The Tailscale Kubernetes Operator Exposes kube-apiserver Without Touching the Public Internet
84% of internet-observable Kubernetes API servers answer to the public internet. The Tailscale operator's API server proxy replaces the IP allowlist with identity-authenticated tailnet access — here is what changes for a self-hosted fleet, what it costs, and what Headscale users shouldn't assume.
Cluster API v1.12's In-Place Updates and Chained Upgrades: What Changes for a Platform Team Running CAPH/CAPD in Production
Cluster API v1.12 shipped in-place updates and chained upgrades. For a 3-control-plane, 20-worker Hetzner fleet jumping three Kubernetes minors, that turns 29 replace-and-drain cycles under best pre-v1.12 practice into as few as zero — and three hand-sequenced hops into one declared version. The before/after runbook, with the CAPD rehearsal loop.
Flagger vs Argo Rollouts in 2026: Which Progressive-Delivery Operator Should Power a Git-Push PaaS's Canary Rollouts?
Flagger and Argo Rollouts shipped releases three days apart in July 2026, but they make opposite bets: wrap the Deployment or replace it, headless reconciler or human dashboard. A build-vs-choose comparison of each operator's stack assumptions, with a concrete verdict for a git-push PaaS on a Cluster API fleet.
ArgoCD 3.3 vs Flux 2.0 in 2026: Which GitOps Reconciler Fits a Cluster-API-Managed Fleet's Own Deploy Pipeline
Argo CD has 2.8x Flux's GitHub stars, but a self-hosted PaaS on Cluster API needs a reconciler shape, not a deploy dashboard. A four-axis head-to-head — tenancy, fleet rollout, footprint, security — with a concrete verdict for platform builders.
Blue-Green Deploys on Cluster API: Flipping a Tenant's Traffic Between Two MachineDeployments Without Touching the Load Balancer
A rolling MachineDeployment update isn't blue-green. Here's the actual Cluster API primitive for an atomic, instantly-reversible traffic cutover — two MachineDeployments, one Service selector flip, and the in-flight-request handling most implementations skip.
Buildpacks vs Dockerfiles for a Git-Push PaaS: The Real Build-Time, Image-Size, and Leaked-Detail Numbers
Buildpacks promise 'no Dockerfile needed,' Dockerfiles promise full control. A real, sourced comparison of build time, image size, and how much implementation detail each one pushes back onto the developer.
Cloudflare D1's Per-Row Meter Turned 765,000 Rows Into a $134 Bill: What a 10GB-Per-Database Cap Costs a Bundled PaaS Database
A published $134 Cloudflare D1 bill — 95% of it a single line item of 127 billion metered row reads from a missing index — is a concrete look at what per-row database billing and a 10GB-per-database cap actually cost, against a self-hosted SQLite-plus-Litestream setup where a bad query is a latency problem, not an invoice line.
Show HN's Cygnus: What a Serverless-Runtime Framing Actually Changes (and What It Doesn't) Versus a Container-Per-App PaaS
Cygnus revives an idle app from zero in about 30 milliseconds using kernel-sandboxed 'cages' instead of containers. Here's exactly what that architecture buys over Coolify and Dokploy's always-on containers — and why it still hits the same one-box ceiling the rest of the category has.
Kubernetes 1.36's Declarative Validation Goes GA: Which Webhook a Self-Hosted Cluster API Fleet Can Actually Delete — and Which One It Can't
Kubernetes 1.36's Declarative Validation only touches built-in types, not CRDs — the webhook a Cluster API fleet can actually delete graduated two releases earlier under ValidatingAdmissionPolicy. Here's the exact boundary between the three mechanisms, and the stateful checks none of them can replace.