Bahriya Kubernetes Engine
Enough detail to tell, before you talk to us, whether BKE fits your estate. Nothing here is behind a licence.
Each machine
| Operating system | Debian 12 (bookworm) or Debian 13 (trixie). Packages come from Debian, from pkgs.k8s.io and from Docker's Debian repository — which is why it is Debian and not a derivative |
| Architecture | amd64 or arm64 |
| Access | Root, and an SSH key already installed — see below |
Free space on / | 5 GB minimum, 10 GB comfortable |
Free space on /var/lib | 20 GB minimum, 40 GB comfortable — every container image lands here |
| Swap | Disabled during installation. The kubelet will not run with it on |
| Clock | Within 60 seconds of correct. Run an NTP client |
There is no CPU or memory floor, because the honest answer depends entirely on what you intend to run. A control-plane node for a small cluster is comfortable at 4 vCPU and 8 GB; we would rather size it with you than publish a number that flatters the product.
Network
Installing and upgrading are online operations. There is no offline bundle.
BKE configures UFW on each node. Anything in front of the machines — a cloud security group, a firewall between subnets — has to allow the same traffic, and BKE cannot see whether it does.
sshd_config already namesWorth knowing
sshd_config is yours. BKE does not rewrite it, does not move the port, does not change your authentication policy and does not restart sshd. Nothing about running Kubernetes requires any of that.
The firewall opens the port your sshd_config already names — read from the file rather than assumed — so enabling it cannot lock you out of a machine you are sitting on.
If you would rather we did own it, install.sh --manage-ssh installs our configuration: password authentication off, root by key only, and --ssh-port to choose the port. It is opt-in, on every node, every time.
Decide before, not after
All three are set when the first control-plane node is created, and all three are baked into certificates and kubeconfigs from that moment. Changing any of them later is a rebuild, not an edit.
Node hostname
Becomes the machine's hostname and its name in Kubernetes, and appears in its certificates.
Control-plane endpoint
A host:port you provide. It goes into every kubeconfig, and it is the address your licence is issued against. Point it at a load balancer or a DNS record you control, not at the first machine.
Service DNS suffix
What your services resolve under. cluster.local is the Kubernetes convention. There is no default.
Licensing
A licence covers one cluster and is independent of node count, CPU and memory. There is nothing to meter and no seats to count.
The licence is checked when you install, upgrade or change components — not while your cluster runs. Nothing of ours sits in the request path of your workloads, and a lapsed licence does not stop a running cluster; it stops you changing it.
A cluster is bound to its licence once, on the first control-plane node, before anything is installed.