll understand that most of them treat Kubernetes as [...] The post Why Environments Beat Clusters For Dev Experience appeared first on Codefresh. ## The Missing Link Between Infrastructure Resiliency and High-Velocity Engineering DevFeed: [The Missing Link Between Infrastructure Resiliency and High-Velocity Engineering]() Original publisher: [Read original article]() Author: info@goteleport.com (Jack Pitts) Published: 2025-04-10T00:00:00Z Content type: opinion Language: en Sources: [Teleport]() Topics: [resiliency](), [Security](), [API keys](), [Cloud](), [Social engineering](), [Microservices](), [systems](), [Kubernetes clusters]() Tags: [api-keys](), [cloud-services](), [kubernetes-clusters](), [microservices](), [resiliency](), [security](), [social-engineering](), [systems]() ### AI overview Teleport CEO Ev Kontsevoy and analyst Jack Poller argue that modern infrastructure resiliency depends on rethinking identity and access. The article links credential-based identity attacks and exposed API keys with the growing complexity of hybrid and multi-cloud systems, microservices, Kubernetes clusters, ephemeral workloads, and machine identities. ### Source excerpt Teleport CEO Ev Kontsevoy and analyst Jack Poller explore why traditional identity approaches fail--and how Infrastructure Identity unlocks resiliency. ## Kubernetes Namespace Restriction and Separation DevFeed: [Kubernetes Namespace Restriction and Separation]() Original publisher: [Read original article]() Author: jackson.pitts@goteleport.com (Jack Pitts) Published: 2024-10-03T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Kubernetes](), [Kubernetes clusters](), [Security](), [Requirements](), [Deployment]() Tags: [compliance](), [deployment](), [downtime](), [financial-services](), [kubernetes](), [kubernetes-clusters](), [requirements](), [security](), [standards]() ### AI overview This article explains how Teleport can help financial services organizations restrict and separate Kubernetes namespaces. It discusses namespace-based resource and workload isolation, environment segmentation, resource quotas, compliance requirements, and improved engineering productivity. ### Source excerpt Learn how Teleport enables secure and scalable namespace restriction and separation in Kubernetes clusters. ## Blog: Introducing Falco Talon v0.1.0 DevFeed: [Blog: Introducing Falco Talon v0.1.0]() Original publisher: [Read original article]() Published: 2024-09-09T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Kubernetes clusters](), [No-code](), [function as a service](), [Security]() Tags: [blog](), [faas](), [falco](), [kubernetes](), [kubernetes-clusters](), [no-code](), [release](), [security](), [talon](), [version]() ### AI overview This release introduces Falco Talon v0.1.0, a response engine for managing threats in Kubernetes clusters. It is designed to let users define rules and react to Falco events without building and maintaining custom FaaS-based response systems. ### Source excerpt More than 7 years ago, frustrated by the lack of integrations between Falco and third parties, I created Falcosidekick. The tool evolved much more than expected, with the help of dozens of contributors, individuals or for companies, to have now almost 70 different integrations, and more are coming. Its baby brother came few years later, Falcosidekick UI, helping people to visualize in real time the alerts leveraged by Falco and fine tuning their rules. A frustation remained after all. With Falco, we have an amazing tool to detect suspicious events in our Linux hosts, VM and Kubernetes clusters, with Falcosidekick, we can easily notify our Dev/Secops, index the alerts in some SIEM, etc. But a last piece was missing: how to react to these events? With the integrations of well known FaaS in Falcosidekick, we started a series of blog posts to show how to create from scratch what we call a "response engine". All these systems are modular, flexible, robust, but they all require a considerable amount of work from the user, to deal with the Falco payload format, the errors, the retries, the authentication to the API (AWS, Kubernetes Control Plane), the logs, the metrics, etc. Not all users and companies have the skills and/or the budget to maintain such an architecture. To answer these needs, we designed and created Falco Talon. The the first version is officially out!. What is Falco Talon? Falco Talon is a Response Engine for managing threats in Kubernetes clusters. It enhances the solutions proposed by the Falco community with a no-code tailor-made solution. With easy rules, you can react to events from Falco in milliseconds. Why did we created Falco Talon? Over the years, the Falco community proposed different methods to react to the Falco Events, what we call a response engine. All these methods rely on a 3rd party FaaS (Function as a Service) and come with drawbacks, all actions must be developped by the users to manage: The errors The Falco event format The authentica ## Ep. 5: Efficient Concurrency in Go: Managing GoRoutines and Load Shedding DevFeed: [Ep. 5: Efficient Concurrency in Go: Managing GoRoutines and Load Shedding]() Original publisher: [Read original article]() Published: 2024-06-11T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Concurrency](), [Go Language](), [Concurrent Programming](), [HTTP](), [servers]() Tags: [best-practices](), [concurrency](), [go](), [goroutines](), [http](), [http-server](), [kubernetes-clusters](), [load](), [managing-goroutines](), [networking](), [programming](), [server]() ### AI overview This video tutorial explains how to manage goroutines in Go using parent-child relationships, clean shutdown APIs, and load shedding. It focuses on preventing orphaned goroutines, protecting data consistency during shutdowns, and gracefully handling HTTP server traffic. ### Source excerpt Introduction: In this installment, Bill delves into the concept of load shedding in Go, explaining its importance in managing GoRoutines and ensuring clean shutdowns. How to manage GoRoutines using a parent-child relationship model to prevent orphan GoRoutines. The role of load shedding in maintaining clean and orderly shutdowns, particularly using the HTTP package in Go. Strategies for implementing GoRoutines in Go to handle concurrent tasks efficiently without risking data corruption during shutdowns. ## Ep. 4: Mastering Kubernetes Networking: Essential Insights for Efficient Deployment DevFeed: [Ep. 4: Mastering Kubernetes Networking: Essential Insights for Efficient Deployment]() Original publisher: [Read original article]() Published: 2024-06-03T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Kubernetes networking](), [Kubernetes](), [Deployment](), [Routing (disambiguation)](), [Go Language](), [configuration]() Tags: [clusters](), [configuration](), [deployment](), [discovery](), [go](), [kubernetes](), [kubernetes-clusters](), [kubernetes-networking](), [networking](), [routing](), [yaml]() ### AI overview This video tutorial explains how to configure networking in Kubernetes clusters for Go applications. It covers service definitions, internal and external traffic routing, namespaces, ports, DNS-based service discovery, and configuration patching with Kustomize. ### Source excerpt Introduction: In this detailed discussion, Bill delves into the critical aspects of networking within Kubernetes clusters, emphasizing the necessity of properly defining services to manage internal and external communication effectively. Learn the critical role of service definitions in Kubernetes for managing internal and external communication, ensuring your Go applications are accessible and networked correctly within the cluster. Gain insights into configuring Kubernetes environments to handle traffic routing and service discovery, which is essential for deploying scalable and maintainable Go applications. ## Teleport Community Edition license change, Kubecon EU and Teleport Product Updates DevFeed: [Teleport Community Edition license change, Kubecon EU and Teleport Product Updates]() Original publisher: [Read original article]() Author: ben@goteleport.com (Ben Arent) Published: 2024-03-15T00:00:00Z Content type: news Language: en Sources: [Teleport]() Topics: [Kubernetes](), [Kubernetes clusters](), [MFA](), [Amazon Elastic Kubernetes Service](), [Azure](), [Google]() Tags: [announcement](), [aws](), [azure](), [change](), [gke](), [google-cloud](), [kubecon](), [kubecon-eu](), [kubernetes](), [kubernetes-clusters](), [mfa](), [product-updates]() ### AI overview The March newsletter announces that Teleport Community Edition will move to a new commercial license with Teleport 16, including restrictions based on company size, revenue, and resale or embedding. It also covers KubeCon EU plans and recent Kubernetes-related product updates. ### Source excerpt March Newsletter ## Blixt - A load-balancer written in Rust, using eBPF, born from Gateway API DevFeed: [Blixt - A load-balancer written in Rust, using eBPF, born from Gateway API]() Original publisher: [Read original article]() Author: The Kubernetes Authors Published: 2024-01-08T00:00:00Z Content type: article Language: en Sources: [Kubernetes Contributors Blog]() Topics: [eBPF](), [Rust](), [networking](), [Kubernetes](), [aya](), [Linux](), [Security]() Tags: [aya](), [ci](), [ebpf](), [kubernetes](), [kubernetes-clusters](), [linux](), [load-balancer](), [networking](), [rust](), [security]() ### AI overview The article introduces Blixt, a Layer 4 load balancer in Kubernetes SIG Network. Originally developed at Kong as an experiment for load-balancing Kubernetes ingress traffic with an eBPF dataplane, it was donated to Kubernetes and rewritten in Rust, with its control plane later moved to Golang. The project is intended to support CI and testing for Gateway API, especially TCPRoute and UDPRoute development. ### Source excerpt In SIG Network we now have a layer 4 ("L4") load balancer named Blixt . This project started as a fun experiment using emerging technologies and is intended to become a utility for CI and testing to help facilitate the continued development of Gateway API . Are you interested in developing networking tools in Rust and eBPF ? Or perhaps you're specifically interested in Gateway API? We'll tell you a bit about the project and how it might benefit you. History Blixt originated at Kong as an experiment to test load-balancing ingress traffic for Kubernetes clusters using eBPF for the dataplane. Around the time of Kubecon Detroit (2022) we (the Gateway API maintainers) realized it had significant potential to help us move our TCPRoute and UDPRoute support forward, which had been sort of "stuck in alpha" at the time due to a lack of conformance tests being developed for them. At the same time, various others in the SIG Network community developed an interest in the project due to the rapid growth of eBPFs use on Kubernetes. Given the potential for benefit to the Kubernetes ecosystem and the growing interest, Kong decided it would be helpful to donate the project to Kubernetes SIGs to benefit upstream Kubernetes. Over several months we rewrote the project in Rust (from C), due to a strong contingency of Rust knowledge (and interest) between us developing the project and an active interest in the burgeoning Aya project (a Rust framework for developing eBPF programs). We did eventually move the control plane (specifically) to Golang however, so that we could take advantage of the Kubebuilder and controller-runtime ecosystems. Additionally, we augmented our custom program loader (in eBPF, you generally write loaders that load your BPF byte code into the kernel) with bpfman : a project adjacent to us in the Rust + eBPF ecosystem, which helps solve several security and ergonomic problems with managing BPF programs on Linux systems. After the recently completed license review pro ## How a Geo Data Pipeline Bug Disrupted Skyscanner Flight Search DevFeed: [How a Geo Data Pipeline Bug Disrupted Skyscanner Flight Search]() Original publisher: [Read original article]() Author: Skyscanner Engineering Published: 2023-11-21T11:36:51Z Content type: article Language: en Sources: [Stories by Skyscanner Engineering on Medium]() Topics: [Graphs](), [data](), [dataset](), [systems](), [Kubernetes clusters]() Tags: [bug](), [data-pipeline](), [dataset](), [graph](), [issue](), [kubernetes-clusters](), [recursion](), [systems]() ### AI overview A bug in Skyscanner's geo data materialisation process made some locations their own parents, creating loops in the location hierarchy and disrupting flight search. The article explains the geo data model and the incident's technical context. ### Source excerpt How recursion brought down flight search at Skyscanner On 14th September, 2023 8:05 AM UTC (all timestamps in UTC) there was a critical bug in the output of our geo data pipeline which resulted in a number of geo locations being set as parents of themselves. This caused disruption to our service, and for this we're sorry. It gave us the opportunity to evaluate what went wrong, what we learned, and ways we could prevent a situation like this from happening again. Let's take a deep dive and explain things further. What is Geo Data? Geo data is a key dataset at Skyscanner which is used to provide systems, industry partners and travellers with a complete and accurate representation of the world. In simpler terms, any time you see an Airport, City, Region or Country used in Skyscanner, it's originating from this dataset. The most visible example across our offering can be seen when searching for flights where you will specify an airport, city or country for your journey. We use the geo data to populate origins/destinations and look for flights What was the issue? Skyscanner has been on a journey to upgrade our geo data set. At this time there are two versions, two geo models, running in parallel. Flights generally need to know about airports, cities, countries, contrary to other parts of the business where we need to model more complex relations such as districts, countries, islands, etc. Those relationships form a complex graph where locations are related to each others as parents and children. For this reason we kept our original "heritage" data set, merged it with our canonical dataset, our source of truth. We then basically generate (or reconstruct) our heritage dataset from the canonical data every day at 8am UTC. This generation is referred to as materialisation. The Materialisation Process On 14th September, a bug in the materialisation process updated some locations to be the parent of themselves. For example Scotland is now parent of Scotland. We've created a lo ## Tuning Temporal server request latency on Kubernetes DevFeed: [Tuning Temporal server request latency on Kubernetes]() Original publisher: [Read original article]() Author: Rob Holland Published: 2023-06-13T14:00:00Z Content type: tutorial Language: en Sources: [Temporal Blog]() Topics: [Kubernetes](), [Latency](), [cpu](), [Monitoring](), [Self-hosted](), [Prometheus]() Tags: [cpu](), [deployment](), [efficiency](), [infrastructure](), [kubernetes](), [kubernetes-clusters](), [latency](), [optimizing](), [prometheus](), [self-hosted](), [temporal-concepts]() ### AI overview A practical guide to reducing and stabilizing Temporal Server request latency when deploying it on Kubernetes. It discusses CPU limits and throttling, GOMAXPROCS, and node efficiency during upgrades. ### Source excerpt Learn how to reduce Temporal Server request latency on Kubernetes by optimizing CPU limits, setting GOMAXPROCS, and managing node efficiency during upgrades. ## Sigstore policy-controller 101 DevFeed: [Sigstore policy-controller 101]() Original publisher: [Read original article]() Published: 2023-03-29T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [sigstore policy controller](), [supply-chain-security](), [Kubernetes admission controller](), [Kubernetes]() Tags: [admission-controller](), [cicd](), [cloud-native](), [cluster-security](), [container-images](), [container-security](), [cosign](), [getting-started](), [how-to](), [kubernetes](), [kubernetes-admission-controller](), [kubernetes-clusters](), [security-policies](), [signing-containers](), [sigstore](), [sigstore-policy-controller](), [software-supply-chain-security]() ### AI overview This tutorial introduces Sigstore policy-controller, a Kubernetes admission controller that integrates with Cosign and the Sigstore standard. It explains how to install the controller in a local kind cluster and configure declarative policies for trusted registries, signed images, and other container conditions. ### Source excerpt Chainguard breaks down the benefits of Sigstore's policy-controller, a Kubernetes admission controller that integrates with Cosign and the Sigstore standard. ## Avoiding Kubernetes Pod Topology Spread Constraint Pitfalls DevFeed: [Avoiding Kubernetes Pod Topology Spread Constraint Pitfalls]() Original publisher: [Read original article]() Author: Matthew Kennedy Published: 2023-03-28T09:12:41Z Content type: tutorial Language: en Sources: [Wise Engineering - Medium]() Topics: [Kubernetes](), [configuration](), [Availability](), [resiliency](), [Amazon Web Services](), [Cloud]() Tags: [availability](), [aws](), [cloud](), [configuration](), [devops](), [kubernetes](), [kubernetes-clusters](), [pitfalls](), [platform-engineering](), [resiliency](), [software-engineering]() ### AI overview This article explains how Kubernetes Pod Topology Spread Constraints distribute workloads across Availability Zones or nodes. It examines how naive configurations can create unexpected pod skew and potentially cause the loss of two-thirds of pods if one Availability Zone fails. ### Source excerpt In the Wise Cloud Platform squad we take resiliency, capacity planning and costs seriously. We are always looking for ways to improve how services running on our self-managed Kubernetes clusters in AWS can be made more resistant to system failures without significantly increasing cost. One of the mechanisms we use are Pod Topology Spread Constraints. This is a built-in Kubernetes feature used to distribute workloads across a topology domain, such as Availability Zones or Nodes. In this blog post, we consider Availability Zones to be our topology domain. We discuss how to configure Pod Topology Spread Constraints correctly and how a naive configuration creates unexpected Pod skew. If Pod Topology Spread Constraints are misconfigured and an Availability Zone were to go down, you could lose 2/3rds of your Pods instead of the expected 1/3rd. This will likely negatively impact your customers' ability to use your product. What is wrong with Kubernetes Pod Topology Spread Constraints? Skew is the difference in the number of pods between the most populated and least populated Availability Zone. If we have 3 Availability Zones and 3 Pods, ideally we want a skew of 0, as seen in the diagram below. Diagram showing skew of 0 If we were to add another pod, it could be placed in any of the Availability Zones and our pods would still be distributed as evenly as possible. Our skew would then be 1. If the pods are not evenly distributed, the skew will always be greater than 1. In the case of the diagram below, Availability Zone 1 contains 2 pods and Availability Zone 3 contains zero pods, so the skew is 2. Diagram showing skew of 2 You can configure the Pod Topology Spread Constraints through the topologySpreadConstraints section of a Pods' spec. The Pods to which the configuration is applied is determined through LabelSelectors and what you deem an acceptable distribution is determined by the maxSkew field. Below is an example of a naive topologySpreadConstraints configuration: api ## Teleport at KubeCon + CloudNativeCon Europe 2023 DevFeed: [Teleport at KubeCon + CloudNativeCon Europe 2023]() Original publisher: [Read original article]() Author: travis.rodgers@goteleport.com (Travis Rodgers) Published: 2023-03-24T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Kubernetes](), [Kubernetes clusters](), [Authorization](), [Cloud Native Ecosystem](), [Open Source](), [Cloud]() Tags: [authorization](), [cloud-native](), [kubecon](), [kubecon-eu](), [kubectl](), [kubernetes](), [kubernetes-clusters](), [open-source](), [security](), [zero-trust]() ### AI overview This article previews Teleport's presence at KubeCon + CloudNativeCon Europe 2023 and presents Teleport as a way to secure Kubernetes infrastructure. It describes centralized access to Kubernetes clusters, fine-grained RBAC, identity-based authentication, VPN-independent Zero Trust access, and use of kubectl. ### Source excerpt A few reasons why you need Teleport in your Kubernetes infrastructure, and what we're up to at KubeCon EU, 2023. ## DevOps at Findmypast: Postgres Database Upgrades DevFeed: [DevOps at Findmypast: Postgres Database Upgrades]() Original publisher: [Read original article]() Author: Robbie Hill Published: 2022-11-17T11:30:00Z Content type: article Language: en Sources: [Findmypast]() Topics: [Databases](), [DevOps](), [upgrade](), [Microservices](), [Kubernetes](), [Puppet](), [Ubuntu]() Tags: [back-end](), [clusters](), [configuration](), [databases](), [deployment](), [devops](), [engineering](), [findmypast](), [kubernetes](), [kubernetes-clusters](), [linux](), [microservices](), [mongodb](), [postgres](), [puppet](), [relational-databases](), [ubuntu](), [updates](), [upgrade](), [upgrades]() ### AI overview Findmypast describes its process for upgrading production and non-production Postgres databases. The article covers the database infrastructure, backup arrangements, Puppet-managed installations, version drift between environments, and the reasons for standardizing on the latest supported Postgres version. ### Source excerpt Introduction Findmypast and its sister site; the British Newspaper Archive (BNA), are served by a web of microservices operating across multiple Kubernetes clusters. A number of our microservices rely upon a back-end database, and although we do operate other database technologies (MSSQL, MongoDB etc.), Postgres is our de-facto standard for relational databases. When the DevOps team first realised the need to upgrade all of the database nodes to the latest Postgres version, we operated a total of twelve production Postgres databases, each running on their own dedicated Ubuntu Linux virtual machine (VM). Running on standalone VMs allows for separation of concerns, and limits the 'blast radius' of issues and failures should they occur. All VMs are managed by our Hyper-V cluster, and backed up regularly by Veeam. In addition to this backup method we operate Barman, which takes a full backup of all production Postgres database hosts nightly, and continuously receives WAL (Write Ahead Log) updates. We operate a a similar number of staging / integration / utility Postgres databases. Unlike the production databases these are (mostly) co-located on a single host, given the reduced storage and performance requirements of these databases. Existing Processes We manage Postgres installations and configuration through Puppet, pinning the installed version of Postgres. After the initial deployment we were not actively upgrading the Postgres version running on the hosts. Upgrades of the production databases were instead only undertaken by the feature teams (those teams that manage our micro-services), or by us when requested by the feature teams. This meant that we had a variety of Postgres databases deployed to production, between versions 9 and 14 (the latest supported version at the time). It also meant that the Production Postgres versions differed from their respective staging / integration database. We knew this situation, as well as the approach to upgrades was bad practice ## A Simple Overview of Authentication Methods for Kubernetes Clusters DevFeed: [A Simple Overview of Authentication Methods for Kubernetes Clusters]() Original publisher: [Read original article]() Author: info@goteleport.com (Tiago Silva) Published: 2022-11-07T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Authentication](), [Kubernetes clusters](), [Kubernetes](), [certificates]() Tags: [authentication](), [certificates](), [kubernetes](), [kubernetes-clusters](), [token]() ### AI overview An introductory guide to authentication methods for Kubernetes clusters, including X.509 certificates, service account tokens, bootstrap tokens, and static tokens. ### Source excerpt An introductory guide to understanding the different authentication methods on Kubernetes clusters. ## New Pluralsight Course - Deploying and Managing Azure Kubernetes Service (AKS) Networking DevFeed: [New Pluralsight Course - Deploying and Managing Azure Kubernetes Service (AKS) Networking]() Original publisher: [Read original article]() Author: Anthony Nocentino Published: 2022-05-31T00:00:00Z Content type: release Language: en Sources: [Kubernetes on Anthony Nocentino's Blog]() Topics: [Kubernetes](), [Azure](), [networking](), [Disaster Recovery](), [Cloud]() Tags: [aks](), [availability](), [azure](), [azure-kubernetes-service](), [cni](), [containers](), [disaster-recovery](), [failover](), [ingress](), [kubernetes](), [kubernetes-clusters](), [networking](), [pluralsight]() ### AI overview The article announces a new Pluralsight course on deploying and managing Azure Kubernetes Service (AKS) networking. The course covers AKS networking models, kubenet, Azure CNI, services, ingress controllers, application access, and disaster recovery design patterns. ### Source excerpt My new course "Deploying and Managing Azure Kubernetes Service (AKS) Networking" is now available on Pluralsight here! If you want to learn about the course, check out the trailer here, or if you're going to dive right in, check it out here! Azure Kubernetes Service is a platform-as-a-service that provides Kubernetes Services in the Azure Cloud. This course will teach you to design, configure, and manage networking, services, and disaster recovery in Azure Kubernetes Service. ## Access Multiple Kubernetes Clusters DevFeed: [Access Multiple Kubernetes Clusters]() Original publisher: [Read original article]() Author: info@goteleport.com (Daniel Olaogun) Published: 2022-05-17T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Kubernetes](), [Kubernetes clusters](), [kubectl](), [Security](), [DevOps](), [Availability](), [vendor lock-in](), [backups]() Tags: [availability](), [aws](), [backups](), [clusters](), [deploy](), [dev](), [devops](), [how-to](), [kubectl](), [kubernetes](), [kubernetes-clusters](), [management](), [orchestration](), [production](), [scale](), [security](), [servers](), [test](), [testing](), [tool]() ### AI overview This tutorial explains why organizations use multiple Kubernetes clusters and introduces ways to manage access to them at scale, including managed Kubernetes, separate development, testing, and production clusters, and virtual clusters for developers. ### Source excerpt How to access multiple Kubernetes clusters using kubectl and Teleport Kubernetes Access. [Next page]()