Kubernetes (K8s) Management & Orchestration

16 min read

Kubernates
KubeOps
Intermediate

Kubernetes (K8s) Management & Orchestration #

BP provides a robust management plane for Kubernetes, abstracting the complexities of cluster operations while maintaining enterprise-grade control. It transforms raw infrastructure into a “Microservices-Ready” ecosystem through automated onboarding, deep observability, and governed workflows.

9+
Cloud Providers
360°
Observability
RBAC
Governed
v1.26–1.32
K8s Versions

Key Capabilities #

🚀 Guided Cluster Onboarding

BP facilitates seamless onboarding of existing clusters — EKS, GKE, AKS, or on-premises — allowing you to manage and deploy workloads directly from the platform.

⚙️ K8s Resource Management

Platform teams can manage Namespaces, Ingress, Gateways, ConfigMaps, and Secrets without writing complex YAML. BP handles automated generation and versioning of these manifests.

📊 360° Cluster Observability

A centralised Kubernetes Dashboard offers real-time telemetry into pod health, node utilisation, container logs, and event streams — eliminating the need for direct kubectl access.

🛡️ Deployment Strategies & Governance

BP facilitates Rolling and Canary deployments reinforced by automated Rollout Validation and mandatory client approval gates to align technical execution with business sign-off.

Pre-requisites of Cluster Onboarding #

Before initiating the cluster onboarding process, it is essential to cross-validate if the base pre-requisites are taken into consideration. The pre-requisites are detailed below:

✅ RBAC Permissions

Check if Required RBAC Permissions are available and configured for BuildPiper to access the cluster.

🔑 Static Kubernetes Credentials

Static Kubernetes Credentials Generation must be completed to ensure stable, non-interactive connectivity between BP and the cluster API server.

🌐 GCP Network Policy

Network policy deletion is required in case of Google Cloud (GKE) to prevent BP from being blocked from communicating with the cluster.

1. Required RBAC Permissions #

Read More >

BP needs certain privileges to the onboarded cluster. To ensure a successful onboarding, you must configure specific Role-Based Access Control (RBAC) settings — defining precise roles and bindings that grant BP the authority to view and manage cluster resources with least-privilege access.


See More

2. Static Kubernetes Token Generation #

Read More >

Authentication requires a long-lived static Kubernetes token associated with a dedicated Service Account. Unlike short-lived credentials, this permanent token ensures stable, non-interactive connectivity between BP and your cluster’s API server, facilitating continuous monitoring and management without frequent credential rotations or timeouts.

⚠️

Pre-requisites

kubectl installed and configured on BP VM. Administrative access to the cluster to create Service Accounts and Cluster Roles.

Workflow #

1

Clone the BuildPiper Repository: https://bitbucket.org/okts/k8s-ro-user.git

2

Execute the Token Generation Script: bash /k8-ro-user/admin/setupAdminUser.sh

3

Validate the updated kube-config generated at: ~/.kube/config-sa-admin.yaml

▸

For an OpenShift cluster, the setupAdminUser.sh script may need to be modified as kubectl commands differ slightly.

▸

If your cloud provider is GCP, you can use normal clusters as well as autopilot clusters.

▸

Clients can also onboard K8s clusters running on their LDC, like Proxmox and OpenShift clusters.

Post-requisites — GKE Network Policy Deletion #

💡

GKE Only

In GKE-managed clusters, certain network policies may be auto-created on successful onboarding of the cluster in BP. This new network policy may potentially block BP from communicating with the cluster. You must manually audit and remove these restrictive policies to ensure connectivity.

Use kubectl get networkpolicy -A to identify existing policies across all namespaces, then delete those interfering with the integration.

UI Guided Cluster Onboarding #

Read More >

BP facilitates the seamless onboarding of existing clusters (EKS, GKE, AKS, or on-premises), allowing you to manage and deploy workloads directly from the platform.

🗺️

How to Access / Navigate

Login to BP → Add Cluster → Add Cluster details and upload .kubeconfig

Note: Admin Privileges are required. The Onboarding Team needs to have the Kubernetes cluster Kubeconfig file. BuildPiper supports Kubernetes version from 1.26 to latest 1.32.

Supported Infrastructure Plugins for K8 Clusters #

▸Amazon Web Services (EKS)
▸Microsoft Azure (AKS)
▸Google Cloud (GKE)
▸On-Premises / LDC
▸Oracle Cloud Infrastructure
▸Alibaba Cloud
▸IBM Cloud
▸Akamai (Linode LKE)
▸Huawei Cloud

BP Snapshot: Cluster Onboarding
BP Snapshot: BuildPiper processing/validating .kubeconfig file
BP Snapshot: User accessing cluster once it is onboarded

Cluster Health Dashboard #

Read More >

After a cluster is successfully onboarded to the BP platform, users can access the Cluster Health Dashboard showing control plane component status, Kubernetes version, real-time CPU and memory utilisation, worker node health summary, and total namespaces — providing a quick operational view of cluster stability and resource usage.

🧠 Control Plane Health

A granular status indicator for essential cluster components, including etcd, CoreDNS, and Controller Manager, verifying the operational integrity of the cluster’s core planes.

🏷️ Cluster Metadata

Display of the control plane version (e.g., v1.28.x) as reported by the Kubernetes API server.

📈 Resource Utilisation Metrics

Real-time graphs displaying aggregate CPU and Memory (RAM) consumption across the entire cluster, calculated as a percentage of total allocatable resources.

🖥️ Node Infrastructure

A summarised view of the node pool, detailing the count of worker nodes and their operation state (Healthy / Unhealthy).

🗂️ Namespace Topology

A total count of namespaces present in the cluster, reflecting the logical segmentation of the environment.

K8 Resources Overview & Management #

Read More >

BP provides native visibility into the operational state of key Kubernetes resources directly within the platform. Users can monitor, assess health, and troubleshoot from the BuildPiper UI without switching to native Kubernetes tooling (kubectl, Lens, etc.).

🖥️ Cluster Nodes Overview

BP provides a comprehensive, real-time view of all nodes in your cluster, clearly indicating whether each node is in a Ready or Not Ready state. BP offers a read-only view in this section.

📦 Namespace Overview

A centralised view of all namespaces including operational status (Active, Terminating, or Failed), configured resource quotas, and current CPU and memory usage per namespace.

🔵 Pods Overview

A comprehensive map of the cluster’s workload identifying the specific Namespace and Node where each pod is scheduled, alongside active Labels, current Status, and Execution Duration.

BP Snapshot: Accessing K8 Cluster Nodes
BP Snapshot: Node Available page
BP Snapshot: K8 pods for an onboarded cluster

Namespace Management #

Read More >

BuildPiper provides comprehensive namespace management capabilities, enabling seamless governance of cluster resources. The following operations are supported:

➕ New Namespace Creation & Onboarding

Create a new Kubernetes namespace directly within BuildPiper. Upon creation, the namespace is automatically onboarded into the platform and immediately available for use in applications and environments.

🔁 Onboard Pre-Existing Namespace

For namespaces that already exist on the target Kubernetes cluster, BP supports discovery and onboarding into the platform while retaining existing CPU and memory resource limit configurations.

👁️ View All Existing Namespaces

BP provides a centralised inventory view of all namespaces present on the onboarded Kubernetes cluster, regardless of whether they were created natively or through BP.

Namespace Configuration Fields #

Field Name Configuration Guide
Namespace Name Enter the namespace name.
Select Registry Tick checkboxes for specific container registries that this namespace is authorised to pull/push images from.
Namespace Setup Strategy Choose Guided Form for BuildPiper UI configuration or Upload Custom Manifest YAML for namespace creation.
Enable Istio Injector Select Yes to automatically inject an Istio sidecar for service mesh features like mTLS and observability.
Add Resource Quota Select Yes to define hard limits on the total resources this namespace can consume within the cluster.
Request Memory/CPU Define the minimum guaranteed resources for the namespace (e.g., 1 Gi Memory / 1 CPU core).
Limit Memory/CPU Define the maximum resource ceiling to prevent a single namespace from starving the rest of the cluster.
Enable Namespace Isolation Toggle to restrict network traffic between this namespace and others via Network Policies.
Add Annotations Add non-identifying metadata for internal tools or third-party integrations (e.g., description: billing-app).
Add Labels Add identifying key-value pairs used for grouping and selecting resources (e.g., env: production).

BP Snapshot: User creating a new Namespace
BP Snapshot: User viewing Namespace at K8 level and BP Managed

Application Onboarding #

Read More >

An application represents a team that manages a group of microservices, non-microservices or mobile apps to deliver a logically independent functionality. BuildPiper UI provides a simple workflow to onboard a new application.

🗺️

How to Access / Navigate

Login to BP → Click on Manage Application on the left plane → Click “Add Application” → Fill in the Application Form → Hit Save

Note: For bulk onboarding, users can leverage the advanced BPCTL command-line utility with a CSV file.

Application Configuration Details #

Field Name Description & Purpose
Application Name A unique identifier for the application/team within the platform.
Application Description A brief description of the application/team.
Select Policy Template Defines the BP access policy/permission rules. The default template creates environment-specific policies defining who can access & modify various BP resources.
Select Job Template Select Default Global Job Template. Think of a Job Template as a Workflow Blueprint — a standardised instruction manual for the execution of Jobs on BP.
Select Version of Job Template Allows the user to select the appropriate Job Template version (e.g., v1-stable, v2-test).
Select VM Groups Define the VM infra boundary for this Application/Team. The team will be able to use the provided infra only for their deployments.
Credential The Credential Management component. Provides necessary SSH keys and credentials required to access cloud provider/LDC resources.
Region The geographic location (e.g., us-east-1, eu-central-1) where the resources will be physically provisioned to minimise latency.
Cluster Choose from already onboarded Kubernetes clusters. Option to allocate a dedicated cluster where all namespaces can be mapped automatically or selectively.

BP Snapshot: Onboarding a new microservice application onto BP
BP Snapshot: Onboarding a sample app by providing relevant details

Container Registry Onboarding #

Read More >

A Container Registry is where container artifacts (images) are stored. It can be hosted either in the cloud or within an LDC. BuildPiper provides out-of-the-box support for all major container registries.

▸Azure Container Registry
▸Nexus
▸Alibaba ACR
▸GitHub Container Registry
▸AWS ECR
▸Google Container Registry
▸JFrog Registry
▸Docker Hub
▸Huawei
▸Others

🔷 Microsoft Azure ACR

Registry URL: your-registry-name.azurecr.io

Username: Admin username or Service Principal ID

Password: Access Key or Secret corresponding to the username/Service Principal

🟦 Nexus

Registry URL: https://nexus.buildpiper.com

Username: Nexus account with view and push permissions

Password: Corresponding password or user token

🟠 Alibaba ACR

Registry URL: registry.cn-hangzhou.aliyuncs.com

Access Key: AccessKey ID from Alibaba Cloud RAM user credentials

Region: Alibaba Cloud region ID (e.g., cn-hangzhou)

🐙 GitHub Container Registry

Registry URL: ghcr.io

Username: GitHub username or Organization name

Password: Personal Access Token (PAT) with packages scopes

🟡 Google Artifact Registry (GAR)

Registry URL: https://us-central1-docker.pkg.dev

Username: _json_key

JSON Key: Paste full content of Service Account JSON key file

🐋 Docker Hub

Registry URL: https://index.docker.io/v1/

Username: Docker Hub ID (not email)

Password: Docker Hub password or Personal Access Token (PAT)

Service Onboarding #

Read More >

In BuildPiper, a Service acts as a flexible deployment unit representing any independent workload — individual microservices, traditional monolithic applications, scheduled Cron jobs, and mobile apps. The complete service onboarding workflow includes:

1Git Repo Integration
2Service Configuration
3Environment Onboarding
4Configure Build (CI)
5Configure Deploy (CD)
6Initiate Build & Deploy

1. Git Repo Integration #

Git onboarding in BuildPiper involves integrating your Git repository (GitHub, GitLab, or Bitbucket) with the platform. A read-only access user is created and provided to BuildPiper, allowing it to securely connect to and clone the repository without making any changes.

Bitbucket

Cloud-based and self-hosted Bitbucket repositories supported.

GitHub

Cloud-based and self-hosted GitHub repositories supported.

GitLab

Cloud-based and self-hosted GitLab repositories supported.

2. Service Configuration Details #

Field Configuration Guide
Service Name Enter a unique identifier for the microservice (e.g., payment-gateway). Use alphanumeric characters and hyphens.
Service Type Select the service architecture type: microservice (containerised), VM-based (legacy/standalone), or Android (mobile builds).
Business Functions Specify the business vertical/functional role/business category this service belongs to (e.g., “Order Processing”).
How do you build? Build once and promote: The same artifact moves through all environments (Dev→QA→Stage→UAT→Prod). Build for every environment: A new artifact is compiled specifically for each environment.

BP Snapshot: Onboarding a new service on to an application in BP
BP Snapshot: Onboarding a sample service by providing relevant details

3. Environment Onboarding #

An environment acts as a dedicated workspace enabling teams to build and deploy their services. Technology teams typically require Dev, QA, Staging, UAT, and Production environments. BP supports creating multiple environments within the same category (e.g., two QA environments — one for Feature 1 and another for Feature 2).

Field Configuration Guide
Choose Environment Type* Select the environment type: DEV, QA, STAGING, UAT, or PROD.
Environment Name* Provide a specific name to the environment for reference, such as ot-dev, ot-prod.
Enable Hyper Build Select Yes to use parallel processing for faster Docker image creation; default is No.
Allow Manual Build* Select Yes to permit users to manually trigger a build process for this environment.
Allow Manual Deploy* Select Yes to permit users to manually trigger a deployment for this environment.
Select Cluster* Map this environment to a specific Kubernetes Cluster from the dropdown list.
Select Namespace* Map this environment to a specific Namespace within the chosen cluster.

BP Snapshot: Onboarding a new environment on to an application in BP
BP Snapshot: Editing already onboarded environment in BP

CI Configuration #

Read More >

Once a service is created and an environment has been associated, the platform team can add build configurations from the BuildPiper UI. There are four segments of settings for CI:

📂 Source Code Details

Git URL, Branch, Build Context, and Dockerfile Path. The build context is the directory Docker uses during the build — typically the root of your repo.

⚙️ Advanced Configurations

Clone from external source (Git submodules), Select Platform (AMD/ARM multi-arch), Shallow Cloning for optimised performance, Provenance Attestations for image build proof.

🔢 CI Variables

Build Env Details (key-value pairs for runtime configuration) and Build Labels (custom metadata/labels added to the generated image).

🪝 Hook Configurations

Pre-hooks and Post-hooks to execute custom scripts before or after the build. Available via Command, File Upload, or Git source.

BP Snapshot: Configuring CI for a new service
BP Snapshot: Configuring build for a service – CI Source Details
BP Snapshot: Configuring build for a service – CI Env Variables
BP Snapshot: Configuring build for a service – CI Hooks – pre and post hooks

CD Configuration #

Read More >

BuildPiper automates the deployment configuration process by providing two approaches:

🤖 Auto-Generated Manifests

By asking a few questions about your service deployment, BuildPiper generates a compliant, secure, scalable, and reliable service manifest which is utilised for service deployments.

📄 Bring Your Own Manifest (BYOM)

If you already have Manifests or a Helm and values file, you can provide the file or the Git URL and BuildPiper will use the same to automate deployments.

CD Key Configuration Sections #

Deploy Details

Service Name, Deployment Name, Container Name, Image Pull Policy, Desired Replica Count, Custom Service Account.

Access Type

Public (internet-facing), Protected (IP whitelist/OIDC), Private (internal VPC only). Service Port, URL, Protocol, ExposedPath, Target Port.

Resource Quota

Request Memory/CPU (minimum guaranteed), Limit Memory/CPU (maximum ceiling), optional GPU quota specification.

Configurations & Secrets

Config Map, Secret Map, External Secret Key — all mountable on a path or sub-path.

Liveness & Readiness

Liveness: Self-healing — restarts crashed containers. Readiness: Traffic controller — stops sending traffic until the app is ready.

Node & Service Affinity

Node Affinity Required/Preferred, Service Affinity (co-locate pods), Service Anti-Affinity (spread pods across nodes).

Security Context

Pod-level: Run As User/Group, FS Group. Container-level: ReadOnly Root Filesystem, Allow Privilege Escalation, Linux Capabilities (add/drop).

Tolerations & Priorities

Tolerations allow pods to schedule on tainted nodes. Priorities determine which pods are evicted first when the cluster is under resource pressure.

BP Snapshot: Configuring CD for a new service
BP Snapshot: CD Access Configuration
BP Snapshot: Resource Quota Configuration
BP Snapshot: CD Liveliness and Readiness

Deployment Analytics #

The Deployment Analytics module in BuildPiper functions as a comprehensive operational command centre, streamlining how teams monitor, manage, and troubleshoot deployments.

⚡ Real-Time Lifecycle Tracking

Provides instantaneous visibility into the deployment process and granular pod details, ensuring teams can monitor the health of their services as they go live.

🔍 Integrated Observability

Centralises Kubernetes events and pod logs within the UI, allowing users to gain immediate insights into application performance and quickly identify underlying issues.

💻 Direct Shell Access

Features a critical browser-based SSH capability that enables engineers to exec into pods directly from the BP interface for advanced, real-time troubleshooting.

📐 On-Demand Scaling

Empowers users to manage workloads dynamically by scaling pods directly from the UI, without manual CLI intervention.

📋 Configuration Transparency

Offers full access to deployment and pod YAMLs, providing a clear view of the underlying specifications and ensuring configuration consistency.

Pipeline Management #

Read More >

BuildPiper enables intuitive and easy setup of feature-rich delivery pipelines for a seamless and secure product release. Pipelines are composed of Stages and Jobs.

🔷 Stages

Major divisions in a pipeline that define when and how to run. Supports Manual Approvals, Conditional Execution. If all jobs in a stage succeed, the pipeline moves to the next stage; if they fail, the pipeline is suspended.

🔶 Jobs

A series of steps that run sequentially as a unit. The smallest unit of work that can be scheduled to run within a pipeline. Jobs define what to run (e.g., code compilation, test runs).

Supported Job Types #

Job Type Definition
Build Compiles source code and packages it into a container image (Docker) or artifact.
Deploy Downloads the artifact from the container registry and deploys to the specific environment.
Promote Moves a verified image/artifact from a lower environment (e.g., QA) to a higher one (e.g., Prod).
Android Build A mobile-centric build process utilising Android-specific SDKs to generate APKs or AABs.
Deploy to Playstore Automates the submission of Android binaries to the Google Play Console.
API Call Executes an HTTP request to interact with external services or trigger webhooks.
Configmap Manages and injects non-sensitive configuration data into the application environment.
Deploy Secret Securely handles and deploys sensitive data like credentials, tokens, and SSH keys.
Jira Ticket Updates or transitions Jira issues based on the pipeline’s progress or final status.
Rollback Reverts the application to the previous stable version in case of deployment failure.
Integration Testing Runs automated tests to verify that the new build functions correctly with other services.
Trigger Pipeline Initiates a separate downstream pipeline to handle dependencies or modular workflows.
ServiceNow Ticket Automates the creation or closure of ServiceNow tickets for compliance and auditing.
Delay Job Introduces a manual or timed pause in the pipeline (e.g., for a “bake time” or soak test).

💡 Note: Admin Privileges are required to access Cluster, Namespace, and Application management functionalities. For bulk onboarding of applications, users can leverage the BPCTL command-line utility with a CSV file executed via SSH.

📘 BuildPiper Documentation · Kubernetes Management & Orchestration

Last updated: May 2026