External Secrets Operator: The Reference Architecture for Hybrid Secrets Management
TL;DR Secrets (API keys, database passwords) do not belong in Git code, but their runtime …

The excitement around Large Language Models (LLMs) and generative AI has brought a fundamental question back to IT departments: How do we scale Machine Learning (ML) workloads without creating parallel shadow IT?
Kubernetes has established itself as a foundation, but the choice of framework determines whether your data scientists work efficiently or get bogged down in infrastructure details. Kubeflow and Ray are two heavyweights with fundamentally different philosophies.
Kubeflow aims to provide a complete end-to-end MLOps platform based on Kubernetes. It is less of a single tool and more of a loosely coupled collection of components (Pipelines, Training Operator, Katib for hyperparameter tuning, KServe).
Ray takes a different approach. It was not designed as an MLOps platform but as a universal framework for distributing Python code. While Kubeflow thinks in “containers,” Ray thinks in “tasks” and “actors.”
| Feature | Kubeflow | Ray |
|---|---|---|
| Primary Abstraction | Kubernetes Pods / Containers | Python Tasks / Actors |
| Focus | Governance & Lifecycle | Performance & Scalability |
| Learning Curve | Steep (K8s knowledge required) | Flat (Python-focused) |
| Scheduling | K8s Scheduler (more static) | Own Low-Latency Scheduler |
| Serving | KServe (tightly integrated) | Ray Serve (very flexible) |
A common mistake in mid-sized companies is forcing data scientists to become Kubernetes experts. If an ML expert has to write YAML manifests to train a model, productivity drops drastically.
The Path to “Production-Ready” Infrastructure: A modern ML infrastructure should use Kubernetes as “Invisible Infrastructure.” This means:
It’s not an either-or situation. In fact, we increasingly see hybrid architectures: Kubeflow is used for orchestrating the entire pipeline and governance, while within the pipeline steps, Ray is used for high-performance, distributed training.
For mid-sized companies, start with the lowest possible complexity level. Often, a well-configured Ray cluster on Kubernetes is the faster path to the first productive AI model than installing the complete Kubeflow stack.
Can I run Ray and Kubeflow simultaneously in the same cluster? Yes. Thanks to namespace isolation in Kubernetes, both systems can coexist. There are even specific integrations to start Ray jobs directly from Kubeflow pipelines.
How do I manage the costs for GPU nodes? Use the Cluster Autoscaler in conjunction with Taints and Tolerations. GPU nodes should only spin up when a corresponding job is in the queue and terminate immediately after completion.
Do we need a service mesh like Istio for MLOps? Kubeflow often relies on Istio for ingress and security. However, if you only use Ray, a service mesh is usually an unnecessary complexity overhead unless you have very specific requirements for zero-trust communication between worker nodes.
Are you facing the decision for an ML stack? Building a stable AI pipeline is a marathon. At ayedo, we help you choose the right architecture that frees your data scientists instead of burdening them with infrastructure problems.
TL;DR Secrets (API keys, database passwords) do not belong in Git code, but their runtime …
Until now, monitoring was often a compromise: Those who wanted to know exactly what was happening …
The classic Horizontal Pod Autoscaler (HPA) of Kubernetes is like a thermostat: When the room gets …