r/kubernetes

Let's say I'm doing the following in a shell script, as example I use Argo CD:

kubectl create namespace argocd

kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.4/manifests/install.yaml

Now before continuing in my script, I want to make sure that everything from Argo CD is running. I've seen `kubectl wait`, but when waiting for ready on the complete manifest the issue is that e.g. service accounts have no ready state so this fails. What is the best practice to wait for everything from the manifest to be installed and running or created? Or is there something that is logically last so I can wait just for that last thing, like e.g. if deployment is ready than this implies that all service accounts were already created?

Trying to setup gitea without a bunch of hard coding or hacky work arounds. Gitea helm just says

If you're using ingress and want to use SSH, keep in mind, that ingress is not able to forward SSH Ports. You will need a LoadBalancer like metallb and a setting in your ssh service annotations.

service:
  ssh:
    annotations:
      metallb.universe.tf/allow-shared-ip: test

I'm not even sure where that is suppose to go. I get that shared ip is suppose to make sure 22 can live on the same IP as 443 but can't manage any setup that ends up on the same IP. I even tried asking AI and it just keeps running in circles suggesting unhinged solutions. I know I have to be missing something simple after going down some rabbit holes

Hello Folks,

recently one of our client requested loadbalancing for microservices, our organization is plannign to implement Envoy and I am new to it, how I should start to study about it? I am mere amount of knowledge about cloud architecture and services. and know that NGINX is load balancer.

Hi everyone,

I recently received a job offer for a position titled Software Engineer – Install and Deploy Applications, and I’m trying to better understand what this role is actually like.

From the title, it seems this may be more related to deployment, delivery, DevOps, or support rather than traditional software development, but I’m not sure.

I’d appreciate insight from anyone who has worked in a similar role.

I have a few questions:

• What are the actual day-to-day responsibilities?
• How much of the job is software development vs installation/configuration/troubleshooting?
• Is this role closer to Software Engineering, DevOps, System Administration, or Technical Support?
• What technologies/tools are commonly used (Linux, scripting, cloud, Kubernetes, databases, etc.)?

Any honest experiences or advice would be really helpful.

Thanks

Hi,

I have a question regarding coding in Go for Kubernetes automation. It's about teasing in Kubebuilder and Go, basically, and I have the problem that I'm looking for the info object about a resource.

I have the code

typedObj, err := scheme.Scheme.ConvertToVersion(info.Object, info.Mapping.GroupVersionKind.GroupVersion())

which should give me the typed object of a resource, but I have looked around the Krusty repo/project for kustomize, but I don't find any possibility how to extract info

Any ideas or hints?

How in the Kubernetes ecosystem can I access info?

I have the baseline code

kOpts := krusty.MakeDefaultOptions()
kOpts.PluginConfig = kustomize_types.EnabledPluginConfig(kustomize_types.BploUndefined)
kOpts.PluginConfig.HelmConfig.Command = "helm"
k := krusty.MakeKustomizer(kOpts)
m, err := k.Run(filesys.FileSystemOrOnDisk{}, filepath.Join(paths...)) // type ResMap, type error

I want to read CRDs from the filesystem, so I need the m object for k.Run().

Any ideas? Anyone at least knows how I can extract the info from the Kubernetes ecosystem by some functionality with some key?

Hi, I knowledge that CSI mean Container Storage Interface which is like an API that I can create the driver of my own and connect with it. But to do that it's like java interface in OOP which means there are rules I must follow to write driver for CSI.

And also in previous days by reading the doc I knowledge that driver plugins are build inside K8s Core code so that's where CSI come.

I knowledge that ReadWriteOncePod make sure that one specific pod can only read the volume but why it must be CSI volumes?

Thank you so much for your time to answer my question.

I've just started migrating from Ingress to Gateway API. And have chosen Envoy-Gateway controller implementation.

Everything is more or less clear and quite simple. Issue is that now there are dozens of objects/resources I have to create and figure out "once" as practical placements as possible. It is about choise paralyses.

TLDR: Where is better to apply custom EnvoyProxy config, GatewayClass or Gateway?

Simple desire: I want to set better names for Gateway's envoy pods and services. (in addition to other config)

I do not plan to have multiple Gateways attached to a single GatewayClass. I plan to have 1:1 several GatewayClasses with their own singular Gateways (similar to what I had ingress-nginx).

Since I'm thinking about 1:1 configuration, attaching EnvoyProxy on a GatewayClass seems to be and OK idea. But then, configuration will happen only on GatewayClass. And if, for some reason, I want to attach another gateway to the same GatewayClass, I will have to provide EnvoyProxy config for the Gateway anyway, otherwise at least names would clash with the first Gateway.

EnvoyProxy config for a Gateway by default completely overrides GatewayClass' config (Without MergeGateways. And I don't want be using that option to not overcomplicate things.

I think EnvoyProxy on a Gateway is winning.
But then I don't know what to set in a GatewayClass' config, and if I need to worry about it at all.

Here's the gap that's been bugging me: everyone's shipping AI agents, but I can't answer a basic question about any of them — what model does it use, what network can it reach, what tools can it call? — without reading the implementation. We govern containers with manifests and labels; agents are just… vibes and a Python file. Security can't review them; platforms can't enforce anything.

So I've been building **agentrc** — an open spec + small CLI to make that reviewable. You declare an agent in a Dockerfile-shaped **Agentfile**:

```

# syntax=agentrc.agentfile/v0.1

FROM python:3.11-slim

IDENTITY name=support-bot version=1.0

CAPABILITY text

SOP Answer billing questions. Escalate anything else.

COPY ./tools/lookup /mnt/tools/lookup

POLICY model.nameclaude-sonnet-4

POLICY network dns:api.stripe.com:443

POLICY agent.tool_timeout 30s

```

Four new keywords over normal Dockerfile syntax: `IDENTITY`, `CAPABILITY`, `SOP`, `POLICY`. Everything under `POLICY` is a **typed request** — not enforcement. The agent *asks*; the platform grants, narrows, or rejects it and enforces deny-by-default (the spec compiles requests to Cedar). The only egress that bot can be granted is `api.stripe.com:443`, and I can see that in one line instead of grepping code.

`arc build` compiles it to a normal **OCI image** with `ai.agentrc.*` labels — platforms read the labels, never the Agentfile, so it ships/signs/mirrors like any container. `arc run <ref> --backend local|bedrock|kubernetes --dry-run` translates the same artifact into that platform's deploy config.

**What this is NOT, so nobody's surprised:**

- Working Draft (0.1.0-draft.6) — expect breaking changes.

- Not a runtime, cloud, model provider, or framework. The backend translators are a **proof of concept** that the labels are sufficient — not production infra.

- Secrets are deliberately out of scope for now.

Try it: `curl -fsSL https://agentrc.ai/install.sh | sh` (or `brew` / `go install`). Spec: https://agentrc.ai · Code: https://github.com/adeelahmad/agentrc

Real questions I want critique on: does the four-keyword split hold up? Is "requests, not enforcement" the right boundary? What would make you comfortable running an agent you didn't write?

Learn K8s with FlashCards

I’m building a free Android flashcard app for learning Kubernetes (concepts, commands, interview prep).

I need 12+ testers for Google Play’s 14‑day closed test.

If you join:

You get early access to a free learning tool.

You can help shape content (tell me which topics/cards are missing).

Join the group

https://groups.google.com/g/skilltesters

Install from Play on your Android device.

https://play.google.com/store/apps/details?id=app.flashcards.kubernetes

join on the web

https://play.google.com/apps/testing/app.flashcards.kubernetes

r/kubernetes, r/devops, r/learncode, r/AWS

We’re trying to design the following: two clusters in two different regions. Each cluster runs the same applications. Each cluster would have a “global proxy” service. If a request comes in through region A cluster but it’s for region B cluster (imagine global proxy in region B is down)….region A proxy needs to be able to send the request directly to the intended service in region B. Essentially arbitrary pod-to-pod (or service to service) traffic between two clusters. How is it normally done? Thank you

Hey , I am just learning on Kubernetes and was wondering why your companies have chosen to run Kubernetes over other containerized solutions (like AWS Fargate)

Share any new Kubernetes tools, UIs, or related projects!