Kubernetes

GitOps Principles v1

Declarative, verifiable and automated operations — using Git as the single source of truth for infra and apps.

Kubernetes Pod Security Standards

Baseline, restricted, and privileged policy levels for securing pod workloads.

Helm Chart Best Practices

Recommendations for structure, naming, versioning, and values of Helm charts.

Service Mesh Best Practices

Guidance for using a service mesh to manage service-to-service traffic, security, and observability through sidecar proxies, keeping that logic out of application code.

Sidecar Pattern

A design pattern that deploys a helper component alongside the main application in the same unit, adding capabilities like proxying, logging, or config without changing the app.

Patterns4

Service Discovery

A mechanism for clients to find the current network location of a service without hard-coding addresses.

Service Mesh

A dedicated infrastructure layer that manages service-to-service communication via co-located proxies and a central control plane.

Health Endpoint Monitoring

Expose health-check endpoints that monitoring tools and load balancers probe to verify an application is functioning correctly.

Health Check

Exposes endpoints that report whether a service is alive and ready to serve, enabling orchestrators and load balancers to route traffic only to healthy instances.

Tutorials25

Setting Up a Local Kubernetes Cluster

Create a local Kubernetes development environment with kind or minikube

How to deploy an application to Kubernetes with Deployment and Service

Package an image into a Kubernetes Deployment and expose it with a Service, then scale and roll out updates.

How to package a Kubernetes app with a Helm chart

Create a reusable Helm chart with templated manifests and values so one app deploys cleanly across environments.

How to configure liveness, readiness, and startup probes in Kubernetes

Add health probes so Kubernetes restarts unhealthy pods and only routes traffic to ready ones.

How to autoscale pods with the Kubernetes HorizontalPodAutoscaler

Scale a Deployment automatically on CPU or custom metrics using the HorizontalPodAutoscaler and metrics-server.

How to expose Kubernetes services with an Ingress and TLS

Route external HTTP traffic to services using an Ingress controller, host and path rules, and automatic TLS.

How to manage configuration with Kubernetes ConfigMaps and Secrets

Externalize app settings into ConfigMaps and sensitive values into Secrets, mounted as env vars or files.

How to run stateful workloads with a Kubernetes StatefulSet

Deploy databases and other stateful apps with stable network identities and per-pod persistent storage.

How to set up RBAC in Kubernetes with Roles and ServiceAccounts

Grant least-privilege access to users and workloads using Roles, RoleBindings, and ServiceAccounts.

How to restrict pod traffic with Kubernetes NetworkPolicies

Lock down pod-to-pod traffic with default-deny and selective allow rules using NetworkPolicy resources.

How to install Istio and enable mTLS for service-to-service traffic

Deploy Istio, enable automatic sidecar injection, and turn on strict mutual TLS between services.

How to add a lightweight service mesh with Linkerd

Install Linkerd, mesh a workload, and gain automatic mTLS plus golden-metrics observability with low overhead.

How to set up GitOps continuous delivery with Argo CD

Deploy and sync Kubernetes manifests from Git using Argo CD Applications with automated, self-healing syncs.

How to manage Kubernetes manifests across environments with Kustomize

Use a base plus overlays to customize Kubernetes manifests per environment without templating or duplication.

How to autoscale Kubernetes nodes with the Cluster Autoscaler

Add and remove nodes automatically based on pending pods using the Cluster Autoscaler on a managed cluster.

How to enforce Pod Security Standards in Kubernetes

Apply the built-in Pod Security Admission to enforce baseline and restricted policies per namespace.

How to provision an Amazon EKS cluster and deploy a workload

Create a managed EKS cluster with managed node groups using eksctl, then deploy and verify an application.

How to provision an Azure AKS cluster and deploy a workload

Create a managed AKS cluster with the Azure CLI, connect kubectl, and deploy an application.

How to provision a Google GKE cluster and deploy a workload

Create a GKE cluster with the gcloud CLI, connect kubectl, and deploy an application with autoscaling.

How to set Kubernetes resource requests and limits correctly

Right-size CPU and memory requests and limits to improve scheduling, stability, and Quality of Service.

How to sign and verify container images with Cosign

Sign images with Cosign and enforce signature verification in Kubernetes for a secure software supply chain.

How to set up GitOps with Argo CD

Deploy applications to Kubernetes declaratively by syncing manifests from Git using Argo CD.

How to implement GitOps with Flux

Bootstrap Flux into a Kubernetes cluster and reconcile workloads from Git using GitRepository and Kustomization resources.

How to deploy Helm charts to Kubernetes from CI

Package an application as a Helm chart and deploy it to Kubernetes from a CI pipeline with per-environment values.

How to deploy a machine learning model for inference

Serve a trained model behind an HTTP API, containerize it, and scale it for production inference.

Blueprints16

On-Premises to Kubernetes Blueprint

Complete guide for migrating on-premises workloads to Kubernetes

Heroku to Kubernetes Blueprint

Migration from Heroku PaaS to self-managed Kubernetes

Physical Servers to Kubernetes Blueprint

Modernize applications running on bare-metal physical servers into containers orchestrated by Kubernetes, with phased discovery and re-platforming.

Monolithic VM Application to Containers Blueprint

Containerize a large monolithic application running on virtual machines, externalizing state and config to run reliably on a container platform.

Self-Managed Kubernetes to Amazon EKS Blueprint

Migrate a self-managed (kubeadm) Kubernetes cluster to Amazon EKS, offloading control-plane operations while preserving workloads and GitOps.

Self-Managed Kubernetes to Google GKE Blueprint

Migrate a self-managed Kubernetes cluster to Google Kubernetes Engine, optionally Autopilot, to offload node and control-plane operations.

Cloud Foundry to Kubernetes Blueprint

Migrate applications from a Cloud Foundry PaaS to Kubernetes, converting buildpacks and manifests into container images and declarative deployments.

On-Prem VMs to GKE with Migrate to Containers Blueprint

Modernize on-premises VMs directly into containers on Google GKE using Migrate to Containers, skipping a separate VM rehosting step.

Modular Monolith to Microservices Blueprint

Decompose a modular monolith into independently deployable microservices using the strangler fig pattern and database-per-service.

Monolith to Go Service Extraction Blueprint

Extract performance-critical capabilities from a monolith into standalone Go services with gRPC contracts and container-native deployment.

VM-Deployed App to Cloud-Native Blueprint

Re-platform a VM-deployed backend application to a cloud-native architecture with containers, managed services, and twelve-factor config.

Stateful Monolith to Stateless Services Blueprint

Re-architect a session-bound stateful backend into horizontally scalable stateless services with externalized session and cache state.

Manual Deployments to Argo CD GitOps Blueprint

Replace manual kubectl and script-based deploys with Argo CD GitOps so Git is the single source of truth for Kubernetes state.

Manual Deployments to Flux GitOps Blueprint

Adopt Flux CD to reconcile Kubernetes clusters from Git, replacing manual deploys with declarative, pull-based GitOps and automated image updates.

VM Monitoring to Prometheus and Grafana Blueprint

Replace legacy agent-based VM monitoring with Prometheus metrics, exporters, and Grafana dashboards using the RED and USE methodologies.

Batch ML Scoring to Real-Time Model Serving Blueprint

Move from nightly batch ML scoring to low-latency online model serving with a model server, feature lookups, and autoscaling.

Migrations4

AWS ECS to EKS Migration

Migrate container workloads from ECS to Kubernetes (EKS) with deployment and networking redesign

Docker Compose to Kubernetes Migration

Containerized application migration from Docker Compose to Kubernetes

Docker Swarm to Kubernetes Migration

Migrate Swarm services to Kubernetes deployments, services, ingress, and config/secrets

VMs to Kubernetes Migration

Containerize and migrate VM-hosted apps to Kubernetes with health checks, scaling, and deployment automation

Products8

Quarkus

Kubernetes-native Java framework for cloud deployments

Kubernetes

Container orchestration platform for automating deployment

Helm

Package manager for Kubernetes

Argo CD

Declarative GitOps continuous delivery for Kubernetes

Flux CD

GitOps toolkit for Kubernetes

Istio

Service mesh for Kubernetes

Linkerd

Ultralight service mesh for Kubernetes

MinIO

High-performance object storage compatible with S3

Reference Architectures26

Event-Driven Microservices

Architecture pattern for building loosely-coupled microservices using event sourcing and CQRS

Event-Driven Microservices on Kubernetes

A Kubernetes-native reference design for loosely coupled microservices that communicate through Kafka events with service-level autoscaling.

EKS Production Container Platform

A hardened, multi-account Amazon EKS platform for running production microservices with GitOps delivery and full observability.

Container Platform with Service Mesh

A Kubernetes container platform with an Istio service mesh providing mTLS, traffic management, and uniform observability across services.

Blue-Green Deployments on Kubernetes

A Kubernetes delivery architecture using blue-green and progressive rollouts to ship changes with instant rollback and zero downtime.

GKE Autopilot Application Platform

A managed GKE Autopilot platform on GCP that runs containers without node operations, with workload identity and integrated observability.

AKS Enterprise Container Platform

An enterprise Azure Kubernetes Service platform with private networking, Entra ID identity, and policy-governed GitOps delivery.

Hybrid Cloud Bursting Platform

A hybrid platform that runs steady workloads on-premises and bursts peak demand to public cloud Kubernetes for elastic capacity.

Multi-Cloud Portable Container Platform

A portable Kubernetes platform deployed identically across AWS, Azure, and GCP using GitOps and infrastructure as code to avoid lock-in.

On-Prem to Kubernetes Landing Zone

A cloud landing zone for migrating on-premises virtual machine workloads to Kubernetes with networking, identity, and governance baked in.

Batch Jobs Platform on Kubernetes

A Kubernetes-native batch platform using job queues and Argo Workflows to run scheduled and on-demand container jobs at scale.

Real-Time Streaming Platform with Kafka

A real-time streaming platform on Kafka with stream processing, a schema registry, and exactly-once pipelines on Kubernetes.

Batch ETL on Apache Spark

A scalable batch ETL platform on Apache Spark running on Kubernetes, transforming large datasets from object storage into curated tables.

Columnar OLAP Analytics with ClickHouse

A high-speed columnar OLAP platform on ClickHouse for sub-second aggregation over billions of rows, deployed on Kubernetes.

LLM Gateway and Proxy on Kubernetes

A reference design for a self-hosted LLM gateway on Kubernetes that centralizes routing, rate limiting, cost tracking, and guardrails across multiple model providers.

End-to-End MLOps Platform on Kubernetes

A reference design for a portable MLOps platform on Kubernetes covering pipelines, experiment tracking, a model registry, serving, and monitoring.

Vector Database Platform on Kubernetes

A reference design for a self-hosted, multi-tenant vector database platform on Kubernetes that powers semantic search and RAG retrieval at scale.

LLM Observability Stack on Kubernetes

A reference design for an LLM observability platform on Kubernetes that captures traces, evaluations, cost, and quality signals across AI applications.

Self-Hosted Open LLM Inference on Kubernetes

A reference design for serving open-weight LLMs on Kubernetes with GPU autoscaling, continuous batching, and an OpenAI-compatible API.

Active-Active Resilience Across Clouds

Multi-cloud design that serves traffic from two providers simultaneously to survive a full provider outage.

Observability and SLO Platform on Kubernetes

Unified metrics, logs, and traces platform with OpenTelemetry, Prometheus, and SLO-based alerting on Kubernetes.

Service Mesh with mTLS on Kubernetes

Istio-based service mesh providing mutual TLS, traffic management, and observability for microservices.

Federated GraphQL Supergraph

A federated GraphQL architecture where independently owned subgraphs compose into one supergraph behind a managed gateway.

gRPC Service Mesh for Internal APIs

A high-performance internal API platform using gRPC over a service mesh for typed, low-latency service-to-service calls.

Event Choreography for Microservices

A choreographed event-driven design where services react to each other's domain events without a central orchestrator.

Asynchronous Task Queue with Workers

A durable task queue that offloads slow or unreliable work from request handlers to scalable background workers with retries.

Playbooks11

Kubernetes Platform Adoption Playbook

A phased program to stand up a production-grade internal Kubernetes platform and onboard application teams onto golden paths.

Container Platform Migration Playbook

A phased program to migrate workloads from VMs and Docker Compose onto a managed container platform with standardized build and deploy.

Service Mesh Adoption Program Playbook

A phased program to roll out a service mesh for mTLS, traffic management, and observability across a Kubernetes microservices estate.

Multi-Cloud Operating Model Playbook

A phased program to operate workloads across two or more public clouds with consistent governance, identity, and delivery while avoiding accidental lock-in.

Platform Engineering Program Playbook

A phased program to build an internal developer platform with golden paths and self-service that reduce cognitive load across product teams.

GitOps Adoption Playbook

A program to make Git the single source of truth for infrastructure and deployments using declarative, continuously reconciled delivery.

Platform Engineering and Internal Developer Platform Playbook

A program to build an internal developer platform with golden paths, self-service infrastructure, and a service catalog that reduces cognitive load.

Container Migration Program Playbook

A program to migrate VM-based and legacy applications into containers with hardened images, registries, and orchestrated deployment.

Service Mesh Adoption Playbook

A program to introduce a service mesh for secure service-to-service communication, traffic control, and observability across microservices.

MLOps Platform Build Playbook

A phased program to stand up an end-to-end MLOps platform covering feature stores, training pipelines, model registry, and automated deployment.

Model Serving Migration Playbook

A phased program to migrate ML model serving from bespoke endpoints to a standardized, autoscaling, observable serving platform.

Checklists6

Kubernetes Production Readiness Checklist

Confirm a Kubernetes cluster and its workloads are secure, observable, and resilient before serving production traffic.

Container Security Hardening Checklist

Harden container images, build pipelines, and runtime so containerized workloads resist compromise and supply-chain attacks.

Kubernetes Cluster Setup Checklist

Provision a new managed Kubernetes cluster with the networking, security, and platform add-ons teams need from day one.

GitOps Adoption Readiness Checklist

Verify the prerequisites for declarative, Git-driven Kubernetes delivery are in place before adopting GitOps.

GitOps Readiness Checklist

Verify that infrastructure and application delivery follow GitOps principles with Git as the single source of truth and automated reconciliation.

Security Hardening Checklist

Reduce the attack surface of an application and its infrastructure across identity, network, runtime, and supply chain.

Stacks15

Cloud Native Stack

Kubernetes, Helm, Istio, Prometheus - CNCF ecosystem

Go Microservices Stack

Go, gRPC, Kubernetes, PostgreSQL - High-performance services

Spring Cloud Stack

Spring Boot, Spring Cloud, Kubernetes - Enterprise Java

Quarkus Cloud-Native Java Stack

Cloud-native Java backend using Quarkus with GraalVM native compilation and PostgreSQL for fast-starting, low-memory containerized services.

Micronaut JVM Microservices Stack

JVM microservices stack using Micronaut with ahead-of-time compilation and PostgreSQL for low-memory, fast-starting services and serverless functions.

Kubernetes + Istio Service Mesh Stack

Cloud-native platform stack pairing Kubernetes orchestration with the Istio service mesh for traffic management, security, and observability.

Knative Serverless Containers Stack

Kubernetes-based serverless stack using Knative for scale-to-zero, request-driven container workloads with event-driven autoscaling.

gRPC Service Mesh Stack

Microservices stack combining gRPC inter-service communication with a service mesh on Kubernetes for typed, observable, secure service-to-service traffic.

Dapr Distributed Application Stack

Polyglot microservices stack using Dapr building blocks for service invocation, state, pub/sub, and bindings, abstracted from underlying infrastructure.

Kubeflow ML Platform

Kubernetes-native ML platform: Kubeflow Pipelines, training operators, KServe serving, and Katib tuning run the ML lifecycle on Kubernetes.

GitOps Stack (ArgoCD + Terraform)

GitOps delivery: Terraform provisions infrastructure declaratively while ArgoCD continuously syncs Kubernetes application state from Git as the source of truth.

Triton Inference Server

A high-performance model-serving stack using NVIDIA Triton to serve models from any framework with GPU optimization on Kubernetes.

Prometheus + Thanos

A scalable, highly available metrics stack extending Prometheus with Thanos for global query, long-term object-storage retention, and multi-cluster aggregation.

Datadog Full Platform

A unified commercial SaaS observability stack covering metrics, traces, logs, RUM, security, and infrastructure monitoring through Datadog agents and integrations.

Tekton + Argo CD

A Kubernetes-native CI/CD stack pairing Tekton pipelines for in-cluster continuous integration with Argo CD for GitOps-based continuous delivery.

Comparisons14

Kubernetes vs Docker Swarm

Container orchestration comparison: Kubernetes vs Docker Swarm

Azure vs GCP

Microsoft Azure and Google Cloud Platform are the second and third largest public clouds, with different strengths in enterprise integration versus data and AI.

EKS vs GKE

Amazon EKS and Google GKE are the leading managed Kubernetes services. GKE is more automated and mature; EKS offers deepest AWS integration.

ECS vs EKS

Amazon ECS is AWS's simpler proprietary container orchestrator; EKS is managed Kubernetes. ECS trades portability for ease; EKS trades simplicity for the open ecosystem.

Docker vs Podman

Docker is the original container engine with a central daemon; Podman is a daemonless, rootless-friendly, drop-in alternative with strong Kubernetes affinity.

Kubernetes vs Nomad

Kubernetes is the dominant, feature-rich container orchestrator; HashiCorp Nomad is a simpler, lightweight scheduler for containers and non-containerized workloads.

Helm vs Kustomize

Helm packages Kubernetes apps as templated, versioned charts; Kustomize overlays plain YAML without templates. Helm suits distribution; Kustomize suits simple in-house config.

ArgoCD vs Flux

Argo CD and Flux are the two leading GitOps continuous delivery tools for Kubernetes. Argo CD offers a rich UI; Flux is lightweight and Kubernetes-native by design.

VMs vs Containers

Virtual machines virtualize hardware with a full guest OS; containers virtualize the OS, sharing the host kernel. VMs offer stronger isolation; containers offer density and speed.

Istio vs Linkerd

Istio and Linkerd are the leading Kubernetes service meshes. Istio is feature-rich and powerful; Linkerd is lightweight, simple, and fast with a purpose-built Rust proxy.

Traefik vs NGINX

Traefik is a cloud-native reverse proxy with automatic service discovery; NGINX is a mature, high-performance web server and proxy with manual configuration.

containerd vs CRI-O

containerd and CRI-O are the two main Kubernetes container runtimes. containerd is general-purpose and widely adopted; CRI-O is minimal and Kubernetes-only by design.

Crossplane vs Terraform

Crossplane manages cloud infrastructure through the Kubernetes API with continuous reconciliation; Terraform uses a standalone CLI and declarative HCL with explicit plan/apply.

Kubeflow vs SageMaker

Kubeflow is an open-source ML platform on Kubernetes; Amazon SageMaker is AWS's managed ML service. The choice trades portability and control against managed convenience.

Benchmarks3

Benchmark

Container Startup Time Benchmark

Measures how quickly a container goes from launch to ready, covering image pull, runtime creation, and application readiness for scaling and resilience.

Benchmark

Autoscaling Responsiveness Benchmark

Measures how quickly and accurately an autoscaler adds or removes capacity in response to load changes, including reaction time, overshoot, and stabilization.

Benchmark

Kubernetes Scheduling Latency Benchmark

Measures how quickly the Kubernetes scheduler places pods on nodes and how the control plane scales as pod, node, and churn counts grow.

FAQs11

What is Kubernetes?

Kubernetes is an open-source platform for automating the deployment, scaling, and operation of containerized applications. It groups containers into l...

What is the difference between a Kubernetes pod and a container?

A container is a single packaged process, while a pod is the smallest deployable unit in Kubernetes and can hold one or more containers that share the...

What is a service mesh?

A service mesh is an infrastructure layer that manages communication between microservices, handling traffic routing, load balancing, retries, encrypt...

What is autoscaling in the cloud?

Autoscaling automatically adjusts the number of running resources, such as virtual machines, containers, or pods, in response to demand or defined met...

When should I use Kubernetes?

Kubernetes makes sense when you run many containerized services that need automated scaling, self-healing, rolling updates, and consistent deployment ...

What is a sidecar container?

A sidecar is a secondary container that runs alongside the main application container in the same pod to extend or support it without changing the app...

What is a Kubernetes ingress controller?

An ingress controller is a component that implements Kubernetes Ingress resources, routing external HTTP and HTTPS traffic to services inside the clus...

What is container orchestration?

Container orchestration is the automated management of the lifecycle of containers across a cluster of machines, including scheduling, scaling, networ...

What is a Kubernetes namespace?

A namespace is a way to divide a single Kubernetes cluster into multiple virtual clusters, providing a scope for names and a boundary for resources. N...

What is a Kubernetes service?

A Kubernetes Service is an abstraction that gives a stable network identity and address to a dynamic set of pods, since pods are ephemeral and their I...