504 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Microsoft's Document Database Rides CloudNativePG: What That Verdict Means for Your Fleet's Postgres Layer
Microsoft's DocumentDB Kubernetes operator creates CNPG Cluster resources instead of reimplementing HA and backups, injecting its gateway through a CNPG-I plugin. What that architecture proves about standardizing a self-hosted fleet's Postgres layer — and the honest cases for not doing it.
One Sponsor Pulled the Plug and Paketo Had Two Weeks to Move Registries: The Buildpack Bus-Factor Problem
When Paketo's GCP sponsor pulled funding, the project had about two weeks to move every image off GCR. This post audits what a build pipeline really inherits from its builder, prices the four responses — trust, mirror, vendor, or switch — and gives platform teams a five-step checklist before the next forced migration.
Your Database Backup Passed and Your App Still Won't Restore: What Portabase's Docker Volume Support Means for Self-Hosted PaaS Backups
Portabase promoted Docker volumes to first-class backup targets alongside Postgres and MySQL. The tool is single-host, but the thesis ports to any fleet: schedule, retain, and restore-test database and volume state as one problem.
BYOC Bills Twice: Porter's $20M Bet on Your Cloud Account vs Owning the Bare Metal
Porter charges a PaaS meter on top of your own AWS bill. We itemize the double bill for a typical team workload and compare it against the fixed price of owned Hetzner bare metal.
Railway Put Postgres HA, PITR, and PgBouncer in the Terminal — and Gave Agents the Keys
Railway's September 2026 CLI release brings Postgres HA, point-in-time recovery, and connection pooling to the terminal with JSON output. Here is how each operation compares to its CloudNativePG equivalent on infrastructure you own, and what it means now that database lifecycles are APIs agents call.
Render Killed the Pasted AWS Key. Your Self-Hosted PaaS Is Now on the Clock.
Render's July 2026 OIDC releases made keyless auth to AWS, Anthropic, and OpenAI a GA platform feature. Here's the trust-chain machinery behind it and the two concrete paths — cluster-issuer federation or SPIFFE/SPIRE — for matching it on machines you own.
iptables Is Quietly Taxing Every New Connection on Your Fleet: The nftables Performance Case, With Numbers
Kubernetes 1.37 started warning clusters that never chose a kube-proxy mode, and the default flips to nftables by 1.40. The benchmark numbers behind retiring iptables, what the switch actually costs, and a decision rule for self-hosted fleets.
Keyless Signing Won: What Rekor v2 and cosign v3 Mean for Verifying Every Image at Admission
Rekor v2, cosign v3, and Open Component Model's breaking 2026 releases made keyless signing the default. What identity-based provenance means for verifying every container image at admission — and where the guarantees stop.
France's Railway Runs on Cluster API: What SNCF's Monthly Zero-Drift Fleet Teaches a Self-Hosted PaaS
SNCF provisions Kubernetes clusters in 30 minutes and updates its whole fleet monthly with zero configuration drift — on infrastructure it owns. Here is the stack behind those numbers and which parts transfer to a small self-hosted fleet.