640 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Cloudflare OS Is Apache-2.0 — But the Only Supported Substrate Is Cloudflare's Network
Cloudflare OS launched Apache-2.0 with zero-access agents and Gatekeeper Workers — but the only supported production path deploys into a Cloudflare account. A component-by-component portability ledger, the Hacker News stress test, and a four-question audit separating open code from an open substrate.
Crossplane vs Cluster API: Two CNCF Answers to "Should Infrastructure Be an API?" — and Where a Self-Hosted PaaS Draws the Line
Crossplane models everything from databases to GPU inference fleets as one declarative API; Cluster API keeps a written list of what it refuses to manage beyond cluster lifecycle. A side-by-side of what each CNCF project actually optimizes for, why they compose as layers rather than compete, and why a self-hosted PaaS builds on Cluster API while skipping multi-cloud abstraction.
Heroku Is in Sustaining-Engineering Mode. Dokku Is the Obvious Exit — Here's What It Actually Gets You (and What It Doesn't)
Heroku's February 2026 shift to sustaining engineering has teams planning exits. A grounded look at migrating to Dokku: the Heroku-to-Dokku concept map, the honest limits of a single-server PaaS, the ten-command migration, and where the one-box ceiling ends.
Gitea's Docker Image Trusted Every Proxy on Earth: A Five-Question Audit for the Defaults Baked Into Your Images
Gitea's container image shipped REVERSE_PROXY_TRUSTED_PROXIES = * while its own docs said loopback-only — CVSS 9.8, armed by the very SSO flag a platform is supposed to set. Five runnable questions, plus a CI check, for auditing the defaults hiding in every image and chart your platform ships.
Headlamp's Knative Plugin Surfaces Traffic Splitting and Scale-to-Zero in One View: What a Serverless Runtime Actually Needs From a Cluster API Fleet's Ingress Layer
The June 2026 Headlamp plugin makes Knative traffic splits and scale-to-zero state visible in one view. Here is what those primitives buy a git-push PaaS, the Gateway API stack a Cluster API fleet must run underneath, the cold-start bill tenants pay, and why scale-to-zero should be opt-in for production routes.
The 4GB RAM Price Gap: What Hetzner at $4 vs Heroku at $260 Actually Buys You
A 4GB-RAM machine costs $4 on Hetzner and $250+ on Heroku. Re-verified 2026 prices, an itemized look at what the 14x–125x premium buys, and a break-even table that prices in your own ops hours.
Metering Your Tenants: Build a Kubernetes Metrics Exporter for Railway-Style Usage Showback
Build a small Go exporter that turns cAdvisor's CPU, working-set memory, and network counters into per-app usage statements priced at Railway's public meters — plus the five cAdvisor pitfalls that silently corrupt naive per-container accounting.
Kubernetes v1.37's Deprecation Sweep: The Migration Inventory a Cluster API Fleet Needs Before August 26
Kubernetes v1.37 lands August 26, 2026, and the July 31 sneak peek already names every deprecation and breaking change. Here is the full migration inventory for a Cluster API fleet — ipvs kube-proxy, static-pod Secret refs, cgroup v1, SELinuxMount GA — with the audit command and deadline for each.
45-Day Let's Encrypt Certificates Are Here: The Renewal-Automation Bar Every Self-Hosted PaaS Now Has to Clear
Let's Encrypt's tlsserver profile dropped to 45-day certificates on May 13, 2026, and the default follows by 2028. A five-point audit of what a halved renewal window demands from a self-hosted PaaS's ACME pipeline: percentage-based margins, retry isolation, external expiry alerting, ARI, and 1-hour authorizations.