504 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
formae Learned Kubernetes. Does a Cluster-API Fleet Still Need Another IaC Layer?
formae's May 2026 release added Kubernetes, Helm, and .tfvars support to its agent-based, state-file-free IaC platform. Here is where it fits on a Cluster-API fleet that is already GitOps-native — and where a second reconciler would only fight the first.
Kagent Brings CRD-Native AI Agents to Kubernetes: What It Means for a Self-Hosted PaaS
Kagent turns AI agents into Kubernetes objects you version, roll out, and inspect with kubectl. Here is what the Agent CRD, MCP tool servers, and A2A teams replace on a self-hosted PaaS roadmap — and where the platform still owns the problem.
KEDA 2.20's Event-RBAC Migration and Two Panic Fixes: What Breaks When Scale-to-Zero Runs Through One Controller
KEDA 2.20 moved event recording to events.k8s.io but dropped the legacy permission its own client library still needed, then shipped two panic fixes for the operator that owns scale-to-zero. A blast-radius breakdown of each failure and an upgrade checklist for fleets you run yourself.
Korifi Brings cf Push to Kubernetes: The Forgotten Git-Push PaaS, Compared
Korifi puts Cloud Foundry's cf push on Kubernetes with buildpack staging and a service-broker Marketplace — here is how it stacks up against Dokku, Coolify, CapRover, and Render-compatible layers, and which teams should shortlist the industry's most battle-tested git-push UX.
Northflank vs bex: Same Kubernetes-Native Pitch, Opposite Answers to Who Owns What
Northflank and bex both promise git-push deploys on real Kubernetes — but one is closed SaaS with a per-second meter and the other is Apache-2.0 software on your own machines. A line-by-line comparison of the bill, the data boundary, and who gets paged.
Pod Certificates Are GA in Kubernetes 1.37: Per-Tenant TLS Without the cert-manager Glue
Kubernetes 1.37 graduates Pod Certificates and Cluster Trust Bundles to stable, turning per-pod X.509 identity and shared trust anchors into platform APIs. Here is how the issuance flow works, what replaces Certificate-per-service sprawl, and the four-item checklist before a self-hosted PaaS adopts it.
The Protocol Is Free, the Control Plane Isn't: What Qovery's MCP-for-Infra Play Shares — and Keeps
Qovery's agent Skill deploys new apps while its MCP server manages existing infrastructure — and the protocol behind both is free. A row-by-row verdict on which parts of MCP-for-infra any self-hosted PaaS shares, and which parts only the rented control plane keeps.
Tenant Offboarding Is a Data-Deletion Problem: The GDPR Erasure Checklist Across Volumes, Snapshots, Logs, Registries, and Backups
Deleting a churned tenant's namespace takes ninety seconds. Erasing their personal data from volumes, snapshots, logs, registries, backups, DNS, and metrics takes a checklist — here it is, with each store's deletion mechanism, retention clock, and an honest accounting of what cannot be deleted.
Wildcard TLS on Autopilot: How Every Tenant Subdomain Gets a Trusted Cert in Under 90 Seconds
Every tenant subdomain on a PaaS needs a trusted certificate at deploy time. Here is how one wildcard cert, cert-manager's DNS-01 solver, and Let's Encrypt deliver it in under 90 seconds — and why per-tenant certs hit rate limits first.