Topic: kubernetes
All articles tagged “kubernetes”.
2026
FinOps cost models: what AWS, Azure and GCP bill — and what VCF calculates
An EKS cluster-hour, an AKS tier, a GKE Pod request and depreciated VCF hardware are not four values of one variable. What each platform bills, and what VCF calculates instead.
Network policies and Cilium: building a defensible default-deny
The NetworkPolicy API ships with Kubernetes; enforcing it is the CNI's job. What Cilium adds, what stays standard, and how to reach default-deny by watching real flows before blocking any.
Kubernetes RBAC: the foundations, and the pitfalls that survive an audit
Every one of these pitfalls is published on kubernetes.io. What is missing is the ordering — and the path that leads from a vSphere Namespace straight to cluster-admin.
Runtime security: Falco and Tetragon, and how to actually choose
Falco and Tetragon both collect through eBPF. What separates them lies elsewhere: event scope, rule model, and above all what each one can actually prevent.
Supply chain security: Sigstore, SBOM, admission control
Kubernetes verifies no image signature on its own. Signing with Sigstore, inventorying with an SBOM, refusing at admission — and what each of those verbs actually covers.
OpenCost: seeing before acting on Kubernetes spend
OpenCost makes cluster spend readable per namespace. We look at its allocation model, what its default pricing really is, and where the open source ends.
Rightsizing Kubernetes workloads with VPA and KRR
VPA recommends and applies, KRR recommends and explains. VPA's six update modes, and what each one actually does to a Pod now that in-place resize is stable.
VCF 9.1: Kubernetes & self-service, the platform takes over
VKS linked clones, 500 clusters per Supervisor, simplified Container-as-a-Service and Tech Preview object storage: how VCF 9.1 closes the self-service gap.
Centralised logging with Loki and Fluent Bit on VCF
Build the PLG logging stack on VCF and VKS: deploy Fluent Bit as a DaemonSet, configure its pipeline stages, ship logs to Loki, and query them with LogQL.
Observability foundations for VCF: metrics, logs and traces
The three pillars of observability defined by the OpenTelemetry specification, why they matter for VCF and VKS, and how to choose the right tool for each.
OpenTelemetry on Kubernetes: distributed tracing for cloud-native apps
Configure the OTel Collector pipeline on VKS, instrument applications with auto-instrumentation agents, export traces to Tempo or Jaeger, and correlate traces with Prometheus exemplars.
Prometheus & Grafana on VKS: the production monitoring stack
Deploy kube-prometheus-stack on VKS, configure ServiceMonitors and PodMonitors, set up alerting, and integrate with Grafana dashboards — an annotated production guide.
GitOps on VKS with Argo CD: from bootstrap to multi-tenant
Turn a VKS cluster into a self-service platform. Argo CD bootstrap, multi-cluster ApplicationSets, external secrets, and multi-tenant patterns — the practical guide.
Day-2 ops on VKS: lifecycle, upgrades, observability
From creation to upgrade through backup and observability — operating a VKS cluster on VCF 9 without surprises. CAPI, VKr, Prom/Graf/Loki, and VCF Operations.
Networking in VCF 9: from vDS to pod, the packet path explained
How a packet travels from the virtual switch to a VKS pod — vDS, NSX segments, T0/T1, NSX ALB and their trade-offs. The architect's networking guide.
Deploying your first VKS cluster on VCF 9: An architect's guide
VKS is not TKG renamed. Architecture, consumption paths, annotated YAML, day-2 ops, and real limitations — the architect's guide to VCF 9.