509 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Strimzi Eases Kafka Onto Kubernetes: What 'Just Run Our Event Bus' Really Costs a Self-Hosted PaaS
A tenant asked your platform team to 'just run Kafka.' This breakdown prices a Strimzi-hosted event bus against MSK, Confluent Cloud, and serverless options — with a reference workload, sensitivity ranges, and a documented build-or-BYO decision checklist.
Synacktiv's Unpatched Argo CD Repo-Server Flaw: Why Any Pod That Can Reach the gRPC Service Is Equivalent to an Authenticated Attacker
Argo CD's repo-server exposes an unauthenticated gRPC endpoint that turns any pod with network reachability into a path to cluster takeover. This breakdown covers Synacktiv's exploit chain, which installs are exposed, and the exact NetworkPolicies that close it.
A2A Joins MCP Under One Roof: How to Hand an Ops Agent a Deploy Investigation Without Handing Over Deploy Authority
A2A joining MCP under the Agentic AI Foundation settles which protocol does what: A2A moves the diagnosis between agents, MCP moves capability between an agent and the platform. Here is the handoff design that keeps it that way — a worked deploy-investigation task, a three-tool audited MCP surface, and the identity, approval, and least-privilege invariants mapped to Kubernetes RBAC.
The Four Capabilities an AI Coding Agent's Deploy Sandbox Actually Needs in 2026
Sub-second provisioning, hardware-isolated execution, agent-readable validation, and canary rollback: the four capabilities a deploy sandbox needs before an AI coding agent can ship unsupervised — scored against what a self-hosted Kubernetes fleet already provides.
Cluster API v1.12: Update the Node, Don't Replace It — What In-Place Updates and Chained Upgrades Buy a Hetzner Fleet on Talos
Cluster API v1.12 trades full machine rollouts for in-place updates and multi-version chained upgrades — a change that saves real time and money on bare-metal Hetzner fleets running Talos. Here is what converges in place, what still replaces, and the operator rule for telling them apart.
The Agent Is the Primary Tenant Now: Auditing CNCF's Platform Engineering 2.0
CNCF says internal platforms must be rebuilt for AI agents. A pillar-by-pillar audit of Platform Engineering 2.0 separates the genuinely new constraints — agent identity, MCP tool surfaces, machine-readable state — from old good practice, with a four-item checklist for self-hosted teams.
CNCF's 'Agentic Enterprise' Essay, Scored: What First-Class Agent Consumers Actually Require
CNCF's July 2026 agentic-enterprise essay lists what treating AI agents as first-class platform consumers requires. A row-by-row score against a self-hosted PaaS: five requirements ship, the shared context model is half-built, and the enterprise catalog baggage can be skipped.
CVE-2026-42533: The 15-Year-Old Core-NGINX Heap Overflow Your Gateway API Migration Didn't Escape
F5's July 2026 disclosure of CVE-2026-42533 — a CVSS 9.2 heap overflow in core NGINX's map directive — reaches Gateway Fabric, the F5 Ingress Controller, and every product embedding the NGINX engine. Here is the patch matrix, the config that makes you exploitable, and the upgrade order.
Dokploy Killed Its Global Build Queue After Two Years: What Per-Server Build Slots Reveal About Scheduling Outgrowing One Box
Dokploy ran every build on every server through one global queue for two years — then v0.29.11 gave each server its own. The wait-time math behind the fix, where per-box caps still strand capacity, and what a fleet build pool owes default-1.