Algunos directivos creen que dirigir consiste en supervisarlo todo y corregir hasta el último detalle. Sin embargo, cuando el control se convierte en intromisión, las personas dejan de sentirse responsables de su trabajo y se desentienden de los resultados.
The post Cuando controlar demasiado destruye el compromiso first appeared on Toma de Decisiones Miguel A. Ariño.
María José Pérez-Barco, del ABC, me escribió para enviarme unas preguntas para un artículo que estaba preparando sobre la muchas veces comentada posibilidad de aplicar impuestos a los robots o a la inteligencia artificial, y el pasado lunes publicó su artículo titulado «¿Llegará la IA a pagar impuestos?» (pdf).
Mi opinión sigue siendo la misma que cuando se empezaron a comentar estos temas allá por 2017 a raíz de unas declaraciones de Bill Gates, más calificables como «ocurrencias» que como ideas realmente pensadas y maduras. Y es que la cuestión, aunque parezca muy sencilla y casi intuitiva por eso de que «un robot se parece a una persona» (que no siempre), la realidad es que no es en absoluto tan sencillo, y que el planteamiento es prácticamente populista.
En primer lugar, porque es absurdo gravar las cosas dos veces: si un empresario aplica tecnología, sea en forma de robots o de otro tipo, lógicamente, pasará a ganar más dinero (si no, no lo haría) y, por tanto, pasará a pagar más impuestos. Aplicar además un gravamen adicional «por ser un robot» o «por usar tecnología» es desincentivar la innovación, y carece completamente de sentido.
En segundo, ¿qué es un robot? ¿Un programa de software es un robot? ¿Un procesador de textos es un robot? ¿Un GPS? ¿Una calculadora? ¿Un brazo mecánico es un robot, o solo es un trozo de uno, porque falta el resto del cuerpo? Como vemos, a todo el razonamiento le falta un hervor: parece sencillo, pero se queda en idea no madurada. Y si pretendemos escudarnos en el fenómeno de la sustitución, el problema se complica todavía más: ¿dónde empezamos a contar? ¿En qué generación tecnológica? Sustituimos a una persona si trabaja con determinadas herramientas, pero seguramente a tres si trabajan solo con su cerebro… ¿nos inventamos una unidad, el «cro-magnon», y planteamos «cuántos cro-magnones harían falta para llevar a cabo una tarea determinada? En el mejor de los casos, pintoresco. Y sobre todo, arbitrario.
Estoy completamente a favor de plantear cualquier idea que pretenda distribuir la riqueza, incluyendo posibilidades que van desde gravar la acumulación de riqueza hasta el universal basic capital mencionado recientemente por Gavin Newson, pero pretender aplicar impuestos a los robots no es una forma adecuada ni lógica de hacerlo, y quien lo afirme es simplemente que no se lo ha planteado con todas sus consecuencias.
A continuación, el listado completo de preguntas y respuestas que intercambié con María José:
- ¿Será necesario gravar la automatización, sistemas de IA y robots? ¿Por qué?
No lo creo. La idea de “poner impuestos a los robots” parte de una visión profundamente equivocada de la innovación tecnológica. Históricamente, cada avance importante ha destruido determinados empleos y creado otros nuevos, normalmente más productivos. Pretender penalizar la automatización es como haber querido gravar el tractor para proteger a los agricultores que trabajaban con mulas. La tecnología aumenta la productividad, y esa productividad genera beneficios, crecimiento y, por tanto, más recaudación fiscal por las vías tradicionales: impuesto de sociedades, IVA, rentas del trabajo derivadas de nuevas actividades, etc. Si una empresa gana más dinero gracias a la automatización, ya pagará más impuestos. Crear un impuesto específico contra la tecnología sería castigar precisamente aquello que mejora la competitividad y la eficiencia.
- ¿Cómo cuantificar el trabajo que realizan estas tecnologías? ¿Cómo mides el trabajo de sistemas que no tienen nómina y no están sujetos a una regulación laboral? ¿Cómo gravar a un software?
Ahí aparece otro problema enorme: la arbitrariedad. ¿Qué es exactamente un “robot”? ¿Un brazo mecánico en una fábrica? ¿Un chatbot? ¿Una hoja de cálculo que automatiza tareas? ¿Excel sustituyó empleos administrativos? Sin duda. ¿Deberíamos haberlo gravado? El concepto se vuelve absurdo en cuanto intentas definirlo. La tecnología siempre ha sustituido tareas humanas: una calculadora reemplaza operaciones manuales, un GPS sustituye parte del trabajo de orientación, un software contable automatiza procesos administrativos. ¿Dónde trazas la línea? Además, la IA no “trabaja” como un empleado: es una herramienta que multiplica capacidades humanas. Gravar software sería abrir un melón regulatorio prácticamente imposible de cerrar.
- ¿Qué fórmulas se están planteando para gravar estas tecnologías?
Se han propuesto varias ideas, desde impuestos directos a robots industriales hasta tasas asociadas al ahorro de costes laborales derivado de la automatización. También se habla de aumentar cotizaciones empresariales cuando una compañía reduce plantilla mediante automatización o incluso de crear figuras fiscales específicas para sistemas de IA. El problema es que todas esas propuestas parten de una lógica defensiva y reaccionaria: intentar frenar el cambio en lugar de adaptarse a él. En muchos casos, además, serían muy fáciles de esquivar trasladando operaciones a otros países o redefiniendo tecnológicamente los procesos.
- Gravar la IA y avanzadas tecnologías con impuestos y cotizaciones, ¿podría desalentar la innovación?
Claramente sí. La innovación necesita incentivos, no castigos. Si desarrollar o implementar IA implica automáticamente una penalización fiscal, muchas empresas retrasarán su adopción o simplemente decidirán innovar en otros mercados con regulaciones más racionales. Europa ya tiene un problema serio de competitividad tecnológica frente a Estados Unidos y China. Añadir más capas fiscales a las tecnologías emergentes sería otra manera de autoimponernos irrelevancia. La historia demuestra que las economías que prosperan son las que abrazan la innovación, no las que intentan ponerle barreras para proteger estructuras productivas obsoletas.
- ¿Qué impacto tendría en las empresas?
Dependería mucho del sector, pero en general supondría un desincentivo claro a la modernización. Las grandes multinacionales probablemente podrían absorber esos costes o mover determinadas operaciones a otras jurisdicciones. Las más perjudicadas serían las pymes, que necesitan precisamente automatizar procesos para ganar eficiencia y competir. En muchos casos, la IA no sustituye trabajadores, sino que permite que pequeñas empresas hagan más con menos recursos. Penalizar eso sería reducir su capacidad de supervivencia y crecimiento.
- ¿Podría restar competitividad al tejido empresarial frente a grandes como Estados Unidos y China?
Sin ninguna duda. Mientras Estados Unidos y China compiten por liderar el desarrollo de IA y atraer talento e inversión, Europa parece obsesionada con regular antes incluso de entender completamente la tecnología. Si además añadimos impuestos específicos, el mensaje es devastador: “innovar aquí sale caro”. El resultado sería previsible: menos inversión, menos startups tecnológicas, menos desarrollo propio y mayor dependencia tecnológica externa. Es difícil imaginar una estrategia más contraproducente.
- ¿Qué tareas, empleos y puestos de trabajo está ya sustituyendo la IA? ¿Y qué previsiones hay a futuro?
La IA ya está automatizando tareas rutinarias cognitivas: atención al cliente básica, generación de textos simples, traducciones estándar, análisis documental, programación repetitiva, diseño básico, gestión administrativa o procesamiento de datos. Pero hablar de “sustitución de empleos” suele simplificar demasiado. Lo que desaparecen son tareas concretas dentro de muchos empleos. La mayoría de los trabajos cambiarán antes de desaparecer completamente. Lo mismo ocurrió con internet, con los ordenadores o con la automatización industrial. Habrá profesiones que se reduzcan mucho y otras nuevas que ni siquiera imaginamos todavía. La clave no es intentar impedir ese cambio, sino preparar a la sociedad para adaptarse: educación, formación continua y capacidad de reinventarse profesionalmente. Penalizar la tecnología nunca ha sido una solución inteligente.
Using this link, you can access the article in English on Medium bypassing the paywall, «Why taxing robots and AI is the wrong answer«
El desarrollo de la instrucción judicial en torno a las presuntas irregularidades en la contratación y desempeño de David Sánchez Pérez-Castejón (conocido artísticamente como David Azagra) en la Diputación de Badajoz ha adquirido un nuevo cariz tras las últimas comparecencias testificales. Según ha podido comprobar THE OBJECTIVE, diversos testigos clave han optado por omitir su vinculación orgánica con el Partido Socialista Obrero Español (PSOE), parapetándose tras su condición de funcionarios públicos. Esta estrategia busca proyectar una imagen de estricta neutralidad técnica en sede judicial, con el aparente propósito de blindar la legalidad de un cargo presuntamente diseñado ad hoc para el hermano del presidente del Gobierno, Pedro Sánchez, y para su entorno más cercano, singularmente su exasesor Luis Carrero. @theobjective
Ver post completo: El PSOE está ya pasándose de vueltas y es así como gripan los motores.
La presión asistencial en las urgencias del Hospital Royo Villanova y Miguel Servet de Zaragoza se mantiene este martes, aunque empieza a disminuir el número de pacientes que aguardan en estos centros sanitarios a que les asignen una cama. Pese a que la situación se alivia ligeramente, a media tarde el Royo tenía 14 pacientes en los pasillos y 24 esperando cama, mientras que en la Casa Grande había 10 en saturación y 44 seguían pendientes de ingreso, según fuentes sindicales. @heraldo
Ver post completo: Aunque lo parezca, NO es una noticia del Mundo Today.
Esta medida con prisas justo antes de las elecciones generales, tratándose del PSOE… no le deja a uno tranquilo. Los inquietantes resultados de las elecciones andaluzas no ayudan.
Ver post completo: Con la Ley de Nietos, más de 2 millones de nuevas identidades podrán votar por correo.
Título original: Israel on the Brink. And the Eight Revolutions that Could Lead to Decolonization and Coexistence.
© Ilan Pappé, 2025
Traducción de Ana Useros Martín
Editorial: Ediciones Akal.
El 7 de octubre y la posterior invasión de Gaza por parte de Israel pusieron al descubierto las grietas de sus cimientos. Se reveló como un país incapaz de proteger a sus ciudadanos, dividido entre teócratas mesiánicos y sionistas liberales iluminados, resentido con sus vecinos y perdiendo el apoyo de los judíos de todo el mundo. Mientras sus líderes justifican campañas de bombardeos que superan las peores atrocidades de la Segunda Guerra Mundial y la Franja de Gaza se sumerge en una creciente catástrofe humanitaria, Israel se está convirtiendo en un Estado paria. Su peor enemigo no es Hamás, sino él mismo.
Para superar la idea del Estado judío, Ilan Pappé nos muestra un camino de justicia restaurativa y descolonización que incluye el retorno de los refugiados, el fin de los asentamientos y la imperiosa necesidad de tender puentes con el mundo árabe.
¿Estamos ante un próximo colapso de Israel?
¿Es posible un futuro de coexistencia y no de guerra sin fin?
Ilan Pappé (Haifa, 1954) es profesor de historia en la Universidad de Exeter (Reino Unido), cuyo Centro Europeo de Estudios Palestinos dirige. Reputado analista político del conflicto palestino-israelí.
Tiempo estimado de lectura: 48 minutos.
Objetivos de este libro:
Ideas principales:
Algunas de las cosillas que aprendí leyendo este libro que no tienen por qué ser ni ciertas ni falsas ni todo lo contrario:
¿Has leído este libro? ¿Algún libro parecido? ¿Tienes alguna cosa que decir sobre lo que expone este libro? ¿Recomiendas algún libro relacionado a este? Estaré encantado de leer lo que piensas sobre este libro en los comentarios.
Algunos enlaces relacionados:
Algunos libros relacionados:
raul
Ocho de cada 10 niños y niñas de familias vulnerables no van a campamentos en los que se les asegura su alimentación. La mitad de las familias de bajos recursos aseguran que los elevados precios son la causa para no poder recurrir a estos recursos.As a developer advocate working with web and mobile application developers, I’ve often heard about the need to maintain consistent user authentication in the unlikely event of a regional service interruption. The increasing use of agentic AI, microservices, automation, and service accounts has sparked a similar need for machine-to-machine authentication. Today, I’m excited to share two important updates to Amazon Cognito: multi-Region replication for improved resilience, and support for customer managed keys for more control encryption control.
Many applications rely on Amazon Cognito to handle user and machine-to-machine authentication, and to manage user profiles. When building for high availability, having consistent data across different AWS Regions is a key approach, and until now, achieving that consistency came with significant challenges. Engineering teams spent significant time building and maintaining custom replication solutions to synchronize configurations across Regions. Manual export and import of user data between Regions created security risks from potential data exposure and introduced opportunities for data inconsistencies. During regional transitions, end users experienced disruptions like forced password resets and re-authentication. For machine-to-machine communications, teams had to create new app clients in the secondary region, which meant reconfiguring their applications and updating OAuth-protected resources to accept access tokens issued by the new regional issuer. These challenges made it difficult to maintain uninterrupted operations across Regions.
With multi-Region replication, Amazon Cognito automatically maintains a synchronized copy of your user data and machine secrets in a secondary AWS Region of your choice. The replication flows in one direction, from your primary Region to the secondary Region. This includes user profiles, credentials, and pool configurations. The secondary Region operates in read-only mode, focusing on maintaining authentication capabilities. Existing sessions continue uninterrupted.
When you need to direct traffic to the secondary Region, your existing users can continue signing in with their existing credentials without disruption, and currently signed-in users remain authenticated because both regions recognize access tokens issued by either region. Multi-Region replication supports all authentication methods, including federated sign-in through social providers (Amazon, Google, Apple, Facebook), Security Assertion Markup Language (SAML) and OpenID Connect (OIDC) integrations, and API authorization flows. This approach maintains availability for both customer-facing applications and machine-to-machine communications in your backend services. While authentication continues without interruption, operations like new user registration or profile updates are not available during failover.
Before configuring multi-Region replication, you must configure a multi-Region customer managed key stored in AWS Key Management Service (AWS KMS) to encrypt your user data at rest. These keys provide consistent encryption across Regions while giving you control over your encryption strategy.
How this works in practice
I start this demo with an existing Cognito user pool in the us-west-2 (Oregon) Region. I want to configure replication to us-east-1 (Northern Virginia). I also have a customer managed key replicated in these two Regions.
Configuring multi-Region replication is just three steps. The AWS Management Console guides me through the steps: set up a custom key for encryption, configure multi-region OIDC endpoints, and configure the replication itself.
First, I set up a custom AWS KMS key to encrypt the data at rest.
I select the custom key I created. I also update the key policy to allow Amazon Cognito to access and use the key. The console shows the correct IAM policy statements to add to my key policy.
The console confirms when the custom key is selected and correctly configured.
Second, I follow the console instructions to configure the OIDC issuer type. On Step 2 – optional, I choose Configure.
I make sure to update my client applications with these new endpoints. This is a required change that will need a redeployment of server-side applications and an update submission for mobile apps on the App Store and Google Play. If I don’t update the endpoints, my users will experience disruptions because requests to the old endpoints will no longer be routed correctly.
On the next screen, I select Updated. I take note of the new URLs. I confirm the changes and choose Change issuer type.
Finally, I select the target Region for replication. Only Regions where the custom encryption key is replicated are available for selection. After having chosen the target Region, I choose Create.
.
The service prepares the replication. The time needed depends on the amount of data in the user pool.
When the replicated user pool is ready, I manually Activate it.
The replication status becomes Active. It is ready to direct traffic to the replica.
Additional configurations
The console helps me to keep track of additional configurations I have to plan. When I’m using Lambda functions for custom authentication flows or SMS or email notifications, I must also deploy and configure these resources in the new Region.
Similarly, log streaming or AWS WAF configuration must be manually configured in the target Region before I start directing authentication traffic to it.
Health checks and failover
Both primary and secondary regional endpoints remain active and ready to serve your traffic at all times. To monitor system health and manage failovers, you design a strategy that aligns with your application’s specific requirements and security posture. You can implement health checks to monitor the status of authentication services in your primary Region and define criteria for when to initiate failover. These checks might look for error rates, latency patterns, or specific service alerts.
When your monitoring system detects issues meeting your failover criteria, you can redirect traffic to the secondary Region through DNS updates. This approach gives you control over the failover process while maintaining security. Consider testing your failover strategy during off-peak hours by redirecting a small portion of traffic to verify that authentication continues working as expected in the secondary Region.
When using managed login and federation with custom domains, you can also use the built-in traffic routing feature by providing an Amazon Route 53 health check ID.
Pricing and availability
Multi-Region replication is available today as an add-on feature for Amazon Cognito customers using Essentials and Plus tier. For user authentication, the add-on costs $0.0045 per monthly active user per replica Region for Essentials tier customers and $0.006 per monthly active user per replica region for Plus tier customers. For machine-to-machine (M2M) authentication, the add-on is a 30% charge on top of the standard volume-based pricing for successful tokens issued. For detailed pricing information, see Amazon Cognito pricing.
Multi-Region replication is available in the following Regions: US East (Ohio, N. Virginia), US West (N. California, Oregon), Asia Pacific (Mumbai, Seoul, Singapore, Sydney, Tokyo), Canada (Central), Europe (Frankfurt, Ireland, London, Paris, Stockholm), and South America (São Paulo).
Any of these Regions can be used as the source or the destination for the replication.
Support for customer managed keys is available for the Essentials and Plus tiers. It is available in the following Regions: US East (Ohio, N. Virginia), US West (N. California, Oregon), Africa (Cape Town), Asia Pacific (Hong Kong, Hyderabad, Jakarta, Malaysia, Melbourne, Mumbai, New Zealand, Osaka, Seoul, Singapore, Sydney, Thailand, Tokyo), Canada (Central), Canada West (Calgary), Europe (Frankfurt, Ireland, London, Milan, Paris, Spain, Stockholm, Zurich), Israel (Tel Aviv), Mexico (Central), South America (São Paulo), and AWS GovCloud (US-East, US-West)
From my conversations with customers, maintaining business continuity during regional incidents while meeting security requirements is a high priority. Multi-Region replication provides the capability to build more resilient applications without managing complex replication logic yourself. The automatic synchronization of user data and configurations reduces operational overhead while maintaining security.
For customers in regulated industries, the new support for customer managed keys provides additional control over data encryption. You can now use your own encryption keys to protect user data at rest, helping you meet regulatory requirements in industries like healthcare and financial services.
To get started with multi-Region replication and customer managed key encryption, visit the Amazon Cognito console or see the documentation for detailed setup instructions. I look forward to hearing how you use this feature to strengthen your application architecture.
— sebA hands-on field test of moving stateful GKE workloads onto fourth-generation compute, and the storage migration playbook I wish I’d had before I started.
If you run stateful workloads on Google Kubernetes Engine, you will eventually want to move them onto fourth-generation machines like N4. The performance and price-performance gains are real. But there’s a catch that trips up a lot of teams the first time they try it: N4, N4D, and N4A don’t support Persistent Disk at all. They support Hyperdisk only.
That single fact turns what looks like a routine node-pool swap into a storage migration. Your pd-balanced and pd-ssd volumes can't simply follow your pods onto N4. The disk underneath has to become a Hyperdisk first.
I wanted to know exactly how that works in practice — not in theory, not in a slide — so I built a GKE cluster, ran a continuously-writing stateful workload on it, and migrated it end to end from N2 with Persistent Disk to N4 with Hyperdisk. Then I did it again with regional disks, where the story changes in an important way.
This article walks through what I tested, what worked, what failed, and the operational playbook that came out of it. If you’re planning this migration for anything that matters, the second half is the part to read twice.
The mechanism that makes this migration possible is a Compute Engine command: gcloud compute disks convert. It converts a Persistent Disk volume into a Hyperdisk volume in place, at the Compute Engine layer.
But GKE volumes aren’t raw Compute Engine disks. They’re Kubernetes objects — a PersistentVolumeClaim bound to a PersistentVolume, provisioned by the Persistent Disk CSI driver (pd.csi.storage.gke.io). The PV points at the underlying disk through a volumeHandle. So the real question was:
Can a Kubernetes PVC/PV backed by the GKE CSI driver survive an in-place Compute Engine disk conversion from Persistent Disk to Hyperdisk, and then mount cleanly on an N4 node — with the data intact?
Short answer: yes, for zonal disks. And there’s a separate, supported path for regional disks. Let me show you both.
I created a GKE Standard cluster on n2-standard-2 nodes with pd-balanced boot disks, in europe-west1-b. (An org policy blocked external IPs, so the cluster used private nodes behind an existing Cloud NAT — a detail worth flagging because it's the kind of environment most production clusters actually live in.)
The workload was deliberately simple: a busybox deployment writing a timestamp and its pod hostname to a file on a mounted volume every five seconds.
command:
- sh
- -c
- |
while true; do
date -Iseconds >> /data/heartbeat.log
hostname >> /data/heartbeat.log
sleep 5
done
That heartbeat file is the whole point. If data survives the migration, I’ll see pre-migration lines (written by the N2 pod) and post-migration lines (written by the N4 pod) in the same file. No ambiguity.
The volume was a standard CSI-provisioned pd-balanced PVC:
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: pd-balanced-test
provisioner: pd.csi.storage.gke.io
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
parameters:
type: pd-balanced
Once the PVC bound, GKE created a Compute Engine disk named after the PV (pvc-13843ff8-...), pd-balanced, attached to the N2 node. The pod was running and writing. Time to migrate.
First I added an N4 node pool to the same cluster, with Hyperdisk Balanced as the node boot disk — and a temporary taint so nothing would schedule there before I was ready:
gcloud container node-pools create n4-pool \
--cluster=gke-pd-to-hyperdisk-test \
--zone=europe-west1-b \
--machine-type=n4-standard-2 \
--num-nodes=1 \
--disk-type=hyperdisk-balanced \
--disk-size=50 \
--node-taints=migration-test=true:NoSchedule
That taint is the first piece of the safety story. During a migration window you do not want a pod with an unconverted disk accidentally landing on an N4 node it can’t mount, or a converted workload drifting back to N2. Scheduling guards make the migration deterministic.
The conversion itself is where the discipline matters. The sequence was:
1. Stop writes and detach the disk. A ReadWriteOnce volume can't be converted while it's attached, so I scaled the deployment to zero and waited for the disk to fully detach:
kubectl scale deploy pv-writer --replicas=0
kubectl wait --for=delete pod -l app=pv-writer --timeout=180s
Then I polled the Compute Engine disk until its users field went empty — that's the signal it's truly detached, not just that the pod is gone:
users: []
type: pd-balanced
status: READY
2. Take a safety snapshot. Before touching the disk, I snapshotted it. gcloud compute disks convert is a permanent operation; the snapshot is your rollback.
gcloud compute disks snapshot pvc-13843ff8-... \
--zone=europe-west1-b \
--snapshot-names=pvc-13843ff8-...-before-hyperdisk
3. Convert. With the disk detached and snapshotted:
gcloud compute disks convert pvc-13843ff8-... \
--zone=europe-west1-b \
--target-disk-type=hyperdisk-balanced
The conversion took under a minute on a 20 GiB disk. Afterward:
type: hyperdisk-balanced
sizeGb: 20
status: READY
provisionedIops: 3120
provisionedThroughput: 170
users: []
4. Move the workload to N4. I removed the taint, patched the deployment’s nodeSelector to target n4-pool, and scaled back up:
kubectl patch deploy pv-writer --type='json' -p='[
{"op":"replace",
"path":"/spec/template/spec/nodeSelector/cloud.google.com~1gke-nodepool",
"value":"n4-pool"}
]'
kubectl scale deploy pv-writer --replicas=1
The pod came up on N4, and Kubernetes confirmed the attach:
Normal SuccessfulAttachVolume AttachVolume.Attach succeeded for
volume "pvc-13843ff8-..."
Normal Started Container started
And the heartbeat file? Both eras, same file:
2026-06-03T15:08:33+00:00 <- written on N2, pd-balanced
pv-writer-9dbbb975f-ks7q4
...
2026-06-03T15:11:20+00:00 <- written on N4, hyperdisk-balanced
pv-writer-959b587f4-mrh75
The same PVC/PV survived an in-place disk-type change and a move to a completely different machine family, with zero data loss.
Here’s the subtlety that has real operational consequences. After the conversion, the underlying Compute Engine disk was hyperdisk-balanced. But the Kubernetes objects hadn't changed at all:
spec:
storageClassName: pd-balanced-test # still says "pd-balanced"
csi:
driver: pd.csi.storage.gke.io
volumeHandle: projects/.../disks/pvc-13843ff8-...
The PV and PVC kept working only because the volumeHandle still points to the same disk name. The conversion happened a layer below Kubernetes' awareness. The StorageClass still says pd-balanced. Kubernetes never rewrites that metadata.
This is fine for the converted volume itself — it works. But it creates three traps for the unwary:
So the conversion fixes the disk in front of you, but not your future. You need a separate Hyperdisk StorageClass for anything new:
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: hyperdisk-balanced
provisioner: pd.csi.storage.gke.io
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
parameters:
type: hyperdisk-balanced
provisioned-iops-on-create: "3000"
provisioned-throughput-on-create: "140Mi"
Plenty of production workloads use regional Persistent Disks for cross-zone durability. So I ran the whole test again with regional pd-balanced, pd-ssd, and pd-standard disks, replicated across europe-west1-b and europe-west1-c.
The in-place conversion command failed immediately — for all three:
ERROR: (gcloud.compute.disks.convert) Invalid value for [--region]:
Regional disks are not supported for this command.
gcloud compute disks convert is a zonal-only operation. There's no in-place path for regional disks. This is the single biggest gotcha in the whole migration, because the technique that works perfectly for zonal disks simply doesn't exist for regional ones.
The supported path is snapshot and restore into a new Hyperdisk Balanced High Availability disk (the multi-zone Hyperdisk type that replaces a regional PD):
gcloud compute disks create hdbha-from-rpd-balanced \
--region=europe-west1 \
--replica-zones=europe-west1-b,europe-west1-c \
--type=hyperdisk-balanced-high-availability \
--size=20GiB \
--source-snapshot=pvc-1d025f5e-...-before-hdbha \
--provisioned-iops=3000 \
--provisioned-throughput=140
Then you create new static PV/PVC objects pointing at the new disk, repoint the workload, and move it to N4. I did this for all three regional source types. All three pods came up on N4, all three Hyperdisk Balanced HA volumes attached, and every heartbeat file again showed both pre- and post-migration lines.
The crucial difference: with regional disks, the Kubernetes objects change. You’re not keeping the same PV — you’re creating a new disk, a new PV, and a new PVC, then cutting the workload over to them. Existing regional PD PVCs will not become Hyperdisk HA PVCs in place. Plan for the object churn.
Source disk Migration method Same K8s PV/PVC?
Both paths work, but neither is zero-downtime for ReadWriteOnce volumes — the disk has to detach, which means the pod has to stop. Here's how to do this safely for workloads that matter.
Plan a maintenance window. For RWO volumes, conversion requires detach, and detach requires stopping the pod. Don’t pretend otherwise. If you need true continuity, that has to come from application-level replication and cutover, not from the disk migration.
Get application consistency before you detach. Stop writes cleanly, flush buffers, complete database checkpoints. For databases, prefer application-native backup or replication over filesystem-level consistency, and never convert a disk after an unclean shutdown.
Always snapshot first. Take the snapshot immediately before conversion and keep it until the workload has passed functional validation on N4. Since convert is permanent, this snapshot — plus your previous manifest and scheduling constraints — is your rollback plan.
Gate scheduling throughout. Use taints and node selectors so unconverted workloads stay on N2/N2D and converted ones move to N4/N4D, with nothing landing on an incompatible node mid-window. The repeatable loop is: create the N4 pool with a NoSchedule taint, convert one disk, patch that one workload, remove the guard for it only, verify, repeat.
Keep a migration inventory. Because Kubernetes won’t update StorageClass metadata, track it yourself — namespace, workload, PVC, PV, disk name, old and new disk type, target node pool, conversion timestamp, snapshot name, and validation status. This is the only reliable source of truth during a fleet-wide migration.
Create Hyperdisk StorageClasses for new volumes, and tune IOPS and throughput deliberately. The test disk landed on 3,120 IOPS / 170 MBps by default; real workloads should be sized against actual needs and the limits of the machine type and disk count, not left to defaults.
Mind zonal vs. regional topology. Zonal disks stay pinned to their zone, so the N4 target pool must have nodes in that same zone. For anything regional, the target is hyperdisk-balanced-high-availability, and you're on the snapshot-restore path with new Kubernetes objects.
Treat StatefulSets with extra care. Convert one ordinal at a time, hold strict pod-disruption controls, verify each PVC/disk pair before advancing, and update volumeClaimTemplates for future scale-out. When you want a genuinely clean end state, it's often better to stand up a new StatefulSet on Hyperdisk PVCs and migrate data into it.
Moving GKE workloads to N4 is, underneath, a storage migration — because N4 speaks Hyperdisk and nothing else. The good news from the field is that the path is solid and the data survives, on both routes:
The trap to internalize is that the Compute Engine layer and the Kubernetes layer don’t converge on their own. The disk becomes Hyperdisk; the StorageClass metadata doesn’t. Bridge that gap with inventory, scheduling guards, fresh Hyperdisk StorageClasses, and application-aware consistency — and an N2-to-N4 migration becomes a controlled, repeatable operation instead of a leap of faith.
Test environment: GKE Standard 1.35, europe-west1-b, N2 and N4 node pools, validated June 2026. Always test the full sequence in a non-production cluster before running it against critical data.
Migrating GKE Workloads from Persistent Disk to Hyperdisk: A Safe Path from N2 to N4 was originally published in Google Cloud - Community on Medium, where people are continuing the conversation by highlighting and responding to this story.
If you've been looking to deploy your Spring Boot app to the cloud but feel a little overwhelmed by all the moving pieces, don't worry, you're not alone.
Kubernetes can seem intimidating at first, but Amazon EKS (Elastic Kubernetes Service) makes it much more approachable, especially when you have a step-by-step guide to follow.
In this tutorial, we'll walk through exactly how to get a Spring Boot application with a MySQL database up and running on Amazon EKS. I'll take you from from containerizing your app to connecting it to a managed database, all the way to accessing it live in the cloud. Let’s get started.
Before you begin, ensure you have the following:
Basic knowledge of AWS (AWS Console access).
Basic knowledge of containerization.
Working knowledge of Kubernetes.
Basic knowledge of databases.
Helm installed
Kubectl installed
Eksctl installed
An IDE
The application runs inside an AWS VPC spread across two availability zones for high availability. When a user makes a request, it flows through an Internet Gateway into an AWS Application Load Balancer sitting in the public subnet, which handles incoming traffic via an Ingress rule.
The Load Balancer routes requests to the App Service, which distributes them across multiple App Pods running inside AWS EKS (Elastic Kubernetes Service) in the private subnets.
The Docker images for these pods are pulled from AWS ECR (Elastic Container Registry). For data persistence, the app pods connect to Amazon RDS MySQL databases through a MySQL External Service, with an RDS instance in each availability zone to ensure redundancy.
A NAT Gateway in the public subnet allows the private resources to make outbound internet calls without being directly exposed to the internet.
If you've ever tried to manage containers manually, you already know it can get messy pretty quickly, tracking which containers are running, restarting ones that crash, scaling up when traffic spikes... It's a lot.
That's exactly the problem Kubernetes was built to solve. It automates the deployment, scaling, and management of containerized applications. But setting up and maintaining your own Kubernetes cluster from scratch? That's a whole other challenge.
That's where Amazon EKS comes in. EKS is a fully managed Kubernetes service provided by AWS, which means AWS handles the heavy lifting of setting up, securing, and maintaining the Kubernetes control plane for you. You just focus on deploying your application.
In this section, we’ll cover the steps to follow in deploying your SpringBoot application with MySQL on Amazon EKS.
To create a VPC, log in to the AWS IAM Console and search for “VPC,” then click create VPC.
Select the "VPC and more option:, and give your VPC a name for your project, for example, spring-demo. Set the IPv4 CIDR block to 10.4.0.0/16. For the NAT gateway configuration, select Zonal, then In 1 AZ.
Select None for VPC endpoints configuration. Next, click Create VPC, then click View VPC. This takes you to the VPC resource map.
First, you need to create the security group for the MySQL and EC2 instance deployment. To do that, navigate to EC2 > Security Groups. For the inbound rule, select Type: All traffic and Source: Anywhere-IPv4. Then click Create security group.
Next, we’ll create the subnet group for the database. To do that, navigate to Aurora and RDS > Subnet groups and click Create DB subnet group. Next, configure the DB subnet to include:
Name: private-subnet-db
Description: private-subnet-db
VPC: Select VPC
Add subnets: Choose us-east-1a and us-east-1b as the availability zones, then select the private and public subnets
Click Create**.**
Now, navigate to Databases, click Create database, and select Full configuration. Select MySQL as the engine type.
Select the Free tier when choosing a sample template. Next, give your DB a username and a strong password. Choose db.t3.micro as the instance type.
Select your VPC and associated private subnet. Now, uncheck the "Enable auto minor version upgrade" option in the Additional configuration section and click Create database.
While our database initializes, let's create a key pair for the EC2 instance, which will be launched in a public subnet. To do that, navigate to EC2 > Network & Security > Key Pairs and click Create key pair.
Give your key pair a name, for example, ece-db-key-pair. Leave everything else as-is and click Create key pair. This automatically downloads the key-pair into your local machine.
Now it’s time to create an EC2 instance. To do this, navigate to EC2 > Instances and click Launch instances. Select the key pair you just created in the Key pair section.
Next, in the Network section, select the VPC created earlier for the project. For Auto-assign public IP, choose Enable. Next, choose the Select existing security group option and select the all-access-sg security group created earlier. Next, click Launch instance.
For this step, go into your terminal and navigate to the folder where your key pair is downloaded. Run the ls command, and you should see your key pair there.
Next, you need to change the permission of the key pair file. Use the command below:
chmod 0400 ece-db-key-pair.pem
Now, run the SSH tunneling command below:
ssh -i <YOUR-KEY-PAIR>.pem -f -N -L <LOCAL-PORT>:<YOUR-RDS-ENDPOINT>:<RDS-PORT> <EC2-USERNAME>@<YOUR-EC2-PUBLIC-DNS> -v
<YOUR-KEY-PAIR>.pem: the name of your downloaded key pair file
<LOCAL-PORT>: the port on your laptop (3306 for MySQL, 5432 for PostgreSQL)
<YOUR-RDS-ENDPOINT>: found in AWS Console > RDS > Your database > Connectivity & Security > Endpoint
<RDS-PORT>: same as local port (3306 for MySQL, 5432 for PostgreSQL)
<EC2-USERNAME>: usually ec2-user for Amazon Linux, ubuntu for Ubuntu
<YOUR-EC2-PUBLIC-DNS>: found in AWS Console > EC2 > Your instance > Public IPv4 DNS
This command lets your laptop or local machine talk directly to your remote database, as if the database were sitting on your own computer.
After running this command, you can open a database tool (like MySQL Workbench, DBeaver, or TablePlus) on your laptop and connect to:
Host: localhost
Port: 3306
For this tutorial, I’ll be using the community version of DBeaver. You can use other similar tools, but if you prefer to use the same tool for the purpose of this guide, you can install the community version from the official DBeaver download page.
After download and installation, open the DBeaver client and click the Connect to a database icon in the top-left corner of the app.
Select MySQL and click Next. On the next window, enter your database username and password, and set Server Host to 127.0.0.1.
Click Test Connection.
You should see a window appear on your screen, indicating that the connection is successful.
Click OK and Finish.
Now, on the left panel, you should see your connection. Expand it to see the database structure.
Now, you have successfully created SSH tunneling for your database.
While attempting to test the database connection, I initially ran into a “Plugin 'mysql_native_password' is not loaded” error. If you encounter this error, follow the steps below to fix it.
On the Connection Settings window, navigate to the Driver properties tab.
Look for allowPublicKeyRetrieval and set it to FALSE.
Navigate back to the Main tab and click Test Connection.
Everything should work fine now.
To get started, head over to the Spring Initializr website. Rename Artifact to “springboot-mysql-eks”. Then click ADD DEPENDENCIES… to add dependencies for the REST APIs. Search for the following dependencies:
Spring Web: Build web apps, including RESTful applications using Spring MVC. Uses Apache Tomcat as the default embedded container.
Spring Data JPA: Persist data in SQL stores with the Java Persistence API using Spring Data and Hibernate.
IBM DB2 Driver: A JDBC driver that provides access to IBM DB2.
Lombok: A Java annotation library that helps to reduce boilerplate code.
Next, click GENERATE at the bottom center of the page. This action downloads a zip file to your local machine. Open this file in an IDE, such as VSCode or IntelliJ IDEA. For this tutorial, I use VSCode. In the build.gradle file, you can see all the added dependencies:
dependencies {
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
implementation 'org.springframework.boot:spring-boot-starter-webmvc'
compileOnly 'org.projectlombok:lombok'
runtimeOnly 'com.ibm.db2:jcc'
annotationProcessor 'org.projectlombok:lombok'
testImplementation 'org.springframework.boot:spring-boot-starter-data-jpa-test'
testImplementation 'org.springframework.boot:spring-boot-starter-webmvc-test'
testCompileOnly 'org.projectlombok:lombok'
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
testAnnotationProcessor 'org.projectlombok:lombok'
}
The Spring Boot app is a currency exchange rate and conversion app:
We'll be inserting the exchange data into the database table.
To continue with this tutorial, you can clone the project repo here to save time.
In main > java > com.. > model > ExchangeRate, you’ll see the code below:
package com.example.springbootmysqleks.model;
import jakarta.persistence.*;
import lombok.Getter;
import lombok.Setter;
import java.sql.Date;
@Getter
@Setter
@Entity
@Table(name = "exchange-rate")
public class ExchangeRate {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Integer transactionId;
private String sourceCurrency;
private String targetCurrency;
private double amount;
private Date lastUpdated;
}
This class is essentially a blueprint for storing currency exchange rate data in our database. It uses the libraries and dependencies added earlier. Lombok handles all the repetitive getter/setter boilerplate so you don't have to write it yourself, while JPA annotations like @Entity and @Table tell Spring, "hey, this class maps to a database table called exchange-rate."
Inside the class, there are five fields that become database columns:
A self-incrementing transactionId as the primary key.
sourceCurrency and targetCurrency to track which currencies are being converted,
The amount holding the actual exchange rate
lastUpdated date, so you always know how fresh your data is.
To store the data, create a repository file in main > java > com.. > repository > ExchangeRateRepository:
package com.example.springbootmysqleks.repository;
import com.example.springbootmysqleks.model.ExchangeRate;
import org.springframework.data.jpa.repository.JpaRepository;
public interface ExchangeRateRepository extends JpaRepository<ExchangeRate, Integer> {
ExchangeRate findBySourceCurrencyAndTargetCurrency(String sourceCurrency, String targetCurrency);
}
This file acts as the middleman between your code and the database. By simply extending JpaRepository, you instantly get a whole suite of built-in database operations (like save, delete, findAll, and so on) completely for free, without writing a single SQL query.
The interface is typed to work with the ExchangeRate model we just looked at, using Integer as the primary key type.
The one custom method, findBySourceCurrencyAndTargetCurrency, is where Spring's magic really shines. Just by following a naming convention, Spring automatically figures out the SQL query it needs to run, so you can look up an exchange rate by simply passing in two currency codes like "USD" and "EUR" without writing any query logic yourself.
To use the findBySourceCurrencyAndTargetCurrency method, create a service file in main > java > com.. > service > ExchangeRateService with the code below:
package com.example.springbootmysqleks.service;
import com.example.springbootmysqleks.model.ExchangeRate;
import com.example.springbootmysqleks.repository.ExchangeRateRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@Service
public class ExchangeRateService {
@Autowired
private ExchangeRateRepository exchangeRateRepository;
public ExchangeRate addExchangeRate(ExchangeRate exchangeRate) {
return exchangeRateRepository.save(exchangeRate);
}
public double getAmount(String sourceCurrency, String targetCurrency) {
ExchangeRate exchangeRate = exchangeRateRepository.findBySourceCurrencyAndTargetCurrency(sourceCurrency, targetCurrency);
return exchangeRate == null ? 0 : exchangeRate.getAmount();
}
}
Here, we created a @Service class that interacts with the repository.
The class has two methods, the addExchangeRate, which simply takes an ExchangeRate object and saves it to the database, and getAmount, which takes a source and target currency, uses our custom repository method to look up the matching record, and then either returns the exchange rate amount or a safe default of 0 if no record is found.
That little ternary check (exchangeRate == null ? 0 : exchangeRate.getAmount()) ensures the app doesn't crash if you query a currency pair that doesn't exist in the database yet.
In main > java > com.. > controller > ExchangeRateService, we have the following code:
package com.example.springbootmysqleks.controller;
import com.example.springbootmysqleks.model.ExchangeRate;
import com.example.springbootmysqleks.service.ExchangeRateService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;
@RestController
public class ExchangeRateController {
@Autowired
ExchangeRateService exchangeRateService;
@GetMapping("/getAmount")
public double getAmount(@RequestParam String sourceCurrency, @RequestParam String targetCurrency) {
return exchangeRateService.getAmount(sourceCurrency, targetCurrency);
}
@PostMapping("/addExchangeRate")
public ExchangeRate addExchangeRate(@RequestBody ExchangeRate exchangeRate) {
return exchangeRateService.addExchangeRate(exchangeRate);
}
@GetMapping("/")
public String getHealth() {
return "up";
}
}
The @RestController annotation tells Spring this class will be serving up REST API endpoints, and again @Autowired wires in the service layer automatically.
There are three endpoints:
a GET request to /getAmount that accepts sourceCurrency and targetCurrency as query parameters and returns the exchange rate amount
a POST request to /addExchangeRate that accepts a full ExchangeRate object as a JSON body and saves it to the database
and finally a simple health check endpoint at / that just returns "up", which is a common pattern in cloud deployments to let load balancers and orchestration tools know the app is alive and running.
Now, it’s time to configure the application for the database. Navigate to src > main > resources > application.properties, and you should see this:
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
spring.datasource.url=jdbc:mysql://\({MYSQL_HOSTNAME}:\){MYSQL_PORT}/${MYSQL_DATABASE}?createDatabaseIfNotExist=true
spring.datasource.username=${MYSQL_USERNAME}
spring.datasource.password=${MYSQL_PASSWORD}
spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql: true
These are the configurations that allow your app to connect with the database.
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver: The driver class for the MySQL database.
spring.datasource.url=jdbc:mysql://\({MYSQL_HOSTNAME}:\){MYSQL_PORT}/${MYSQL_DATABASE}?createDatabaseIfNotExist=true: This is the data source URL in which we are using the MySQL hostname (127.0.0.1), port name, and database name.
spring.datasource.username=${MYSQL_USERNAME}: your database user name.
spring.datasource.password=${MYSQL_PASSWORD}: your database password.
One thing to note: the process of configuring environment variables with your actual credentials varies depending on the IDE you're using. If you're using IntelliJ IDEA, this process is pretty straightforward. If you're using VS Code, the process is different.
To configure your actual credentials for the env variables, create a .vscode/launch.json file in your project root folder and paste in the following configuration:
{
"version": "0.2.0",
"configurations": [
{
"type": "java",
"name": "Spring Boot App",
"request": "launch",
"mainClass": "com.example.springbootmysqleks.SpringbootMysqlEksApplication",
"projectName": "springboot-mysql-eks",
"env": {
"MYSQL_HOSTNAME": "localhost",
"MYSQL_PORT": "3306",
"MYSQL_DATABASE": "exchangedb",
"MYSQL_USERNAME": "root",
"MYSQL_PASSWORD": "CHANGE_ME"
}
}
]
}
Configure the credentials to use your actual credentials.
Now, when you run the app, you should be able to see the created exchangedb table in DBeaver:
Use an API testing tool like Postman to send a POST request to the database:
Next, run the select * from exchange_rate er script in the exchangedb SQL script editor:
At the bottom of the editor, you should see the created table from the Postman request.
Now, run a GET request to the endpoint below:
http://localhost:8080/getAmount?sourceCurrency=USD&targetCurrency=EUR&transactionId=1
You should get a 200 OK response with the currency exchange value, for example, 0.93.
To Dockerize your application, create a file named Dockerfile and paste in the configuration below:
FROM eclipse-temurin:17-jre-jammy
WORKDIR /app
COPY build/libs/springboot-mysql-eks.jar /app
EXPOSE 8080
CMD ["java", "-jar", "springboot-mysql-eks.jar"]
Our Dockerfile starts by pulling the lightweight eclipse-temurin:17-jre-jammy base image to keep things lean, then sets /app as the working directory inside the container. It copies our compiled Spring Boot JAR file from the local build/libs/ folder into that directory, exposes port 8080 for incoming traffic, and finally runs the app with java -jar when the container starts up.
Next, build the app to create the .jar file. To do that, run the command below:
./gradlew clean assemble
You should get a successful build output as shown below:
Navigate to build > the libs folder. You’ll see the springboot-mysql-eks file created.
If you run into an “operation couldn’t be completed.” error, try running the export commands to fix this issue. If you’re using a Mac, then run the command below:
brew install openjdk@21
Next, run the export commands:
export JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home
export PATH=\(JAVA_HOME/bin:\)PATH
Then run the ./gradlew clean assemble command again.
In this next step, we’ll create an Amazon ECR and push our image to the registry.
To get started, head back into your AWS Console and search for “ECR”. On the ECR page, click Create**.** Then, enter a repository name, for example, “springboot-mysql-eks.” Next, click Create.
Next, select the repo and click View push commands at the top of the page. This presents a window with a bunch of commands you can use to push your image to the registry. Open your terminal and run these commands. You'll need to ensure Docker is running on your local machine before running the commands.
After running the commands, you should see that your image has been successfully pushed to the registry.
Before getting started with this step, make sure you check out the installation steps and link to additional AWS documentation in the project README. This will help you follow along.
Now, to get started, create a new folder in your root directory named cluster . This is where you'll download the AWS IAM policy for the load balancer. To download the policy, go into your terminal and cd into cluster, then run the command below:
curl -O https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.14.1/docs/install/iam_policy.json
This command is gotten from the AWS documentation. Now, when you go to the folder, you’ll see an iam_policy.json file automatically generated.
Next, apply the IAM policy using the command below:
aws iam create-policy \
--policy-name AWSLoadBalancerControllerIAMPolicy \
--policy-document file://iam_policy.json
You should get an output like this in your terminal:
This shows that the IAM policy has been successfully created. To confirm this, head over to the IAM section in your console, navigate to Policies**,** and search for “AWSLoad…”. You should see the policy created there.
The next step is creating the Kubernetes service account. But before that, you need to tag your public and private subnets as described in this documentation.
Now, head over to the VPC dashboard, navigate to Subnets, click into a subnet, and navigate to Tags. Then, click Manage tags.
Click Add new tag, then enter the key/pair value in the documentation.
To create a Kubernetes cluster on EKS, you need the eksctl CLI. Follow the instructions in the AWS eksctl documentation to install the CLI. Next, you need a config file schema to create the cluster. To use this schema, create a new file called cluster.yaml in the cluster folder.
Next, paste in the following configurations:
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
name: spring-test-cluster
region: us-east-1
version: "1.30"
vpc:
id: "<your-vpc-id>"
subnets:
private:
us-east-1a:
id: "<your-private-subnet-1a-id>" # spring-demo-subnet-private1-us-east-1a
us-east-1b:
id: "<your-private-subnet-1b-id>" # spring-demo-subnet-private2-us-east-1b
public:
us-east-1a:
id: "<your-public-subnet-1a-id>" # spring-demo-subnet-public1-us-east-1a
us-east-1b:
id: "<your-public-subnet-1b-id>" # spring-demo-subnet-public2-us-east-1b
nodeGroups:
- name: ng-1
labels: { role: backend }
instanceType: t2.micro
desiredCapacity: 3
minSize: 3
maxSize: 5
privateNetworking: true
ssh:
allow: true
publicKeyName: <your-ec2-key-name>
iam:
withAddonPolicies:
imageBuilder: true
awsLoadBalancerController: true
autoScaler: true
iam:
withOIDC: true
serviceAccounts:
- metadata:
name: aws-load-balancer-controller
namespace: kube-system
attachPolicyARNs:
- arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:policy/AWSLoadBalancerControllerIAMPolicy
Th ClusterConfig file is used by eksctl to create our EKS cluster called spring-test-cluster in the us-east-1 region, running Kubernetes version 1.30. It plugs into our existing VPC, placing the worker nodes across private subnets in two availability zones us-east-1a and us-east-1b) for high availability, while keeping public subnets available for the load balancer.
The node group spins up t2.micro EC2 instances with a desired count of 3 (scaling up to 5 if needed), all with private networking enabled for security. It also sets up the necessary IAM permissions for the AWS Load Balancer Controller, Auto Scaler, and ECR image access so our cluster has everything it needs to manage traffic and pull our Docker images automatically.
Now, after updating your configuration with your credentials, run the command below:
eksctl create cluster -f cluster.yaml
This creates the cluster. You should see an output like this on your terminal:
Now, in your AWS console, navigate to CloudFormation, and you’ll see your cluster creation process in progress.
Now, when you go into the EC2 instance page, you should see the three nodes created.
The next step is installing a load balancer for our application. To get started, run the command below:
kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"
This installs custom resource definitions (CRDs) for our controller. Next, run the command below to add the Helm chart repo.
helm repo add eks https://aws.github.io/eks-charts
Update your local repo to ensure you have the most recent charts:
helm repo update eks
Next, install the Helm chart:
helm install aws-load-balancer-controller eks/aws-load-balancer-controller \
-n kube-system \
--set clusterName=my-cluster \
--set serviceAccount.create=false \
--set serviceAccount.name=aws-load-balancer-controller \
--version 1.14.0
Next, verify that the controller is installed:
kubectl get deployment -n kube-system aws-load-balancer-controller
You should see this on your terminal:
This indicates that your controller is ready.
To get started, you'll first need to create a Kubernetes manifest file. For that, we’ll use Helm Chart.
helm create ytchart
The command above creates a folder named ytchart with the templates for the components. In this folder, you need to make some configurations for your use case. First, navigate to ytchart > templates and delete the serviceaccount.yaml file, since we already created the service account earlier.
Next, go to values.yaml and make the following changes:
For repository, navigate to the ECR service page on the AWS Console and copy the image URI.
Tag is latest.
Set database name
mysql:
databaseName: exchangedb
Change service account creation to false.
Scroll down a bit more and change the service type to NodePort and port to 8080.
You also need to store the database username and password using secrets. Navigate to the templates folder and go into the file named secrets.yaml. Here, set your database username and password, then comment out the liveness and readiness probe in deployment.yaml.
Next, we’ll create a service to connect to the database. To do that, navigate to the mysql.yaml file, then for externalName. Navigate to the RDS service page on the AWS console and copy the database endpoint.
Now, in the deployment.yaml file, paste in the following configuration:
env:
- name: SPRING_DATASOURCE_URL
value: jdbc:mysql://spring-mysql:3306/{{ .Values.mysql.databaseName }}?createDatabaseIfNotExist=true&characterEncoding=UTF-8&useUnicode=true&useSSL=false&allowPublicKeyRetrieval=true
- name: SPRING_DATASOURCE_USERNAME
valueFrom:
secretKeyRef:
name: mysql-username
key: username
- name: SPRING_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef:
name: mysql-root-password
key: password
You have successfully created environment variables to secure your database credentials.
In the ingress.yaml file, paste in the following configuration:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: "spring-microservice-ingress"
annotations:
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/load-balancer-name: spring-alb-test
labels:
app: spring-microservice
spec:
ingressClassName: alb
rules:
- http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: {{ include "ytchart.fullname" . }}
port:
number: 8080
This is your configuration for the ingress service.
Run the command below to see all your configuration values:
helm template ytchart/
Next, run the command below to deploy the chart:
helm install mychart ytchart
You should see an output like this on your terminal:
Now, when you run kubectl get all, you should see this:
Now, navigate to EC2 > Load balancers, copy the DNS name, and enter it into a browser. You should see the “up” text. This indicates that your application is working properly.
Now, when you call the API using the DNS URL as such:
http://spring-alb-test-260424558.us-east-1.elb.amazonaws.com/addExchangeRate
You should get a 200 OK response. Congratulations, you have successfully deployed a SpringBoot app in Kubernetes!
If you’re familiar with AWS and the cloud, you should already be aware of how costly it can be to leave resources running for extended periods, especially when you’re not using them actively.
Now that we've come to the end of this tutorial, it’s time to delete the resources.
These are the resources to delete:
RDS database.
Cluster using the command eksctl delete cluster -f cluster.yaml.
Navigate to VPC and delete the NAT Gateway
Deploying a Spring Boot application with MySQL on Amazon EKS involves a lot of moving parts, but each step builds logically on the last.
In this tutorial, you've gone from setting up a VPC and provisioning a managed database to containerizing your app, pushing it to ECR, and finally orchestrating everything with Kubernetes and an Application Load Balancer.
What you get is a production-grade setup with high availability, private networking, secure credential management, and auto-scaling built in. This is the kind of infrastructure that would take significant manual effort to replicate without managed services like EKS and RDS.
As a next step, consider adding HTTPS support via AWS Certificate Manager, setting up horizontal pod autoscaling, or integrating a CI/CD pipeline to automate future deployments. And remember to clean up your AWS resources when you're done experimenting. Your wallet will thank you.
Una nueva tecnología permite desalinizar agua de mar utilizando únicamente energía solar térmica, sin aditivos y sin generar residuos de salmuera. El sistema, basado en un material metálico tratado con láser que aprovecha el "efecto anillo del café", logra una gran eficiencia y una recuperación de minerales cercana al 100%. En pruebas con agua real de los océanos Pacífico, Atlántico e Índico, alcanzó una evaporación de 1,76 kg/m²/h. En fase de laboratorio, podría transformar el acceso global al agua dulce.
etiquetas: desalinización, agua potable, energía solar, tratamiento de agua
» noticia original (www.youtube.com)
Google, Microsoft y otras gigantes tecnológicas de gran escala han sido objeto de escrutinio por su impacto en la calidad y disponibilidad del agua. El lunes, SpaceX modificó su oferta pública inicial para declarar que las condiciones hídricas, incluida la escasez de agua, las regulaciones en torno a la sequía, podrían limitar el desarrollo de centros de datos.
Críticos con esta versión denuncian que se trata de una peligrosa manipulación ideológica para blanquear una invasión militar que cambió radicalmente la cultura, la política y la religión del territorio. "Es como decir que la Segunda Guerra Mundial fue un malentendido entre amigos", ironiza un profesor de Historia que prefiere permanecer en el anonimato para evitar represalias académicas.
etiquetas: historia, corrupción
» noticia original (www.mediterraneodigital.com)
«Los directores generales son especialmente propensos a la psicosis de la IA», opina Aaron Levie, director general de Box. Quizá eso explique esa fe casi religiosa en las mejoras de productividad que aporta la IA.
etiquetas: psicosis por ia, ceos de tecnología, despidos, productividad
» noticia original (techcrunch.com)
Varias empresas y expertos anticipan la expansión de sistemas que ajustan los precios en tiempo real según la demanda, la ubicación o los hábitos de consumo del cliente
etiquetas: precios dinámicos, hostelería, precios personalizados, transparencia
» noticia original (cadenaser.com)
Tiene como objetivo sensibilizar a niños, jóvenes y profesionales de la educación acerca de las problemáticas actuales que están afectando al desarrollo y la salud mental infanto-juvenil. Si tú o alguien que conoces está pasando por un momento difícil, recuerda que hay ayuda disponible de forma gratuita y confidencial en España llamando a la Línea de atención a la conducta suicida (024) o al Teléfono de la Esperanza (717Â003 717)
etiquetas: ong
» noticia original (www.nosabeisquemepasa.org)
El Gobierno británico nacionaliza la principal empresa de trenes de cercanías del país, participada por la española Globalvia
etiquetas: nacionalización, reino unido, globalvia, renacionalización
» noticia original (www.publico.es)
España atraviesa uno de los mayores desafíos de su sistema de pensiones. El envejecimiento de la población, el aumento de la esperanza de vida y el creciente gasto destinado al pago de prestaciones han situado la sostenibilidad de las jubilaciones en el centro del debate económico.
etiquetas: pensiones, jubilación, flexible, envejecimiento, sostenibilidad, expertos
» noticia original (www.elespanol.com)
cross-posted from: https://news.abolish.capital/post/54312
51 nations armed Israel during the settler-colonial state’s genocide against Palestinians. Some states gave the regime hundreds of millions of dollars in arms. Others just a few hundred dollars worth of equipment. All bear the mark of shame.
Al Jazeera reported on 24 May:
military-related goods originating from at least 51 countries and self-governing territories continued entering Israel after the ICJ’s warning of a plausible risk of genocide in Gaza.
The outlet used Israel tax authority data, customs records and freedom of information requests from “between 2022 and 2025” to trace:
military supply chains linked to countries across Europe, Asia, North America and South America.
Al Jazeera said:
All named countries are signatories to the Genocide Convention.
In some cases, the military-related goods originated from countries that had formally imposed arms embargoes on Israel or had partially suspended arms supplies to the country.
A large part of the equipment was lethal:
In fact, according to the ITA data, arms imports increased after the ICJ ruling, with the largest share falling under the category of munitions.
The five biggest countries of origin all increased arms shipments during the period:
The United States, India, Romania, Taiwan and the Czech Republic – all recorded increased shipments during the war.
Legal experts and NGOs condemned the nations involved for contributing to the generational horrors of Gaza.
Israel — Ample evidence of war crimes
Stephen Humphreys is a professor of international law at the London School of Economics (LSE). He told Al Jazeera that even prior to the ICC ruling that a plausible genocide was underway there was:
ample evidence that countries arming Israel may be complicit in international crimes, including war crimes and crimes against humanity.
Gerhard Kemp is a professor of criminal law at the University of the West of England (UWE). He told Al Jazeera:
Some states have a very narrow understanding of the duty to prevent genocide and are waiting for a judicial determination that there is a genocide in Gaza.
But warned that the obligation was triggered by the risk of genocide – not the final findings of an international court:
The better view is to look at domestic legal obligations … and international legal obligations and legal tools triggered by available evidence.
Action on Armed Violence (AOAV) director Iain Overton, executive director of AOAV, said:
This investigation reinforces growing concerns about the continued transfer of explosive weapons and military components into a conflict where civilians have borne the overwhelming burden of harm.
He said AOAV’s research:
has consistently shown that the use of explosive weapons in populated areas causes catastrophic civilian suffering, destroys vital infrastructure and leaves lasting humanitarian consequences long after the fighting ends.
The scale of imports identified by Al Jazeera raises urgent questions about international obligations, transparency and accountability in global arms transfers.
The US sent more than £368mn of arms to Israel in the period concerned, the Al Jazeera report claims. While Japan’s contribution was just $161. ‘Anti-imperialist’ China provided $19mn worth of arms to the genocide state. The UK sent over $1.8mn. All of these countries bear a mark of shame which will never be erased. And all should be held accountable.
Featured image via Maja Hitij/Getty Images
By Joe Glenton
From Canary via This RSS Feed.
cross-posted from: https://news.abolish.capital/post/54341
By Alan MacLeod – Jun 2, 2026
Amid widespread and growing public opposition to the Israeli genocide of Gaza and South Lebanon, a controversial new bill seeks to formally integrate the U.S. and Israeli militaries like never before, making it difficult to tell where one ends and the other begins.
Section 224 of the 2027 National Defense Authorization Act (NDAA) proposes to join the two forces together at the hip, laying the groundwork for extensive cooperation into “seemingly every manner of U.S.-Israeli military-industrial complex cooperation,” according to the Institute for Responsible Statecraft.
This includes the research, development, and production of modern, hi-tech arms, artificial intelligence, biotechnology, drones, directed energy, cyber, and autonomous weapons systems. It would compel the United States to integrate Israeli arms and technologies into its defense supply chain, and fuse the countries’ data capturing and storage facilities together, meaning that Israel could have access to essentially all the U.S. military’s data.
The bill also requires the creation of a new position within the Department of Defense: an executive agent whose role is to coordinate cooperation and integration between the two parties.
In essence, then, it would dramatically change the relationship between the two states, from one where Washington supplies Tel Aviv with money, weapons, and diplomatic support, to a situation where the two are fundamentally intertwined.
It would also make the relationship far less transparent, as aid to Israel currently requires an annual public debate and vote. However, by moving it away from the political realm into that of defense acquisition, oversight and accountability mechanisms will be removed, and the public will have little right to know the details going forward.
Judging by its sponsors, Section 224 has strong support on Capitol Hill. It was put forward by Mike Rogers (R-AL), Chairman of the House Armed Services Committee, and Adam Smith (D-WA), the panel’s highest-ranking Democrat. It is surely, therefore, a formality that it will pass the House Armed Services Committee, before being taken to Congress and the Senate.
Analysts have noted that, if passed, the bill will “extraordinarily” expand Israeli influence in domestic American politics, giving Tel Aviv the opportunity to pull powerful political levers through the tried and tested method of offering jobs. As the Institute for Responsible Statecraft warn, by expanding or starting new arms production facilities like they already have in Mississippi and Arkansas, the Israeli government could use the influence of bringing jobs to districts to buy the support of American members of Congress.
The news that a new bill could essentially fuse together the U.S. and Israeli militaries has been met with pushback online, but provoked little comment in Washington, D.C. One lawmaker who has spoken up in Kentucky Congressman Thomas Massie. “If the provision in the NDAA to integrate/synchronize the U.S. and Israeli militaries (section 224) makes it out of committee, I’ll offer an amendment to strip it from the bill on the floor. We are a sovereign country,” he said on Saturday.
Massie, a strong critic of U.S. support for Israel, recently lost his primary to challenger Ed Gallrein, after AIPAC and other Israel Lobby groups flooded the race with tens of millions of dollars, making it the most expensive contest in American history.
The U.S. already provides Israel with enormous amounts of military aid, having sent hundreds of billions of dollars worth of weapons since 1948. Since 2008, it is required by law to protect Israel’s “qualitative military edge,” by supplying it with advanced weaponry. Section 224, however, would transform and deepen this relationship, making it all-but-impossible to democratically break the U.S.-Israel special relationship.
That alliance is under increased scrutiny, as support for Israel is collapsing across the United States.
A new poll published by Israel’s Institute for National Security Studies found that 60% of Americans (including 75% of respondents under 30 years old) hold a negative view of the country. When asked, a large plurality says that Israel holds too much sway over American politics and politicians.A 2025 study found that half of American voters believe Israel is carrying out a genocide against its neighbors in West Asia. The International Criminal Court has issued arrest warrants for Israeli prime minister Benjamin Netanyahu and former defense minister Yoav Gallant, among others, on charges of crimes against humanity.
The United States, however, has refused to accept the ICC’s actions, attempted to shut down proceedings, and imposed sanctions on the court. ICC prosecutor Karim Khan stated that Senior U.S. Senator Lindsey Graham – one of Netanyahu’s closest allies in Washington – told him that his court is only “for African thugs like [Russian president Vladimir] Putin. It is not for democracies like Israel and the United States of America.”
The response from the governments of Israel and the United States to the increasing opposition to the genocide has been to crack down on dissent and to censor social media. As Jonathan Greenblatt, CEO of pro-Israel pressure group, the Anti-Defamation League stated, “We really have a TikTok problem, a Gen Z problem.” The Trump administration forced through the sale of TikTok to the family of Larry Ellison, a passionately pro-Israel tech billionaire who is the largest private funder of the Israeli Defense Forces (IDF).
Ellison, no doubt, will support Section 224. Yet the effective merger between the U.S. military and the IDF will have profound consequences for the future of America, and should provoke stiff opposition nationwide. Whether it passes will depend largely on the nature and scale of that opposition.
From Orinoco Tribune via This RSS Feed.
Sin embargo, en lugar reincorporarse a la Escuela Judicial para ser jueza, Sofía Marchena es ahora fiscal, dado que el órgano de gobierno de los jueces, el Consejo General del Poder Judicial (CGPJ) en una decisión inexplicable, ha cambiado su nota (de 68,20 a 52,31) sin dar ninguna explicación y ha asignado a Marchena una plaza de fiscal creada sólo para ella y que se suma a las 35 plazas ya creadas.
etiquetas: sofía marchena, escuela judicial, reasignación de plaza
» noticia original (www.elplural.com)
