640 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
The $3,000-to-$200 Migration Story Cuts Both Ways: What a Kubernetes-to-Fly.io Bill Drop Really Proves
A $3,000 Kubernetes bill rebuilt on Fly.io for $200 decomposes into roughly 80% right-sizing and 20% unit prices — and the same disciplined workload runs on owned Hetzner hardware for about $50.
Your API Server Already Speaks Post-Quantum TLS — Your Service Mesh Probably Doesn't
A TLS-hop inventory and 4-phase migration playbook for a Cluster-API fleet: which hops already negotiate hybrid ML-KEM, what Envoy, Istio, and Linkerd each need, and where ML-DSA certificates stand.
Gang Scheduling Is Beta in Kubernetes 1.37 — and Off: The Opt-In Checklist for GPU Node Pools
Kubernetes 1.37 graduates gang scheduling to beta — disabled by default — so a bare Garhwal upgrade changes nothing about GPU placement. Enable GenericWorkload on all three control-plane components, drop the removed alpha gate, wire PodGroups or Job scheduling policies, and roll it out per cluster: the full opt-in checklist for CAPI-managed GPU pools.
KYAML Goes Stable in Kubernetes 1.37: What Canonical kubectl Output Means for GitOps Diff Hygiene
Kubernetes 1.37 graduates KYAML to stable, giving kubectl a canonical YAML output that collapses reformatting noise out of GitOps diffs — normalize both sides before comparing, and keep Flux drift detection for the semantic layer it can't see.
Let's Encrypt's 64-Day Certificates Are Live in Staging — Your Renewal Automation Has 4 Months to Prove Itself
Let's Encrypt staging now issues 64-day certificates ahead of the February 10, 2027 production cutover — two days after a 6-hour ACME outage. This sequel to our cert-manager audit delivers the 4-month proof plan: kill hardcoded renewal offsets, switch to ARI scheduling, run staging-canary renewals, and line up a fallback CA.
No More Stringly-Typed Deploys: What pikpik's Four Invariants Say About Coolify, Dokploy, and CapRover Reliability
Dokploy fixed five shell-injection RCEs in one release — the sharpest proof of pikpik's 'zero shelling' invariant. This audit ranks all four invariants against the public CVE and issue record of Coolify, Dokploy, and CapRover, and shows why a PaaS built on typed Kubernetes manifests inherits the whole bar by construction.
Rivet Wants to Be Kubernetes 2.0: What a PaaS Without Kubernetes Gives Up on Machine Two
Rivet pitches itself as Kubernetes 2.0 — a trivially self-hostable orchestrator with a small core. A concrete inventory of what it drops (machine provisioning, upgrades, networking, bin-packing) versus what a Cluster API fleet already solves, and why a self-hosted PaaS still needs Kubernetes once the second machine arrives.
Rootless Kubelet Hits Beta in Kubernetes 1.37: What Unprivileged Nodes Buy a Multi-Tenant Fleet
Kubernetes 1.37 promotes rootless nodes to beta, so the kubelet and runtimes can run unprivileged and cap five years of container breakouts — but only on cgroup v2 with local storage and a short CNI list. Here is the evidence and the adoption checklist.
Talos Linux Grows a Hypervisor: VMs Without KubeVirt, Containers Without Kubernetes
Sidero Labs is building a native hypervisor and Kubernetes-less containers into Talos Linux, with an alpha demo at TalosCon 2026 and GA in December — here is when to choose Talos VMs over KubeVirt, what single-node edge containers are good for, and what it means for a Cluster-API fleet.