An internal developer platform succeeds or fails on six decisions. Not on the technology — Kubernetes, ArgoCD and Terraform are the baseline, and every platform uses them. The decisions are architectural, and they are invisible until the platform is in production and developers are either adopting it or working around it.
A GPU node costs 5-10x what a CPU node costs per hour. Getting GPU scheduling wrong on Kubernetes means paying for idle GPUs, or worse — having GPUs available and no workload scheduled on them while a data scientist waits. This guide covers the setup, the scheduling rules and the cost controls.
Kubernetes disaster recovery is not complicated. It is a checklist, and most teams get three-quarters of the way down it and stop. The missing quarter is the one that matters in an actual disaster.
This is the full checklist, from etcd snapshots to the restore runbook you need to test before you need to run it.
Observability is the difference between knowing something is broken and finding out from a user. On Kubernetes, the toolchain that answers this for most teams is Prometheus, Grafana and Alertmanager — three projects from the CNCF ecosystem that together give you metrics collection, dashboards and alerting.
This guide walks through setting them up, deciding what to monitor and configuring the alerts that actually matter.
Managed Kubernetes hands you workload identity. AKS runs an OIDC issuer for the cluster, publishes its discovery documents, and Entra already trusts them — a pod gets an Azure token and nobody thinks about it.
On plain VMs, none of that exists. The nodes have no Azure identity to assume, and the workloads still need Key Vault and Blob Storage. The default answer at that point is a service principal secret in a Kubernetes Secret: a static cloud credential, sitting on a node, rotated by nobody. It is the same credential CI pipelines are still carrying, in a different place.
There is a better answer, and the cluster already does most of it. Every Kubernetes cluster signs service-account tokens with a private key. Those tokens are already OIDC-shaped JWTs. Publish the public half over HTTPS, point Entra at it, and the cluster becomes an identity provider it always was.
This is what that took on a production RKE2 cluster running on bare VMs.
A cluster that costs three times what it should is rarely running three times the workload. It is usually running the right workload, badly sized, on the wrong pricing model, with a layer of things nobody is willing to delete.
Orchestration Made Easy with Kubernetes
Horizontal Pod Autoscaler is table stakes. But HPA only knows what it observes — CPU, memory, or a custom metric — and it has no opinion about whether a pod was the right size to begin with. That is a different question, answered by a different controller, and the two can be made to work against each other.
Ingress controllers got most of us started, and Ingress is not deprecated. But on a multi-tenant platform it fails in a specific, predictable way: one object ends up owning TLS, routing and rate limits, which means three teams edit the same YAML and none of them owns it.