ExternalDNS: The Controller That Turns Every Ingress Into a DNS Record (and What Breaks at Fleet Scale)
ExternalDNS watches Kubernetes Service, Ingress, and Gateway API objects and syncs DNS records to your provider automatically. A concrete walkthrough of the reconciliation loop, TXT ownership registry, rate-limit wiring, and fleet-scale pitfalls — and why you shouldn't hand-roll this.
Cloudflare OS Is Open Source — But Only Runs on Cloudflare: What That Means Compared to Apache-2.0 on Your Own Machines
Cloudflare OS open-sourced an agent workspace on August 5 that only deploys into a Cloudflare account — zero-access agents, Gatekeeper Workers, and Dynamic Workers with per-app SQLite. What that flavor of open actually controls next to an Apache-2.0 PaaS on machines you own.
Cluster API Stops Serving v1beta1 in v1.16: The Seven-Row Migration Audit Every CAPI Platform Owes Itself Before April 2027
Cluster API's v1beta1 API stops being served in v1.16, April 2027 — and CAPD's Docker resources are removed a release earlier. Here's the seven-place audit, what clusterctl convert does and doesn't cover, and how to sequence the upgrade as management-cluster Kubernetes support narrows to v1.33-v1.36.
KEDA v2.20's One-Line RBAC Change Silenced Your Autoscaler's Events for 60 Days
KEDA v2.20 swapped the operator's events RBAC from the core API group to events.k8s.io and dropped the old one — so every KEDA event was forbidden on the default install for 60 days. The exact rule to grant, who actually has to act, and the pre-upgrade checklist for a fleet whose scale-from-zero runs through one controller.
Talos v1.14 Puts a BGP Speaker Inside the OS: What It Actually Deletes (Not MetalLB), and Who Can Actually Use It (Not Hetzner)
Talos v1.14's embedded GoBGP doesn't replace MetalLB — it takes the BGP session your routers hold with a Kubernetes pod and moves it into machine config. A priced comparison of BGP, L2 announcement, and provider load balancers, the two-instance wiring that actually works, and why Hetzner fleets are locked out.
The Entrypoint You Didn't Write: Buildpacks Is Moving Its 2.9 MB Launcher Into the Run Image and Rewriting It in Rust
Every buildpack-built image runs a 2.9 MB Go binary you never chose, and it is why your scanner is red. Two open CNB RFCs would move it into the run image and rewrite it in Rust — here is what each one actually fixes, and what it does not.
What a Git-Push PaaS Should Actually Clone: Shallow vs Partial Clones and What Checkout Time Adds to Every Build
Shallow clones are 4-6x faster and the industry default, but they break versioning tools and make every later fetch 25x more expensive. Benchmarks, real PaaS defaults from Render to Heroku, and the break-even point where blobless partial clones win.
Field Is Immutable: Why helm upgrade Dies at the API Server, and Which Escape Hatch Actually Scales
A community Helm chart renames one label and your upgrade dies in the API server's validation path. Here is the full table of immutable Kubernetes fields with their exact error strings, the five ways out priced against each other, and the fleet size where a platform operator finally beats the runbook.
Hetzner Is Building an LLM Inference API: What €889/Month of GPU and a Free Experimental Endpoint Do to the Self-Hosted AI Math
Hetzner is testing an OpenAI-compatible inference API alongside its €889/month RTX PRO 6000 GEX131 — what the experiment changes for self-hosted AI rent-vs-own math, EU sovereignty, and running inference as a regular tenant workload.