640 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Kubernetes v1.37's Node Lifecycle Conditions: Teaching MachineHealthCheck to Tell 'Draining' Apart From 'Dying'
Kubernetes v1.37 reserves five Node Lifecycle Conditions that finally let a node say 'I'm draining' instead of just going NotReady. What MaintenancePlanned changes for MachineHealthCheck remediation, what MHC already covers, and what a Cluster-API fleet should publish this quarter.
The Gate That Wasn't There: What Nomad's CVE-2026-14891 Teaches About Scheduler Isolation
Nomad 2.0.4 fixed a CVE that let any job submitter land a container in the host's PID, network, or IPC namespaces — because the allow_privileged check was never evaluated. What the bug, its two sibling fixes, and Kubernetes' admission-time enforcement say about choosing a scheduler for untrusting tenants.
CPU at 40%, Everything on Fire: What Kubernetes 1.36's PSI Metrics Finally Tell a Bin-Packed Fleet
Kubernetes 1.36 graduates PSI metrics to GA, exposing CPU, memory, and I/O stall percentages per node, pod, and container. Here is what that reveals on a bin-packed fleet, the kernel and cgroup v2 checklist to enable it, and three stall-based queries to run before your next 'utilization looks fine' incident.
Japan Just Named the Kubernetes AI Stack: What a Self-Hosted PaaS Should Adopt, Pilot, or Skip
Japan's new CNCF AI Infrastructure SIG names DRA, Kueue, KServe, the Gateway API Inference Extension, and more as one coordinated stack. A concrete adopt-pilot-skip triage for self-hosted PaaS teams: three to adopt now, two to pilot, two stacks to decline, and two watches with dated triggers.
AWS Load Balancer Controller Goes GA on Gateway API: Why Your Self-Hosted Ingress Bet Just Got Its Strongest Signal Yet
AWS Load Balancer Controller v3.0.0 made Gateway API generally available — the hyperscaler's own controller now targets typed Gateway/HTTPRoute CRDs instead of annotations. What that signals for self-hosted fleets, the four non-portable limits, and an Envoy-vs-Cilium pick table.
Your Buildpack Already Wrote the SBOM — Your Cluster Just Isn't Reading It
Cloud Native Buildpacks already emit a per-layer SBOM with every image, but most fleets never enforce it. Attaching that SBOM as a signed Sigstore attestation and verifying it with an admission controller turns scan-after-deploy into a deny decision before an unapproved image ever shares a node with other tenants.
CAPH Stopped Checking Your Server Type: What Hetzner's Hardware Churn Teaches About Pinning Machine Templates
CAPH v1.0.7 deleted its hardcoded server-type allowlist after Hetzner's October 2025 lineup rework retired types like cx22. A typo'd or retired type now passes kubectl apply and fails later at Hetzner's API — here is the four-part CI discipline that replaces the deleted guardrail.
Cloud Native Buildpacks Just Graduated: Why Your PaaS Build Step Shouldn't Belong to One Vendor
Cloud Native Buildpacks graduated in August 2026 with 535 contributors and 20+ production adopters. Graduation makes CNB the boring, multi-vendor foundation for a fleet's build step — just as Nixpacks' maintenance mode shows what single-vendor builders cost — but build speed still has to be earned with cache locality.
Freeze the Crash: How CRIU Container Checkpoints Turn a Crash-Looping Pod Into a Debuggable Core Dump
One kubelet API call freezes a failing container into a tarball of memory, file descriptors, and process state. What the January 2026 Checkpoint/Restore Working Group means, the exact checkpoint-debug-restore loop, and the four boundaries — TCP sockets, GPUs, sandboxed runtimes, pod-level restore — that still say no.