640 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Mimir vs Cortex vs Thanos: Picking the Multi-Tenant Metrics Backend for a PaaS That Bills by Usage
Mimir, Cortex, and Thanos compared as the multi-tenant metrics backend for a self-hosted PaaS that bills by usage — per-tenant cardinality isolation, cost attribution for chargeback, and owned-capacity footprint, with a decision table.
Stop Copying Registry Passwords Into Every Namespace: Kubernetes 1.34 ServiceAccount Image Pulls in Practice
Kubernetes 1.34's beta ServiceAccount token flow replaces per-namespace imagePullSecrets with short-lived, workload-bound pull credentials — how to wire the registry side, bind ServiceAccounts, handle rotation, and test the failure modes before deleting static secrets.
Sonobuoy Conformance as a Fleet Gate: Don't Schedule Tenants on an Unproven Node
A two-tier Sonobuoy gate for CAPH-managed Hetzner fleets: taint every new machine at join, prove it with a focused non-disruptive conformance slice, and reserve full certified-conformance for template promotion on a canary cluster.
SUSE Put MCP Across Its Whole Portfolio: What a Vendor-Blessed Agent-to-Infra Interface Means for Your PaaS's Own MCP Server
SUSE embedded MCP servers across Rancher Prime and Multi-Linux Manager with AWS, n8n, Revenium, and Stacklok aboard. Here is what a vendor-blessed agent-to-infra interface validates for a PaaS agent API, where its patch-and-monitor scope stops short of the git-push deploy surface, and a checklist for building that surface yourself.
ARC 0.14.0: Ephemeral Tenant CI on Your Own Fleet, Without the Scale-Set Sprawl
ARC 0.14.0 adds multilabel runner scale sets, stale-config protection, and a standalone Go client — a walkthrough of running ephemeral per-job tenant CI on a Cluster-API fleet, from Helm install to listener scheduling.
Gateway API v1.5 Is Stable: What a Self-Hosted Fleet Gains by Leaving Ingress Behind, and What the Move Costs
Gateway API v1.5 and v1.6 graduated TLS passthrough, CORS, mTLS, and TCP/UDP routing to stable while ingress-nginx went unpatched. A self-hosted fleet's migration guide: an annotation mapping table, a worked Ingress-to-HTTPRoute rewrite, and the real cost of the move.
Kubernetes Rewrote Its Image Promoter and Deleted 20% of It: A 7-Phase Registry Lesson for Self-Hosted PaaS
Kubernetes rewrote kpromo, its registry.k8s.io image promoter, deleting 20% of the code while cutting plan time from 20 minutes to 2 and signature replication from 17 hours to 15 minutes. A close read of the 7-phase pipeline — and what a self-hosted PaaS should copy and skip.
Your TLS Renewals Have an Expiration Date Too: Auditing cert-manager for Let's Encrypt's 45-Day Countdown
Let's Encrypt drops to 45-day certificates by 2028 — run this four-step cert-manager audit on versions, hardcoded renewBefore windows, the ARI gate, and expiry alerting before fixed renewal intervals start breaking.
Kubernetes 1.37 Locks In On-Demand PLEG Relist: What Cost-Sized Nodes Actually Save
Kubernetes 1.37 graduates PLEG on-demand relist to GA, cutting pod-create observation from 1.8s to 1.1s with no opt-out. What the locked-on change saves cost-sized node pools, and a six-step checklist to verify it during your upgrade.