510 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Ingress-NGINX Is Dead. Gateway API v1.5 Is What You Migrate To — and It Finally Covers the Gaps
Ingress NGINX has received no patches since March 2026. Gateway API v1.5's stable TLSRoute, ListenerSet, and CORS filter close the gaps that kept teams on NGINX annotations — here is the annotation-by-annotation payoff map, the mechanical migration path, and which implementation to pick for owned hardware.
k0rdent Turns One: What a Year of Shipping a Cluster API Fleet Orchestrator Proves About Not Building Your Platform From Scratch
k0rdent went from v0.1 to v1.7 in its first year, and RBC Capital Markets now runs 50+ clusters on it. What the Cluster API-based orchestrator's lifecycle, state, and observability layers prove — and which parts a small self-hosted fleet should borrow, skip, or work around.
Kubernetes 1.36 Teaches Controllers to Distrust Their Own Cache: Why a Skipped Sync Beats a Wrong Reconcile
Kubernetes 1.36 makes DaemonSet, StatefulSet, ReplicaSet, and Job controllers skip any sync where the informer cache lags their own last write. The mechanism, the two metrics that expose it, and why a lean self-hosted fleet feels every wrong reconcile as an invoice.
MCP Won the Protocol War — the Lock-In Just Moved Up a Layer: A Self-Hoster's Field Test
MCP became the universal agent interface — and the lock-in moved into security policies, drift detection, and Skills libraries. A hands-on field test shows which moats self-hosting defeats and which one follows you home.
Nvidia Runs OpenBao in Production: The Vault Fork's Enterprise Moment, and How to Wire It Into Kubernetes
NVIDIA runs its serverless GPU platform's secrets on OpenBao, eight vendors now sell commercial support, and v2.6 added per-namespace sealing — why the Vault fork is now safe to bet a self-hosted platform on, and how to wire it into Kubernetes with the External Secrets Operator.
The OpenClaw Operator's Default-Deny Baseline: What One CRD Can (and Cannot) Contain
The OpenClaw Kubernetes operator packs non-root pods, dropped capabilities, and a default-deny NetworkPolicy into one install — a solid floor for running AI agents in-cluster. But Pod hardening stops at the process boundary: prompt injection, over-broad MCP credentials, and destructive-tool authorization need a governance layer no CRD provides.
One PaaS API on k3s and EKS: What Ownkube's Dual Substrates Really Cost vs Owning One Cluster API Fleet
Ownkube runs one PaaS API on k3s and EKS. We price both shapes against a single-substrate Cluster API fleet on Hetzner, name every seam the shared API hides, and give a rule for picking.
Red Hat OpenShift AI Bakes In MCP — and the Bottleneck Moves to Discovery at 10,000 Servers
Red Hat is baking MCP into OpenShift AI as governed infrastructure — Playground validation, a verified catalog, a lifecycle operator, and a gateway. Why the agent tooling gap moved from protocol to discovery at 10,000+ servers, and a six-item checklist for a self-hosted platform's own MCP server.
Rootless Kubelet Hits Beta in Kubernetes 1.37: What Dropping Host Root Changes for Multi-Tenant Nodes (and What Still Needs It)
Kubernetes 1.37 promotes rootless kubelet mode to beta, so node components run as a non-root host user and breakouts stay confined to one account. Here is the blast-radius accounting, the full compatibility inventory, and a one-pool pilot playbook for Hetzner fleets.