AWS's New ACME Endpoint Isn't Free: What $1 Per Domain, Every 45 Days, Costs a Multi-Tenant PaaS
AWS Certificate Manager now speaks ACME, but it charges $1 per domain on every issuance and renewal — at a 45-day cert lifetime, that's a metered bill free Let's Encrypt never had. Here's the worked cost comparison.
AWS CloudFront's Control-Plane Failure Took Down Hugging Face and Canvas: What Owning Your Infrastructure Doesn't Save You From
A CloudFront control-plane bug took down Hugging Face, Canvas, and Blackboard at once, even though none of them run application logic on CloudFront. A layer-by-layer look at what owning your own ingress actually removes from that risk — and what it only relocates.
Why bex Skips the Crossplane-Style Multi-Cloud Abstraction Layer
Crossplane just graduated CNCF's top maturity tier promising one API across every cloud. Here's why bex, a Cluster API-based platform, deliberately skips that abstraction to keep every workload traceable to one physical machine.
Kaniko Is Archived: What Actually Changes When a Buildpacks Pipeline Switches to Buildah
Google archived Kaniko in June 2025 and its Chainguard fork is maintenance-only. Here's exactly what changes in a Kubernetes build pod's spec, caching architecture, and registry auth when a buildpacks-based PaaS switches its Dockerfile-fallback builder to Buildah — and the one dependency on Kaniko you can't migrate away from.
cgroup v1 Is About to Break Your Kubernetes Nodes: A Migration Checklist Before August 26, 2026
Kubernetes v1.37 makes kubelet refuse to boot on cgroup v1 nodes by default. Here's the exact command to check your fleet, what changes in tenant CPU/memory enforcement, and a migration checklist before the August 26, 2026 deadline.
CloudNativePG's Snapshot PITR Can Restore a Multi-TB Postgres in Minutes — Hetzner's CSI Driver Still Can't Take the Snapshot
CloudNativePG's snapshot-based backup can restore a multi-terabyte Postgres cluster in minutes, but Hetzner's own CSI driver has never implemented volume snapshots. Here's what actually runs on Hetzner today — the Barman Cloud Plugin path — and when swapping in Piraeus/LINSTOR for snapshot support is worth the operational cost.
Cluster API v1.12: What Chained Upgrades Actually Save a Kubernetes Fleet That Fell Behind
Cluster API v1.12 adds in-place updates and chained upgrades — here's what collapsing three separate Kubernetes minor-version rollouts into one reconciliation pass actually saves a bare-metal Hetzner fleet that fell behind, and where the old drain-and-verify discipline still applies.
ClusterClass Turns Tenant Cluster #500 Into a One-Line Diff From Cluster #1
Cluster API's ClusterClass collapses seven hand-copied objects per tenant cluster into one shared template plus a handful of variable overrides — the concrete before/after, the patch mechanics, and what it still doesn't solve.
CNCF Buildpacks Graduation: What Reaching the Top Maturity Tier Actually Changes
Cloud Native Buildpacks reached CNCF's Graduated maturity level on July 17, 2026. Here's what the governance milestone actually verifies, what it doesn't change technically, and why it matters for a platform team betting its build layer on the spec.