Kubernetes 1.36's Fine-Grained Kubelet Authorization Is GA — Here's Exactly What It Doesn't Fix
Kubernetes 1.36 splits kubelet API permissions out of the all-or-nothing nodes/proxy grant — but exec, attach, and portforward stay bundled together by design, so tenant kubectl exec access is exactly as risky as before.
The 20-40% Kubernetes Tax: What Small-Team Maintenance Data Actually Costs, and When Fleet Management Pays It Off
Small teams running their own Kubernetes lose 20-40% of an engineer's time to upgrades, cert rotation, and etcd backups — here's what that costs in dollars, and when Cluster API automation actually claws it back.
User Namespaces Are GA in Kubernetes 1.36: Exactly What It Buys You (and What It Doesn't) for Multi-Tenant and AI-Agent Nodes
Kubernetes 1.36 makes User Namespaces GA — a near-free identity remap that neutralizes four real container-escape CVEs, but stops short of the kernel-level isolation AI agents running untrusted code still need.
Kubernetes 1.36's Volume Group Snapshots Go GA: Can Your Self-Hosted Fleet Actually Use It?
Kubernetes 1.36 graduated VolumeGroupSnapshot to GA — a crash-consistent, multi-volume snapshot API. Here's the CSI driver support matrix that decides whether a Hetzner or Longhorn fleet can actually use it today, and the one path that works.
MCP Drops Sticky Sessions: What the July 28 Stateless Spec Actually Removes From Your Infrastructure
The MCP spec finalizing July 28, 2026 deletes the session ID and the handshake. Here's the actual infrastructure a production MCP server gets to delete with it — and the two things that don't get any simpler.
Metal3 Enters CNCF Incubation: What the Bare-Metal Provisioning Layer Actually Changes for a Cluster API Fleet Not Already Running It
Metal3 just became a CNCF incubating project, but the badge only matters to a Cluster API fleet the day its hardware stops living behind a single vendor's API. Here's the concrete Redfish/IPMI-vs-Hetzner-API line that decides when to adopt it.
MinIO's Community Edition Is Archived: Garage vs. SeaweedFS vs. RustFS Compared
MinIO's open-source Community Edition went from feature-frozen to fully archived over 18 months — a governance-first comparison of Garage, SeaweedFS, and RustFS, and which one is least likely to repeat the same bait-and-switch.
Mist Joins the 2026 Self-Hosted PaaS Wave as a Go-Minimalist Heroku Clone: What a Fresh Show HN Entrant Still Gets Right (and Skips) Versus a Cluster-API Platform
Mist launched on Show HN in July 2026 as a 20MB Go binary that deploys Docker apps from git push. What a brand-new entrant choosing the same single-box architecture as Dokploy and Kamal signals about the self-hosted PaaS bar in 2026, and exactly what it skips versus a Cluster-API-managed fleet.
The Kubernetes Backlash Is Right — Just Aimed at the Wrong Layer
The 2026 case against Kubernetes is right about YAML, Helm, and RBAC — but it never touches the fleet-management layer that keeps a multi-node platform running when a machine dies at 3 A.M. Here's what actually happens on Compose versus a Cluster API fleet.