Notes for Deploying ScyllaDB to Kubernetes Cluster

If you’ve ever tried — or are currently trying — to deploy ScyllaDB to a Kubernetes cluster, chances are you’re banging your head against the wall. A few simple things to note when deploying a production-grade Scylla cluster with Kubernetes:

ScyllaDB is traditionally meant to be deployed with Kubernetes, not on it.
For a fully optimal cluster you need at least three nodes spread across different zones, each with a minimum of 8 GB RAM and 4 vCPU.
If you’re running a self-deployed cluster that isn’t set up idiomatically, you might encounter issues — particularly with DNS resolution via CoreDNS.
ScyllaDB relies heavily on CRDs and a number of supporting components, so a misconfigured cluster will surface issues quickly.

This isn’t an article about how to deploy ScyllaDB on Kubernetes from scratch — it walks you through the process and calls out a few things along the way that aren’t intuitive or noted in the official steps.

To deploy ScyllaDB and its operator on a Kubernetes cluster, see Install ScyllaDB Operator.

Be careful with NodeConfig on shared clusters

If you’re running ScyllaDB in a shared cluster with tight resources, be very careful when setting up NodeConfig — it can break other apps running in your cluster. If that’s your situation, you don’t need to configure one.

Running ScyllaDB with constrained resources

One issue you’ll often hit when testing ScyllaDB on Kubernetes is tight resource constraints causing pods not to fully start, because the nodes aren’t tuned to let the database perform at maximum efficiency.

Fortunately, there’s a parameter you can apply that makes ScyllaDB ignore those errors and run in a limited setup. Apply this to the spec:

spec:
    developerMode: true

Working around cert-manager webhook issues

Another thing to note in a traditional cluster setup is that the Kubernetes API server may be unable to reach cert-manager because it has no idea how to resolve its DNS — or even reach it. Even if you tweak the webhook config to manually resolve the DNS, you’ll still hit certificate verification errors.

I wouldn’t recommend this for production, but one option for getting past the issue is to run:

kubectl delete validatingwebhookconfiguration cert-manager-webhook
kubectl delete mutatingwebhookconfiguration cert-manager-webhook

Pick a cloud-native CSI driver

Depending on which cloud platform you’re deploying to, I recommend using the cloud provider’s CSI driver over the local-csi-driver.

Quick-start manifests

If you’ve already set up the Scylla operator and manager on your cluster and just need a quick bootstrap, these manifests will get you going.

StorageClass

apiVersion: storage.k8s.io/v1
  kind: StorageClass
  metadata:
    name: scylladb-ebs-storage
    labels:
      app: scylladb
  provisioner: ebs.csi.aws.com
  parameters:
    type: gp3
    fsType: xfs
    iopsPerGB: "50"
  volumeBindingMode: WaitForFirstConsumer
  allowVolumeExpansion: true

ConfigMap

apiVersion: v1
  kind: ConfigMap
  metadata:
    name: scylladb-config
    namespace: wraithbytes
  data:
    scylla.yaml: |
      authenticator: PasswordAuthenticator
      authorizer: CassandraAuthorizer

ScyllaCluster

apiVersion: scylla.scylladb.com/v1
  kind: ScyllaCluster
  metadata:
    name: scylladb
    namespace: wraithbytes
  spec:
    repository: docker.io/scylladb/scylla
    version: 2025.3.3
    agentVersion: 3.7.0
    developerMode: true
    automaticOrphanedNodeCleanup: true
    datacenter:
      name: us-east-1
      racks:
        - name: us-east-1a
          members: 1
          scyllaConfig: scylladb-config
          storage:
            capacity: 4Gi
            storageClassName: scylladb-ebs-storage
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 200m
              memory: 256Mi
          placement:
            nodeAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                nodeSelectorTerms:
                  - matchExpressions:
                      - key: topology.kubernetes.io/zone
                        operator: In
                        values:
                          - us-east-1a
                      - key: scylla.scylladb.com/node-type
                        operator: In
                        values:
                          - scylla
        - name: us-east-1b
          members: 1
          scyllaConfig: scylladb-config
          storage:
            capacity: 4Gi
            storageClassName: scylladb-ebs-storage
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 200m
              memory: 256Mi
          placement:
            nodeAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                nodeSelectorTerms:
                  - matchExpressions:
                      - key: topology.kubernetes.io/zone
                        operator: In
                        values:
                          - us-east-1b
                      - key: scylla.scylladb.com/node-type
                        operator: In
                        values:
                          - scylla