Dora Noda
Software Engineer
2331 posts · View all authors
Ingress2Gateway 1.0 vs. a Real Ingress-NGINX Annotation Set: What Actually Translates
We ran Ingress2Gateway 1.0 against a realistic ingress-nginx annotation set from a Cluster-API-managed fleet: four annotations translated cleanly, four landed on non-portable extension CRDs, and two had no Gateway API equivalent at all.
Kaniko Is Dead: Google Quietly Archived It in June 2025 — What Rootless BuildKit Means for a Git-Push PaaS's Image-Build Path
Google archived Kaniko in June 2025 with no successor named. Here's why rootless BuildKit is the closest maintained replacement for daemonless, unprivileged Kubernetes image builds — and the caching, security, and kernel details a git-push PaaS has to re-verify before migrating.
KEDA's Scale-to-Zero: What It Actually Buys a Self-Hosted PaaS Billing Tenants for Idle Containers
A dormant tenant app held at a minimum of one replica costs real money — on Railway's metered pricing, about $30/month for a 1 vCPU/1GB container that serves zero requests. Here's what wiring KEDA's true scale-to-zero into a Cluster API fleet actually changes, in dollars and in cold-start seconds.
Kelos Turns Autonomous Coding Agents Into Kubernetes CRDs
Kelos turns an AI coding agent's entire working context into four Kubernetes CRDs you can kubectl get and git-revert. Here's what each primitive actually does, and the concrete case for treating it as a reference architecture rather than a dependency.
Kubernetes 1.36's Declarative Validation Went GA — But Not for the CRDs Your Agent Actually Writes To
Kubernetes 1.36 graduated Declarative Validation to GA — for built-in types only. The CEL rules that actually govern your CRDs have been GA since 1.29. Here's the real timeline, a worked example from Cluster API's own CRDs, and what it means for an agent generating manifests.
OCI VolumeSource Goes Stable in Kubernetes 1.36: Do You Still Need to Bake Large Assets Into Your App Image?
Kubernetes 1.36 made OCI VolumeSource stable, letting a Pod mount any OCI image as a read-only volume. Here's the honest before/after against a well-cached Dockerfile, a worked build-pipeline split, and what a self-hosted platform must verify before offering it to tenants.
Kubernetes Quietly Corrected Three 'Fixed' CVEs That Were Never Patched — What That Means for Your Cluster's Threat Model
Kubernetes just admitted three CVE records carried a fake 'fixed' field for years — a concrete look at what the correction reveals about trusting scanner output, and the version-pinned scanning check a Cluster-API fleet needs instead.
Kubernetes Swap Went Stable in 1.34: What LimitedSwap Actually Buys a Self-Hosted PaaS on NVMe
Kubernetes' node swap support graduated to stable in 1.34. A walkthrough of what LimitedSwap actually protects against, what it doesn't, and the concrete tenant-density math it unlocks on a Hetzner NVMe node that a fixed-instance managed PaaS can't touch.
OpenTelemetry Graduates CNCF in May 2026: Why Self-Hosted Collectors Beat Egress-Metered Observability SaaS
OpenTelemetry's May 2026 CNCF graduation locked in OTLP as the universal interchange format, and the cost gap it exposed between egress-metered SaaS and self-hosted collectors runs 38x to 166x depending on scale — with worked numbers to prove it.