510 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Let's Encrypt Won't Make 6-Day Certificates the Default: the 6-Question Automation Exam Before You Opt In
Let's Encrypt's 160-hour certificates are GA but staying opt-in because most renewal automation can't hold a six-day clock. The per-cert slack math, a six-question pass/fail exam with a cert-manager example, and why a PaaS that owns its whole TLS path can go first.
NGINX Is Back: Gateway Fabric vs Envoy vs Cilium for Your Self-Hosted PaaS
F5's March 2026 Kubernetes roadmap puts NGINX Gateway Fabric back in the ingress race just as ingress-nginx retires. A concrete three-way comparison with Envoy Gateway and Cilium, plus the decision guide for a Cluster API fleet routing every tenant domain through one gateway.
One GPU, Two Tenants: Where DRA, MIG, vCluster, and DCGM Share a Card — and Where the Trust Boundary Says Stop
CNCF's AI-factory guide lists DRA, MIG, vCluster, and DCGM as one stack. A concrete two-tenant design for a self-hosted fleet — which layers can share a single GPU within one trust domain, and why untrusted tenants still need whole cards or dedicated nodes.
Open-Weight AI's Kubernetes Moment: Stress-Testing the Analogy Phase by Phase
Tobi Knaup argues open-weight AI sits where Kubernetes sat in 2016. We grade the analogy across all four phases of the Kubernetes decade — substrate, distro fight, hyperscaler absorption, and the self-hosting price — with the utilization math that decides it.
One Control Plane, Four Operators: What OpenChoreo's MCP Bet Teaches Self-Hosted PaaS Builders
OpenChoreo 1.0 treats AI agents as first-class platform consumers through MCP servers on a single Kubernetes system of record. A four-surface replay plus an identity, dependency-graph, policy, and audit-trail checklist for letting agents investigate — and eventually change — deployments.
Scale Before the Spike: Predictive GPU Pre-Warming for a Cluster API Fleet Without the Always-On Bill
Reactive autoscaling leaves a roughly 45-minute gap between an inference spike and ready GPUs. A concrete pre-warm design for a Cluster API fleet — request-side forecast signals, a measured boot budget, and a capped warm reserve — priced against Hetzner's monthly GPU boxes.
SOPS with Age vs Sealed Secrets: What GitOps Secrets Cost to Rotate on a Cluster API Fleet
Committing encrypted secrets to Git is the easy part. A fleet-scale comparison of SOPS with age versus Bitnami Sealed Secrets on what each costs to rotate, audit, and recover after the management cluster dies — with runbooks and the February 2026 rotation CVE that settles it.
Kubernetes 1.37's StatefulSet Recreate Strategy (Alpha): Stop Deleting Stuck Pods by Hand
Kubernetes 1.37 adds an alpha Recreate update strategy for StatefulSets that deletes old-revision pods wholesale instead of halting behind the first stuck pod. What it changes, the full-outage price, and where a self-hosted PaaS may use it — and where it must not.
Your Three Replicas Are All in FSN1: TopologySpreadConstraints, Hetzner Failure Domains, and the Placement Policy a Self-Hosted PaaS Owes Its Tenants
Two replicas across three Hetzner locations at maxSkew 1 lands 1/1/0, with one location always empty. The skew formula behind it, the minDomains trap that wedges pods in Pending, what cross-location spread really costs on Hetzner's private networks, and the soft-by-default placement policy a self-hosted PaaS should ship.