[{"data":1,"prerenderedAt":43},["ShallowReactive",2],{"blog-tag-en-servicelb":3},[4,16,25,34],{"path":5,"title":6,"description":7,"date":8,"tags":9},"\u002Fblog\u002Fen\u002Fk3s-pod-security-admission-restricted-servicelb-outage","We Enabled Restricted and ServiceLB Died: The K3s Pod Security Admission Gap No Generic Guide Mentions","Enabling the restricted Pod Security Admission profile on K3s following standard Kubernetes guides can silently kill ServiceLB. Here's why, backed by K3s's own CIS hardening guide, and how to roll it out safely.","2026-10-16",[10,11,12,13,14,15],"k3s","kubernetes","pod-security-admission","pod-security-standards","servicelb","security",{"path":17,"title":18,"description":19,"date":20,"tags":21},"\u002Fblog\u002Fen\u002Fk3s-cert-manager-servicelb-http01-challenge-renewal-failure","K3s Wouldn't Renew Its cert-manager Certificate. ServiceLB Was Stealing the HTTP-01 Challenge","cert-manager certificates on K3s stopped renewing, and neither Traefik nor cert-manager itself was the cause — ServiceLB was occupying ports 80\u002F443. Here's how the HTTP-01 challenge silently fails, and how to fix it for good.","2026-09-25",[10,11,22,14,23,24],"cert-manager","tls","lets-encrypt",{"path":26,"title":27,"description":28,"date":29,"tags":30},"\u002Fblog\u002Fen\u002Fk3s-networkpolicy-dual-stack-kube-router-ipv6-gap","\"K3s Ignores NetworkPolicy\" Was a Myth. Traffic Still Leaked Through — the ServiceLB Blind Spot","K3s enforces NetworkPolicy by default via its built-in kube-router controller. Yet traffic via LoadBalancer still leaked through — the cause was ServiceLB's implementation combined with a permanent limitation of the NetworkPolicy API. Here's how to detect and fix it.","2026-09-24",[10,11,31,14,32,33],"networkpolicy","kube-router","network-security",{"path":35,"title":36,"description":37,"date":38,"tags":39},"\u002Fblog\u002Fen\u002Fk3s-traefik-servicelb-ingress-nginx-port-conflict","You Disabled Traefik on K3s, But ingress-nginx Still Can't Grab Port 443. Meet ServiceLB, the Roommate You Forgot About","You ran the K3s disable-traefik flag but ingress-nginx still can't bind port 443. The culprit is ServiceLB (klipper-lb), another default K3s component. Here's how to diagnose it, disable it correctly, and what changes if you're running MetalLB.","2026-09-19",[10,11,40,14,41,42],"traefik","ingress-nginx","load-balancer",1792592704297]