k3s Node Upgrades Without Downtime
Upgrade k3s without dropping workloads: the cordon and drain sequence, then system-upgrade-controller Plans that automate it, with PDB and Longhorn gotchas.
Tag: kubernetes
All the articles with the tag "kubernetes".
Kyverno: K8s Policy Without Rego
Kyverno on k3s: validate, mutate, generate, verify signed images, handle exceptions, and test policies in CI. Plus the CEL policy types replacing ClusterPolicy.
OpenCost on k3s: What Your Pods Cost
A home lab has no cloud invoice. Feed OpenCost your power rate and hardware price, then see which namespace on your k3s cluster is the real monthly cost hog.
GitOps Rollback: Argo CD vs Flux
How to roll back a broken GitOps sync in Argo CD v3.5 and Flux v2.9: git revert, argocd app rollback, HelmRelease remediation, plus a 2 AM runbook to copy.
Cluster API for Homelab k3s
Cluster API turns k3s cluster lifecycle into YAML: create, scale, and upgrade whole clusters as code with a management cluster, no more one off scripts.
Renovate for k8s GitOps
Auto-update Kubernetes images and Helm charts with Renovate: the built-in Helm managers, custom regex managers, cron scheduling, and PR grouping rules.
External Secrets Operator + Vault on k3s
Pull secrets out of git with External Secrets Operator and Vault on k3s: real server mode, Kubernetes auth that actually works, rotation and audit trails.
k3s on Pi 5 Cluster: Real or Toy?
A k3s cluster on Raspberry Pi 5 is real Kubernetes with real limits. Which workloads stick, why the M.2 HAT is mandatory, and when to go buy mini-PCs.
Kustomize Without Helm: When Overlays Win
Skip Helm for home lab Kubernetes. Kustomize base + overlays give you dev/staging/prod variants with zero templating pain.
Compose-to-Helm Migration That Doesn't Break
Migrate from Docker Compose to Helm without throwing away your Compose setup. Use kompose, hybrid CI stages, and run both in parallel during the transition.
Ingress Choices in k3s: Traefik vs ingress-nginx vs HAProxy
Traefik, ingress-nginx, or HAProxy on k3s? ingress-nginx retired in March 2026. Install commands, IngressRoute vs Ingress, and the ServiceLB port trap.
k3s Backups: etcd Snapshots + Velero
etcd snapshots and Velero on k3s: the native S3 upload flags, the local-path hostPath trap that silently skips your PV data, and a restore drill that works.