510 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
The Tenant Domain That Didn't Renew: cert-manager vs Gardener vs certctl for Per-Tenant TLS
One certificate per tenant collides with Let's Encrypt's 50-per-week ceiling fast. A concrete comparison of cert-manager, Gardener cert-management, and certctl on challenges, secret distribution, and renewal failure modes — plus which one a self-hosted PaaS should default to.
Your PaaS Quietly Reweighted Every Tenant's CPU: The cgroup v1-to-v2 Conversion Kubernetes Fixed in January 2026
Moving a node to cgroup v2 silently cut a 1-CPU pod's priority to a weight of 39 against the default 100. How the January 2026 quadratic fix restores fair share, what stays transparent, and a four-check audit for your fleet.
100x Faster Than Containers: What Cloudflare's Dynamic Workers Get Right About Sandboxing Agent Code
Cloudflare's Dynamic Workers run AI-generated snippets in V8 isolates with millisecond startup — but the 100x headline only holds for sub-second tool calls. Here are the real numbers against containers and microVMs, the isolation tradeoff Spectre exposed, and the two-tier sandbox rule for self-hosted platforms.
One Cluster for Training and Inference: How a Bank Cut AI Token Costs 60% on Kubernetes
China Merchants Bank won the CNCF End User Case Study Contest for running AI training and inference on a single Kubernetes stack of nearly 10,000 accelerator cards — lifting utilization from 35% to over 60% and cutting inference cost per million tokens by more than 60%. The component-by-component breakdown, the fairness rules behind it, and what smaller self-hosted fleets can copy.
Colmena vs Cluster API: Nix Fleet Management Without Kubernetes — What It Gets Right and Where It Stops
Colmena manages a NixOS fleet with no control plane, no agent, and no state database — but it cannot provision machines, schedule containers, or heal dead processes. A grounded comparison with Cluster API, an honest NixOps 4 status check, and a decision checklist.
E2B's $150/Month Sandbox Meter vs a $70 Hetzner Box: What Agent Sandbox-Hours Really Cost
E2B bills agent sandboxes per second on top of a $150/month Pro plan; a Hetzner box you own runs the same Firecracker isolation for a flat $70. A worked recompute across three team sizes shows where the meter wins, where the flat box wins by 10x, and why E2B's CPU-only ceiling settles the GPU question before pricing does.
eBPF Ate the Sidecar: What Hubble, Pixie, and Coroot Actually Replace on a Self-Hosted Fleet
67% of Kubernetes teams at scale already run eBPF observability. The sidecar-per-pod telemetry model costs ~250MB RAM per pod and milliseconds per request — a per-node kernel agent replaces it at a fraction of the cost. What Hubble, Pixie, and Coroot each replace, and which one a team that patches its own stack should run.
Your Ingress-Nginx Has an Expiry Date: What Moving to Gateway API Actually Takes
ingress-nginx maintenance ended in March 2026 and the last vendor patch bridge runs out in November 2026. A before/after resource map, a four-phase migration with no flag day, and the full TLS story for self-hosted fleets.
Hetzner's Datacenters API Goes 410 on October 1: The 4-Row Checklist for Your CAPH Fleet
On October 1, 2026, Hetzner's datacenters API endpoints start returning HTTP 410 Gone — while retired server-type names and a removed datacenter field can already break provisioning today. A four-row migration checklist for Cluster API fleets on Hetzner, with the greps and the runbook.