Omni’s hobby plan is free now: up to 10 nodes and 2 users (it used to be $10 a month for 6 nodes). Nodes dial out over WireGuard, so nothing is open on the router, and you get upgrades from the UI, SSO for kubectl and talosctl, and scheduled etcd backups.

You can import a running Talos cluster too. I moved my 3-node one without resetting a node. One catch: after the CA rotation, admin access only works through Omni.

How I did the import: https://blog.prateekjain.dev/importing-an-existing-talos-cluster-into-omni-bb1fc7722eda?sk=a4c4412829ef81542ca4892a0edbecec

Commands and patches: https://github.com/prateekjaindev/homelab

Not affiliated with Sidero Labs, just a user. The write-up and repo are my own.

i deploy jupyterhubs to california institutions for free under a grant from the state's startup incubator... so i figured a monitor w/a jupyter notebook, some granfana and particularly some k9s love was in order for our big-ass monitor! :)

https://imgur.com/a/UvyfTim

(i use old reddit, so i can't really embed images... unless there's a PEBKAC lol)

edit: removed accidental duplicate text pasting

Been running home labs for a long time. This is the first time I rebuilt everything on kubernetes and it has been great!

I am designing a service that can spin up a requested database snapshot (Neo4j) and pass queries to the database via the requester's cypher payload -> bolt. These database instances are ephemeral, and they should die after some amount of inactivity.

I've never done any sort of container orchestration, but my initial thought was to have a small HTTP server that controls the ephemeral database instances and incoming cypher requests. This and all ephemeral database containers (1-3 concurrent instances would be typical, maximum of 5), would live on a single VM or app service.

I work at a startup and we need a lightweight solution to this problem that could scale within the next 6 months to year. What I'm proposing now is cheap and simple. I think i can get what i need with k3s (1 control plane and up to 10 nodes) running on the same VM as the HTTP server. But Codex is pushing AKS or ACI. I really don't think that's necessary with the amount of business we are doing right now. And I think that if i design the interface properly, I can easily move from k3s -> AKS later without having to redesign the server or change its API schema.

What do you all think? Again, very new to k8s. Maybe i need to read a book first.

The built-in view role skips Secrets but still reads ConfigMaps and pod logs, and both can end up holding credentials. For a bot that helps with on-call debugging, what did you grant it, and did you scope it per namespace?

Something I ran into while building a manifest checker (disclosure: it's my open-source project, link at the end).

If a namespace has pod-security.kubernetes.io/enforce=restricted and you apply a Deployment whose pod template violates "restricted", the API server accepts the Deployment. Pod Security enforces on pods, not workloads. The ReplicaSet then fails to create every pod, and the only signal at deploy time is:

Warning: would violate PodSecurity "restricted:latest": ...

Two details I verified on a 1.37 API server:

- The warning text is the same for enforce=restricted (pods rejected) and warn=restricted (pods admitted), so you can't tell from the warning alone.

- With enforce=baseline + warn=restricted, a Deployment with a privileged container only gets the "restricted" warning, not a separate "baseline" one.

So the check reads the namespace's enforce label: it's an error when the namespace enforces the level in the warning, otherwise a warning.

It's in k8s-guardian v0.8.0 (diff --server-side, a server-side apply dry run). Repo: https://github.com/andronaft/k8s-guardian

Curious whether people catch this in CI some other way, e.g. by running kubectl with --warnings-as-errors?