Earlier this year, AWS had a major Availability Zone outage in us-east-1. Only one AZ went down, but if your workloads were running there, you know how it went: alerts firing, runbooks open, manual fixes, and a race to move traffic before customers noticed. For those who were not lucky enough to be in a different AZ, it raised an obvious question: why isn’t there a button for this? There is. It’s called ARC Zonal Shift. ...
Switching kube-proxy mode from IPVS to nftables Many of you have heard about the nginx-ingress controller retirement, right? But have you also heard about the deprecation of IPVS mode in Kubernetes 1.35? Kubernetes 1.35 release notes: https://kubernetes.io/blog/2025/12/17/kubernetes-v1-35-release/#deprecation-of-ipvs-mode-in-kube-proxy If your Kubernetes clusters are running kube-proxy in IPVS mode, it is time to prepare for switching to nftables. What I found interesting is that the official AWS EKS documentation still recommends IPVS mode, with only a small mention that nftables is ‘in development’: https://docs.aws.amazon.com/eks/latest/best-practices/ipvs.html ...
There is a great article on the AWS Blog: How to use AWS Secrets Manager and ABAC for enhanced secrets management in Amazon EKS . The only downside of that approach is that it uses OpenID Connect (OIDC) and IRSA for authentication. But there is now a better and simpler option: Amazon EKS Pod Identity . ...
Managing Internal TLS Trust in Kubernetes with cert-manager and trust-manager How do you maintain a secure SSL/TLS connection between services within a Kubernetes cluster? One simple (but unsafe) answer is to create a self-signed certificate and skip verification with a flag like --insecure-skip-tls-verify. A more advanced solution is to use a service mesh (e.g., Linkerd, Istio), which automatically manages certificates and trust. But what if you want something simpler and lighter? That’s where trust-manager comes in. It’s the easiest way to manage trust bundles in Kubernetes and OpenShift clusters. ...
I’ve noticed that questions about scaling workloads in Kubernetes remain consistently high and don’t decrease over time. Many users struggle with scaling their workloads effectively and don’t know the optimal approach. While many rely on the default Horizontal Pod Autoscaler (HPA), which has its limitations, this often leads to the creation of custom scripts and tools. I’d like to introduce you to KEDA (Kubernetes Event Driven Autoscaler), an excellent tool for scaling workloads in Kubernetes. KEDA is a lightweight component that works alongside HPA and significantly extends its capabilities. ...
Introduction Topology Aware Routing (TAR) is a Kubernetes feature designed to keep traffic within the same availability zone (AZ). This can reduce cross-AZ traffic costs on cloud providers like AWS and GCP, where inter-AZ traffic incurs charges. Additionally, it can lower latency by keeping network requests local. However, TAR is not a silver bullet. While it helps optimize costs and performance, it strictly prohibits cross-zone traffic, regardless of the system’s health or workload distribution. This limitation can lead to unintended service disruptions. ...