510 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Ingress-NGINX Is Retired. Your Annotations Aren't Portable: A Gateway API Migration Audit
Ingress-NGINX lost upstream maintenance in March 2026 and Gateway API v1.5 did not add the WebSocket and retry features the headlines suggest. A row-by-row audit of which NGINX annotations have a first-class Gateway API equivalent, which need a vendor policy CRD, and which have no equivalent — plus the cutover sequence that avoids a routing gap.
Ingress-NGINX Is Retired: A Zero-Downtime Migration Plan for Every Tenant Domain on Your Git-Push PaaS
Ingress-NGINX stopped receiving security patches in March 2026. A staged runbook for moving wildcard and tenant custom domains to Gateway API with Ingress2Gateway 1.0 — shadow validation, weighted-DNS cutover, and rollback triggers included.
kuberc Is On by Default: Your kubectl Habits Finally Move Out of the Kubeconfig
Kubernetes 1.36 keeps kuberc beta and on by default, adds a real management CLI, and turns the credential-plugin allowlist rename into a hard error. What the preferences/kubeconfig split means for a shared ops box.
Kueue 1.3 Plus JobSet: Skip the Second Scheduler for Agent Batch Jobs — Until You Can't
Kueue 1.3 added first-class JobSet support, completing a native quota-plus-gang batch stack that runs on the default scheduler. Tabled here: what it covers, the worked manifests, and the three triggers that still justify Volcano.
Six Days to Renew: What Let's Encrypt's Short-Lived Certificates Do to Your Renewal Margin
Let's Encrypt's 160-hour shortlived certificates cut renewal slack from 30 days to about 53 hours. The before/after margin math, plus the automation, monitoring, and default-or-opt-in checklist a self-hosted platform needs first.
Kubernetes v1.37's Node Lifecycle Conditions: Teaching MachineHealthCheck to Tell 'Draining' Apart From 'Dying'
Kubernetes v1.37 reserves five Node Lifecycle Conditions that finally let a node say 'I'm draining' instead of just going NotReady. What MaintenancePlanned changes for MachineHealthCheck remediation, what MHC already covers, and what a Cluster-API fleet should publish this quarter.
The Gate That Wasn't There: What Nomad's CVE-2026-14891 Teaches About Scheduler Isolation
Nomad 2.0.4 fixed a CVE that let any job submitter land a container in the host's PID, network, or IPC namespaces — because the allow_privileged check was never evaluated. What the bug, its two sibling fixes, and Kubernetes' admission-time enforcement say about choosing a scheduler for untrusting tenants.
CPU at 40%, Everything on Fire: What Kubernetes 1.36's PSI Metrics Finally Tell a Bin-Packed Fleet
Kubernetes 1.36 graduates PSI metrics to GA, exposing CPU, memory, and I/O stall percentages per node, pod, and container. Here is what that reveals on a bin-packed fleet, the kernel and cgroup v2 checklist to enable it, and three stall-based queries to run before your next 'utilization looks fine' incident.
Japan Just Named the Kubernetes AI Stack: What a Self-Hosted PaaS Should Adopt, Pilot, or Skip
Japan's new CNCF AI Infrastructure SIG names DRA, Kueue, KServe, the Gateway API Inference Extension, and more as one coordinated stack. A concrete adopt-pilot-skip triage for self-hosted PaaS teams: three to adopt now, two to pilot, two stacks to decline, and two watches with dated triggers.