Dora Noda
Software Engineer
2319 posts · View all authors
Cluster API v1.12: What Chained Upgrades Actually Save a Kubernetes Fleet That Fell Behind
Cluster API v1.12 adds in-place updates and chained upgrades — here's what collapsing three separate Kubernetes minor-version rollouts into one reconciliation pass actually saves a bare-metal Hetzner fleet that fell behind, and where the old drain-and-verify discipline still applies.
ClusterClass Turns Tenant Cluster #500 Into a One-Line Diff From Cluster #1
Cluster API's ClusterClass collapses seven hand-copied objects per tenant cluster into one shared template plus a handful of variable overrides — the concrete before/after, the patch mechanics, and what it still doesn't solve.
CNCF Buildpacks Graduation: What Reaching the Top Maturity Tier Actually Changes
Cloud Native Buildpacks reached CNCF's Graduated maturity level on July 17, 2026. Here's what the governance milestone actually verifies, what it doesn't change technically, and why it matters for a platform team betting its build layer on the spec.
CNCF's Composable-by-Design Rule: What It Actually Costs to Build a Swappable PaaS
CNCF says platforms should be built from swappable, API-first building blocks. Here's what that actually costs on day one versus a hardcoded platform, worked through two real architecture cases — one of them a GPU request a Cluster API-based PaaS wasn't built to handle.
Coinbase's Rollback Tool Broke Along With the Deploy It Was Supposed to Fix
A 50-minute Coinbase outage on July 14, 2026 got worse because the tool engineers needed to roll back the bad deploy was itself unreachable through the gateway the deploy had just broken. Here's the mechanism, and a concrete audit for whether a self-hosted PaaS's own control plane could hit the same trap.
Confidential Containers Reaches CNCF Incubation: What TEE-Attested Secrets Release Actually Costs a Self-Hosted PaaS
Confidential Containers just reached CNCF incubation, promising tenant code even the platform operator can't read. Here's what the TEE hardware, the Trustee attestation service, and the per-pod overhead actually cost to run on a self-hosted Hetzner fleet.
GitHub Copilot's Coding Agent Now Runs on Self-Hosted Runners — But You Have to Turn Off Its Firewall to Get There
GitHub's coding agent can now run on your own Actions Runner Controller fleet to reach internal registries and on-prem services — but doing so requires disabling its managed firewall entirely. Here's what changes, and the three ARC misconfigurations that leave the gap unguarded.
The Docker Desktop License Threshold Nobody Rechecks: What 250 Employees or $10M Revenue Actually Costs a Team
Docker Desktop stops being free the moment a company crosses 250 employees or $10M in revenue — whichever it hits first. For a 30-developer team, that's $5,400 to $8,640 a year, plus a three-year audit lookback most finance teams never see coming.
DockLog Ships One Image for Docker and Kubernetes Logs: What It Buys a Cluster API Fleet Over kubectl logs -f
DockLog puts Docker and Kubernetes log tailing behind one container and one RUNTIME_MODE toggle — here's exactly what that buys an operator over kubectl logs -f loops, where its single-cluster scope stops short of a real fleet, and when a growing fleet actually needs Loki instead.