FAUN.dev's Kubernetes Weekly Newsletter 🔗 View in your browser. | ✍️ Publish on FAUN.dev | 🦄 Become a sponsor
Kaptain
🔍 Inside this Issue
Scale is exploding (EKS at 100K nodes, DRA for GPUs) while assumptions crack (DNS‑based GitOps, VPA’s limits). If you want right‑sizing that sticks, observability that holds at 80M series, and a saner container stack, the sharp details are inside.
🚀 Amazon EKS Enables Ultra-Scale AI/ML Workloads with Support for 100K Nodes per Cluster
🧮 Dynamic Kubernetes request right sizing with Kubecost
🧨 Kubernetes DNS Exploit Enables Git Credential Theft from ArgoCD
🎛️ Kubernetes Primer: Dynamic Resource Allocation (DRA) for GPU Workloads
🧩 Kubernetes right-sizing with metrics-driven GitOps automation
⚖️ Kubernetes VPA: Limitations, Best Practices, and the Future of Pod Rightsizing
🧠 Rethinking Efficiency for Cloud-Native AI Workloads
📈 Scaling Prometheus: Managing 80M Metrics Smoothly
🛡️ The Quiet Revolution in Kubernetes Security
🐧 Why I Ditched Docker for Podman (And You Should Too)
You’ve got sharper levers now—pull them and ship.
Have a great week!
FAUN.dev Team
⭐ Patrons
👉 Get yours today for €12,95 – ships in 2-9 days.
ℹ️ News, Updates & Announcements
What’s broken: GitOps pipelines are trusting internal DNS and certs way too much. That blind trust? It’s leaving CI/CD creds wide open.
The upgrade brings pod-level isolation, fault tolerance, and bulk Linux onboarding. Azure and GCP are next on the list.
DRA adds ResourceClaims, DeviceClasses, and ResourceSlices, slicing device management away from pod specs. It replaces the old device plugin clunk for a cleaner, CEL-powered model that actually scales.
Big picture: Kubernetes gets smarter about where stuff runs. DRA pushes it toward topology-aware, parameter-tuned provisioning. Think tighter resource sharing, leaner clusters, and hardware that works for you—not the other way around.
Optimization profiles are customizable, and resizing can be baked into cluster setup using Helm. Yes, that means resource efficiency meets infrastructure-as-code.
Why it matters: Built-in automation for cost-tuned requests points to a bigger trend—Kubernetes resource management that’s proactive, policy-driven, and less of a guessing game.
Here’s the play: it maps usage metrics to templated manifests, then spits out pull requests suggesting better CPU and memory configs. Git stays the source of truth. No manual tweaking. No guessing games.
What changed: This blows up the old playbook. Instead of juggling multiple clusters for scale, teams can now run massive ML workloads on a single, packed control plane. Fewer moving parts. Fewer headaches. More actual work done.
🔗 Stories, Tutorials & Articles
What’s actually happening: Infra teams are ditching cost-first playbooks for something smarter—business-aligned orchestration that chases performance, not just savings. It's less “trim the fat,” more “feed the model.”
VPA sees a narrow slice of the world. No awareness of cluster topology. No big-picture view of workload patterns. It leans on short-term signals and brute-force restarts—not great if you're running critical, multi-region systems or trying to scale cleanly.
Why it matters: Prometheus federation makes multi-tenant observability not just possible, but scalable—even with high cardinality and messy sprawl.
⚙️ Tools, Apps & Software
A home lab cluster running like a mini prod. Declarative from top to bottom: Talos Linux handles the OS, Flux wires up GitOps, Terraform provisions the ground, and GitHub Actions runs the plumbing. Renovate keeps dependencies fresh—no clickers needed.
Myks is a tool and a framework for managing the configuration of applications for multiple Kubernetes clusters. It helps to reuse, mutate, and share the configuration between applications and clusters.
kubewall - Single-Binary Kubernetes Dashboard with Multi-Cluster Management & AI Integration. (OpenAI / Claude 4 / Gemini / DeepSeek / OpenRouter / Ollama / Qwen / LMStudio)
Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage by writing context-aware access control policies for your application resources.
🤔 Did you know?
😂 Meme of the week
🤖 Once, SenseiOne Said
"Kubernetes promises portability; CRDs, storage classes, and cloud IAM quietly take it back. We abstracted servers, then re-coupled to controllers, backoffs, and tail latency."
— SenseiOne