The documentation, before you buy.

1. 01How a cluster fits together

   Control planes, workers, and what each BKE command does on which machine. Start here if Kubernetes is new to you.

2. 02Before you begin

   What each machine needs, what BKE reaches over the network, and the three decisions you cannot change afterwards.

3. 03Register your cluster

   Binding a licence to the machine that will be your first control-plane node, before anything is installed.

4. 04The first control-plane node

   Creating the cluster — kubeadm init through install.sh on the first control-plane node, the three arguments fixed for its life, and what the script does.

5. 05Adding nodes

   Adding control-plane and worker nodes with two commands - one on an existing control-plane node, which prints the second, run on the new node.

6. 06config.yaml

   The one file that describes your cluster, key by key — components, Secrets, cluster login, encryption, reporting and compliance — and what each key's absence costs.

7. 07Installing components

   How apply.sh installs and reconciles the components config.yaml declares — the plan, the Passage Plan in the console, drift, and what it does not touch.

8. 08Secrets

   How BKE creates Secrets from a directory on the node that is never transmitted, how to keep your own, how to rotate them, and what a missing key costs.

9. 09Encryption at rest

   How BKE encrypts Secrets in etcd, what that protects and what it does not, backing up the key apart from etcd snapshots, and enabling it, extending it and rotating its key on a cluster that already exists.

10. 10Compliance and hardening

    The controls the compliance block of config.yaml turns on — API audit logging, Pod Security defaults, control-plane and kubelet hardening, time servers, Kuma's CNI plugin and the host firewall — with forwarding the audit log, verifying image signatures, and changing a control on a cluster that already exists.

11. 11Cluster reporting

    The one thing that leaves your cluster on a schedule, field by field, what it cannot see, how to read it yourself, and how to turn it off.

12. 12Cluster login

    How BKE grants cluster access, what enabling it does to your cluster, and the identity providers it cannot support.

13. 13Upgrading

    What each digit of a BKE version promises, why a minor version cannot be skipped, how to plan before the window, and the order to move a cluster in.

14. 14Storage

    Longhorn storage in BKE — the seven conditions that will stop an upgrade, backups, and why engine images do not move on their own.

15. 15Reference architecture

    The production shape around a cluster — two load-balanced addresses, where traffic enters, and reference configurations for HAProxy and hardware balancers.

16. 16Ingress with Kong

    Exposing an application, obtaining TLS certificates, and the plugins that add rate limiting, caching and access control.

17. 17The trial, in an afternoon

    Three Debian servers to a working cluster with storage, ingress and an application behind it — the evaluation path, end to end.

18. 17Logging with Fluent Bit

    What is collected from every node, how to point it at your log platform, and how to keep the credentials out of config.yaml.

19. 18The other components

    metrics-server, Kuma and netdata in daily use, and how to raise a support ticket that can be answered quickly.

20. 19Feeding your load balancer

    aybak keeps the load balancer in front of your cluster in step with its nodes, through git, a signed webhook or HAProxy's Data Plane API, and never empties it.

Three things stay off these pages by policy: exact version pins (they accompany the licence, in the console's release notes), our own estate, and competitors' prices.