Page 3 — Technical articles on Kubernetes, K3s, and Proxmox
K3s ships with Flannel built in, while standard Kubernetes starts with no CNI selected at all. This comparison, grounded in the official K3s, Kubernetes, Calico, and Cilium docs, explains how that difference affects NetworkPolicy enforcement and network performance.
Draining a node in production K3s left a Pod stuck Pending. The cause: Topology Spread Constraints' maxSkew colliding with PodDisruptionBudget. We verify how draining itself creates a node shortage, based on official documentation.
As Kyverno's ClusterPolicy heads toward deprecation, teams migrating to ValidatingAdmissionPolicy (CEL) have found that validation silently skipped for certain resource types. Here's the CEL runtime error and failurePolicy trap behind it, and a safe migration path.
Does VPA's InPlaceOrRecreate mode and In-Place Pod Resize really avoid Pod restarts? We test QoS class constraints and the cgroup v1 trap on K3s with real configs and kubectl commands.
Enabling the restricted Pod Security Admission profile on K3s following standard Kubernetes guides can silently kill ServiceLB. Here's why, backed by K3s's own CIS hardening guide, and how to roll it out safely.
Rebuilding a K3s cluster with GitOps left every Sealed Secret undecryptable. The real cause was how the private key was handled. Here's the failure mechanism, the recovery steps, and how to prevent it from happening again.
K3s's default local-path-provisioner doesn't support CSI snapshots. Velero backups can keep reporting "Completed" while the volume data is never actually protected, leaving restored PVCs empty. Here's how to diagnose it and fix it with File System Backup and restore drills.
K3s HPA won't scale even though CPU usage looks normal. The culprit is a mismatch between Prometheus Adapter's metrics-relist-interval/metrics-max-age and the HPA sync-period. Here's the three-layer delay chain and how to diagnose it.
Which should you choose for K3s production, Kyverno or OPA Gatekeeper? We break down the real-world gap: wildcard policy overhead and measured p99 latency across replica configurations.
Migrating to Gateway API on K3s sounds simple since Traefik ships by default, but it still requires installing CRDs, rebuilding canary configs, and re-checking cert-manager wiring. A practical guide grounded in the 2026 Ingress-nginx retirement and Kubernetes 1.36.