TGViewer
Kubesploit Kubesploit @kubesploit · 2.13K subscribers
Post #1674 246

Forwarded from KubeFM

Karpenter can rotate your nodes for three reasons: they're underutilized, they're empty, or the AMI has drifted from what you specified.

You can set a disruption budget for each reason to control how many nodes rotate at once. But here's the catch: if you only set budgets for two reasons and skip the third, Karpenter doesn't disable it. It silently applies a default 10% budget to any reason you didn't mention.

Adhi Sutandi's team found this the hard way — drift events fired during maintenance windows they thought were locked down. The fix? Set a single budget of one node with no reason qualifier, so it applies to everything.



New episode out now: https://ku.bz/XyVfsSQPr
More from @kubesploit
  1. Sep 25, 2026This tutorial builds a Docker image with a secret, then shows how it still sits in an earl…
  2. Sep 24, 2026This article explains how Vault piles up unexpired leases when pods keep re-authenticating…
  3. Sep 23, 2026This article asks what a container can block on its own when a dependency turns malicious,…
  4. Sep 23, 2026This week on Learn Kubernetes Weekly 202: 🔥 We Replaced etcd with Google Cloud Spanner 😌…
  5. Sep 22, 2026This article explains what an attacker can really do with leaked Kubernetes credentials, f…
  6. Sep 22, 2026"When an agent goes loose, you might find yourself: your S3 bucket has been deleted by mis…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →