Shipping It to Kubernetes: Kind + Podman + Helm

A docker-compose stack proves a system works on your machine. Kubernetes proves it can be deployed. Phase 10 took Phronis’s 11 services to Kubernetes with raw manifests plus a Helm chart, and surfaced the gap between “runs in Compose” and “runs in a cluster.”

// 01 — TWO WAYS TO DEPLOY

k8s/ holds raw manifests, one file per service group: namespace, configmap, secrets, and StatefulSets/Deployments for Redpanda, PostgreSQL, MinIO, RisingWave, the API, and the observability trio. helm/phronis/ wraps the same topology in a chart with a values.yaml, so production deploys are parameterized:

helm install phronis ./helm/phronis \
  --set postgres.password=... --set api.apiKey=...

// 02 — WHAT COMPOSE HID

Three things worked in Compose and broke in Kubernetes, each a small lesson in how clusters differ (all three have their own anomaly logs):

• Redpanda couldn’t bind to its address: in K8s, the service name resolves to a ClusterIP a pod can’t bind to. Bind 0.0.0.0, advertise the service name.
• MinIO’s init container hung: init containers complete before the main container starts, so “reach MinIO on localhost” can’t work. Remove the init container; create the bucket on first write.
• Local images wouldn’t pull: Kind has no registry, so images need imagePullPolicy: Never and a localhost/ prefix, loaded via podman save | kind load.

// 03 — THE RESULT

Tested with Kind on the Podman provider: after kubectl apply -f k8s/, all 8 pods reach Running in under three minutes. The platform proof is done. Phronis isn’t just a demo stack, it’s a deployable one.

TAKEAWAYS

• “Runs in docker-compose” and “runs in Kubernetes” are different claims. Networking, init ordering, and image distribution all change.
• A pod can’t bind to a Service ClusterIP. Bind 0.0.0.0 and advertise the routable name. This bites almost everyone once.
• Ship both raw manifests (to understand) and a Helm chart (to parameterize). The manifests teach; the chart deploys.

NEXT

• Anomaly logs: the five bugs Kubernetes and the Iceberg sink taught me, starting with the credential saga.