Kubernetes' New Node Readiness Controller Closes the 'Pod Scheduled Before the Node Actually Works' Gap
None of CCM, CNI, or CSI natively report a Node Condition NRR can gate on — a worked example wires three NodeReadinessRule manifests into a Hetzner bare-metal bootstrap sequence anyway, and shows why managed EKS/GKE node pools never surface this bug in the first place.
Kamal 2.0's kamal-proxy: How Thin Can a Production PaaS Get Before It Needs Kubernetes?
Kamal 2.0's kamal-proxy runs HEY and Basecamp on nothing but Docker and a YAML file. Here's exactly what's in that box, where its five structural gaps are, and which Cluster API mechanism closes each one.
Kargo Puts Terraform and Kubernetes Behind One Freight Promotion — Does a Self-Hosted PaaS Actually Need That?
Kargo's 2026 Terraform/OpenTofu support bundles infra and app changes into one gated GitOps promotion. Here's a concrete three-question test for whether a Cluster API-managed PaaS actually needs that pattern, run against four real deploy scenarios.
Kubernetes 1.36's Mixed Version Proxy Beta: What It Fixes for maxSurge:0 Fleets
Kubernetes 1.36 graduates Mixed Version Proxy to Beta, closing the 404-on-your-own-CRD gap during rolling control-plane upgrades. Here's what changes for a maxSurge:0 fleet on bare metal, and the peer-auth flags you still have to configure yourself.
Kubernetes 1.36's PSI Metrics Go GA (Memory QoS Tiering Stays Alpha): What It Takes to Bin-Pack a Fixed Fleet
Kubernetes 1.36 makes kubelet PSI pressure metrics GA but leaves Memory QoS tiering in Alpha — here's exactly what wiring real per-node stall data into scheduler placement takes when your fleet is four owned boxes, not an autoscaler.
Kubernetes Has Scheduled GPUs as Integers Since 2017 — What KAI Scheduler and Grove Actually Change for a Fleet Without Multi-GPU Nodes
Kubernetes has scheduled GPUs as opaque integers since 2017 — here's what KAI Scheduler and Grove's fragmentation-aware bin-packing actually fix, and why the classic multi-GPU fragmentation story doesn't apply to a fleet built on single-GPU Hetzner nodes.
CVE-2026-33814: A Single Zero in One HTTP/2 Field Can Hang Every Go Client in Your Kubernetes Fleet
A malformed SETTINGS_MAX_FRAME_SIZE value can hang any unpatched Go HTTP/2 client forever — and in Kubernetes, that's the apiserver, the kubelet, and every Cluster API provider controller. Here's the mechanism, the exposed-component map, and the govulncheck commands to audit your own fleet.
Kubernetes 1.35 Takes In-Place Pod Resize to GA: What the Restart-Based Workaround It Just Killed Was Actually Costing You
In-place pod resize reached GA in Kubernetes 1.35. Here's the before/after: what evicting and rescheduling a pod to change its CPU/memory actually cost versus a resize subresource PATCH that completes in seconds — and what a Cluster-API-managed PaaS's own autoscaling logic should do differently now.
Let's Encrypt's 2.5-Hour Outage Broke Live Renewals: A Real Fallback-CA Design for Self-Hosted ACME
Let's Encrypt's May 2026 outage lasted 2.5 hours and still broke live renewals. The renewal-buffer math showing why short-lived certificates make it worse, and a concrete two-issuer failover design for self-hosted ACME automation.