506 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Why Self-Hosted PaaS Secrets Managers Still Default to Plaintext Env Vars: A Survey of Coolify, Dokploy, and CapRover
Coolify, Dokploy, and CapRover all hand your production credentials to anyone with dashboard access — a feature-by-feature survey of how each stores secrets, why plaintext env vars are an architectural default, and what a Sealed Secrets or External Secrets Operator pattern on Kubernetes buys instead.
The Tailscale Kubernetes Operator Exposes kube-apiserver Without Touching the Public Internet
84% of internet-observable Kubernetes API servers answer to the public internet. The Tailscale operator's API server proxy replaces the IP allowlist with identity-authenticated tailnet access — here is what changes for a self-hosted fleet, what it costs, and what Headscale users shouldn't assume.
Cluster API v1.12's In-Place Updates and Chained Upgrades: What Changes for a Platform Team Running CAPH/CAPD in Production
Cluster API v1.12 shipped in-place updates and chained upgrades. For a 3-control-plane, 20-worker Hetzner fleet jumping three Kubernetes minors, that turns 29 replace-and-drain cycles under best pre-v1.12 practice into as few as zero — and three hand-sequenced hops into one declared version. The before/after runbook, with the CAPD rehearsal loop.
Flagger vs Argo Rollouts in 2026: Which Progressive-Delivery Operator Should Power a Git-Push PaaS's Canary Rollouts?
Flagger and Argo Rollouts shipped releases three days apart in July 2026, but they make opposite bets: wrap the Deployment or replace it, headless reconciler or human dashboard. A build-vs-choose comparison of each operator's stack assumptions, with a concrete verdict for a git-push PaaS on a Cluster API fleet.
ArgoCD 3.3 vs Flux 2.0 in 2026: Which GitOps Reconciler Fits a Cluster-API-Managed Fleet's Own Deploy Pipeline
Argo CD has 2.8x Flux's GitHub stars, but a self-hosted PaaS on Cluster API needs a reconciler shape, not a deploy dashboard. A four-axis head-to-head — tenancy, fleet rollout, footprint, security — with a concrete verdict for platform builders.
Blue-Green Deploys on Cluster API: Flipping a Tenant's Traffic Between Two MachineDeployments Without Touching the Load Balancer
A rolling MachineDeployment update isn't blue-green. Here's the actual Cluster API primitive for an atomic, instantly-reversible traffic cutover — two MachineDeployments, one Service selector flip, and the in-flight-request handling most implementations skip.
CVE-2026-18381: When Your Operator's CRD Field Becomes a Token Exfiltration Bootstrap
A user-editable upload URL in a Red Hat OpenShift operator let anyone with CR edit access steal its service-account token — no exploit needed, just a redirect. Here's the audit checklist for finding the same bug shape in your own operators.
Show HN's Cygnus: What a Serverless-Runtime Framing Actually Changes (and What It Doesn't) Versus a Container-Per-App PaaS
Cygnus revives an idle app from zero in about 30 milliseconds using kernel-sandboxed 'cages' instead of containers. Here's exactly what that architecture buys over Coolify and Dokploy's always-on containers — and why it still hits the same one-box ceiling the rest of the category has.
Kubernetes 1.36's Declarative Validation Goes GA: Which Webhook a Self-Hosted Cluster API Fleet Can Actually Delete — and Which One It Can't
Kubernetes 1.36's Declarative Validation only touches built-in types, not CRDs — the webhook a Cluster API fleet can actually delete graduated two releases earlier under ValidatingAdmissionPolicy. Here's the exact boundary between the three mechanisms, and the stateful checks none of them can replace.