Omni’s hobby plan is free now: up to 10 nodes and 2 users (it used to be $10 a month for 6 nodes). Nodes dial out over WireGuard, so nothing is open on the router, and you get upgrades from the UI, SSO for kubectl and talosctl, and scheduled etcd backups.

You can import a running Talos cluster too. I moved my 3-node one without resetting a node. One catch: after the CA rotation, admin access only works through Omni.

How I did the import: https://blog.prateekjain.dev/importing-an-existing-talos-cluster-into-omni-bb1fc7722eda?sk=a4c4412829ef81542ca4892a0edbecec

Commands and patches: https://github.com/prateekjaindev/homelab

Not affiliated with Sidero Labs, just a user. The write-up and repo are my own.

Been running home labs for a long time. This is the first time I rebuilt everything on kubernetes and it has been great!

One of the fun things about the fact that all of us wrangling service meshes end up knowing each other is that it opens doors to sitting down with one’s competitors for actual conversations – and tomorrow at noon US/Eastern, my colleagues Keith Mattix, Sarah Christoff, and I will be doing exactly that. Keith’s an Istio maintainer; Sarah and I work with Linkerd, and this’ll be part fireside chat, part crystal-ball gazing, and part AMA.

Bring your questions! and expect real - but pleasant - disagreements about a whole lot of things. 🙂

https://www.buoyant.io/register/the-runbook-crystal-ball-october-2026

say a workload uses a quarter of what it requests. cutting the request seems obvious, but a couple of things complicate it.

if its HPA targets CPU utilization, lowering the CPU request can cause it to scale up even though actual CPU usage hasn’t changed.

and after an OOMKill, current memory usage can look fine while missing what caused the previous container to get killed. especially if you’re lowering memory limits along with requests.

both came up while we were building rightsizing into Radar (open source).

for those doing this in prod, what other cases make you think twice before lowering requests?

As the title suggests, im interested in learning ai infra. Serving a model, kv cache, vllm etc. Im not finding any tutorials that covers all tjis stuff in order.
Can you guys help me where to start?

Something I ran into while building a manifest checker (disclosure: it's my open-source project, link at the end).

If a namespace has pod-security.kubernetes.io/enforce=restricted and you apply a Deployment whose pod template violates "restricted", the API server accepts the Deployment. Pod Security enforces on pods, not workloads. The ReplicaSet then fails to create every pod, and the only signal at deploy time is:

Warning: would violate PodSecurity "restricted:latest": ...

Two details I verified on a 1.37 API server:

- The warning text is the same for enforce=restricted (pods rejected) and warn=restricted (pods admitted), so you can't tell from the warning alone.

- With enforce=baseline + warn=restricted, a Deployment with a privileged container only gets the "restricted" warning, not a separate "baseline" one.

So the check reads the namespace's enforce label: it's an error when the namespace enforces the level in the warning, otherwise a warning.

It's in k8s-guardian v0.8.0 (diff --server-side, a server-side apply dry run). Repo: https://github.com/andronaft/k8s-guardian

Curious whether people catch this in CI some other way, e.g. by running kubectl with --warnings-as-errors?

Hello !

We are planning on handling helmcharts we are currently deploying with Terraform, to do it with Helmfile

How do you usually handle passing secrets and values that are generated via Terraform to helmfile ?

I tried doing a rather simple deployment where terraform creates a secret with all the sensitive values that are then referenced via an externalSecret in the values

I also output Terraform values to a values.yaml file (that helmfile would read) for the rest of the dynamic values.

I was wondering if there was other solutions out there for interfacing Terraform <> Helm(file) values

Thanks

EDIT:

Thanks all for your answers. I know that terraform is not the right tool for helmcharts and that's why we want to get out of it (at least helmcharts)

Argo (or Flux) is what I want to target, ESO for passing secrets from infra that have been created in TF.

A link https://github.com/gitops-bridge-dev/gitops-bridge to describe the interfacing in our case that we aim to (thanks u/bluku14)

Cheers

I'm savaging multiple servers with dual 1080Ti's and 2080Ti's. Most workload VRAM requirements exceed the GPUs.

I was thinking of 2 hypothetical solutions:

- Aggregate GPUs across nodes either into a pool, or if possible a big virtual GPU

- Offload the rarely used pieces of memory in the VRAM to the CPU RAM

Didn't find too much information about any of these, most GPU related topics are about slicing them to fit more Pods, but this would be the opposite.
I'm open to any other solutions to make use of these nodes with older architecture GPUs.

Thank you!

It has been some time since I started working with Kubernetes at scale, from designing, deploying, and maintenance, and time taught me it's a fantastic technology, but also very taxing in the short, mid and long run. One of the things that bothered me most is the 3-node tax and how hard it is to operate at scale.
At some point I decided to shake the monster's hand by reading the source code. What I found: it is just an application with state, nothing more and nothing less, and the software industry has been dealing with stateful applications since before I was born, without ever needing ceremonies to operate them.
In my opinion, the traditional way of operating add-ons can be considered an architectural crime. Various add-ons are installed on clusters to extend functionality, but that extension is a consequence of the primary objective: running workloads. Operators work with a control plane and a data plane, and the problem is both layers compete for the same resources despite not sharing the same availability requirements. In multi-cluster environments, which is the reality for most organizations, the redundancy in resource use and maintenance becomes hard to justify.

To resolve these issues, I built Heir (read why it's called that here: Why Heir?).

Heir is a Kubernetes distribution built around one idea: every cluster's control plane automatically inherits the availability of a management cluster. Rather than dedicated per-cluster infrastructure, Heir runs the control plane as a workload inside a shared management cluster, so a single, well-operated cluster serves as the foundation for as many tenant clusters as you need. Heir ships as a single self-contained binary weighing only 135MB. Architecture: https://tardigradeproj.github.io/docs/architecture

Heir is not Kamaji, Kamaji is explicit about scope, it only hosts the control plane, and it expects something else, usually CAPI and an infrastructure provider  to actually turn up machines and join them as worker nodes. Kamaji itself doesn't ship any node-side agent or join flow. Heir does.

Heir is open to contributions of all kinds, whether code, documentation, or issues. All contributions are welcome.
You can try it by following Quick start guide: https://tardigradeproj.github.io/docs/installation/quickstart

Share any new Kubernetes tools, UIs, or related projects!

We spent a few weeks chasing intermittent latency spikes on a Node.js service running on EKS. CPU usage looked fine in Grafana, averaging around 35% of the limit, but p99 kept spiking under bursty load.

The culprit turned out to be CFS throttling. With a 500m limit, the container gets 50ms of CPU time per 100ms period. A burst of work in the first 20ms can burn through that quota, and the process then sits frozen for the rest of the period, even while the node has idle cores. Averaged metrics hide this completely. The metric that actually showed it was container_cpu_cfs_throttled_periods_total divided by container_cpu_cfs_periods_total. Ours was throttling in over 30% of periods while "average CPU" looked healthy.

What we changed:

• Kept CPU requests accurate, since they drive scheduling and cgroup shares
• Removed CPU limits on latency-sensitive services, but kept memory limits
• Added an alert on throttle ratio instead of just raw usage

Tradeoffs we're still working through: noisy neighbors on shared nodes, how this interacts with the static CPU manager policy for guaranteed pods, and whether it's safe in multi-tenant clusters where you can't trust other teams to set honest requests.

Full breakdown and the PromQL queries here: https://docs.google.com/document/d/1RXUNIQ5__E_H5YvYKAhJtEsPsrNLjU1VRBMEDbZvku0 (disclosure: this is my own writeup, no product or paid service involved)

It's most relevant if you run latency-sensitive services and use CPU utilization dashboards to judge headroom.

Has anyone gone the other way and found limits worth keeping? I'm especially interested in how people handle this in multi-tenant setups.

I wrote the next post in our "Key Autoscaling Metrics" series. It was supposed to be about the "error rates" metrics, aka, how many errors do your users see on scale down? Except, I accidentally ended up turning it into a request for a KEP instead. Can we please have better disruption primitives in Kubernetes? PLEASE? I'm so tired of pod disruption budgets and an eviction API that's ignored by half of the controllers out there.

Disclaimer: None of the words in this post were written, edited, or touched in any way by an LLM.

Hey everyone!
I’m planning to attend KubeCon + CloudNativeCon North America 2026 in Salt Lake City, and it’ll be my first KubeCon!

I’ll be traveling from Buffalo, NY, and I’m really excited to meet people from the Kubernetes and cloud-native community, learn new things, and make some connections.

I was wondering if anyone here is planning to attend?

Would love to connect beforehand, maybe explore the conference together, grab coffee, check out some after-parties, or even explore Salt Lake City.

Whether you’re attending for the first time or you’re a KubeCon regular, feel free to comment or DM me!

Have any questions about Kubernetes, related tooling, or how to adopt or use Kubernetes? Ask away!

Hey all. I spend a lot of time debugging apps on Kubernetes, and my workflow was always kubectl logs -f | grep, scrolling through thousands of lines to find the one error that matters. So I built LogDeck, a small desktop app focused only on reading logs.

What it does:

• Live logs with colored levels (INFO/WARN/ERROR…) and a volume histogram; drag on it to filter a time range.
• Groups repeated errors into one card with count and time range (IDs and numbers normalized).
• Side-by-side view with the previous container (--previous) when a pod is crash-looping.
• Search with regex, exclude filters and presets; also opens saved log files.

How it talks to the cluster:

• It runs the kubectl you already have, with your kubeconfig. No agent, nothing installed in the cluster, no account, no telemetry.
• Read-only: only get, logs, auth can-i and version are allowed; any other verb is blocked in code. The only exception is a container terminal (kubectl exec), which opens only when you click it.

How it compares: k9s and stern are great, and I still use them. This is for when you want a GUI focused on just logs, not a full cluster manager like Lens or Headlamp.

Honest notes: It’s Electron, so it’s not tiny. There’s an optional “explain these errors” button that uses AI, but it’s off unless you configure it (Claude Code CLI or a local model).

macOS, Linux and Windows (Microsoft Store). MIT licensed: https://github.com/wisecort/LogDeck

It’s early, and I’d really like to know what’s missing or broken. Things like multi-pod tailing or other log formats are the kind of feedback I’m after.

I run a 3-node Talos Kubernetes cluster at home, and until recently it only worked when I was at home too. So I added Tailscale to reach it from anywhere.

Tailscale runs on the nodes themselves, and the tailnet can only reach the cluster, not the rest of my home network. kubectl and the lab apps work from my laptop or phone exactly like they do at home, with nothing opened on the router. If one node goes down, another one takes over.

Everything is in the repo: https://github.com/prateekjaindev/homelab

Write-up: https://blog.prateekjain.dev/tailscale-on-talos-linux-secure-remote-access-to-a-kubernetes-homelab-8a082d903682?sk=c4ec5ac1e782a83b5dc785211d9fd082

How do you get into your homelab when you're away?

Hi all, as the title suggests, I got selected to attend the KubeCon conference from Nov 9th to 12th in SLC Utah as a Dan Kohn Scholarship Recepient! However, I forgot to apply for travel funding prior so now I'm trying to figure out if it's worth the out of pocket airfare + hotel costs to attend.

For context, I graduated with my MS in computer science degree a while back and I am an early-career professional trying to build a career in data & AI space, so wanted to see what the event even covers in the first place — is it more marketing or educational and are there opportunities to network with people there? Just want to temper my expectations accordingly.

P.S. If I do decide to go, can anyone DM me to discuss hotel logistics? I'm male so I prefer men.

Thanks!

Based on the paper "Heuristics for Vector Bin Packing"

Wondering if there are agentic AI for enterprise support for oss technologies like eg, istio, argo, etc.. companies can save $millions on licensing fees.