KubernetesLinks

I'm glad to announce my new book: GitOps the Hard Way, with Argo CD

Most Argo CD tutorials stop at "apply this, watch it sync". Then production reality hits: drifts, RBAC lockouts, repo-server OOM, secrets sitting in Git ..etc and you're on your own.

This book is the other path. 12 hands-on chapters from an empty cluster to automated deploys: Argo CD, Helm, ApplicationSets, GitLab CI/CD, Kubernetes and more! Every command ran against a live cluster and every manifest applies and syncs.

Build it the hard way once, you finish with a working artifact; an automated GitOps pipeline you assembled yourself, running on infrastructure you provisioned, that you can explain piece by piece.

20% off with GITOPS20, through June 30 -> Get it on FAUN.sensei()

Have a great week,
Aymen.

Kubernetes got a little sharper and a little weirder this week: VM benchmarking is finally getting grown-up tooling, signatures are getting out of your way, and the Dashboard era is officially over. Then there is the uncomfortable part: a default CoreDNS setting that makes it way too easy to lie with DNS.

🧪 Benchmarking KubeVirt performance with virtbench
🌍 Breaking free of a single datacenter: Practical geo-distributed AI operations with the k0smos platforms
🔏 Eliminating Kubernetes Image Signature Replication
🧭 From Dashboard to Headlamp: Understanding the Transition
🕳️ Kubernetes' Default CoreDNS Configuration is insecure

Steal the good ideas, fix the scary defaults, and ship with confidence.

See you in the next issue!
FAUN.dev() Team

First thing you do on a fresh machine: alias k=kubectl

Second thing: buy the shirt.

"kubectl". The command you've typed more times than your own name. Now on 100% cotton, no side seams, runs true to size.

Buy now

The Kubernetes image promoter no longer replicates container image signatures across regions. The rewrite drops that replication entirely, cuts latency, and simplifies the codebase, while keeping signature verification working seamlessly for end users.

Next, the project is moving to OCI 1.1 referrers for signature discovery, which opens the door to further improvements in how signatures are handled.

This post discusses the challenges of leveraging distributed resources for AI workloads and the role of Kubernetes in addressing these challenges. The k0smos stack is highlighted as a solution for operating geo-distributed AI infrastructure, divided into three technical layers: k0s, k0smotron, and k0rdent. Field studies conducted using this stack demonstrate the feasibility of running AI workloads across dynamic, energy-aware orchestration models.

Portworx released "virtbench," an open-source CLI that lets platform teams run reproducible KubeVirt benchmarks and assess VM readiness, rather than rely on pod health as a proxy.

The Kubernetes Dashboard project has been archived, with Headlamp now carrying the legacy forward by offering a visual interface with enhanced capabilities like multi-cluster visibility and application-centric views.

Headlamp keeps familiar workflows, while expanding to support multi-cluster environments and application context with Projects. The UI can be extended with plugins, and Headlamp can be run in-cluster or as a desktop application based on user needs.

CoreDNS pods insecure option is the default in Kubernetes as it allows for the creation of arbitrary DNS A records. Combined with wildcard SSL certs, it poses a security risk, highlighted by Cilium's handling of network policies in the face of DNS manipulation. Time to shift to a more secure DNS configuration!

Skill pack for Claude Code that helps you monitor and troubleshoot your K8s clusters superintelligently

A landing page for your services, dashboards, and documents, discovered automatically from sources such as Docker, Kubernetes, and Tailscale.

Free Software-Defined Storage System based on Kubernetes

Interactive Kubernetes Playground

A native Kubernetes desktop client - nothing in your cluster. Helm, Argo CD, Flux CD, Gateway API & cert-manager built in.

Did you know that Kubernetes will keep routing live traffic to a Pod that is functionally dead, as long as its readiness probe keeps returning success? A readiness probe is a small health check Kubernetes runs to decide whether a Pod should receive requests, and teams often aim it at a trivial endpoint that stays green even when the real request path is frozen. The liveness probe, which restarts stuck containers, shares the same blind spot when it checks that same shallow endpoint. The fix is to make your probes hit the actual code path real requests use, so a wedged Pod actually looks wedged.

"Kubernetes turns failure into a feature, then punishes you for pretending your service boundaries are real. Containers make things reproducible until the network reminds you the system is the product. The orchestration is deterministic; the behavior never is."
- SenseiOne