509 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Hetzner's Post-July API Churn: The Primary IP Flip and Prometheus 3.14 Label Drop Your CAPH Fleet Still Hasn't Pinned
Hetzner's July datacenter removal was only the headline: unassigned Primary IPs flipped to assignee_type unassigned on August 1, Prometheus 3.14 dropped the Hetzner datacenter label, and the datacenters API goes 410 on October 1. A per-break fix table plus a six-grep audit runbook for CAPH fleets.
Hetzner After the June 2026 Price Hikes: Auction Metal vs Cloud VMs as Kubernetes Fleet Nodes
Hetzner's June 2026 hikes tripled dedicated cloud prices while auction boxes held at €37–€46 — a euro-level comparison of auction metal versus cloud VMs as Kubernetes fleet nodes, the operational tradeoffs, and which roles fit each.
Kubernetes 1.36 Locks On Fine-Grained Kubelet Authorization: The nodes/proxy Migration Your Multi-Tenant Fleet Owes Itself
Kubernetes 1.36 graduates fine-grained kubelet authorization to GA, replacing the over-broad nodes/proxy grant that lets read-only agents execute code in any pod. This playbook maps every kubelet endpoint to its least-privilege subresource and walks through the five-step migration for fleets running untrusted tenant workloads.
Kubernetes 1.37 Scales HPA to Zero in Core: No More Paying for Idle Pods
Kubernetes 1.37 graduates HPA scale-to-zero to a default-on beta, so queue workers and preview environments can drop to zero replicas on an external metric. This post works the idle-economics math, shows the exact wiring, and maps where KEDA and Knative still fit.
Signing Every Build Means Nothing If Nothing Checks: Wiring Cosign Into a Git-Push PaaS
Kubernetes signs its releases with Sigstore — but a signature nobody verifies is theater. How to wire Cosign keyless signing into a git-push pipeline and enforce it with a Kyverno admission policy before unsigned images reach your nodes.
OpenCost's Built-In MCP Server Turns Cost Allocation Into an Agent-Callable Tool
OpenCost's built-in MCP server exposes Kubernetes cost allocation as agent-callable tools. Here is the exact tool surface, a worked tenant-cost query, and the scoping rules that keep read-only cost data safe on a multi-tenant fleet.
After the 2026 Price Hikes: Re-Ranking Hetzner, OVHcloud, and DigitalOcean for a Self-Hosted PaaS Fleet
Hetzner raised cloud prices twice in 2026 while OVHcloud added 9–11% — a line-by-line re-ranking of 2 vCPU/4 GB nodes and what a six-node self-hosted fleet month costs on each provider now.
Platform Engineering 2.0: Your Internal Platform's Newest User Is an AI Agent
CNCF's 2026 Platform Engineering 2.0 framing says your platform's newest user is an AI agent. A 5-minute audit plus the API-first requirements — declarative state, idempotent writes, policy at execution — that make agents operable on machines you own.
Your Sidecars Are Eating Whole CPUs: Kubernetes 1.37's Pod-Level Resource Managers Hit Beta
Kubernetes 1.37 graduates Pod-Level Resource Managers to beta, ending the era when every sidecar needed its own exclusive CPU. How the hybrid pod-budget model reclaims wasted cores, what changed since alpha, and the staging checklist for self-hosted platforms.