Dora Noda
Software Engineer
2328 posts · View all authors
PowerDNS Operator: The Last Layer a Self-Hosted PaaS Still Outsources
PowerDNS Operator turns DNS zones and records into Kubernetes Custom Resources so tenants can self-serve custom domains via RBAC instead of a shared API credential — here's the CRD model, the win over external-dns, and the anycast tradeoff it doesn't solve.
Your Namespace-Scoped Sealed Secret Wasn't: What CVE-2026-22728's Rotation Bug Actually Broke
A rotation-endpoint bug in Bitnami's Sealed Secrets let attacker-controlled annotations turn a namespace-scoped secret cluster-wide — without touching Kubernetes RBAC at all. Here's the attack, and the NetworkPolicy audit every shared cluster needs to run.
How SNCF Cut Kubernetes Cluster Provisioning From 30 Days to 30 Minutes With Cluster API
SNCF rebuilt its on-prem Kubernetes fleet around Cluster API, cutting cluster provisioning from 30 days to 30 minutes and reconciling every cluster monthly with zero drift — a real-world case for owning the machines under a self-hosted platform.
Tekton Joins the CNCF: What Building a Git-Push PaaS's Pipeline Directly on Kubernetes CRDs Actually Buys You
Tekton became a CNCF incubating project on March 24, 2026. Here's what building a self-hosted PaaS's build pipeline directly on its Task and Pipeline CRDs actually gets you architecturally — and where the platform still has to fill in the gaps.
Gateway API v1.6 Graduates UDPRoute to GA: What It Actually Takes to Route Non-HTTP Traffic on a Self-Hosted PaaS
Gateway API v1.6 made UDPRoute GA, but controller support is uneven, there's an upgrade-order trap that drops traffic, and UDPRoute still can't multiplex tenants on one port the way HTTPRoute does. Here's what actually changes, with a working example.
Pinterest Ran 66,000 MCP Tool Calls a Month — Here's the Gate Your Deploy Agent Needs
Pinterest's production MCP fleet handled 66,000 tool calls a month across 844 users. Here's the registry-and-gate architecture behind those numbers, and the concrete rate-limit and audit-retention policy a deploy-from-chat PaaS should ship on day one.
Your Deploy Agent's MCP Server Is a Trust Boundary — Here's the Threat Model
A malicious MCP server already backdoored a mail pipeline in the wild. Here's the threat model for what happens when the same protocol holds your deploy and rollback credentials — and the scoping, gating, and logging practices that actually bound the damage.
Fly.io's 'Global Edge' Has a 6x Egress Cliff — and Flat Hetzner Pricing Wins the Workload It's Marketed For
Fly.io bills egress at 6x more to Africa and India than to North America and Europe — exactly the traffic its 'deploy close to your users' pitch is supposed to serve. Here's the worked cost comparison against Hetzner's flat, destination-blind bandwidth.
Kubelet Config Drop-in Directories Just Went GA: What Kubernetes 1.35 Actually Buys a Cluster API Fleet
Kubernetes 1.35 took kubelet's --config-dir flag to GA, letting drop-in KubeletConfiguration snippets replace one monolithic file. Here's the exact Cluster API YAML that uses it, and the node drift it still doesn't fix.