505 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
CVE-2026-24834: The Kata Containers Bug That Turned a Hardware Isolation Boundary Into a Config Default
A container process with nothing but CAP_MKNOD got root inside a Kata Containers microVM meant to be hardware-isolated. Here's the exploit, the exact audit to run against your fleet, and why the fix was a config default, not a KVM flaw.
kro Just Landed in CNCF's 'Adopt' Tier Next to Helm — While Still Being Alpha Software
CNCF and SlashData's Q1 2026 Platform Engineering Radar put kro in the 'Adopt' tier alongside Helm and Backstage — a maturity signal for a project still shipping a v1alpha1 API. Here's the actual RGD YAML, what the rating measured, and what building a tenant-facing App CRD on kro's pattern would cost a Cluster API fleet.
Kubernetes 1.36's CRI List Streaming Doesn't Cut Kubelet Memory — It Removes a Hard Container-Count Wall Bin-Packed Nodes Actually Hit
KEP-5825's own text admits CRI List Streaming does not reduce kubelet memory usage. The real fix is a hard 11,000-container / 14,000-pod gRPC ceiling that's already bricked production nodes — and it matters more on a fixed Hetzner box than an autoscaling cloud fleet.
Kubernetes' Partitionable GPU Devices (KEP-4815): The Real Cost Math Behind Slicing One GPU Into 7 Schedulable Sandboxes
Kubernetes' Partitionable Devices KEP lets one GPU serve multiple independently-scheduled sandboxes instead of one tenant. Here's the actual cost math on 7-way MIG slicing versus whole-card allocation, and what a Cluster API GPU node needs to expose those slices.
Kubernetes 1.34 Ships KYAML: What a Safer YAML Subset Does (and Doesn't) Fix for a Manifest-Generating PaaS
Kubernetes 1.34 shipped KYAML to kill YAML's Norway-problem bugs, but the KEP is explicit that it's a kubectl output format, not a server-side change. Here's what that actually means for a platform generating Cluster API and tenant manifests programmatically.
Kubernetes SIG Storage's Next Move Isn't Another Snapshot Feature: What Volume Health Monitoring and Mutable PV Affinity Actually Buy a Self-Hosted Fleet
Kubernetes SIG Storage's Volume Health Monitoring and Mutable PV Affinity don't need Hetzner's still-missing CSI snapshot support to matter — but only one of them actually works on a self-hosted fleet today. Here's the verified breakdown of both KEPs, straight from the spec text and the driver source.
Railway vs. Fly.io vs. Owning the Box: The Cost Comparison No PaaS Vendor Will Run For You
Northflank's Railway-vs-Fly.io teardown never asks what the same workload costs on an owned Hetzner box — here's the post-price-hike math, tier by tier, including the one case where per-second billing is supposed to win.
VolumeAttributesClass Went GA Promising Online Volume Resize. Here's What Actually Happens on a Self-Hosted Hetzner Fleet
Kubernetes 1.34 made VolumeAttributesClass GA, promising online volume tier changes with no detach-recreate cycle. Here's what actually happens when you check the CSI drivers a self-hosted Hetzner fleet runs — and the live gap even the one that supports it hasn't closed yet.
WebAssembly's 'Container Killer' Just Got Bought by a CDN
Akamai bought Fermyon in December 2025, but Spin and SpinKube left the company's sole ownership eight months earlier when they became CNCF projects. Here's the honest 2026 case for adding them as a self-hosted PaaS's second build target.