504 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
CloudNativePG Restored 4.5TB of Postgres in Two Minutes: What Snapshot Recovery Really Buys Your Self-Hosted DR Promise
CloudNativePG restored a 4.5TB Postgres database from a volume snapshot in about two minutes. Here is what that RTO number means for teams running tenant Postgres on their own Kubernetes fleets, and where object-store backups still carry the region-loss half of the promise.
When Will EKS, AKS, and GKE Actually Support Kubernetes 1.37?
Kubernetes 1.37 shipped August 26, but EKS still doesn't offer it, AKS won't GA it until October, and only GKE has a build. A date-by-date scoreboard of managed version lag — and what the wait costs teams that want scale-to-zero, rootless kubelets, and native histograms now.
Flatcar vs Talos vs bootc: Picking the Immutable Node OS for a CAPH-Provisioned Hetzner Fleet
Flatcar, Talos, and bootc compared as the immutable node OS for a Cluster API fleet on Hetzner: image pipelines, update and reboot semantics, CAPH integration maturity, and which one a cost-sized team should standardize on first.
Gateway API v1.6 Makes TCPRoute and UDPRoute Standard: Own Your PaaS's L4 Traffic Without Ingress Annotations
Gateway API v1.6 graduates TCPRoute and UDPRoute to the Standard channel as stable v1 resources. Here is the one-Gateway design for tenant Postgres, game, DNS, and agent-protocol traffic — copy-paste YAML, a port-allocation policy that keeps tenants off each other's listeners, and the controller support matrix to check first.
gVisor vs Kata vs Firecracker: Picking Sandbox Isolation for an Agent Layer on Shared Nodes
An agent sandbox on a node shared with paying tenants must survive hostile model-generated code. This concrete comparison of gVisor, Kata Containers, and Firecracker covers cold starts, memory per sandbox, and blast-radius containment — plus a decision rule for self-hosted fleets.
Ingress-NGINX Is Retired. Your PaaS Inherited Its Quirks — Audit Them Before They Become Outages
Ingress-NGINX retired in March 2026, leaving five silent routing behaviors behind. This behavior-by-behavior audit maps each quirk to what breaks on a naive Gateway API migration — and what a self-hosted PaaS routing layer must now own explicitly.
Kubernetes v1.37 Finally Lets You noexec a Volume Mount: Closing the 9-Year-Old Hole in readOnlyRootFilesystem
Kubernetes v1.37 adds alpha bindMountOptions and emptyDir mode fields that finally let operators mount volumes noexec and stop emptyDir from defaulting to 0777. What the two knobs block, and the gate rollout checklist for multi-tenant fleets.
Kubernetes 1.37 Scales HPA Workloads to Zero (Beta): What It Replaces in Your Idle-Reaping Playbook — and What It Doesn't
Kubernetes 1.37 graduates HPA scale-to-zero to beta with one line — minReplicas: 0. Queue consumers can drop the bespoke idle-reaper, but HTTP services still need Knative-style request buffering, and four policy gaps stay on the platform.
An AI Agent Found a WireGuard Bug in GKE: A Blueprint for Agent-Led Triage on Your Own Fleet
Lovable's agent surfaced a crash-looping GKE networking daemon buried in millions of log lines; humans did everything after. The honest agent-vs-human split from that incident, plus a trust-boundary matrix for giving a triage agent read-only cluster access on your own fleet.