Loading…
Topic
144 posts about Kubernetes. Every summary links to the original.
See the idea
Bare metal gives engineers direct control over GPU, network, and virtualization layers, but it shifts elasticity and lifecycle work onto the team. This trade-off map shows when that bargain pays off.
Argo CD is a GitOps controller that treats Git as the desired state and continuously reconciles it against what actually runs in each cluster. It maps the parts of that loop and why pull-based agents change its scale.
Binary Authorization blocks container images that lack the attestations a cluster policy requires. This comparison sets a strict blocking posture beside an audit-only one, and shows how to choose between them.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Multigres v0.1 alpha is an open-source release of a system intended to provide Vitess-grade horizontal scaling, high availability, and operational simplicity for Postgres. It manages Postgres instances with sharding, connection pooling, automatic failover, and backup orchestration, while this release adds advanced pooling, automatic failovers, and a Kubernetes operator. Its high-availability protocol builds on unmodified Postgres replication, supports user-defined durability policies, resolves split-brain scenarios without losing succeeded commits, and permits replica changes while running. The release is suitable for experimentation but not production workloads: v0.1 is single-shard, sharding is absent, the custom-resource API may change, backward compatibility is not guaranteed, and performance benchmarks are still in progress.
Spotify experienced rapid codebase growth alongside widespread adoption of AI coding tools, resulting in a 76% increase in pull request frequency. To manage fleet-wide codebase maintenance and complex refactoring, the company combined its Fleetshift automation platform with Honk, a background coding agent powered by Claude. Honk runs inside Kubernetes pods with access to CI build environments and integrates with Backstage via Model Context Protocol tools to inspect component metadata. Standardized service architectures and active lint guardrails enable the agent to maintain consistency and auto-correct invalid design patterns during execution. By automating routine migrations, Spotify reduced fleet-wide Java backend updates from multi-week cross-team efforts down to three days handled by a single engineer.
Databricks describes an inference platform serving open-source and proprietary frontier models at more than 125T tokens per month, with reliability as the central challenge under spiky, multi-tenant demand. It identifies failures and latency risks from expensive GPU configurations, variable input and output lengths, long-context requests, multimodal preprocessing, and engine-level hangs. Its architecture combines rate limiting, capacity management, model units, Dicer load-aware sticky routing, and autoscaling; model units estimate multidimensional request cost and allocate capacity more predictably. For runtime reliability, prioritized black-box health checks trigger Kubernetes liveness restarts for silent hangs, completing detection and recovery in less than five minutes while eliminating false probe failures. Image-processing changes, including Torchvision processors and OMP_NUM_THREADS configuration, removed CPU throttling and increased completed requests per second by more than threefold with the same replicas and load; bursty workloads also achieved over 80% GPU savings versus static peak provisioning.
Lakebase is adapting its reliability architecture to agentic and on-demand workloads, which create far more control-plane activity, database starts, and pressure on finite cloud capacity. Lakebase uses stateless Postgres compute over zone-resilient storage, dedicated multi-availability-zone computes for optional high availability, and a vertically autoscaling virtualization layer that reduces dependence on cloud provisioning control planes. A dedicated data-plane controller is being developed for hot-path start and suspend operations, while cell-based regional deployments isolate failures and allow capacity to expand incrementally. The reliability program also uses component and whole-availability-zone failure injection, consistency checks, Service Level Indicators, and Service Level Objectives, including startup, failover, storage, and API measurements. The stated target is for every database to exceed 99.99% monthly availability; reported 2026 attainment through April shows 99.75% to 99.85% of databases meeting that threshold.
The post explains why npm supply-chain attacks matter to Supabase projects: Edge Functions, the Supabase CLI, and packages including supabase-js, @supabase/ssr, and @supabase/server all depend on npm. Attackers can compromise maintainers, register typosquats, or exploit build pipelines; once malicious code reaches node_modules, lifecycle scripts may read environment variables, cloud metadata, tokens, kubeconfig, and SSH keys. The proposed defense is layered: upgrade to pnpm 11, increase minimumReleaseAge to several days, pin sensitive dependency versions, commit and review lockfiles, disable or allowlist install scripts, verify package names, and pin GitHub Actions to full commit SHAs. Supabase is publishing a canonical security guide, hardening its GitHub Actions, adding secret-handling warnings to API documentation, and coordinating communications; the post also recommends rotating credentials after a potentially compromised install and using scanners as supplementary defense.
Uber describes its 2025 effort to give AI agents verifiable identities and preserve attribution as agents act for users across compositional, multi-step workflows. The problem is that conventional human and workload identities expose only generic service identities, dropping originating users and intermediate agents across hops and weakening audits, authorization, and incident response. The design extends Uber’s Zero Trust Architecture with an Agent Registry, an AI Agent Mesh, Security Token Service (STS), MCP Gateway, downstream systems, and an AI Gateway, while integrating identity and context propagation into the agent SDK. Workloads obtain cryptographically signed workload SVIDs from SPIRE, and STS issues short-lived, scoped JWTs for each hop; MCP Gateway authenticates and authorizes tool calls. Production metrics reported show P99 STS token-exchange latency consistently below 40 milliseconds, while the roadmap places dynamic access control and unified policy enforcement above the identity foundation.
The post explains how foundation-model scaling now spans pre-training, post-training, and test-time compute, creating shared infrastructure requirements rather than a single pre-training curve. It examines how AWS infrastructure and open-source tools support these workloads across accelerated compute, networking, storage, orchestration, ML frameworks, and observability. Technical detail includes NVIDIA H100, H200, B200, and B300 GPU characteristics, NVLink/NVSwitch scale-up communication, and EFA-based scale-out networking for distributed collectives. The architecture also incorporates EC2 P instances, tiered storage, Slurm, Kubernetes, SageMaker HyperPod, CUDA, NCCL, PyTorch, Prometheus, and Grafana. The conclusion presents integration points between these layers as the basis for diagnosing bottlenecks and making scaling decisions across the foundation-model lifecycle.
Superhuman replaced a DIY vLLM-based serving stack for its grammar-correction model with Databricks model serving, targeting peak traffic above 200,000 QPS, sub-second P99 latency, four-nines reliability, and no quality regression. The platform combines an Endpoint Discovery Service with power-of-two-choices load balancing, concurrency-based autoscaling, and asymmetric scale policies to reduce hotspots and handle rapid traffic ramps. Lazy-loading container images changed startup from several minutes to a few seconds by fetching metadata first and retrieving 4MB blocks on demand. Runtime work on H100 GPUs raised per-pod throughput from 750 to 1,200 QPS: FP8 weight quantization contributed up to 30%, while a multiprocessing server added 20%, alongside C++ and asynchronous scheduling optimizations. The teams validated changes through shadow testing and evaluation harnesses, and Superhuman is migrating additional models and workflows to the platform.
Grab’s Coban data streaming team addresses production-only Apache Flink deployment failures, which can leave an application unavailable for about 10 minutes while the system observes it and rolls it back. Its Shadow Testing stage runs a new version in parallel with the current Main version, replaying production data without affecting Main outputs and allowing behavior and regressions to be assessed before promotion. The Shadow deployment uses a shadow Kubernetes namespace, a shadow-prefixed application name, isShadow=true, a distinct Job ID, isolated sinks, and connector-specific separation such as suffixed Kafka consumer groups and shifted Debezium Server ID ranges. By default, Shadow runs for one hour while its job-manager status is monitored; users then continue to Main deployment, which receives a 10-minute health check and automatic rollback if unhealthy. The framework isolates Kafka and S3 outputs, prefixes metrics and logs for observability, and plans more connector support.
Databricks’ monitoring infrastructure now tracks 5 billion active timeseries in real time and ingests more than 10 trillion samples daily, exposing scalability, reliability, cost, and operability limits in its older stack. The replacement, Pantheon, is a fork of CNCF Thanos deployed across more than 160 instances in about 70 regions and three cloud providers; tiered storage, differentiated memory retention, isolated replicated Receive groups, multitenancy, and a custom control plane support automated scaling and recovery. Pantheon’s largest instance holds about 300 million in-memory timeseries and handles nearly 1,000 PromQL queries per second, while migration reduced annual cloud costs by millions and monitoring downtime by roughly five times. For high-cardinality troubleshooting, Hydra preserves raw metrics in Delta tables, exposes them through Grafana and SQL, and unifies metric semantics across aggregated and raw paths, with freshness improvements planned.
Distributed tracing frequently suffers from visibility gaps, broken context across asynchronous boundaries like Kafka, and high operational overhead from manually configuring OpenTelemetry SDKs and collectors. To resolve these issues, Odigos provides zero-code instrumentation via eBPF probes that dynamically attach to running workloads without modifying application code. An intelligent control plane within Odigos dynamically adjusts trace sampling and attribute enrichment based on real-time latency and error rates. The resulting telemetry exports over OTLP into ClickStack, an all-in-one backend featuring an OpenTelemetry Collector, ClickHouse storage, and the HyperDX query interface. This unified pipeline preserves end-to-end trace continuity, captures deep application and database context, and enables fast SQL-based trace analysis.
Yelp's Database Reliability Engineering team upgraded over a thousand Cassandra nodes from version 3.11 to 4.1 without downtime. The upgrade delivered reliability, observability, and performance improvements, including Java 11 support, configurable guardrails, and fixed incremental repairs. To avoid the high costs, consistency compromises, and data streaming delays of standing up separate datacenters, the team selected an in-place rolling upgrade strategy. The rollout orchestrated staged node updates alongside compatible versions of the Stargate proxy and custom data pipeline connectors without requiring client code modifications. Although Stargate 2.x introduced regressions on range and multi-partition queries that required downgrading to 1.x, the finished migration achieved up to a 58% reduction in p99 latency across key clusters.
ClickHouse Bring Your Own Cloud is now generally available on Google Cloud across all public ClickHouse Cloud Google regions without requiring a waitlist. The architecture separates the ClickHouse-managed control plane from the customer data plane, which runs entirely within the user Google Cloud project on Google Kubernetes Engine and Google Cloud Storage. An outbound-only, encrypted Tailscale zero-trust tunnel restricts control plane communication strictly to orchestration traffic, ensuring query data never leaves the customer environment. Deployment involves a three-step Terraform setup that establishes least-privilege IAM roles, configures VPC networking, and automates cluster provisioning. ClickHouse manages database and infrastructure maintenance through ArgoCD, employing a make-before-break strategy to add updated replicas before decommissioning older nodes across customizable release channels.
Cursor has made self-hosted cloud agents generally available, allowing code, tool execution, and build artifacts to remain within an organization’s network. Each agent runs in an isolated virtual machine or dedicated worker with a terminal, browser, and full desktop; it can clone repositories, configure environments, write and test code, and push changes for review. A worker connects outbound to Cursor’s cloud over HTTPS, receives tool calls from the agent harness, and returns execution results, while organizations can run long-lived or single-use workers and manage large fleets through a Helm chart, Kubernetes operator, or fleet management API. The product retains cloud-agent capabilities including multi-model support, plugins, and team permissions, while giving teams access to internal caches, dependencies, endpoints, and security controls without maintaining a separate agent stack.
IBM Research and UC Berkeley analyze how agentic LLM systems fail in enterprise IT automation, including incident triage, logs and metrics queries, and Kubernetes actions across long-horizon tool loops. To move beyond benchmark success rates, the analysis applies MAST (Multi-Agent System Failure Taxonomy) to execution traces, converting failures into structured signatures across system design, inter-agent misalignment, and task verification. It covers 310 ITBench SRE traces from Gemini-3-Flash, Kimi-K2, and GPT-OSS-120B, whose mean recalls were 75.5%, 28.6%, and 12.4%, respectively. Gemini averaged 2.6 failure modes per failed trace, compared with 4.7 for Kimi and 5.3 for GPT-OSS-120B, while FM-3.3, Incorrect Verification, was identified as the strongest predictor across models; the analysis recommends external verification, explicit termination controls, and clarification branches.
Notion describes how it reduced Spark compute costs on Kubernetes while maintaining reliability across production workloads. After moving from fixed EC2 clusters on Amazon EMR to EMR on EKS, it used Karpenter, EKS Auto Mode, and the MostAllocated scheduler for dynamic provisioning and bin-packing. Spot Instances then exposed a failure mode: one interruption could remove many bin-packed executors, causing shuffle loss and expensive recomputation. Spot Balancer addresses this by labeling executor creation through a Kubernetes webhook and maintaining each job’s configured spot-to-on-demand ratio, with per-job counts stored in Redis. Named stability weights make the cost-reliability trade-off explicit, and reported savings reached 60–90 percent while jobs that previously failed from interruptions finished reliably.
Shopify uses SkyPilot to run machine-learning training workloads across GPU clusters on Nebius and GCP, addressing scarce hardware, fragmented capacity, and provider-specific interfaces. Persistent Kubernetes clusters remain managed by Shopify, while SkyPilot launches jobs and a company plugin routes requests, validates labels, injects configuration, and applies organizational policies. H200 workloads go to Nebius for InfiniBand-equipped distributed training, while L4 and CPU-only jobs go to GCP; labels also connect jobs to cost ownership, Kueue quotas, priority classes, and development-environment rules. The plugin automatically configures InfiniBand access, shared caches, and temporary storage, reducing manual setup and speeding repeated workloads. The resulting YAML-based interface preserves direct resource control while hiding cloud-selection decisions, giving teams common workflows as providers, prices, and GPU availability change.
Large Docker images for Airflow and Spark Connect caused minute-scale downloads, delaying cold starts and weakening autoscaling responsiveness. The post describes testing eStargz and Seekable OCI (SOCI) with containerd remote snapshotters, which expose registry-backed layers through a virtual lowerdir and fetch file content on demand. In production, SOCI delivered 30–40% faster startup times for Airflow and Spark Connect, while benchmark results showed SOCI matching standard images’ 5.0-second Airflow application startup; eStargz took 25.0 seconds. Configuration tuning increased download concurrency, unpack concurrency, and chunk size, reducing fresh-node image download time from 60 seconds to 24, a 60% improvement. Grab chose SOCI because Bottlerocket supports it natively, while noting that lazy loading redistributes rather than removes download work and requires workload-specific tuning.
Grab describes migrating its service mesh from Consul and the Catcher fallback across a microservices ecosystem of more than 1,000 services spanning VMs, EKS clusters, AWS, and GCP. The existing setup exposed fleet-wide risk from a single Consul server issue, added fallback complexity, and lacked advanced traffic management, security controls, and robust multi-cluster support. After evaluating Application Load Balancer, Istio, AWS Lattice, and Linkerd for stability, performance, integration, and operational simplicity, the team selected Istio for its Kubernetes integration, flexible deployment models, and feature set. The design uses multiple control planes on dedicated Kubernetes clusters, active-active pairs, organization-based mesh boundaries, custom resource definitions, and cross-cluster endpoint discovery to support isolation, availability, routing, security, and observability. Migration began in Q4 2024 with GCP-to-AWS work alongside gRPC and HTTP traffic initiatives, using gradual shifting, rollback mechanisms, and performance monitoring while teams manage legacy systems and cross-mesh connectivity.
Modern cloud-native applications span distributed microservices and dynamic environments, making performance diagnosis and failure analysis dependent on observability. The post explains how Fir, Heroku’s next-generation platform, combines Kubernetes infrastructure with OpenTelemetry to provide standardized visibility while hiding Kubernetes complexity behind Heroku’s interface. Fir runs on AWS EKS, uses OCI images and Cloud Native Buildpacks, and includes a Heroku OpenTelemetry Collector that gathers telemetry from applications, the Heroku router, and the Heroku API. OpenTelemetry’s APIs, SDKs, Collector, and OTLP support logs, metrics, and traces, with drains routing data to dashboards, CLI logs, or external observability platforms. The text also distinguishes OTLP gRPC and HTTP transports, noting gRPC efficiency and features versus HTTP’s firewall compatibility, and presents Fir’s open standards as a way to support scaling, hybrid environments, and reduce lock-in.
The best engineering reads, once a week.
