Tag: Kubernetes
All the articles with the tag "Kubernetes".
-
Sidecar-free service mesh: Cilium Service Mesh next to Istio Ambient
Cilium Service Mesh handles mTLS and L7 routing on the eBPF datapath with no separate proxy components at all — unlike Istio Ambient, which drops the sidecar but keeps ztunnel and waypoint. We compare the architectures, the honest limitations, and turn on mTLS in a cluster that already runs Hubble.
-
Flux 2.8: CEL-based health checks and what they change for release gating
Flux 2.8 adds healthCheckExprs — CEL expressions for health checks in Kustomization and HelmRelease. We cover the syntax, migrating an existing resource, and how it differs from canary checks in Argo Rollouts/Flagger.
-
OpenCost: cost-allocating a Kubernetes cluster down to the namespace
OpenCost is a CNCF project that allocates Kubernetes cost by namespace, deployment, and label — no commercial subscription required. We cover the allocation model, how it differs from Kubecost after IBM's acquisition, and how to install it next to a Prometheus you already run.
-
SPIFFE/SPIRE: cryptographic workload identity instead of static secrets
SPIFFE standardizes workload identity through short-lived SVID certificates, and SPIRE — its reference implementation — issues and rotates them via two-tier attestation (node + workload) with no pre-shared secret anywhere. We break down how it differs from external-secrets-operator, how federation works across clusters, and deploy SPIRE to fetch a real X.509-SVID for a test pod.