640 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
The Tailscale Kubernetes Operator Exposes kube-apiserver Without Touching the Public Internet
84% of internet-observable Kubernetes API servers answer to the public internet. The Tailscale operator's API server proxy replaces the IP allowlist with identity-authenticated tailnet access — here is what changes for a self-hosted fleet, what it costs, and what Headscale users shouldn't assume.
Cluster API v1.12's In-Place Updates and Chained Upgrades: What Changes for a Platform Team Running CAPH/CAPD in Production
Cluster API v1.12 shipped in-place updates and chained upgrades. For a 3-control-plane, 20-worker Hetzner fleet jumping three Kubernetes minors, that turns 29 replace-and-drain cycles under best pre-v1.12 practice into as few as zero — and three hand-sequenced hops into one declared version. The before/after runbook, with the CAPD rehearsal loop.
Flagger vs Argo Rollouts in 2026: Which Progressive-Delivery Operator Should Power a Git-Push PaaS's Canary Rollouts?
Flagger and Argo Rollouts shipped releases three days apart in July 2026, but they make opposite bets: wrap the Deployment or replace it, headless reconciler or human dashboard. A build-vs-choose comparison of each operator's stack assumptions, with a concrete verdict for a git-push PaaS on a Cluster API fleet.
ArgoCD 3.3 vs Flux 2.0 in 2026: Which GitOps Reconciler Fits a Cluster-API-Managed Fleet's Own Deploy Pipeline
Argo CD has 2.8x Flux's GitHub stars, but a self-hosted PaaS on Cluster API needs a reconciler shape, not a deploy dashboard. A four-axis head-to-head — tenancy, fleet rollout, footprint, security — with a concrete verdict for platform builders.
Blue-Green Deploys on Cluster API: Flipping a Tenant's Traffic Between Two MachineDeployments Without Touching the Load Balancer
A rolling MachineDeployment update isn't blue-green. Here's the actual Cluster API primitive for an atomic, instantly-reversible traffic cutover — two MachineDeployments, one Service selector flip, and the in-flight-request handling most implementations skip.
CVE-2026-18381: When Your Operator's CRD Field Becomes a Token Exfiltration Bootstrap
A user-editable upload URL in a Red Hat OpenShift operator let anyone with CR edit access steal its service-account token — no exploit needed, just a redirect. Here's the audit checklist for finding the same bug shape in your own operators.
Show HN's Cygnus: What a Serverless-Runtime Framing Actually Changes (and What It Doesn't) Versus a Container-Per-App PaaS
Cygnus revives an idle app from zero in about 30 milliseconds using kernel-sandboxed 'cages' instead of containers. Here's exactly what that architecture buys over Coolify and Dokploy's always-on containers — and why it still hits the same one-box ceiling the rest of the category has.
Kubernetes 1.36's Declarative Validation Goes GA: Which Webhook a Self-Hosted Cluster API Fleet Can Actually Delete — and Which One It Can't
Kubernetes 1.36's Declarative Validation only touches built-in types, not CRDs — the webhook a Cluster API fleet can actually delete graduated two releases earlier under ValidatingAdmissionPolicy. Here's the exact boundary between the three mechanisms, and the stateful checks none of them can replace.
Docker Hub's 2026 Price Hikes Make the Case for a Self-Hosted Harbor Registry
Docker's 2026 price hikes and pull rate limits push a busy CI pipeline into a $1,800/year seat-priced plan for one feature: unlimited pulls. Here's what a self-hosted Harbor registry costs instead.