Bahriya Kubernetes Engine
A distribution is a set of promises about which versions work together. These are the parts BKE is made of, and what each one is there to do.
The platform
These are not optional. A cluster without them is not a cluster.
| Component | What it does |
|---|---|
| Kubernetes | The cluster itself, installed with kubeadm |
| Calico | Pod networking, with WireGuard encryption enabled by default |
| containerd | The container runtime, from Docker's Debian repository |
| Helm | How components are installed and upgraded |
| k9s | A terminal UI for the cluster, on every node |
The components
Each is a mainstream open-source project, pinned to a version we have tested against this Kubernetes release and against each other. You enable the ones you want in one configuration file; the rest are never installed.
| Component | For |
|---|---|
| Longhorn | Replicated block storage, with backups to S3-compatible object storage |
| Kong | Ingress gateway |
| Kuma | Service mesh |
| cert-manager | Certificate issuance and renewal |
| metrics-server | Resource metrics, for autoscaling and kubectl top |
| Fluent Bit | Log shipping, to a destination you choose |
| Netdata | Metrics and alerting, optionally into your own Netdata Cloud account |
A BKE version names every one of these exactly. Nothing resolves to “latest”, no image tag is ever re-pushed, and two clusters on the same BKE version are running the same software. The exact version each release pins is in that release’s notes, in your documentation once you are a customer.
Honestly
Worth knowing before an evaluation rather than during one.
BKE runs on your machines. We do not operate your cluster unless you buy a support and maintenance contract separately.
The control-plane endpoint is an address you provide. BKE does not create it, and does not configure hardware or cloud load balancers.
cert-manager is installed; the ClusterIssuer and the DNS credential behind it are yours, because only you know which certificate authority and which domain.
Installing and upgrading need outbound HTTPS to ten hosts, listed in full on the requirements page, and there is no offline bundle today. We are building one. If air-gapped installation decides your evaluation, tell us and it moves up the order.
Debian on amd64 or arm64.
Your identity provider connects to the API server and all access is granted by group membership, so a provider that cannot emit a groups claim is unsupported. BKE refuses that configuration rather than leaving people able to log in and do nothing.