505 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Kubernetes 1.35 Makes Supplemental Groups Strict: Closing the Shared-Volume Leak Hiding in Every Tenant Image's /etc/group
Kubernetes 1.35 lets a Pod ignore the supplemental groups baked into a container image's /etc/group — closing a quiet leak where an untrusted tenant image could silently gain access to another tenant's shared volume.
Kubernetes 1.36 Ships the Metric That Finally Proves Your Route Controller Isn't Wasting API Calls
Kubernetes 1.36 adds a counter that proves whether your route controller is syncing on real node changes or wasting API calls on a timer. Here's what it measures, how to check if your Hetzner CCM exposes it, and a PromQL alert that catches a stuck node join before it becomes an outage.
Kubernetes 1.36's Memory QoS Goes Tiered: What TieredReservation Actually Guarantees on a Multi-Tenant Node
Kubernetes 1.36 lets a kubelet write hard memory.min protection for Guaranteed pods and soft memory.low for Burstable ones. Here's exactly what that stops a noisy neighbor from doing on a bin-packed multi-tenant node — and the two failure modes it still doesn't cover.
Kubernetes 1.36 Didn't Put DRA in GA — Here's What Shipped, and How to Run GPU-Aware Scheduling on Your Own Hetzner Fleet
Kubernetes 1.36 didn't put Dynamic Resource Allocation into GA — that happened in 1.34. Here's what actually shipped for GPU scheduling, and how to get a real DRA-scheduled GPU node onto a self-hosted Cluster API fleet on Hetzner.
Kubernetes 1.36's HPA Can Now Scale to Zero: What It Actually Changes for Idle-App Billing
Kubernetes 1.36 finally defaults HPAScaleToZero on, but it only solves half the scale-to-zero problem. Here's the exact split, real cold-start numbers from Render and Fly.io, and a worked cost model for a self-hosted PaaS's dormant-app billing.
Kubernetes 1.36's PSI Metrics Graduate to GA: What Pressure Stall Information Catches About Resource Starvation That CPU% Utilization Misses
Kubernetes 1.36 locks PSI metrics to GA, catching resource stalls a CPU% dashboard can't see. Here's the worked example, the two ways the signal can lie, and the pre-flight checklist a bare-metal fleet needs before trusting it.
KubeVela's OAM Delivery Engine Runs Alibaba's Hybrid Cloud and ByteDance's Gaming PaaS: What It Buys Over a Simpler Git-Push Deploy API
KubeVela's component-trait-policy-workflow model runs Alibaba's hybrid-cloud fleet and ByteDance's gaming PaaS. Here's the concrete YAML gap between that and a Render-style git-push deploy API — and when the extra layer is worth the complexity.
Your Deploy Agent's Sandbox Will Die Mid-Rollout — Here's How Its MCP Server Should Survive That
MCP's July 2026 spec update made the protocol stateless — which means the burden of surviving a crashed sandbox now falls entirely on the MCP server. Here's the Postgres checkpoint design, borrowed from LangGraph, that a deploy-from-chat PaaS needs to make a multi-step rollout outlive the agent that started it.
Designing upgrade_cluster: An MCP Tool Contract for Fleet-Wide Kubernetes Node Upgrades
A deploy/rollback MCP tool that goes wrong costs a bad release. An upgrade_cluster tool that goes wrong can leave a fleet straddling a Kubernetes version-skew boundary mid-drain. Here's a concrete tool contract — plan mode, per-node health gates, and a hard stop — for handing an agent that authority safely.