509 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
How the controller-runtime Cache Actually Works: What PaaS Builders Should Know Before Their First OOMKill
Your operator's Get() never hits the API server — it silently caches every object of that Kind in the cluster. How controller-runtime's shared-informer cache works, why it OOMKills control planes at fleet scale, and the exact selectors, transforms, and DisableFor config that shrink a PaaS control plane from gigabytes to a few hundred MB.
Coolify v4 and the v5 Rewrite: What 325,000 Users on a Single-Box PaaS Say About Multi-Server Scalability
Coolify v4 polished the single-box self-hosted PaaS to a shine — then announced v5 as a ground-up rewrite for multi-server scalability. A mechanism-by-mechanism look at why fleet behavior can't be bolted onto per-host SSH orchestration, and what a Kubernetes/Cluster API platform inherits on day one.
Headlamp's Cluster API Plugin: What a Point-and-Click Fleet UI Changes for Teams Who'd Rather Not Live in kubectl
Headlamp's new Cluster API plugin puts CAPI fleet state behind a point-and-click UI. Where it beats kubectl and clusterctl, where it fights your GitOps loop, and why a self-hosted PaaS should adopt it for operators instead of building a fleet dashboard.
Retiring cluster-admin and the Shared Bastion: Kubernetes' Access-Broker Pattern for Production Debugging
Kubernetes' March 2026 guidance replaces cluster-admin exec and shared bastions with a three-layer access broker: least-privilege RBAC, group-based bindings, and a just-in-time gateway — plus how to wire it into a multi-tenant PaaS debug-shell feature without rebuilding the anti-pattern.
Cloudflare OS Is Apache-2.0 — But the Only Supported Substrate Is Cloudflare's Network
Cloudflare OS launched Apache-2.0 with zero-access agents and Gatekeeper Workers — but the only supported production path deploys into a Cloudflare account. A component-by-component portability ledger, the Hacker News stress test, and a four-question audit separating open code from an open substrate.
Crossplane vs Cluster API: Two CNCF Answers to "Should Infrastructure Be an API?" — and Where a Self-Hosted PaaS Draws the Line
Crossplane models everything from databases to GPU inference fleets as one declarative API; Cluster API keeps a written list of what it refuses to manage beyond cluster lifecycle. A side-by-side of what each CNCF project actually optimizes for, why they compose as layers rather than compete, and why a self-hosted PaaS builds on Cluster API while skipping multi-cloud abstraction.
Heroku Is in Sustaining-Engineering Mode. Dokku Is the Obvious Exit — Here's What It Actually Gets You (and What It Doesn't)
Heroku's February 2026 shift to sustaining engineering has teams planning exits. A grounded look at migrating to Dokku: the Heroku-to-Dokku concept map, the honest limits of a single-server PaaS, the ten-command migration, and where the one-box ceiling ends.
Gitea's Docker Image Trusted Every Proxy on Earth: A Five-Question Audit for the Defaults Baked Into Your Images
Gitea's container image shipped REVERSE_PROXY_TRUSTED_PROXIES = * while its own docs said loopback-only — CVSS 9.8, armed by the very SSO flag a platform is supposed to set. Five runnable questions, plus a CI check, for auditing the defaults hiding in every image and chart your platform ships.
Headlamp's Knative Plugin Surfaces Traffic Splitting and Scale-to-Zero in One View: What a Serverless Runtime Actually Needs From a Cluster API Fleet's Ingress Layer
The June 2026 Headlamp plugin makes Knative traffic splits and scale-to-zero state visible in one view. Here is what those primitives buy a git-push PaaS, the Gateway API stack a Cluster API fleet must run underneath, the cold-start bill tenants pay, and why scale-to-zero should be opt-in for production routes.