506 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
llm-d Is Now a CNCF Sandbox Project: What Kubernetes-Native Distributed Inference Means for Self-Hosting Your AI Agents' Brains
llm-d brings distributed LLM inference — prefix-cache-aware routing and prefill/decode disaggregation — to Kubernetes as a CNCF Sandbox project. What it means for self-hosting AI-agent inference, what it costs versus hosted APIs, and how early the project still is.
pedit COW: A Packet-Editor Bug Is the Fifth Linux Kernel Escape in Ten Weeks — and It Lives in Code Your CNI Already Loads
CVE-2026-46331 (pedit COW) is the fifth independent Linux kernel escape disclosed in ten weeks — and it lives in traffic-control code your CNI loads on every node. What the five-escape window means for self-hosted Kubernetes fleets, and the patch checklist that closes it.
No More AI API Keys in Env Vars: Reproducing Render's Short-Lived Anthropic and OpenAI Credentials on Your Own Kubernetes
Render's July 2026 Managed OIDC trades long-lived Anthropic and OpenAI API keys for short-lived tokens minted from platform identity — and the same exchange runs on any Kubernetes cluster via projected service-account tokens, issuer registration, and a JWKS upload. The concrete recipe plus what Render still operates for you.
Telepresence Intercepts vs a Preview Environment Per PR: Debugging Live Cluster Traffic From Your Laptop
Routing live cluster traffic to a laptop beats booting a preview per developer on fixed hardware — until it doesn't. A worked cost comparison, the traffic-manager's RBAC trust price, and the golden path that stacks both.
vCluster vs Signadot vs Full-Stack Copy: Which Preview-Environment Model Fits a Self-Hosted Fleet's Fixed Capacity?
Full-stack copy, virtual clusters, or request-level routing: a worked per-PR capacity comparison shows which preview-environment model fits a fixed self-hosted fleet, and why request-level isolation wins on owned hardware.
Your Next Platform User Isn't Human: RBAC and Quotas for AI Agents as Platform Consumers
CNCF's Platform Engineering 2.0 names AI agents as platform consumers with their own access, scope, and governance needs. Here is the concrete design that follows: per-agent identity, least-privilege roles, machine-speed quotas — and why MCP auth must be agent-first from day one.
Gateway API 1.4 Stabilizes BackendTLSPolicy: Encrypting the Gateway-to-Pod Hop Without a Service Mesh
Gateway API 1.4 graduates BackendTLSPolicy to stable, giving shared clusters a portable way to encrypt gateway-to-Pod traffic with fail-closed validation — here is the complete YAML and the rollout checklist for multi-tenant platforms.
Your Admission Webhook Never Saw That Container: Runtime Supply-Chain Verification With containerd's NRI
Static pods, direct node access, and webhook outages all bypass API-layer image checks. A CNCF-backed NRI plugin moves SLSA, VEX, and VSA verification into the container runtime itself — here is how it works and what it costs to run across a fleet.
Railway Locked Enterprise Deploys to a GitHub Org Allowlist: Build the Same Guardrail on Your Own Fleet
Railway's May 2026 changelog lets enterprise workspaces restrict deployments to approved GitHub orgs. Here is what the guardrail enforces and how to rebuild it on your own fleet with ArgoCD source pinning, Kyverno admission policy, and pipeline owner checks.