Kubernetes for platform teams
The parts of Kubernetes you meet when you run a platform on it rather than an app: Cluster API fleets, controller-runtime memory, RBAC that fails silently, and resizing pods without restarting them.
Start here
- Retiring cluster-admin and the Shared Bastion: Kubernetes' Access-Broker Pattern for Production DebuggingKubernetes' March 2026 guidance replaces cluster-admin exec and shared bastions with a three-layer access broker: least-privilege RBAC, group-based bindings, and a just-in-time gateway — plus how to wire it into a multi-tenant PaaS debug-shell feature without rebuilding the anti-pattern.
- Field Is Immutable: Why helm upgrade Dies at the API Server, and Which Escape Hatch Actually ScalesA community Helm chart renames one label and your upgrade dies in the API server's validation path. Here is the full table of immutable Kubernetes fields with their exact error strings, the five ways out priced against each other, and the fleet size where a platform operator finally beats the runbook.
- Cluster API Stops Serving v1beta1 in v1.16: The Seven-Row Migration Audit Every CAPI Platform Owes Itself Before April 2027Cluster API's v1beta1 API stops being served in v1.16, April 2027 — and CAPD's Docker resources are removed a release earlier. Here's the seven-place audit, what clusterctl convert does and doesn't cover, and how to sequence the upgrade as management-cluster Kubernetes support narrows to v1.33-v1.36.
- How the controller-runtime Cache Actually Works: What PaaS Builders Should Know Before Their First OOMKillYour operator's Get() never hits the API server — it silently caches every object of that Kind in the cluster. How controller-runtime's shared-informer cache works, why it OOMKills control planes at fleet scale, and the exact selectors, transforms, and DisableFor config that shrink a PaaS control plane from gigabytes to a few hundred MB.
- Kubernetes 1.35 Takes In-Place Pod Resize to GA: What the Restart-Based Workaround It Just Killed Was Actually Costing YouIn-place pod resize reached GA in Kubernetes 1.35. Here's the before/after: what evicting and rescheduling a pod to change its CPU/memory actually cost versus a resize subresource PATCH that completes in seconds — and what a Cluster-API-managed PaaS's own autoscaling logic should do differently now.
- KEDA v2.20's One-Line RBAC Change Silenced Your Autoscaler's Events for 60 DaysKEDA v2.20 swapped the operator's events RBAC from the core API group to events.k8s.io and dropped the old one — so every KEDA event was forbidden on the default install for 60 days. The exact rule to grant, who actually has to act, and the pre-upgrade checklist for a fleet whose scale-from-zero runs through one controller.
In the documentation
Terms to know
Run this on infrastructure you own
bex is the open-source, AI-native Render alternative — push a git repo and get a running HTTPS service on your own machines.
Get started with bex