Learn Kubernetes Weekly issue 192 · 15 Jul 2026
Kubernetes Operator Did Not Scale, ClickHouse Shard Rebalancing, Invisible OOMkill, ConfigMaps as a State Store, Container Escape to Takeover
This newsletter is brought to you by Buoyant, the creators of Linkerd.
Articles
Our Kubernetes operator didn't scale, so we rebuilt it
infisical.com
Infisical's case study explains why its Kubernetes operator hit memory and authentication scaling limits and how a reference-based CRD design fixed secret sync.
The SRE Guide to Kubernetes Observability: RED vs. USE Methods
www.buoyant.io
RED and USE aren't the same dashboard. One tracks what your service does for callers, the other tracks what your nodes have left.
We walk through an incident where success stayed at 100% while p99 climbed 47%, and only USE identified the cause.
sponsored
ClickHouse Shard Rebalancing on Kubernetes: From Talk to Operator
medium.com
This case study shows how a team built a Kubernetes operator to rebalance old ClickHouse partitions across shards during cluster size changes.
Invisible OOMkill: Java pods crashing in Kubernetes
dzone.com
This article explains why Java pods can be OOMKilled when JVM heap settings ignore off-heap memory and shows how to align JVM flags with Kubernetes limits.
Using Kubernetes ConfigMaps as a Real-Time State Store
medium.com
This article shows how to use Kubernetes ConfigMaps as a lightweight real-time state store by watching ConfigMap changes and faning events out with Python asyncio.
From Container Escape to Cloud Takeover: A Real-World Cloud Security Assessment
medium.com
This case study explains how a privileged Kubernetes pod with host access can lead to container escape, control plane disruption, service account theft, and cloud resource takeover.
Articles worth checking out:
Let Your Trust Anchor Rotate Itself
One expired root certificate can take down every meshed connection at once.
Join our July 16 hands-on Service Mesh Academy workshop to see how Buoyant Enterprise for Linkerd automates trust anchor rotation with zero downtime.
Tutorials
Linkerd: Federating Clusters for Zero-Downtime Kubernetes
linkerd.io
Linkerd multicluster supports 3 modes:
- federated,
- flat,
- and gateway.
This walkthrough wires all 3 together across 3 GKE clusters, runs a chaos test that kills a whole cluster, and shows automatic failover in action, scripts included.
sponsored
Solving secret sprawl in multi-account Kubernetes with external secrets operator
www.cncf.io
This tutorial shows how External Secrets Operator syncs shared credentials from Bitwarden into Kubernetes Secrets across isolated clusters, namespaces, and cloud accounts.
Session policies for Amazon EKS pod identity
aws.amazon.com
This tutorial explains how Amazon EKS Pod Identity session policies let teams restrict pod IAM permissions with inline policies.
Blocking copy fail (CVE-2026-31431) in Kubernetes with Tetragon
isala.me
This tutorial shows how to block Copy Fail exploitation in Kubernetes by using Tetragon to deny AF_ALG socket creation and emit detection events.
Multiple PodCIDR Pools with Cilium and vCluster
medium.com
This tutorial teaches how to use Cilium's Multi-Pool IPAM mode with vCluster-in-Docker to assign namespace-scoped pod CIDRs, so frontend, backend, and default workloads each get IPs from distinct pools.
Kubernetes jobs
Engineering Manager with StackAdapt
Salary: $112.5K to $421.3K a year
Location: remote from
Tech stack: Kubernetes, Kubernetes, AWS, Kafka, Aerospike, AI tools, AI, golang, Kanban, Scrum
Site Reliability Engineer with GitLab
Salary: $126.4K to $314.4K a year
Location: remote from
Tech stack: Kubernetes, Kubernetes, AWS EC2, AWS, GKE, GCP, SLOs, SLIs, alerting, metrics
Software Engineer with Inversion
Salary: $139K to $201K a year
Location: based in the office in Playa Vista, CA, USA
Tech stack: Kubernetes, Kubernetes, Docker, GitOps, CI/CD, Helm, storage systems, Databases, LLM tools, AI
Software Engineer with Inversion
Salary: $101K to $160K a year
Location: based in the office in Playa Vista, CA, USA
Tech stack: Kubernetes, Kubernetes, Docker, CI/CD, storage systems, Databases, AI tools, LLM tools, AI, React
DevOps Engineer with Internal Job Board
Salary: $91K to $99K a year
Location: based in the office (and remote from home) in Toronto, ON, CA
Tech stack: Kubernetes, Podman, Google Cloud Platform, Kubernetes, Docker, GCP, observability tools, Loki, Observability stacks, Grafana
Discover more Kubernetes jobs on Kube Careers →
Code & tools
k8scout: Kubernetes attack path mapper
github.com/k8scout
k8scout maps realistic Kubernetes escalation paths from a compromised pod to cluster-admin, node access, secret theft, or cloud IAM takeover, with graph output and reviewer mode.
Kogaro – Kubernetes Configuration Hygiene Agent
github.com/topiaruss
Kogaro continuously validates Kubernetes config with 60+ checks across reference, resource, security, image, and network domains, catching silent failures before they impact production.
KubePlumber: Kubernetes network validation utility
github.com/David-VTUK
KubePlumber tests Kubernetes networking from inside the cluster by checking:
- internal DNS,
- pod-to-pod traffic,
- external DNS,
- and bandwidth between nodes.
Kubernetes MCP Server: AI control layer for Kubernetes and OpenShift
github.com/containers
Kubernetes MCP Server lets Claude, VS Code, Cursor, and other MCP clients inspect and manage Kubernetes or OpenShift resources through a native Go server.
Ariadne: Kubernetes graph MCP for coding agents
github.com/REASY
Ariadne turns Kubernetes cluster state into a Memgraph property graph so agents can answer relationship-heavy questions with read-only Cypher instead of raw YAML dumps.
Other interesting projects:
Upcoming Kubernetes events
Jul
15
OpenShift Virtualization Networking Deep Dive - Architecture and implementation best practices
Online webinar organized by Red Hat.
This is a virtual event
This is a free event.
Jul
15
Infrastructure Mistakes That Create Tech Debt — and How AI-Powered Platforms Fix It.
In-person meetup organized by Cloud Native Platform NL.
Location: Amsterdam, NL
This is a free event.
Jul
18
In-person conference organized by Kubernetes Community Days.
Location: Lima, PE
This is a free event.
Jul
18
Kubernetes Community Days Lima 2026
In-person conference organized by KCD Lima, Perú.
Location: Lima, PE
This is a free event.
Jul
20
Online & in-person conference organized by Debian Argentina community.
Location: Santa Fe, AR and virtual
This is a free event.
Sept
10
Online workshop organized by LearnKube.
This is a virtual event
This event requires an entrance fee
Kubernetes call for papers
16
days
ContainerDays & AI Context Singapore
The Call For Paper is open until 31 July 2026 at UTC. More info →
Location: Singapore, SG
In-person conference organized by ContainerDays.
The conference starts on the 28 October 2026.
- Apply here
0
days
Kubernetes Community Days Porto 2026
The Call For Paper is open until 16 July 2026 at UTC. More info →
Location: Porto, PT
In-person conference organized by KCD Porto.
The conference starts on the 20 November 2026.
- Apply here
3
days
Kubernetes Community Days Sofia 2026
The Call For Paper is open until 18 July 2026 at UTC. More info →
Location: Sofia, BG
In-person conference organized by KCD Sofia.
The conference starts on the 29 September 2026.
- Apply here
expired
Kubernetes Community Days Suisse Romande 2026
The Call For Paper was open until 15 July 2026 at UTC. More info →
Location: Geneva, CH
In-person conference organized by KCD Suisse Romande.
The conference starts on the 10 December 2026.
- Apply here
47
days
The Call For Paper is open until 31 August 2026 at UTC. More info →
Location: Bucharest, RO
In-person conference organized by OmniOpenCon.
The conference starts on the 18 October 2026.
- Apply here
30
days
The Call For Paper is open until 14 August 2026 at UTC. More info →
Location: Paris, FR
In-person conference organized by mate.dev.
The conference starts on the 3 December 2026.
- Apply here
31
days
The Call For Paper is open until 15 August 2026 at UTC. More info →
Location: Buenos Aires, AR
In-person conference organized by Cloud Security Space.
The conference starts on the 9 October 2026.
- Apply here
44
days
The Call For Paper is open until 28 August 2026 at UTC. More info →
This is a virtual event
Online conference organized by ScyllaDB.
The conference starts on the 11 March 2027.
- Apply here
expired
Great International AI Native Summit
The Call For Paper was open until 15 July 2026 at UTC. More info →
Location: Bangalore, IN
In-person conference organized by Saltmarch.
The conference starts on the 10 December 2026.
- Apply here
Thanks for reading.
Until next time!
— Gulcan