An operator moved seven services onto k3s and back because he wrote none of them

The reversal was cheap because of a rule set before the first service moved: external domains and ports stay unchanged, and the reverse proxy stays the anchor ^[6]. A service comes up on k3s, gets working, and only then does the proxy rule get repointed ^[6]. Both directions are the same operation. That is why the move up took a few weeks ^[1] and the move back took a single day ^[2]. Nothing in the migration failed ^[9]. That is harder to argue with than an outage.

The case against keeping the services on the cluster is about who owns the version tag. Canary releases, service meshes, mTLS between services and gradual rollouts exist to give an owner fine-grained control over their own delivery, the post argues, and a third-party image arrives with a tag someone else cut, so the only available control is on or off ^[14]. "The mesh and the canary and the grader were looking for a producer, and I showed up as a consumer," the author wrote ^[15].

The integration cost is the part I would expect to bite in any small estate. A stock upstream image was not written for your network policy, your CI pipeline, your internal DNS or your admission rules ^[13]. Either it stays half-integrated, or someone wires the sealed box into the platform, and the post's position is that this second option produces nothing anyone ever uses ^[13].

The third test is supply-chain policy, and the post grants that a clean scan is a real notion: a scanner runs against every image and flags the CVEs it finds ^[16]. Trivy was doing that job in the migrated stack ^[4]. For an image you build, a finding is a change you can make. For one you pull, in my view, it is a wait on upstream plus a policy exception in the meantime.

What came down was one line of the plan, the one that said move existing compose services into k8s ^[9]. The cluster foundation, the GitOps loop, the supply-chain policy and the service mesh were kept, and the post says most are still running ^[10]. The workloads left on the cluster are lab-environment, headlamp and a PR-lanes namespace running a two-tier practice app named hello ^[8]. That is three items, all of them cluster tooling or practice ^[17].

The stated cause is authorship. "Everything I had migrated was software I didn't write," the author wrote ^[11], and the list is dify, vikunja, trilium, homepage, apprise and the model runners, all pulled from upstream registries ^[12]. The 4-core, 24-gig box is the setting ^[3]. The argument built on it turns on who cuts the version tags, and it does not appeal to team size or coordination cost at all. For the reasoning to transfer, your estate has to look like that one: mostly images whose releases you do not control. Put two services you actually ship on the same box and the mesh, the canary and the rollout have a subject again. The write-up does not report what k3s, ArgoCD, Kyverno and Trivy cost in CPU or memory on that machine ^[18]. I would want that before repeating either half of the experiment.