The story of two crashloops in RudderStack, an open-source event pipeline, running on Kubernetes. Neither act was caused by a bug in RudderStack. In the first, a tight CPU limit throttled a single-threaded control plane until its liveness probe timed out. ArgoCD then reported the fix as "Synced" while the old limit stayed live, because client-side apply doesn't remove fields it never recorded. In the second, a routine memory spike on a small shared node squeezed the page cache and pushed the node's disk past its IOPS limit, so five unrelated pods crashlooped without a single OOM kill or eviction. The talk covers how CFS CPU quotas actually work, why a health check can't tell a dead app from a slow one, and the Kubernetes gotchas behind both failures.

As Kubernetes evolves, so must policy enforcement. This talk explains why namespace-scoped policies matter, how they secure multi-tenant environments, and how Kyverno internals can help you optimize admission performance.