Kubernates
KubeOps
Intermediate
Kubernetes (K8s) Management & Orchestration #
BP provides a robust management plane for Kubernetes, abstracting the complexities of cluster operations while maintaining enterprise-grade control. It transforms raw infrastructure into a “Microservices-Ready” ecosystem through automated onboarding, deep observability, and governed workflows.
🚀 Guided Cluster Onboarding
BP facilitates seamless onboarding of existing clusters — EKS, GKE, AKS, or on-premises — allowing you to manage and deploy workloads directly from the platform.
⚙️ K8s Resource Management
Platform teams can manage Namespaces, Ingress, Gateways, ConfigMaps, and Secrets without writing complex YAML. BP handles automated generation and versioning of these manifests.
📊 360° Cluster Observability
A centralised Kubernetes Dashboard offers real-time telemetry into pod health, node utilisation, container logs, and event streams — eliminating the need for direct kubectl access.
🛡️ Deployment Strategies & Governance
BP facilitates Rolling and Canary deployments reinforced by automated Rollout Validation and mandatory client approval gates to align technical execution with business sign-off.
Pre-requisites of Cluster Onboarding #
Before initiating the cluster onboarding process, it is essential to cross-validate if the base pre-requisites are taken into consideration. The pre-requisites are detailed below:
Check if Required RBAC Permissions are available and configured for BuildPiper to access the cluster.
🔑 Static Kubernetes Credentials
Static Kubernetes Credentials Generation must be completed to ensure stable, non-interactive connectivity between BP and the cluster API server.
Network policy deletion is required in case of Google Cloud (GKE) to prevent BP from being blocked from communicating with the cluster.
BP needs certain privileges to the onboarded cluster. To ensure a successful onboarding, you must configure specific Role-Based Access Control (RBAC) settings — defining precise roles and bindings that grant BP the authority to view and manage cluster resources with least-privilege access.
See More
| Category |
Resource |
API Group |
Verbs / Permissions |
Usage Description |
| Workloads |
deployments |
apps |
get, list, create, update, patch, delete |
Primary management of application deployments. |
| Networking |
services |
v1 (Core) |
get, list, create, update, patch, delete |
Internal service discovery and load balancing. |
| Networking |
ingresses |
networking.k8s.io |
get, list, create, update, patch, delete |
Management of external access and routing. |
| Autoscaling |
horizontalpodautoscalers |
autoscaling |
create, update, patch, delete |
Dynamic scaling based on load. |
| Pods |
pods |
v1 (Core) |
create, update, patch, delete |
Direct pod manipulation for troubleshooting or tasks. |
| Storage/Env |
configmaps |
v1 (Core) |
get, list |
Reading application configuration files. |
| Storage/Env |
secrets |
v1 (Core) |
get, list |
Reading environment variables and credentials. |
| Security |
secrets (TLS) |
v1 (Core) |
get, list, create, update, patch, delete |
Managing SSL/TLS certificates for Ingress. |
Authentication requires a long-lived static Kubernetes token associated with a dedicated Service Account. Unlike short-lived credentials, this permanent token ensures stable, non-interactive connectivity between BP and your cluster’s API server, facilitating continuous monitoring and management without frequent credential rotations or timeouts.
⚠️
Pre-requisites
kubectl installed and configured on BP VM. Administrative access to the cluster to create Service Accounts and Cluster Roles.
Workflow #
1
Clone the BuildPiper Repository: https://bitbucket.org/okts/k8s-ro-user.git
2
Execute the Token Generation Script: bash /k8-ro-user/admin/setupAdminUser.sh
3
Validate the updated kube-config generated at: ~/.kube/config-sa-admin.yaml
▸
For an OpenShift cluster, the setupAdminUser.sh script may need to be modified as kubectl commands differ slightly.
▸
If your cloud provider is GCP, you can use normal clusters as well as autopilot clusters.
▸
Clients can also onboard K8s clusters running on their LDC, like Proxmox and OpenShift clusters.
Post-requisites — GKE Network Policy Deletion #
💡
GKE Only
In GKE-managed clusters, certain network policies may be auto-created on successful onboarding of the cluster in BP. This new network policy may potentially block BP from communicating with the cluster. You must manually audit and remove these restrictive policies to ensure connectivity.
Use kubectl get networkpolicy -A to identify existing policies across all namespaces, then delete those interfering with the integration.
BP facilitates the seamless onboarding of existing clusters (EKS, GKE, AKS, or on-premises), allowing you to manage and deploy workloads directly from the platform.
🗺️
How to Access / Navigate
Login to BP → Add Cluster → Add Cluster details and upload .kubeconfig
Note: Admin Privileges are required. The Onboarding Team needs to have the Kubernetes cluster Kubeconfig file. BuildPiper supports Kubernetes version from 1.26 to latest 1.32.
Supported Infrastructure Plugins for K8 Clusters #
▸Amazon Web Services (EKS)
▸Microsoft Azure (AKS)
▸Google Cloud (GKE)
▸On-Premises / LDC
▸Oracle Cloud Infrastructure
▸Alibaba Cloud
▸IBM Cloud
▸Akamai (Linode LKE)
▸Huawei Cloud
![BP Snapshot: Cluster Onboarding]()
![BP Snapshot: BuildPiper processing/validating .kubeconfig file]()
![BP Snapshot: User accessing cluster once it is onboarded]()
After a cluster is successfully onboarded to the BP platform, users can access the Cluster Health Dashboard showing control plane component status, Kubernetes version, real-time CPU and memory utilisation, worker node health summary, and total namespaces — providing a quick operational view of cluster stability and resource usage.
A granular status indicator for essential cluster components, including etcd, CoreDNS, and Controller Manager, verifying the operational integrity of the cluster’s core planes.
Display of the control plane version (e.g., v1.28.x) as reported by the Kubernetes API server.
📈 Resource Utilisation Metrics
Real-time graphs displaying aggregate CPU and Memory (RAM) consumption across the entire cluster, calculated as a percentage of total allocatable resources.
A summarised view of the node pool, detailing the count of worker nodes and their operation state (Healthy / Unhealthy).
A total count of namespaces present in the cluster, reflecting the logical segmentation of the environment.
BP provides native visibility into the operational state of key Kubernetes resources directly within the platform. Users can monitor, assess health, and troubleshoot from the BuildPiper UI without switching to native Kubernetes tooling (kubectl, Lens, etc.).
🖥️ Cluster Nodes Overview
BP provides a comprehensive, real-time view of all nodes in your cluster, clearly indicating whether each node is in a Ready or Not Ready state. BP offers a read-only view in this section.
A centralised view of all namespaces including operational status (Active, Terminating, or Failed), configured resource quotas, and current CPU and memory usage per namespace.
A comprehensive map of the cluster’s workload identifying the specific Namespace and Node where each pod is scheduled, alongside active Labels, current Status, and Execution Duration.
![BP Snapshot: Accessing K8 Cluster Nodes]()
![BP Snapshot: Node Available page]()
![BP Snapshot: K8 pods for an onboarded cluster]()
BuildPiper provides comprehensive namespace management capabilities, enabling seamless governance of cluster resources. The following operations are supported:
➕ New Namespace Creation & Onboarding
Create a new Kubernetes namespace directly within BuildPiper. Upon creation, the namespace is automatically onboarded into the platform and immediately available for use in applications and environments.
🔁 Onboard Pre-Existing Namespace
For namespaces that already exist on the target Kubernetes cluster, BP supports discovery and onboarding into the platform while retaining existing CPU and memory resource limit configurations.
👁️ View All Existing Namespaces
BP provides a centralised inventory view of all namespaces present on the onboarded Kubernetes cluster, regardless of whether they were created natively or through BP.
Namespace Configuration Fields #
| Field Name |
Configuration Guide |
| Namespace Name |
Enter the namespace name. |
| Select Registry |
Tick checkboxes for specific container registries that this namespace is authorised to pull/push images from. |
| Namespace Setup Strategy |
Choose Guided Form for BuildPiper UI configuration or Upload Custom Manifest YAML for namespace creation. |
| Enable Istio Injector |
Select Yes to automatically inject an Istio sidecar for service mesh features like mTLS and observability. |
| Add Resource Quota |
Select Yes to define hard limits on the total resources this namespace can consume within the cluster. |
| Request Memory/CPU |
Define the minimum guaranteed resources for the namespace (e.g., 1 Gi Memory / 1 CPU core). |
| Limit Memory/CPU |
Define the maximum resource ceiling to prevent a single namespace from starving the rest of the cluster. |
| Enable Namespace Isolation |
Toggle to restrict network traffic between this namespace and others via Network Policies. |
| Add Annotations |
Add non-identifying metadata for internal tools or third-party integrations (e.g., description: billing-app). |
| Add Labels |
Add identifying key-value pairs used for grouping and selecting resources (e.g., env: production). |
![BP Snapshot: User creating a new Namespace]()
![BP Snapshot: User viewing Namespace at K8 level and BP Managed]()
An application represents a team that manages a group of microservices, non-microservices or mobile apps to deliver a logically independent functionality. BuildPiper UI provides a simple workflow to onboard a new application.
🗺️
How to Access / Navigate
Login to BP → Click on Manage Application on the left plane → Click “Add Application” → Fill in the Application Form → Hit Save
Note: For bulk onboarding, users can leverage the advanced BPCTL command-line utility with a CSV file.
Application Configuration Details #
| Field Name |
Description & Purpose |
| Application Name |
A unique identifier for the application/team within the platform. |
| Application Description |
A brief description of the application/team. |
| Select Policy Template |
Defines the BP access policy/permission rules. The default template creates environment-specific policies defining who can access & modify various BP resources. |
| Select Job Template |
Select Default Global Job Template. Think of a Job Template as a Workflow Blueprint — a standardised instruction manual for the execution of Jobs on BP. |
| Select Version of Job Template |
Allows the user to select the appropriate Job Template version (e.g., v1-stable, v2-test). |
| Select VM Groups |
Define the VM infra boundary for this Application/Team. The team will be able to use the provided infra only for their deployments. |
| Credential |
The Credential Management component. Provides necessary SSH keys and credentials required to access cloud provider/LDC resources. |
| Region |
The geographic location (e.g., us-east-1, eu-central-1) where the resources will be physically provisioned to minimise latency. |
| Cluster |
Choose from already onboarded Kubernetes clusters. Option to allocate a dedicated cluster where all namespaces can be mapped automatically or selectively. |
![BP Snapshot: Onboarding a new microservice application onto BP]()
![BP Snapshot: Onboarding a sample app by providing relevant details]()
A Container Registry is where container artifacts (images) are stored. It can be hosted either in the cloud or within an LDC. BuildPiper provides out-of-the-box support for all major container registries.
▸Azure Container Registry
▸Nexus
▸Alibaba ACR
▸GitHub Container Registry
▸AWS ECR
▸Google Container Registry
▸JFrog Registry
▸Docker Hub
▸Huawei
▸Others
Registry URL: your-registry-name.azurecr.io
Username: Admin username or Service Principal ID
Password: Access Key or Secret corresponding to the username/Service Principal
Registry URL: https://nexus.buildpiper.com
Username: Nexus account with view and push permissions
Password: Corresponding password or user token
Registry URL: registry.cn-hangzhou.aliyuncs.com
Access Key: AccessKey ID from Alibaba Cloud RAM user credentials
Region: Alibaba Cloud region ID (e.g., cn-hangzhou)
🐙 GitHub Container Registry
Registry URL: ghcr.io
Username: GitHub username or Organization name
Password: Personal Access Token (PAT) with packages scopes
🟡 Google Artifact Registry (GAR)
Registry URL: https://us-central1-docker.pkg.dev
Username: _json_key
JSON Key: Paste full content of Service Account JSON key file
Registry URL: https://index.docker.io/v1/
Username: Docker Hub ID (not email)
Password: Docker Hub password or Personal Access Token (PAT)
In BuildPiper, a Service acts as a flexible deployment unit representing any independent workload — individual microservices, traditional monolithic applications, scheduled Cron jobs, and mobile apps. The complete service onboarding workflow includes:
1Git Repo Integration
2Service Configuration
3Environment Onboarding
4Configure Build (CI)
5Configure Deploy (CD)
6Initiate Build & Deploy
1. Git Repo Integration #
Git onboarding in BuildPiper involves integrating your Git repository (GitHub, GitLab, or Bitbucket) with the platform. A read-only access user is created and provided to BuildPiper, allowing it to securely connect to and clone the repository without making any changes.
Cloud-based and self-hosted Bitbucket repositories supported.
Cloud-based and self-hosted GitHub repositories supported.
Cloud-based and self-hosted GitLab repositories supported.
2. Service Configuration Details #
| Field |
Configuration Guide |
| Service Name |
Enter a unique identifier for the microservice (e.g., payment-gateway). Use alphanumeric characters and hyphens. |
| Service Type |
Select the service architecture type: microservice (containerised), VM-based (legacy/standalone), or Android (mobile builds). |
| Business Functions |
Specify the business vertical/functional role/business category this service belongs to (e.g., “Order Processing”). |
| How do you build? |
Build once and promote: The same artifact moves through all environments (Dev→QA→Stage→UAT→Prod). Build for every environment: A new artifact is compiled specifically for each environment. |
![BP Snapshot: Onboarding a new service on to an application in BP]()
![BP Snapshot: Onboarding a sample service by providing relevant details]()
3. Environment Onboarding #
An environment acts as a dedicated workspace enabling teams to build and deploy their services. Technology teams typically require Dev, QA, Staging, UAT, and Production environments. BP supports creating multiple environments within the same category (e.g., two QA environments — one for Feature 1 and another for Feature 2).
| Field |
Configuration Guide |
| Choose Environment Type* |
Select the environment type: DEV, QA, STAGING, UAT, or PROD. |
| Environment Name* |
Provide a specific name to the environment for reference, such as ot-dev, ot-prod. |
| Enable Hyper Build |
Select Yes to use parallel processing for faster Docker image creation; default is No. |
| Allow Manual Build* |
Select Yes to permit users to manually trigger a build process for this environment. |
| Allow Manual Deploy* |
Select Yes to permit users to manually trigger a deployment for this environment. |
| Select Cluster* |
Map this environment to a specific Kubernetes Cluster from the dropdown list. |
| Select Namespace* |
Map this environment to a specific Namespace within the chosen cluster. |
![BP Snapshot: Onboarding a new environment on to an application in BP]()
![BP Snapshot: Editing already onboarded environment in BP]()
Once a service is created and an environment has been associated, the platform team can add build configurations from the BuildPiper UI. There are four segments of settings for CI:
Git URL, Branch, Build Context, and Dockerfile Path. The build context is the directory Docker uses during the build — typically the root of your repo.
⚙️ Advanced Configurations
Clone from external source (Git submodules), Select Platform (AMD/ARM multi-arch), Shallow Cloning for optimised performance, Provenance Attestations for image build proof.
Build Env Details (key-value pairs for runtime configuration) and Build Labels (custom metadata/labels added to the generated image).
Pre-hooks and Post-hooks to execute custom scripts before or after the build. Available via Command, File Upload, or Git source.
![BP Snapshot: Configuring CI for a new service]()
![BP Snapshot: Configuring build for a service – CI Source Details]()
![BP Snapshot: Configuring build for a service – CI Env Variables]()
![BP Snapshot: Configuring build for a service – CI Hooks – pre and post hooks]()
BuildPiper automates the deployment configuration process by providing two approaches:
🤖 Auto-Generated Manifests
By asking a few questions about your service deployment, BuildPiper generates a compliant, secure, scalable, and reliable service manifest which is utilised for service deployments.
📄 Bring Your Own Manifest (BYOM)
If you already have Manifests or a Helm and values file, you can provide the file or the Git URL and BuildPiper will use the same to automate deployments.
CD Key Configuration Sections #
Service Name, Deployment Name, Container Name, Image Pull Policy, Desired Replica Count, Custom Service Account.
Public (internet-facing), Protected (IP whitelist/OIDC), Private (internal VPC only). Service Port, URL, Protocol, ExposedPath, Target Port.
Request Memory/CPU (minimum guaranteed), Limit Memory/CPU (maximum ceiling), optional GPU quota specification.
Config Map, Secret Map, External Secret Key — all mountable on a path or sub-path.
Liveness: Self-healing — restarts crashed containers. Readiness: Traffic controller — stops sending traffic until the app is ready.
Node Affinity Required/Preferred, Service Affinity (co-locate pods), Service Anti-Affinity (spread pods across nodes).
Pod-level: Run As User/Group, FS Group. Container-level: ReadOnly Root Filesystem, Allow Privilege Escalation, Linux Capabilities (add/drop).
Tolerations allow pods to schedule on tainted nodes. Priorities determine which pods are evicted first when the cluster is under resource pressure.
![BP Snapshot: Configuring CD for a new service]()
![BP Snapshot: CD Access Configuration]()
![BP Snapshot: Resource Quota Configuration]()
![BP Snapshot: CD Liveliness and Readiness]()
The Deployment Analytics module in BuildPiper functions as a comprehensive operational command centre, streamlining how teams monitor, manage, and troubleshoot deployments.
⚡ Real-Time Lifecycle Tracking
Provides instantaneous visibility into the deployment process and granular pod details, ensuring teams can monitor the health of their services as they go live.
🔍 Integrated Observability
Centralises Kubernetes events and pod logs within the UI, allowing users to gain immediate insights into application performance and quickly identify underlying issues.
Features a critical browser-based SSH capability that enables engineers to exec into pods directly from the BP interface for advanced, real-time troubleshooting.
Empowers users to manage workloads dynamically by scaling pods directly from the UI, without manual CLI intervention.
📋 Configuration Transparency
Offers full access to deployment and pod YAMLs, providing a clear view of the underlying specifications and ensuring configuration consistency.
BuildPiper enables intuitive and easy setup of feature-rich delivery pipelines for a seamless and secure product release. Pipelines are composed of Stages and Jobs.
Major divisions in a pipeline that define when and how to run. Supports Manual Approvals, Conditional Execution. If all jobs in a stage succeed, the pipeline moves to the next stage; if they fail, the pipeline is suspended.
A series of steps that run sequentially as a unit. The smallest unit of work that can be scheduled to run within a pipeline. Jobs define what to run (e.g., code compilation, test runs).
Supported Job Types #
| Job Type |
Definition |
| Build |
Compiles source code and packages it into a container image (Docker) or artifact. |
| Deploy |
Downloads the artifact from the container registry and deploys to the specific environment. |
| Promote |
Moves a verified image/artifact from a lower environment (e.g., QA) to a higher one (e.g., Prod). |
| Android Build |
A mobile-centric build process utilising Android-specific SDKs to generate APKs or AABs. |
| Deploy to Playstore |
Automates the submission of Android binaries to the Google Play Console. |
| API Call |
Executes an HTTP request to interact with external services or trigger webhooks. |
| Configmap |
Manages and injects non-sensitive configuration data into the application environment. |
| Deploy Secret |
Securely handles and deploys sensitive data like credentials, tokens, and SSH keys. |
| Jira Ticket |
Updates or transitions Jira issues based on the pipeline’s progress or final status. |
| Rollback |
Reverts the application to the previous stable version in case of deployment failure. |
| Integration Testing |
Runs automated tests to verify that the new build functions correctly with other services. |
| Trigger Pipeline |
Initiates a separate downstream pipeline to handle dependencies or modular workflows. |
| ServiceNow Ticket |
Automates the creation or closure of ServiceNow tickets for compliance and auditing. |
| Delay Job |
Introduces a manual or timed pause in the pipeline (e.g., for a “bake time” or soak test). |
💡 Note: Admin Privileges are required to access Cluster, Namespace, and Application management functionalities. For bulk onboarding of applications, users can leverage the BPCTL command-line utility with a CSV file executed via SSH.
📘 BuildPiper Documentation · Kubernetes Management & Orchestration
Last updated: May 2026