506 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
1.5TB of RAM and 192 vCPUs for Under €600/Month: What a Hybrid Talos-on-Hetzner Build Validates About Splitting Control Planes From Workers
A third-party builder ran 1.5TB of RAM and 192 vCPUs on hybrid Talos-on-Hetzner iron for under €600/month. Here is what the numbers verify, what broke on the VM-to-bare-metal seam, and where the bare-metal-is-cheaper claim lands.
Automatic TLS on Owned Hardware: Caddy vs cert-manager After Hetzner's July Load Balancer Disruption
Hetzner's July 2026 Ashburn load balancer disruption showed what happens when TLS renewal shares fate with a provider's data plane. A comparison of managed LB certificates, Caddy automatic HTTPS, and cert-manager plus Gateway API — and why self-hosted platforms should own the certificate path as Let's Encrypt lifetimes shrink.
Bare-IP TLS Is GA: Instant HTTPS for Preview URLs Without a DNS Round-Trip
Let's Encrypt's generally available 160-hour IP certificates let a preview environment serve valid HTTPS on a bare node IP with no DNS records. Here is the cert-manager plus Gateway API wiring, the renewal math, and when a subdomain still wins.
Better-PaaS and the 'Agent-First' PaaS Pitch: What a Single-VPS Deploy Tool Gets Right — and Where It Stops at the Second Machine
Better-PaaS puts scoped agent tokens and MCP deploy tools on a single VPS — genuinely good design. A verified inventory of what ships, the principle worth stealing, and the concrete second-machine line where single-box agent surfaces stop and multi-node control planes take over.
Bottlerocket Killed Bare-Metal Kubernetes After 1.28: Picking a Node OS for Your CAPH Fleet
Bottlerocket's bare-metal Kubernetes variants ended at 1.28, and the last patches expired with Kubernetes 1.28's end-of-life. Here is how Talos Linux, Flatcar Container Linux, and Kairos compare as the node OS for a Cluster API fleet on owned hardware — and which one fits your team.
Cilium 1.20: Default to Portable Policy, Go Cilium-Native Only Where It Earns It
Cilium 1.20 implements upstream ClusterNetworkPolicy and promotes MCS to stable. A decision table for writing tenant-isolation policy in portable Kubernetes APIs — and the four things that still need Cilium-native rules.
Cilium 1.20 Puts Tenant Auth in the CNI: What ExternalAuth Means for Fleets Still on ingress-nginx
Cilium 1.20 adds the ExternalAuth filter to Gateway API, moving per-route authorization into the CNI you already run. A before/after of tenant auth on ingress-nginx versus HTTPRoute filters, plus an itemized migration bill for fleets facing the retired controller.
containerd 1.7 Is Dead: The Node-Image Audit Your Fleet Owes Itself Before the Next Kubernetes Upgrade
containerd 1.7 left support in September 2026, and Kubernetes 1.38 drops the kubelet fallback that kept it working. A fifteen-minute audit to find every 1.7 node in your fleet, a table of what the 2.x jump breaks, and the upgrade order that keeps kubelets healthy.
Copy Fail: 4 Bytes in the Page Cache Break Container Isolation on Every Major Distro
A 732-byte script turns an unprivileged user into root on every major distro — and the shared page cache carries the corruption across containers. What stops it, what doesn't, and the patch-and-isolate playbook for your fleet.