kube32 Runs Kubernetes Pods on ESP32-S3 Boards, and Its README Lists TLS Its Own Quick Start Skips
Software / news
kube32 Runs Kubernetes Pods on ESP32-S3 Boards, and Its README Lists TLS Its Own Quick Start Skips
The Apache 2.0 project, at 25 stars, runs WebAssembly pods under kubectl, but its SECURITY.md says the API serves plain HTTP with authentication off by default.
The README for kube32, a Kubernetes-compatible control plane for ESP32-S3 microcontrollers, lists "automatic self-signed ECDSA P-256 TLS on port 6443". Its own quick start then points kubectl at http://<control-plane-ip>:6443, and its SECURITY.md says "the API server and ingress serve plain HTTP".
The project is a single GitHub repository, arterialist/kube32, released under Apache 2.0 and showing 25 stars and 156 commits on 31 October 2026. Stars are not adoption, and 25 of them say little about whether anyone but the author has flashed a board.
What kube32 does on the board
Per the README, one firmware image runs on every board. A board with at least 2 MB of quad SPI PSRAM and 8 MB of flash becomes the control plane and runs a local kubelet. Any ESP32-S3 with 8 MB of flash can join as a worker. The reference worker is an M5Stack Cardputer.
Pods are WebAssembly modules run by the wasm3 interpreter, with SDKs for Rust, C and AssemblyScript. The README lists memory limits and "per-call gas budgets" for each pod, and distinct exit codes for Wasm traps, gas exhaustion and OOMKilled. A capability firewall gates each pod's access to GPIO pins, ADC channels, I2C and UART buses, the display, the speaker and the microSD card.
The same sources build kube32-sim, a host simulator for macOS and Linux. The README's worked example, Tessera, is an issue tracker made of four Wasm pods behind an Ingress.
The TLS contradiction
Three statements in the repository do not agree. The feature list promises self-signed TLS on port 6443. The quick start for both the simulator and real boards sets the cluster server to http:// on that same port. SECURITY.md, the third, says plainly that the API server and ingress serve plain HTTP and that bearer-token authentication "is disabled by default".
The README sends readers to docs/quickstart.md for "TLS configuration". That page was not read for this piece, so it is possible TLS is a build or provisioning option that the quick start leaves off. What is established is that the default path in the README is unencrypted and unauthenticated, and that SECURITY.md tells operators to "run kube32 clusters on trusted networks only".
Until a first tagged release, SECURITY.md says only the main branch receives security updates.
How it compares with picokubelet
Another ESP32-S3 project takes a narrower approach. picokubelet, a Specht Labs project by GitHub user cedi, is a Rust kubelet that joins Wi-Fi, talks TLS to a k3s API server and renews its Lease every 10 seconds so the board appears as a Ready node. Its pods are faked: the README reports the container runtime as lies://0.1.0, and a scheduled Promtail pod stays in Pending.
| kube32 | picokubelet | |
|---|---|---|
| Runs pods | Yes, Wasm via wasm3 | No, faked |
| Control plane | On an ESP32-S3 with PSRAM | k3s on a Raspberry Pi |
| Licence | Apache 2.0 | MIT or Apache 2.0 |
| Stars, 31 Oct 2026 | 25 | 55 |
picokubelet says it should not be used in production. kube32's README makes no such statement, though its SECURITY.md limits it to trusted networks.
- kube3225 stars
- picokubelet55 stars
- wasm3 (the interpreter kube32 embeds)8100 stars
Source: GitHub repository pages for kube32, picokubelet and wasm3, accessed 2026-10-31
What the interpreter limits
wasm3 is an MIT-licensed interpreter that lists ESP32 among its supported microcontrollers and says a minimal system needs about 64 KB for code and about 10 KB of RAM. Its README calls it "a fast WebAssembly interpreter" and adds "Your mileage may vary". It also says the maintainer is entering "a minimal maintenance phase" and cannot add new features, though pull requests are still merged. A project that vendors it under third_party/wasm3 carries that dependency.
The README gives no throughput, latency or pod-density figures. Memory budgets are in docs/hardware-spec.md, which was not read for this piece. How many pods fit in 2 MB of PSRAM is unanswered here.
WebAssembly is also moving into the browser tooling the site has covered, as in ElementaryUI's Swift-to-Wasm toolchain. kube32 shows the same format on a chip with no operating system. The repository's next milestone is its first tagged release, since SECURITY.md's support table lists only main. For the networking side of small devices, see Firezone's sanstun.
Sources
- 04wasm3
More in Software
- 01Python 3.15 Ships a Built-In sentinel After Five Years of PEP 661The new type replaces the object() idiom with a one-line constructor that survives copying, pickling and type checking, but a Python 3.15 floor is the price of using it.
- 02Lightpanda 1.0 Passes 80% of Chrome's Web Tests, by Its Own CountThe Zig-built headless browser left beta on Oct. 2, and its own benchmarks put it ahead of two Rust rivals on a 940-page crawl, with no hardware listed.
- 03Claude-Mem Hits 107,900 Stars, and Its Own Pages Disagree on LicenceThe Claude Code memory plugin has gained about 35,500 stars since May, but a May write-up says AGPL-3.0, the repository now says Apache-2.0, and the README describes an optional cloud sync that earlier coverage did not.
- 04Jepsen Found 96 Issues in ParticleDB 1.1.4 and Tells Users to Halt DeploymentKyle Kingsbury’s 31 October report, funded by vendor Orkes, finds lost writes and ignored constraints in healthy single-node runs.