From a9c84eb2abdc838053059db6b3e4dee6316f7074 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:28:50 -0400 Subject: [PATCH 1/2] Page: Gradle build cache on Kubernetes --- gradle-build-cache-kubernetes/index.html | 127 +++++++++++++++++++++++ sitemap.xml | 4 + 2 files changed, 131 insertions(+) create mode 100644 gradle-build-cache-kubernetes/index.html diff --git a/gradle-build-cache-kubernetes/index.html b/gradle-build-cache-kubernetes/index.html new file mode 100644 index 0000000..37c5b78 --- /dev/null +++ b/gradle-build-cache-kubernetes/index.html @@ -0,0 +1,127 @@ + + + + + +Gradle build cache on Kubernetes + + + + + + + + +
+ +
Infrastructure worth keeping — and kept patched.
+
+
+

Gradle build cache on Kubernetes

+

Run a shared build cache in your cluster with plain manifests: one Deployment, one volume, one Service. There is no Helm chart yet. It has not been through a beta on a production cluster, so treat it that way.

+ +

Run exactly one replica

+

Do not scale this out. The cache keeps its index in a database file that one process holds a lock on. A second pod on the same volume does not share the cache; it waits on the lock or fails to start. Two pods on different volumes give you two half-filled caches.

+ +

A cache is safe to lose for a moment. If it is down during a rollout, builds miss the cache and run slower, and nothing breaks. High availability across nodes is a paid-tier idea that is not built, so do not improvise it with two replicas.

+ +

Size it in Kubernetes terms

+ + +

Locked down by default

+

The manifests run as a non-root user with a read-only root file system, drop all capabilities, forbid privilege escalation, and use the runtime default seccomp profile. There is no privileged mode, no host networking and no host path. They satisfy the Pod Security restricted profile. The volume must be writable by user 65532, which is what the fsGroup setting is for.

+ +

Runners in the same cluster

+

If your CI runners already run in this cluster, including Jenkins agents, GitHub Actions runner controller and GitLab runners, you need no load balancer and no ingress. Point Gradle at the cluster-internal name, for example http://fscache.fscache-ns.svc.cluster.local/, with isAllowInsecureProtocol = true. Gradle requires that for any non-localhost http:// address. Here it is reasonable because the traffic never leaves the cluster network. See Jenkins and CI build cache.

+ +

Get the manifests

+

The four manifests (Secret, volume claim, Deployment, Service) and the steps to reach the cache from outside the cluster are in the Kubernetes guide on GitHub. Copy them into one file and apply it.

+ +
+ Kubernetes guide + Gradle and Maven setup +
+
+ + + diff --git a/sitemap.xml b/sitemap.xml index 8c1e470..ee811a2 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -16,4 +16,8 @@ weekly 1.0 + + https://fosterstack.com/gradle-build-cache-kubernetes/ + 2026-10-08 + From 66c0eab9d9349295e87be788af7260fb38f1af76 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 21:03:57 -0400 Subject: [PATCH 2/2] Kubernetes page: answer the Helm question in the title and a section --- gradle-build-cache-kubernetes/index.html | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/gradle-build-cache-kubernetes/index.html b/gradle-build-cache-kubernetes/index.html index 37c5b78..5d82aaf 100644 --- a/gradle-build-cache-kubernetes/index.html +++ b/gradle-build-cache-kubernetes/index.html @@ -3,8 +3,8 @@ -Gradle build cache on Kubernetes - +Gradle build cache on Kubernetes: plain manifests, no Helm chart yet + @@ -78,9 +78,12 @@
Infrastructure worth keeping — and kept patched.
-

Gradle build cache on Kubernetes

+

Gradle build cache on Kubernetes: plain manifests, no Helm chart yet

Run a shared build cache in your cluster with plain manifests: one Deployment, one volume, one Service. There is no Helm chart yet. It has not been through a beta on a production cluster, so treat it that way.

+

Is there a Helm chart?

+

Not yet. Today the supported way to deploy on Kubernetes is the plain manifests in the Kubernetes guide: a Secret, a volume claim, a Deployment and a Service. Copy them into one file and apply it with kubectl apply -f.

+

Run exactly one replica

Do not scale this out. The cache keeps its index in a database file that one process holds a lock on. A second pod on the same volume does not share the cache; it waits on the lock or fails to start. Two pods on different volumes give you two half-filled caches.