Technical articles on Kubernetes, K3s, and Proxmox
Container security guidelines often stop at 'we run a scanner.' This guide walks through the practical checklist you need to pass before production in K3s: minimal base images, vulnerability scanning, SBOM generation, signing, and admission control.
Docker Hub's pull rate limit is an increasingly real risk to image pulls on production K3s clusters. Kubo explains the design decisions and hidden costs of self-hosting Harbor, a CNCF Graduated project.
Why do Kubernetes costs on EKS/AKS balloon unexpectedly? We break down how autoscaling and cross-AZ billing hide costs, and explore how K3s-based managed infrastructure turns them into a fixed cost.
Why do Kubernetes operations roles stay unfilled for months? It isn't a lack of tool knowledge — it's that the discipline has splintered into too many specialties. Instead of hiring more heads, absorb the specialization into the platform with managed K3s.
Are you burning incident-response time checking Prometheus, Loki, and Jaeger separately? Learn how to correlate metrics, logs, and traces with OpenTelemetry to cut investigation time on K3s clusters, with practical Collector deployment patterns.
When adopting CNCF projects for your Kubernetes stack, are you judging them by GitHub stars and name recognition alone? Learn the Sandbox/Incubating/Graduated maturity framework and the Harbor case study to know what to check before production.
Handing AI agents static API keys is an operating model that eventually breaks down. This article explains why static secrets hit a wall when running MCP servers on Kubernetes, and how Keycloak combined with SPIFFE/SPIRE enables a 'keyless' authentication design.
GitLab Auto DevOps runs SAST/DAST automatically the moment you turn it on. But a scan 'running' and a vulnerable image never reaching your production K3s cluster are two completely different things. Here's how to build an audit gate between CI/CD and the cluster.
Why does troubleshooting a Kubernetes overlay network take so long? This article breaks down how CNI works, the differences between Flannel VXLAN and Calico BGP, and the step-by-step process for isolating MTU mismatches that every K3s operator should know.
When you can't add a privileged container or inject a sidecar into a production Kubernetes cluster, how do you diagnose Pod traffic and syscalls? We explain how the eBPF tool Inspektor Gadget works, and what happened to it in 2026.