640 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Your Tenants' 'edit' Role Could Steal Another Tenant's DNS Credentials: The cert-manager Challenge Bug and the RBAC Audit to Run Today
A cert-manager bug let any tenant with Kubernetes' built-in edit or admin role steal another tenant's DNS credentials through a crafted ACME Challenge — not from a misconfiguration, but from an RBAC aggregation label almost no one audits. Here's the mechanism and a six-check audit to run against your own multi-tenant TLS setup.
CloudNativePG's First CVE Is a 9.4: How Scraping Metrics Handed Out Postgres Superuser
CloudNativePG's first-ever CVE let a low-privileged database user escalate to PostgreSQL superuser and OS command execution through the default metrics exporter — the exploit chain, the fix, and the unrelated failover bug that shipped in the same release.
Cluster API v1.12: What Chained Upgrades Actually Save a Kubernetes Fleet That Fell Behind
Cluster API v1.12 adds in-place updates and chained upgrades — here's what collapsing three separate Kubernetes minor-version rollouts into one reconciliation pass actually saves a bare-metal Hetzner fleet that fell behind, and where the old drain-and-verify discipline still applies.
ClusterClass Turns Tenant Cluster #500 Into a One-Line Diff From Cluster #1
Cluster API's ClusterClass collapses seven hand-copied objects per tenant cluster into one shared template plus a handful of variable overrides — the concrete before/after, the patch mechanics, and what it still doesn't solve.
Coinbase's Rollback Tool Broke Along With the Deploy It Was Supposed to Fix
A 50-minute Coinbase outage on July 14, 2026 got worse because the tool engineers needed to roll back the bad deploy was itself unreachable through the gateway the deploy had just broken. Here's the mechanism, and a concrete audit for whether a self-hosted PaaS's own control plane could hit the same trap.
GitHub Copilot's Coding Agent Now Runs on Self-Hosted Runners — But You Have to Turn Off Its Firewall to Get There
GitHub's coding agent can now run on your own Actions Runner Controller fleet to reach internal registries and on-prem services — but doing so requires disabling its managed firewall entirely. Here's what changes, and the three ARC misconfigurations that leave the gap unguarded.
DockLog Ships One Image for Docker and Kubernetes Logs: What It Buys a Cluster API Fleet Over kubectl logs -f
DockLog puts Docker and Kubernetes log tailing behind one container and one RUNTIME_MODE toggle — here's exactly what that buys an operator over kubectl logs -f loops, where its single-cluster scope stops short of a real fleet, and when a growing fleet actually needs Loki instead.
Preventing etcd Zombies on Upgrade to 3.6: A Cluster API Operator's Pre-Flight Checklist
Kubeadm still pins etcd to v3.5.24-0 for Kubernetes 1.31 through 1.33 — one patch below the v3.5.26 floor etcd's maintainers say you need before v3.6. Here's why Cluster API's machine-replacement upgrade model skips that safety margin entirely, and the pre-flight checklist to run before you cross the boundary.
The 2026 'PaaS First' Consensus Has a Blind Spot: Who Owns the Machines
Hacker News flipped its default from Kubernetes-first to PaaS-first in 2026 — but the argument for skipping Kubernetes and the argument for handing your infrastructure to a vendor are not the same argument, and most 2026 takes conflate them.