505 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Januscape: A 16-Year-Old KVM Escape, the Two CVEs That Fix It, and the One Kernel Flag Your Fleet Should Audit
Januscape (CVE-2026-53359) is a 16-year-old KVM shadow-MMU bug giving guest root a host escape on Intel and AMD — closed by two CVEs and mitigated by one kernel flag. What it means for hypervisor-backed tenant isolation, and the fleet audit that verifies the fix.
Your Gateway's Next Feature Doesn't Need an Envoy Fork: What kgateway's Rust Dynamic Modules Actually Buy a Self-Hosted PaaS
kgateway's Rust dynamic modules run custom payload logic inside Envoy at native speed with no fork and no recompile. How the mechanism works, how it compares to Lua, Wasm, and ext_proc, and the three catches a self-hosted platform team should budget for.
Kubernetes v1.36 Route Sync Metric: Catch Your CCM Wasting API Calls on Hetzner
Kubernetes v1.36 adds a route sync counter to the Cloud Controller Manager. Here is what it measures, how to A/B test watch-based reconciliation with it, and which Prometheus alerts to wire on Hetzner.
Kubernetes v1.37 Takes Workload-Aware Scheduling to Beta: Bin-Packing Batch Jobs on Bare Metal Without a Managed Autoscaler
Kubernetes v1.37 graduates gang scheduling and the Workload/PodGroup APIs to Beta. A worked before/after on a fixed 4-node pool shows what atomic placement buys a bare-metal fleet with no autoscaler, plus the exact feature gates and API versions needed to opt in.
The Heroku-to-Kubernetes Exit Industry, Mapped: 4 Vendors, 6 Steps, and an Honest Downtime Budget
Qovery's September 2026 guide maps the Heroku-to-Kubernetes exit market into four buyable vendor categories and one repeatable six-step cutover. The honest version: stateless services move with zero downtime, but promoting a new Postgres primary needs a planned write pause of seconds to minutes.
Render Now Mints Short-Lived OIDC Tokens for Anthropic and OpenAI: The Beginning of the End for LLM API Keys in Env Vars
Render's July 2026 changelog lets services authenticate to Anthropic and OpenAI with short-lived OIDC tokens instead of pasted API keys. How the federation works, the setup on each side, and the native equivalent on self-hosted Kubernetes.
France's Railway Runs on Cluster API and Talos Now: What SNCF's Zero-Drift Rebuild Teaches a Self-Hosted PaaS
SNCF cut cluster provisioning from a month to 30 minutes with Cluster API and Talos Linux. A look at the numbers behind the rebuild and what self-hosted platform teams should copy.
Self-Hosted Preview Environments: Pricing Uffizzi on Your Own Kubernetes Cluster Against Vercel and Metered EaaS
Self-hosting Uffizzi's namespace-per-PR previews on flat-rate Hetzner nodes costs ~$30/mo in infrastructure — but the honest comparison is ops attention versus a per-hour meter. A worked cost model with sensitivity across PR volume and environment lifetime.
Before Agents Create Their Own Compute: A Capacity Budget for Agent Sandboxes on Kubernetes
Agent-callable sandbox creation turns capacity into a control-plane decision. A worked budget for a three-node Hetzner fleet: warm-pool reserve, 32 claimable sandboxes, TTL defaults, per-tenant quotas, and admission rules that stop one runaway loop.