506 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
45-Day Let's Encrypt Certificates Are Here: The Renewal-Automation Bar Every Self-Hosted PaaS Now Has to Clear
Let's Encrypt's tlsserver profile dropped to 45-day certificates on May 13, 2026, and the default follows by 2028. A five-point audit of what a halved renewal window demands from a self-hosted PaaS's ACME pipeline: percentage-based margins, retry isolation, external expiry alerting, ARI, and 1-hour authorizations.
OpenCost 1.121 Brings Inference Cost Tracking to Kubernetes: Metering GPU Token Workloads Like Any Other Tenant
OpenCost 1.121 adds per-inference cost metering to Kubernetes, so self-hosters can finally measure dollars per million tokens per tenant. We decompose owned vs leased vs rented GPU vs API costs, find the utilization crossover, and wire vLLM token metrics into a multi-tenant showback report.
Spend Caps Are a Feature Hosted PaaS Has to Build — and Owned Hardware Gets for Free
Railway's July 2026 CLI usage limits let you cap spend by taking your own app offline. A fixed-price Hetzner box makes the same guarantee for free — but owned hardware still owes its tenants quotas. The full economics of bill anxiety, with the numbers.
Static Outbound IPs Are a Paid PaaS Add-On — and a Rounding Error on a Server You Own
Railway's July 2026 release put static outbound IPs behind its Pro plan — the same allowlist-friendly egress identity that costs €0.50/month on a Hetzner box. A platform-by-platform accounting of the egress tax on Railway, Render, Heroku, and Fly.io versus servers you own.
step-ca vs Let's Encrypt: What an Internal-Only ACME CA Buys Your Fleet's Service-to-Service TLS
Let's Encrypt logs every certificate publicly and refuses private hostnames by design. step-ca gives a Cluster API fleet automated internal TLS with 24-hour certs and no CT-log exposure — here's the full setup, plus the honest cost of running your own CA.
Six Traefik Gateway API Advisories in Six Months: The Namespace-Boundary Probes Your Shared Ingress Owes Every Tenant
Traefik shipped six Gateway API isolation advisories between March and August 2026 — including a 9.9 CRITICAL REST-provider exposure and a route-key collision with no workaround. Seven concrete namespace-boundary probes, each with the manifest and the exact assertion, for any platform routing many tenants through one shared ingress.
Appwrite Sites and the BaaS Land Grab: When Your Backend Vendor Wants to Host Your App Too
Appwrite Sites turns an open-source BaaS into a git-push app host, and the 1.9.5 release adds branch/path deploy filters, a Rust runtime, and Bun/Deno builds. Here's what backend vendors climbing the stack means for who owns your deploy pipeline — and where a single-box Compose stack ends and a scheduled fleet begins.
CNCF's Platform Engineering 2.0 Five Pillars: Grading a Self-Hosted PaaS Against the AI-Era Scorecard
CNCF's July 2026 Platform Engineering 2.0 framework sets five AI-era pillars. We grade a Cluster-API-managed, Render-compatible self-hosted PaaS against each one — one pass, two partials, two gaps — and map the honest upgrade path.
Docker Hub Almost Cut You to 40 Pulls an Hour: The Math for Sizing Your Own Registry Cache
Docker's walked-back 10/40-per-hour limits were a preview, not a false alarm: a 15-developer team with ephemeral CI runners and a 12-node cluster hits today's enforced 100/200-per-6-hour buckets on an ordinary Tuesday. The full pull ledger, the tipping-point formula, and how to size and wire a registry cache — registry:2 or Harbor — into a Cluster API fleet.