Build1 publisher3 min readPublished
The 48.5% comes off a kind cluster running Kubernetes 1.36.1 and 77 timed reconciles, and the same harness measured resync-driven reconciles at zero extra API requests, which puts the saving in controller CPU rather than at the API server.
The Engineer · Build desk

Compiled by The EngineerSomething wrong?How this is made
`req` is a namespace and a name, not a diff and not a copy of the object [8]. Every invocation re-reads the desired spec from scratch, recomputes what all three children should look like, and hands that to `controllerutil.CreateOrUpdate` to diff against whatever exists right now [9]. The work is identical whether the trigger was a kubectl command a millisecond ago or a process that just booted after eight hours down [10].
That is what makes a filter survivable. The architecture principles in the Kubernetes design proposals archive require level-based behaviour, correct given desired and observed state regardless of how many intermediate updates were missed, with edge-triggered behaviour "must be just an optimization" [11]. So a dropped event is a delayed repair rather than a lost one, and there is no catch-up path to forget to write because there is only the one path [12]. A predicate can throw events away precisely because nothing downstream depends on having seen them.
Which is also why the 48.5% is a number about that harness's event mix [6]. The controller under test reconciles one CRD into three children and writes observed state back to `Echo.status` [1][2][3]. The share of steady-state updates the predicate discards depends on how much non-spec churn your own objects generate. An operator whose status block is rewritten by a hot metrics loop, or whose children are annotated by three other controllers, has a different ratio, and the predicate's saving moves with the ratio, not with the predicate.
It reports that a short resync period costs zero additional API requests, because a resync is not a re-check against the cluster [5][13]. Grant that, and the no-op reconciles the predicate removed were already free at the API server. What is left is controller-side: CPU, workqueue depth, and whatever writes a reconcile issues when it does find drift. On the evidence in this material, the 48.5% is a CPU and queue lever [21]. The API-server case is the part the text does not reach: it asserts that a controller does not poll and that what it does instead is where API load comes from, then breaks off before saying so [20].
Sizing the CPU side from the reported mean: 2.71ms per reconcile is about 369 back-to-back invocations a second on one worker [4][18]. That ceiling only holds with no queue wait, and it is measured on macOS on Apple Silicon under kind v0.32.0 with controller-runtime v0.24.1 [7]. 77 timed invocations bound a maximum at 25ms [4]; they cannot resolve a tail you would care about at a thousand times the volume.
Ten injections per failure mode across the five failure modes in the summary is 50 drift events, and the material does not say how those map onto 77 timings [15][16][17]; the raw data is in the repo [19]. A second gap sits next to it: the author calls a predicate a filter with a silent cost whose cost is not the one the documentation warns about first, without printing it here [14]. Until that cost is measured, the 48.5% carries an unknown offsetting cost of its own.
Ranked by verification strength, evidence, and original report placement.
A short resync period costs zero additional API requests.
A resync is not a re-check against the cluster, which is why a short resync period is nearly free, and the expensive number sits somewhere else.
The author writes that a predicate is not a pure optimisation but a filter with a silent cost, and that the cost is not the one the documentation warns about first.
The writeup states that a controller does not poll the API server and that knowing what it does instead tells you where API load comes from, but the available text breaks off before describing that mechanism.
The author built a minimal Kubernetes operator around a single CRD called Echo, holding an image, a replica count and a greeting.
The controller keeps three child objects in sync with the Echo resource: a Deployment, a Service, and a ConfigMap holding the greeting, with owner references on all three so Kubernetes garbage-collects them when the Echo goes away.
Publishers with included, body-backed reporting in this cluster.
1 article · September 7, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
SSE in Go breaks twice before your handler runs: an illegal header, then a 30-second timeout1 publisher
build
Rate limit your MCP servers, because a retrying agent turns one error into a billing incident1 publisher
build
Eleven agent sessions on one machine settled CPU contention by writing to each other1 publisher
build
Your meter now runs on someone else's machine: signed receipts, fsync, and failing open1 publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One laptop, fully version-pinned
Every figure traces to a single harness on a single machine, and the latency claim rests on 77 invocations. Against that, the author pins each component down to the node image and publishes the harness and raw data, so the numbers are checkable in a way most blog benchmarks are not. Checkable is not checked: no one in this reporting has rerun them.
Confined to the author's own test setup
The operator exists in order to be broken on purpose. The only events in this reporting are the author's own publication of the repository and the author's own benchmark run; no deployment, no second user, no download or star count. That supports no adoption reading in either direction.
Scale framing on a one-node bench
The results are stated with their own caveat attached, and "without touching live repair at all" is the author's phrase, not a summary of ours. The overreach is a single sentence, that this combination is the one that matters at scale, offered from a one-node test with one custom resource. Working the two results together also shrinks the claim: the removed reconciles were already free at the API server, so the win is controller CPU, which is a narrower prize than the scale framing suggests.
Self-promotion, no sponsor
The writeup advertises the author's own repository and technical judgement, which is a reason to reach for a striking number and no reason at all to hide the setup. The setup is disclosed in full, with the data attached. No vendor, sponsor or product appears anywhere in the material, so the pressure runs toward an interesting result rather than toward a purchase.
Mechanics hold, the percentage is thin
The design claims are the sturdy part: level-based reconciliation quoted from the Kubernetes architecture principles, keys rather than events in the workqueue, cache-served reads. Those hold whether or not this particular experiment was run well. The quantitative half is one unreplicated run on hardware nobody else touched, with the relationship between 50 injected failures and 77 timed reconciles never spelled out, so we hold the mechanism firmly and the number loosely.