Why bex Skips the Crossplane-Style Multi-Cloud Abstraction Layer
Crossplane just graduated CNCF's top maturity tier promising one API across every cloud. Here's why bex, a Cluster API-based platform, deliberately skips that abstraction to keep every workload traceable to one physical machine.
Kaniko Is Archived: What Actually Changes When a Buildpacks Pipeline Switches to Buildah
Google archived Kaniko in June 2025 and its Chainguard fork is maintenance-only. Here's exactly what changes in a Kubernetes build pod's spec, caching architecture, and registry auth when a buildpacks-based PaaS switches its Dockerfile-fallback builder to Buildah — and the one dependency on Kaniko you can't migrate away from.
Your Tenants' 'edit' Role Could Steal Another Tenant's DNS Credentials: The cert-manager Challenge Bug and the RBAC Audit to Run Today
A cert-manager bug let any tenant with Kubernetes' built-in edit or admin role steal another tenant's DNS credentials through a crafted ACME Challenge — not from a misconfiguration, but from an RBAC aggregation label almost no one audits. Here's the mechanism and a six-check audit to run against your own multi-tenant TLS setup.
cgroup v1 Is About to Break Your Kubernetes Nodes: A Migration Checklist Before August 26, 2026
Kubernetes v1.37 makes kubelet refuse to boot on cgroup v1 nodes by default. Here's the exact command to check your fleet, what changes in tenant CPU/memory enforcement, and a migration checklist before the August 26, 2026 deadline.
Cilium's Sidecarless mTLS Kills the Service-Mesh Tax — But Not the Way You'd Assume
Real numbers on what a sidecar mesh actually costs, how Cilium's eBPF mTLS removes it, and the eventually-consistent identity cache that a documented security review found exploitable — plus what a multi-tenant self-hosted PaaS should actually run.
Cloudflare Containers Went GA on 128MB-Workers Money: What Per-10ms Billing Actually Costs a Real Backend
Cloudflare Containers left beta on April 13, 2026 billing every 10ms of active CPU on top of the $5/mo Workers Paid plan. A worked recompute: what a persistent backend actually costs on that meter versus a flat €5.49/mo owned Hetzner box — and the bursty workload where Containers wins outright.
Cloudflare R2 Was Down for 17 Hours in July 2026 — Here's What 'Zero Egress' Actually Costs When It Breaks
Cloudflare R2 returned 500 errors across three separate incidents in July 2026, blowing past its own 99.9% SLA by roughly 30x in one month. Here's the SLA math, a worked cost comparison against Hetzner-owned object storage, and the exact egress volume where R2's free-egress pricing actually starts winning.
Cloudflare Tunnel Is Now Fully Free — What Zero-Open-Ports Ingress Means for Your Self-Hosted PaaS
Cloudflare Tunnel is now free with unmetered bandwidth and unlimited tunnels — but an October 5, 2026 API change breaks anything scripted against its old routes. Here's what it buys a self-hosted PaaS's tenants, what it costs, and the migration checklist.
CloudNativePG's First CVE Is a 9.4: How Scraping Metrics Handed Out Postgres Superuser
CloudNativePG's first-ever CVE let a low-privileged database user escalate to PostgreSQL superuser and OS command execution through the default metrics exporter — the exploit chain, the fix, and the unrelated failover bug that shipped in the same release.