Cilium runs in the kernel-level networking path of millions of Kubernetes pods. If our supply chain were compromised, the blast radius would not be small. Hardening the project against that scenario is something we work on continuously, and we wanted to write down what we actually do, in detail. Most of what follows isn't Cilium-specific: any open source project running CI/CD on GitHub Actions can apply these patterns.

A short debugging story about a two-year-old credentials file, an EKS cluster, and the AWS credential chain quietly doing exactly what it was designed to do.

As you'll know if you've ever tried to build a reasonably sized microservices application locally, you can run out of system resources quickly. So, in order to free up some of that valuable memory, I figured I'd offload things to a Kubernetes cluster running on some relatively cheap hardware, and in this post I'll describe the steps I took so that you can do the same.

This guide breaks down the ultimate architectural blueprint to solve cluster sprawl and deployment friction for good. By unifying the centralized governance of Rancher, the resource-saving isolation of virtual control planes (vCluster), and the advanced multi-stage pipeline automation of Kargo GitOps, this write-up touches on how to build a highly scalable, zero-touch infrastructure environment.

In this article, we will use Kubernetes Service Accounts and the TokenReview API to authenticate requests between two in-cluster services, then improve the setup with audience-bound projected Service Account tokens.

DCGM exporter tells you a GPU is hot. It won't tell you whose job is frying it. l9gpu closes the loop. One agent per node emits vendor-neutral OTLP with workload attribution baked in — Kubernetes pod, namespace, deployment; Slurm job, user, partition.

A native iOS and Android app for monitoring and managing Argo CD deployments from your phone.

Ballast is a Kubernetes operator that automatically right-sizes workload resource requests and limits based on real operational history. It is a more active alternative to Fairwinds Goldilocks: rather than suggesting changes, it applies them — at admission time and on running pods via in-place resize (Kubernetes 1.35+).

Cordium is a free and open source, self-hosted, identity-based sandbox platform built on Kubernetes and Octelium. Cordium is a general-purpose platform that provides isolated, reproducible isolated sandboxes for developers, AI agents, and automated workloads.

Most load-testing tools, however, were designed for a simpler world. They assume requests are independent, stateless, and interchangeable. But an AI agent doesn't work that way. This gap was the motivation behind OpenTelemetry (OTel) Trace Replay, a new capability in Inference Perf, the Kubernetes SIG tool for GenAI inference benchmarking.