Dora Noda
Software Engineer
2331 posts · View all authors
kubectl for AI Agents: What Klaw.sh Reveals About the Layer Between CrewAI and Kubernetes
Klaw.sh borrowed kubectl's verbs for AI agent fleets instead of pods. Here's what layer that actually is, and a concrete verdict on whether a PaaS control plane that already runs Cluster API should absorb it or leave it alone.
Kubernetes 1.36 Splits nodes/proxy Into Nine Permissions — But Exec Still Needs the Keys to Every Container
Kubernetes 1.36 finally splits the kubelet's one catch-all nodes/proxy permission into nine narrower ones — but exec, attach, portforward, and run stay exactly as broad as before. Here's the before/after RBAC migration checklist for a multi-tenant self-hosted PaaS.
Kubernetes 1.36's Mixed Version Proxy Beta: What It Fixes for maxSurge:0 Fleets
Kubernetes 1.36 graduates Mixed Version Proxy to Beta, closing the 404-on-your-own-CRD gap during rolling control-plane upgrades. Here's what changes for a maxSurge:0 fleet on bare metal, and the peer-auth flags you still have to configure yourself.
Kubernetes 1.36's PSI Metrics Go GA (Memory QoS Tiering Stays Alpha): What It Takes to Bin-Pack a Fixed Fleet
Kubernetes 1.36 makes kubelet PSI pressure metrics GA but leaves Memory QoS tiering in Alpha — here's exactly what wiring real per-node stall data into scheduler placement takes when your fleet is four owned boxes, not an autoscaler.
Your MCP Traffic and Your Tenants' LLM Calls Just Got a Real Kubernetes Primitive
Kubernetes' new AI Gateway Working Group is formalizing token-based rate limiting, model-aware routing, and provider failover as Gateway API primitives. Here's what's already GA, what's still a proposal, and what it means for a platform routing both tenant and agent MCP traffic through one ingress layer.
Kubernetes' Pod Checkpoint/Restore Is Headed for Alpha in v1.37 — What That Means for Preview Environments Right Now
Kubernetes' new Checkpoint/Restore Working Group has pod-level restore alpha-targeted for v1.37 — but the CRIU mechanism already runs in production via a third-party shim. Here's what's actually shipped, what's still missing, and the real blockers for preview-environment resume.
Kubernetes Has Scheduled GPUs as Integers Since 2017 — What KAI Scheduler and Grove Actually Change for a Fleet Without Multi-GPU Nodes
Kubernetes has scheduled GPUs as opaque integers since 2017 — here's what KAI Scheduler and Grove's fragmentation-aware bin-packing actually fix, and why the classic multi-GPU fragmentation story doesn't apply to a fleet built on single-GPU Hetzner nodes.
CVE-2026-33814: A Single Zero in One HTTP/2 Field Can Hang Every Go Client in Your Kubernetes Fleet
A malformed SETTINGS_MAX_FRAME_SIZE value can hang any unpatched Go HTTP/2 client forever — and in Kubernetes, that's the apiserver, the kubelet, and every Cluster API provider controller. Here's the mechanism, the exposed-component map, and the govulncheck commands to audit your own fleet.
Kubernetes 1.35 Takes In-Place Pod Resize to GA: What the Restart-Based Workaround It Just Killed Was Actually Costing You
In-place pod resize reached GA in Kubernetes 1.35. Here's the before/after: what evicting and rescheduling a pod to change its CPU/memory actually cost versus a resize subresource PATCH that completes in seconds — and what a Cluster-API-managed PaaS's own autoscaling logic should do differently now.