Software Delivery Platform – App Hosting & Managed Kubernetes on ayedo

Digital Sovereignty Does Not End at the Data Center

Wed, 09 Sep 2026 08:26:13 +0000

Why We Built the ayedo Edge Cloud

An application can be fully operated in Germany and still rely on US infrastructure for every single access.

Because before a request reaches the first pod in the Kubernetes cluster , a lot has already happened. DNS has resolved the name. The internet has chosen a network path. A public IP has been reached. TLS has been terminated or forwarded. Traffic has been inspected and distributed to a backend.

DNS, Routing, Anycast: Why Europe's Cloud Also Needs Its Own Edge

Wed, 09 Sep 2026 08:19:24 +0000

We recently introduced the ayedo Edge Cloud, a European edge infrastructure for DNS, Anycast, load balancing, web application firewall, DDoS protection, and controlled access to applications.

The response showed us that a closer look at the technology is worthwhile. An Edge Cloud is far more than just a front-end load balancer.

It controls a crucial part of the infrastructure: the path from the public internet to the actual application.

Building the Edge — Part 1

Wed, 09 Sep 2026 07:38:27 +0000

The Underestimated Architecture of Modern Applications

Modern applications no longer start in the data center.

Edge is Not a Kubernetes Feature

Mon, 07 Sep 2026 10:42:25 +0000

Why the ayedo Edge Cloud Can Operate Independently of Any Infrastructure

Equating Edge infrastructure with Kubernetes conflates two distinct layers.

Kubernetes orchestrates workloads. An Edge Cloud controls how traffic reaches these workloads.

This separation is crucial.

The ayedo Edge Cloud forms an independent infrastructure layer between the internet and the backend. DNS, routing, load balancing, monitoring, and protection mechanisms are implemented not where an application runs, but in front of it.

From Cloud Company to Instagram Sensation:

Mon, 07 Sep 2026 10:12:43 +0000

ayedo from Schwalbach Reaches Millions

Cloud infrastructure, Kubernetes , and digital sovereignty are the core business. On Instagram, ayedo shows a completely different side: With humorous office videos, the Schwalbach-based tech company now reaches millions. A single reel garnered over 1.2 million views.

Schwalbach, September 2026 – Typically, ayedo deals with topics that rarely go viral on Instagram: Cloud infrastructure, Kubernetes, Open Source, and the secure operation of business-critical applications. Since 2017, the company from Schwalbach in Saarland has been developing Container solutions and working on European alternatives to services from international cloud and tech providers.

Weekly Backlog Week 37/2026

Mon, 07 Sep 2026 07:57:34 +0000

🧠Editorial

100 billion dollars for an AI company. 18 million euros less for the IT of a capital city. Priorities are indeed a fascinating thing.

While Anthropic is preparing for a record-breaking IPO, the data leak in Berlin vividly demonstrates what happens when the expectations and reality of digital infrastructure diverge.

This raises questions that will likely occupy us for some time: Who actually owns our most sensitive data? How should AI be sensibly regulated? And how do we orchestrate its growing demand for computing power?

ayedo Launches European Edge Cloud as a Sovereign Alternative to Cloudflare

Mon, 07 Sep 2026 07:38:54 +0000

Own network infrastructure, Anycast, DDoS protection, and five active Points of Presence in Germany: With the ayedo Edge Cloud, ayedo expands its cloud platform with a sovereign edge infrastructure for modern applications.

Saarbrücken, September 7, 2026 – The German cloud provider ayedo today announces the availability of its new ayedo Edge Cloud. The platform serves as the central entry layer between the public internet and applications, integrating Anycast routing, DNS, TLS, Layer-4 and Layer-7 load balancing, Web Application Firewall, DDoS protection, and health checks.

ayedo Edge-Cloud: The Underestimated Architecture of Modern Applications

Mon, 07 Sep 2026 07:20:24 +0000

Modern Applications No Longer Start in the Data Center

From DNS to Backend: The Request Path at the Edge

Fri, 04 Sep 2026 22:12:58 +0000

TL;DR

Kubernetes resources already contain the logical mapping between hostnames and applications. An automated DNS process can evaluate this information from Ingress or Gateway API , generate appropriate records for the edge address, and synchronize changes. Clear responsibilities, secure deletion logic, and the connection of DNS, edge routing, and backend targets are crucial.

Introduction

A hostname in a Kubernetes resource is initially just a routing rule. It becomes reachable only when DNS points to a public entry point, and this entry point forwards the hostname to the correct backend. This is where many environments experience breakdowns: Teams maintain Ingress rules, DNS records, and edge configurations separately. This separation makes changes error-prone, outdated records persist, and new services are only reachable after manual coordination. Kubernetes automatic DNS records do not solve this problem merely by adding another controller. A robust lifecycle is needed, which controls hostnames from Ingress or Gateway resources up to the reachable edge address.

Issuing Kubernetes Certificates via DNS Challenge

Wed, 02 Sep 2026 14:12:28 +0000

TL;DR

The DNS-01 challenge validates a domain using a TXT record and does not require a publicly accessible HTTP application. This is particularly relevant when the ayedo Edge Cloud handles public traffic and terminates TLS while the Kubernetes cluster remains isolated. Clear responsibilities for DNS, certificates, and TLS are crucial.

A certificate for a Kubernetes service is not successfully issued just because an ingress is internally accessible. ACME processes validate a domain through a defined network path. With HTTP-01, the validation service must reach the application over port 80. With DNS-01, a correctly set TXT record under _acme-challenge suffices. This fundamentally changes the requirements for network topology, firewall rules, and the boundaries of responsibility between the cluster and the edge.

Automatically Provisioning Load Balancers from Kubernetes

Wed, 02 Sep 2026 14:12:27 +0000

TL;DR

Kubernetes can trigger the provisioning of a public load balancer as a declarative process. A Kubernetes Service describes the desired access to the application, while the ayedo Edge Cloud handles public accessibility, routing, and protection. This reduces manual network configuration and cleanly separates workload and edge responsibilities.

Introduction

A common operational error is treating Kubernetes workloads and public network configuration as two separate change processes. One team creates a Kubernetes Service , while another manually configures a cloud load balancer, DNS entries, or backend targets. This results in delays, media breaks, and potentially divergent states. A Kubernetes-native provisioning process takes a different approach: the desired accessibility is described as a resource and implemented automatically. The key is the clear separation between cluster workload and edge configuration. Kubernetes manages the application and its service abstraction; the ayedo Edge Cloud handles the public ingress, routing, protection, and traffic distribution.

Provider-Independent Kubernetes Ingress with the Edge Cloud

Wed, 02 Sep 2026 14:12:27 +0000

TL;DR

Many DNS issues arise not from a single faulty record but from contradictory changes across multiple zone environments. A service is switched to a new endpoint internally, while the external zone continues to point to the old target. Or a publicly accessible name is spelled differently in the internal zone than in the external zone. Such discrepancies lead to errors that are difficult to reproduce: Applications work from the corporate network, external clients receive different responses, and operations teams search in the wrong places. Synchronizing DNS zones is therefore primarily a matter of responsibility, visibility, and change processes—not about the most complete duplication possible.

Securely Planning and Operating DNSSEC in Multi-Provider DNS

Wed, 02 Sep 2026 14:04:53 +0000

TL;DR:

DNSSEC enhances the trustworthiness of authoritative DNS responses, but any discrepancy between DNS providers becomes operationally significant. In a multi-provider architecture, zone signing, DNSSEC keys, DS records, delegation, and failover must be planned as an integrated process. Redundant DNS operation is only resilient if all providers deliver verifiable and consistent responses.

Many DNS architectures treat DNSSEC as an option activated after redundancy is established. In multi-provider DNS, this order is risky. Once multiple authoritative systems deliver the same zone, not only A, AAAA, or MX records need to be synchronized. DNSKEY, RRSIG, and potentially NSEC or NSEC3 records must also fit the signing model.

Manage External DNS Zones Centrally and Controlled

Wed, 02 Sep 2026 14:04:42 +0000

TL;DR

Cleanly Separating BGP Routing and Backend Failover

Wed, 02 Sep 2026 13:51:55 +0000

TL;DR

BGP routing determines which network path a client uses to reach the edge. However, it does not indicate whether a specific backend is operational. This task is handled by health checks and backend failover within the edge cloud. Separating these two failure domains prevents false expectations and simplifies operational analysis.

A common misconception in distributed architectures is that if an application is unreachable, the routing must have failed. In reality, errors often lie beyond the edge, such as a failed backend, a faulty service, or a disrupted cluster connection. Conversely, a properly functioning backend can be useless if the path to the edge is not working.

Kubernetes 1.37: Metrics API Reaches Stability

Fri, 28 Aug 2026 13:43:29 +0000

The Metrics API is Stable – After Nearly Nine Years in Beta

With Kubernetes 1.37, metrics.k8s.io is released as v1, marking it as a Stable API. The Resource Metrics API has been part of the established infrastructure of a Kubernetes cluster for years: it provides current CPU and memory usage data for nodes and pods, is consumed by kubectl top, and forms the basis for resource-based autoscaling via the HorizontalPodAutoscaler.

Weekly Backlog Week 36/2026

Thu, 27 Aug 2026 08:15:14 +0000

🧠Editorial:

Sometimes you only realize how dependent you are when something fails. Or is sold. Or suddenly someone else wants access to your data.

That’s exactly what this issue of my Weekly Backlog is about.

The USA wants access to European police data. Billions of images from Pokémon Go become training material for AI years later. An Exchange outage reminds companies how much of their communication relies on a single provider. And AWS acquires the company behind DuckDB – while the code remains Open Source.

Zero-Downtime Migration

Thu, 27 Aug 2026 08:00:45 +0000

Historical application structures and evolved monoliths often form the operational backbone of established companies. However, as the demands on digital business processes become more dynamic, these traditional infrastructures increasingly become costly barriers to innovation—especially when every code change or platform migration threatens business-critical downtime.

As an architectural solution, the gradual integration into standardized container orchestration platforms is becoming established. By strictly separating application logic from the underlying operating system, companies decouple their business-critical legacy processes from historical hardware, ensure seamless transitions, and lay the foundation for future-proof, scalable architectures.

Weekly Backlog Week 35/2026

Tue, 25 Aug 2026 11:21:42 +0000

📰 Tech News:

German Companies Fear Their US Dependency

German companies increasingly view their reliance on US technology as a risk. However, many do not take any action.

This is shown by a recent ifo survey reported by heise. 88 percent of the companies surveyed use digital products from the US. 31 percent consider their dependency to be significant. Particularly noteworthy: about one in five companies considers their own dependency risky but still does not plan any countermeasures.

August 2026

Tue, 25 Aug 2026 11:12:03 +0000

Cloud infrastructure is constantly evolving. That’s why we want to provide a monthly overview of what’s happening at ayedo—technically, entrepreneurially, and with a focus on digital sovereignty.

In this first edition, we discuss our new Edge Cloud, the renewed certification according to ISO 27001 and ISO 9001 , and why we’re still quite alone on a European social media platform.

In short: three topics worth reading about.

The Exit Strategy as a Competitive Advantage:

Mon, 24 Aug 2026 07:17:33 +0000

In tenders and procurement processes within the industrial, financial, and critical infrastructure sectors, mid-sized service providers are observing a fundamental shift: Pure functionality promises and ISO certificates are no longer sufficient for large corporations. In the context of NIS-2, DORA, and stringent supply chain audits, purchasers and security officers demand explicit proof that business-critical data flows and service workflows are portable in an emergency and not held hostage by individual US SaaS monopolies.

The Zero-Trust Identity Foundation:

Mon, 24 Aug 2026 07:15:07 +0000

In many medium-sized IT organizations, identity and access management has organically evolved into a confusing patchwork over the years. Local user databases in isolated SaaS tools, manual password lists, and inconsistently enforced multi-factor procedures open dangerous attack vectors and make regulatory evidence impossible in critical situations. With the implementation of strict supply chain security requirements like NIS-2 and industry-specific KRITIS audits, this identity chaos threatens to become a direct exclusion criterion in the awarding of framework contracts.

The TCO Liberation Strike:

Mon, 24 Aug 2026 07:12:59 +0000

In the commercial mid-market, standard SaaS was considered the economic optimum for years: no acquisition costs for servers, seemingly transparent per-user pricing, and zero administrative effort. However, as the workforce grows and compliance requirements increase, the cost calculation shifts. Linear licensing models, opaque feature tierings, and annual price increases of 15 to 25% turn the supposedly lean cloud strategy into a financial bottomless pit.

True cost efficiency is not achieved by renting proprietary US licenses, but by decoupling user numbers from infrastructure costs. Consolidating collaboration, ticketing, and signature workflows on a sovereign managed Kubernetes platform breaks the linear cost curve and sustainably reduces the Total Cost of Ownership (TCO) by up to 40%.

The End of Siloed SaaS:

Mon, 24 Aug 2026 07:10:56 +0000

In many medium-sized service and industrial companies, the IT landscape resembles a patchwork of isolated SaaS tools: Zendesk for tickets, Microsoft Teams for chats, SharePoint for files, and DocuSign for signatures. What appears modern in isolation proves to be an operational bottleneck in daily business, slowing employees down with constant context switching and scattering business-critical data across countless US clouds.

True efficiency and data integrity do not arise from merely stacking proprietary monoliths, but through the targeted orchestration of open systems. The seamless integration of Nextcloud, Zammad, Mattermost, and Docuseal on a central platform eliminates manual handover errors and creates continuous, automated workflows under full European data sovereignty.

The US CLOUD Act Fallacy:

Mon, 24 Aug 2026 07:08:23 +0000

Many medium-sized industrial and service companies are lulled into a false sense of security: Contracts with US hyperscalers specify server locations in Frankfurt or Dublin, and compliance dashboards show green checkmarks. However, due to intensified supply chain security audits and the expansion of regulations like NIS-2, operators of critical infrastructures (KRITIS) increasingly demand comprehensive evidence of actual data access rights.

The physical localization of workloads on European soil does not dissolve the fundamental legal construct of the US legal framework. True digital sovereignty requires a complete decoupling of the IT operational level from US corporate structures through containerized open-source platforms in sovereign data centers.

The Platform Paradigm in E-Commerce

Fri, 21 Aug 2026 08:30:38 +0000

In the dynamic e-commerce business, the client portfolio of agencies and digital service providers often grows faster than the underlying hosting infrastructure. Over the years, established single-server setups, historically grown configuration differences, and fragmented hosting providers become massive stability and security risks beyond a certain operational size. When marketing campaigns, TV appearances, or seasonal events like Black Friday generate sudden traffic spikes, monolithic single installations reach their physical limits—with fatal consequences for availability commitments and business relationships.

Automated Gatekeeping

Fri, 21 Aug 2026 08:10:44 +0000

In modern CI/CD pipelines, fast release frequency is often considered the primary success metric. However, for platform operators and software providers in regulated markets, this unchecked dynamism increasingly leads to severe security risks: When external base images, third-party libraries, and ephemeral dependencies are rolled out uncontrollably into production clusters, the software supply chain becomes an unpredictable entry point for attackers. The binding requirements of the NIS-2 directive and the Digital Operational Resilience Act (DORA) therefore demand a fundamental shift in direction—away from trusting deployments, towards a seamlessly verifiable software supply chain security.

The Dual-Runtime Principle:

Fri, 21 Aug 2026 08:08:37 +0000

In highly regulated industries such as banking and insurance, modern SaaS business models rarely fail due to application logic, but rather due to restrictive hosting requirements of enterprise customers. While agile fintechs aim to scale their platforms in standardized cloud environments, conservative institutions and public entities demand on-premises operations behind the corporate firewall due to data classification and Compliance reasons. For software manufacturers, this discrepancy traditionally leads to costly codebase fragmentation and significant friction losses in platform engineering.

GitOps as a Revision Authority

Fri, 21 Aug 2026 08:06:34 +0000

In regulated financial and software environments, two opposing worlds collide: development teams demand maximum release speed through automated CI/CD pipelines, while bank auditors and regulators, following DORA (Digital Operational Resilience Act) and MaRisk, require comprehensive, tamper-proof evidence for every single system change. In practice, this tension often leads to bureaucratic ticket systems and manual approval processes that slow down modern DevOps cycles and still cannot prevent configuration drift on production systems.

The Decoupled Exit Strategy:

Fri, 21 Aug 2026 08:03:25 +0000

For regulated financial service providers and SaaS vendors, building on proprietary US hyperscaler services was long the fastest path to market readiness. However, with the binding requirements of the Digital Operational Resilience Act (DORA), risk assessment has fundamentally shifted: perceived efficiency advantages through managed relational databases, proprietary secret management, or cloud-specific ingress controllers have become significant concentration risks. Banks and regulators now demand proof that platforms can be ported within defined timeframes without months-long code refactoring crippling operations.

The Third-Country Dilemma:

Fri, 21 Aug 2026 07:53:00 +0000

Many IT decision-makers are lulled into a false sense of security when using modern Observability SaaS solutions: After all, supposedly only technical health checks and availability data are processed. However, in regulated industries and mature platform architectures, this blind spot is increasingly proving to be a legal and operational liability risk. What appears on paper as non-critical uptime monitoring in practice continuously transmits sensitive metadata across European borders.

The dilemma arises from extraterritorial US legislation that collides with European compliance requirements. Those operating portals for KRITIS operators, healthcare, or public administration need a European monitoring infrastructure. ayedo resolves this third-country risk through a decentralized, fully EU-operated Multi-PoP ring that combines technical precision with digital sovereignty.

Zero-Touch Endpoint Discovery:

Fri, 21 Aug 2026 07:50:49 +0000

In dynamic cloud-native environments, manual configuration of monitoring targets is one of the greatest operational risks. When microservices are deployed multiple times a day via GitOps, documentation and maintenance of external health checks inevitably lag behind. The result is unmonitored shadow endpoints in production that only become noticeable when customers report connection issues or security-related misconfigurations escalate.

The solution lies in completely decoupling monitoring from manual ticket processes through Zero-Touch Endpoint Discovery. By using Kubernetes Ingress Controllers and Gateway API resources as the single source of truth for global monitoring rings, observability becomes an automated byproduct of every regular deployment.

Beyond HTTP 200:

Fri, 21 Aug 2026 07:48:19 +0000

A successful HTTP status code 200 in classic monitoring merely indicates that a web server is responding to requests. However, it says nothing about the actual security and compliance status of an endpoint. In regulated industries and mature hosting environments, this false sense of security regularly leads to critical emergencies: unnoticed expired certificates bring platforms down over the weekend, outdated cipher suites endanger certifications, and missing security headers are only escalated during the annual penetration test.

The Anatomy of Alert Fatigue:

Fri, 21 Aug 2026 07:46:08 +0000

A continuous stream of pager notifications is no longer a fringe phenomenon in 24/7 platform operations but a significant stability risk. When operations teams have to acknowledge dozens of notifications daily, a significant portion of which are transient false alarms, trust in monitoring systems inevitably erodes. The result is a gradual desensitization: genuine incidents are assessed late, SLAs are violated unnoticed, and critical production outages escalate to management level.

Multi-PoP Observability:

Fri, 21 Aug 2026 07:40:25 +0000

A green dashboard in your own data center is often the most expensive illusion in IT operations. While internal health checks suggest uninterrupted availability, end users in specific regions have long been failing due to faulty DNS entries, overloaded peering points, or asymmetric routing. For Managed Service Providers and platform operators, this discrepancy leads to fatal consequences: SLAs are effectively breached long before internal monitoring even triggers.

The root cause lies in an outdated monitoring philosophy that evaluates accessibility in isolation from within one’s own network. A modern infrastructure strategy requires Multi-PoP Observability – a system of distributed measurement points outside of one’s own silos, coupling synthetic probes with consensus-based alerting.

The Sovereign Platform

Fri, 21 Aug 2026 07:31:10 +0000

In many growing European software and eCommerce companies, expansion strategies sooner or later collide with regulatory realities: customers demand specific data center locations, dedicated certifications, or the strict exclusion of US jurisdictions. What is celebrated as a competitive advantage in sales often plunges the IT organization into chaos when a separate operational environment with differing scripts and toolchains must be set up for each IaaS provider.

The solution to this scaling dilemma lies in a sovereign cloud broker architecture that strictly decouples the application lifecycle from the underlying infrastructure. By abstracting heterogeneous European providers through a unified control plane, dedicated clusters can be provisioned on-demand at Hetzner, IONOS, or regional colocation providers - with absolutely identical deployment, security, and observability standards.

The Noise in the Stack:

Fri, 21 Aug 2026 07:28:16 +0000

In growing eCommerce and SaaS platforms, operational operations often tip at an unnoticed point: it’s not the application load that overwhelms the systems, but the uncontrolled data volume of telemetry. When dozens of tenants simultaneously pump metrics, logs, and traces into unstructured shared monitoring instances, not only do storage costs explode, but also search times during critical incidents.

The solution to this scaling problem lies in an architecturally decoupled observability layer that enforces multi-tenancy natively at the ingestion, storage, and query levels. By combining VictoriaMetrics and VictoriaLogs with deterministic label routing, telemetry data is isolated, highly efficiently compressed, and visualized tenant-specifically—without expensive operational overhead or performance losses for neighboring instances.

The End of Server State:

Fri, 21 Aug 2026 07:25:25 +0000

In many growing software and eCommerce companies, manually executing deployment scripts via SSH is still part of daily operations. What seems like a pragmatic shortcut in development and staging environments becomes an unpredictable source of errors in multi-tenant operations: Imperative commands leave fragmented server states, make rollbacks a gamble, and tie up valuable developer time in ongoing incident management.

Switching from imperative shell scripts to a declarative GitOps delivery fundamentally ends this state. By establishing Git as the unassailable single source of truth for the entire application and infrastructure state, deployment transforms from an error-prone sequence of manual commands into a continuously synchronized, self-healing state.

The Fortress in the Cluster:

Fri, 21 Aug 2026 07:22:35 +0000

In many growing platform and eCommerce architectures, Kubernetes is considered the de facto standard for scalability and resilience. However, when multiple tenants are operated on a shared infrastructure, Kubernetes’ default configuration reveals its vulnerable side: Namespaces provide only logical grouping by default, but no reliable isolation at the network, CPU, or memory level.

Hard Multi-Tenancy bridges this gap. By combining uncompromising namespace hardening, strict NetworkPolicies in default-deny mode, and precise resource countermeasures via cgroups v2 and PriorityClasses, a multi-tenant platform is created that combines maximum cost efficiency in a shared cluster model with the security of physically separated servers.

The Base Image Paradox:

Fri, 21 Aug 2026 07:17:11 +0000

In many growing software houses and eCommerce platforms, operational success inadvertently leads to an architectural dead end: Each new customer instance receives individual customizations directly in the build process. What starts as pragmatic customer orientation ends in an uncontrollable explosion of container images , opaque dependencies, and massive security risks with each patch day when dealing with 50 or 100 clients.

The solution to this scaling dilemma does not lie in additional build servers, but in a paradigm shift from tenant-specific builds to strict decoupling of code and configuration. A single, immutable base image serves all tenants, while dynamic runtime parameterization and centralized secret management reflect customer-specific logic.

The Enterprise Security Bridge

Mon, 17 Aug 2026 08:43:23 +0000

In many established corporate and industrial landscapes, there is a risky security gap between central corporate governance and modern Cloud-Native platforms : While identities, roles, and access rights are managed company-wide via Azure Entra ID (formerly Azure AD), Kubernetes clusters and container registries often operate as isolated islands. Developers share static service account tokens, container images are pulled unchecked from public repositories, and IT security management loses visibility over the actual software supply chain.

Weekly Backlog Week 34/2026

Mon, 17 Aug 2026 08:41:57 +0000

🧠Editorial:

40 minutes. That’s apparently how long it took for a compromised access to turn into a supply chain attack affecting thousands of organizations. Meanwhile, in Europe, we’re still debating how much digital sovereignty is actually embedded in an infrastructure that can hardly function without US tech.

At first glance, these seem like two different stories. But they’re not. Ultimately, it’s about dependencies—on platforms, manufacturers, supply chains, and decisions made outside one’s own sphere of influence.

The Software-Defined Storage Foundation:

Mon, 17 Aug 2026 08:39:24 +0000

In many industrial and analytics environments, unstructured data volumes, model artifacts, and ingest archives are growing exponentially. The traditional response of enterprise IT—constantly expanding proprietary SAN/NAS appliances or uncontrolled outsourcing to US hyperscaler buckets—leads to a dead end: hardware expansions demand six-figure CapEx investments, while cloud object storage with opaque API calls and egress fees drain the IT budget.

The architectural solution lies in the software-defined abstraction of storage directly at the platform level. By operating Ceph via the Rook Operator on the ayedo Managed Kubernetes platform, companies transform off-the-shelf standard hardware into a highly available, horizontally scalable, and S3-compatible object storage foundation—software-defined, multi-tenant, and fully under their own control.

The Dual-Engine Analytics Design:

Mon, 17 Aug 2026 08:34:35 +0000

In modern industrial and resource companies, tens of thousands of telemetry data points from global production facilities, programmable logic controllers (PLCs), and IoT gateways are generated every second. Traditional relational databases and conventional data warehouse setups cannot handle this load: aggregation queries over historical periods block operational dashboards, write operations accumulate in buffers, and hardware costs for monolithic storage appliances scale exponentially.

The architectural answer to this dilemma lies in the deliberate separation based on query and data characteristics. By orchestrating TimescaleDB for complex relational time series analyses and ClickHouse for massively parallel columnar aggregations on the ayedo Managed Kubernetes platform, a highly elastic dual-engine architecture emerges—operated on European bare-metal storage with guaranteed sub-second response times.

The Sovereign Bursting Concept:

Mon, 17 Aug 2026 08:32:26 +0000

In many industrial and manufacturing companies, ambitious AI and data science initiatives face a hard physical barrier: local on-premises clusters regularly hit capacity limits with compute-intensive training and simulation jobs, while acquiring new enterprise accelerators like NVIDIA H100 or B200 involves lead times of many months. The obvious solution—turning to US hyperscalers—fails in practice due to unpredictable data transfer costs, proprietary API silos, and the strict compliance requirements of the European industry.

The Elastic ETL Model:

Mon, 17 Aug 2026 08:29:34 +0000

In many industrial and raw material companies, traditional ETL pipelines hit hard physical limits as data volumes increase: Monolithic orchestration setups or static VM environments force data engineers to permanently scale computing capacities for peak loads. The result is costly idle times with the simultaneous risk of pipeline failures as soon as unforeseen data volumes from production sites arrive simultaneously.

The strategic response to this scaling dilemma is the complete decoupling of scheduling logic and dynamic task execution. By operating Apache Airflow with the native KubernetesExecutor on the ayedo Managed Platform, rigid data processing transforms into a highly elastic, demand-driven ingestion and transformation pipeline – resource-efficient, isolated, and fully automated.

The Self-Service Engineering Principle:

Mon, 17 Aug 2026 08:24:54 +0000

In many data engineering and analytics organizations, every new project begins with a time-consuming obstacle course: specialized Python environments, heterogeneous R packages, diverging CUDA drivers, and local host dependencies lead developers to spend days or weeks setting up local workstations. The phrase “It works on my machine” has become the most expensive symptom of fragmented platform landscapes in upper mid-sized companies.

The root cause lies in the manual, host-centric provisioning of development environments via traditional ticket workflows. By establishing Coder as a declarative workspace layer on a managed Kubernetes foundation , ayedo transforms rigid developer setups into reproducible, isolated on-demand workspaces—standardized as code, versioned in the repository, and seamlessly integrated into the existing security architecture.

The Zero-Egress Model: How Bare-Metal Infrastructure Eliminates Data Outflows and Budget Pitfalls

Mon, 17 Aug 2026 08:13:13 +0000

In many growing tech and industrial companies, the public cloud is still considered the standard path for scaling. However, the commercial and regulatory reality catches up with platform managers at the latest during the monthly billing: In addition to non-transparent base fees, variable data transfer costs—so-called egress fees—strain budgets while confidential operational data is routed through uncontrollable global network nodes.

The solution does not lie in manually saving bandwidth but in consistently switching to a sovereign infrastructure model. By combining modern bare-metal providers like Hetzner or IONOS with a declaratively managed Kubernetes platform , ayedo establishes highly available computing environments that structurally prevent data outflows and make IT costs deterministically plannable again.

The Zero-Trust Identity Architecture: How Granular RBAC Isolation Scales ML Platforms for Audit Compliance

Mon, 17 Aug 2026 07:45:32 +0000

In many machine learning initiatives, the speed of innovation and IT security collide head-on: To achieve rapid training results, data scientists, external service providers, and development teams often share blanket cluster admin rights, static API keys, or insufficiently isolated access to sensitive inference endpoints. Once platforms make the leap from the protected sandbox to industrial production, this pragmatic sprawl turns into a significant entry point for privilege escalation and data leaks.

The Air-Gapped GenAI Architecture: How Self-Hosted LLMs Secure Industrial IP and Compliance

Mon, 17 Aug 2026 07:41:11 +0000

In many industrial and manufacturing companies, there is growing pressure to use generative AI for automated error reports, maintenance logs, and root cause analysis. However, the reality in OT and IT practice is sobering: sending proprietary sensor data, machine telemetry, and process know-how through public hyperscaler APIs to US data centers risks uncontrolled leakage of sensitive intellectual property and blatant compliance violations.

The strategic response to this hurdle is not to abandon GenAI, but to completely decouple the platform from external interfaces. By operating self-hosted open-weights models declaratively on a hardened, Kubernetes -based infrastructure, ayedo enables the productive use of modern language models, fully isolated within its own European security perimeter.

The GitOps-MLOps Paradigm: Reducing Time-to-Market from Weeks to Hours

Mon, 17 Aug 2026 07:38:13 +0000

In many data science initiatives, there is a significant gap between the proof-of-concept in a Jupyter Notebook and a robust production environment: Models are trained in isolation, manually packaged into volatile containers , and deployed via fragile REST scripts on ad-hoc servers. The result is months-long release cycles, inseparable dependency conflicts, and inference pipelines that collapse under the first real load spikes in the production network.

The root cause lies in the lack of platform integration between data science artifacts and declarative deployment patterns. By integrating MLflow as a central model registry with KServe on a GitOps-driven Kubernetes foundation, ayedo transforms experimental model states into auditable, latency-optimized, and highly resilient production services.

The GPU Partitioning Paradigm: How MPS and Dynamic Slicing Reduce Hardware Costs by 60%

Mon, 17 Aug 2026 07:31:54 +0000

In many companies, the use of modern accelerator hardware resembles an unregulated race: Data scientists reserve entire high-end GPUs like the NVIDIA A100 or H100 for interactive Jupyter notebooks, while compute-intensive training runs languish in endless queues. The result is low utilization rates alongside skyrocketing cloud budgets and dissatisfied development teams.

The cause is not a lack of computing power, but the absence of a declarative scheduling and partitioning logic at the platform level. By integrating Kubernetes -native control mechanisms with NVIDIA Multi-Process Service (MPS) and dynamic GPU slicing, ayedo transforms rigid silo hardware into an elastic, multi-tenant resource pool.

Weekly Backlog Week 33/2026

Thu, 06 Aug 2026 08:00:33 +0000

🧠Editorial:

This week in the Weekly Backlog: OpenAI prefers to wait for better market conditions, Bavaria continues to transfer millions to Microsoft despite open-source enthusiasm, and European companies suddenly discover their love for ‘America First’—as long as their factory happens to be in Tennessee.

Additionally: AI systems with surprisingly loose relationships to foreign networks, critical vulnerabilities at TP-Link, and the question of whether Europe’s digital sovereignty is more than just a pretty buzzword.

Automate Backups: Less Effort, More Security

Wed, 29 Jul 2026 10:50:51 +0000

Backups are among the most critical tasks in IT operations.

Yet, in many companies, they are still manually initiated, irregularly checked, or only reviewed when a problem has already occurred.

This is risky.

Because data backups are only reliable when they are performed continuously, flawlessly, and transparently. That’s why more and more companies are turning to automated backup processes.

Manual Backups Are Prone to Errors

Wherever human intervention is required, errors occur.

How Long Can Your Business Really Afford to Be Down?

Wed, 29 Jul 2026 10:49:09 +0000

A server goes down. A database is corrupted. A cyberattack cripples central systems.

In such situations, the first question is not whether a backup exists.

What matters is how quickly your business can become operational again.

This is where two metrics come into play that are essential for any backup strategy: RTO and RPO.

A Backup Alone Does Not Meet Business Requirements

Many companies invest in modern backup solutions without first defining what downtime is acceptable.

Ransomware: Why Backups Are More Important Than Firewalls Today

Wed, 29 Jul 2026 10:42:59 +0000

Firewalls, endpoint protection, and email filters are now standard in every IT security strategy.

They reduce risks and successfully fend off many attacks.

However, they share a common weakness: they cannot guarantee that an attack will never be successful.

This is why another component is becoming increasingly important – the backup .

When ransomware encrypts data or cripples systems, it is not the firewall that determines the company’s future, but the ability to quickly restore business operations.

The Real Test of Your Backup: Does It Actually Work?

Wed, 29 Jul 2026 10:40:50 +0000

Backups are created every day.

Green status messages confirm successful backups. Backup jobs run automatically in the background, providing a sense of security.

But this security is deceptive.

Only in a real emergency will you know if a backup truly delivers on its promise.

A Backup Is Only Valuable If It Can Be Restored

Many companies invest time and resources in their backup infrastructure. What often gets overlooked is the crucial step: regularly testing the restore process.

A Backup is Not Yet Data Protection

Wed, 29 Jul 2026 10:35:18 +0000

Many companies can quickly answer the question of whether their data is backed up:

“Yes, we perform daily backups.”

But this is where a dangerous misconception begins.

Creating a backup does not necessarily mean that data can be reliably restored in case of an emergency. Only when backups are regularly tested, protected, and quickly accessible in emergencies do they become a robust data protection strategy.

Backups are Only Part of the Solution

A backup is initially nothing more than a copy of data.

What Actually Happens When Your Application Fails at Night?

Wed, 29 Jul 2026 10:31:51 +0000

It’s 2:17 AM.

Your website is still accessible. The server is running. But a business-critical API is no longer responding. Customers can’t log in, orders are stuck, or important data isn’t being processed.

No one notices.

Only the next morning do support requests start piling up. The first customers report issues, and the IT team begins root cause analysis.

The actual outage has long since occurred by this point.

APIs are the Backbone of Modern Applications – But Who Monitors Them?

Wed, 29 Jul 2026 10:20:50 +0000

Whether it’s a SaaS platform, customer portal, or mobile app – modern software hardly functions without APIs today.

They connect frontend and backend, synchronize data between applications, and enable communication with external services. For users, they usually remain invisible. However, they are indispensable for the operation of an application.

That’s precisely why issues with APIs quickly become a business risk.

Without APIs, the Application Comes to a Halt

Many applications today consist of a multitude of services.

When Customers Discover Errors, It's Already Too Late

Wed, 29 Jul 2026 10:17:47 +0000

There’s a phrase no IT team wants to hear:

“Your application isn’t working.”

It’s even more uncomfortable when this notice doesn’t come from your own monitoring, but from the first customer.

Because at that moment, it’s clear: The problem already exists—and it wasn’t detected in time.

When Customers Discover Errors Before Your Monitoring Does

Many companies invest in monitoring solutions, assuming they will be immediately informed of any disruptions.

Why 99.9% Availability Doesn't Automatically Mean Satisfied Customers

Wed, 29 Jul 2026 10:12:36 +0000

99.9% availability sounds impressive.

At first glance, this figure seems like a quality promise. In fact, it appears in many Service Level Agreements (SLAs) and marketing materials from hosting and cloud providers.

However, for your customers, this number is often meaningless.

Because they don’t care about the theoretical availability of your application. They want login, orders, APIs, or customer portals to work exactly when they need them.

99.9% Sounds Better Than It Is

99.9% availability does not mean an application is always accessible.

Your Website is Accessible – But Your Customers Still Can't Log In

Wed, 29 Jul 2026 10:09:14 +0000

The status page shows green. The web server responds. Monitoring reports no anomalies.

Yet, support requests are piling up.

Customers can’t log in. The checkout isn’t working. An API returns errors or forms can’t be submitted.

The application is technically accessible – but from the user’s perspective, it’s unusable.

This is precisely where the limits of traditional monitoring become apparent.

Accessibility Does Not Mean Availability

Many companies primarily monitor whether their website or application is accessible.

Why Good Software Can Still Be Slow

Wed, 29 Jul 2026 09:50:03 +0000

The application is cleanly developed. The code has been tested, performance optimizations have been implemented, and the infrastructure has sufficient resources.

Yet, users repeatedly report long load times or delayed responses.

The initial reaction is often: The code must be optimized.

However, in modern Cloud-native environments, the cause often lies elsewhere.

Performance Today is the Interplay of Many Components

Modern applications are no longer just a single piece of software on a server.

The Most Expensive Minute in the Data Center is When No One Knows What's Happening

Wed, 29 Jul 2026 09:47:36 +0000

An outage costs money.

But even more costly is the time when no one knows why the outage occurred.

These very minutes often determine whether an incident is quickly resolved or develops into a prolonged disruption. While users wait for a functioning application, many companies begin troubleshooting—often without clear clues.

The real challenge is not the outage itself, but the lack of transparency.

When Every Minute Counts

Whether it’s a SaaS application, an e-commerce platform, or an internal company system—unplanned outages have direct impacts on the business.

When the Issue Isn't in the Server –

Wed, 29 Jul 2026 09:43:50 +0000

The application is slow. Support receives the first reports from customers. Thus begins the search for the cause.

CPU usage? Unremarkable.

Memory? Sufficient.

The servers are running stably.

And yet, the application responds sluggishly.

Such situations are now part of everyday life for many IT teams. In modern Cloud-native environments, the cause of a problem often isn’t where the effects are visible.

Applications are much more complex today

In the past, an application often consisted of a single server and a database. If an error occurred, the cause could usually be quickly narrowed down.

Why Failures Are Often Visible Hours in Advance

Wed, 29 Jul 2026 09:42:24 +0000

A server doesn’t fail without warning. An application doesn’t slow down in an instant. And databases rarely suddenly encounter performance issues.

Most disruptions announce themselves—often hours or even days before users notice anything.

The crucial question is not whether warning signals exist, but whether they are recognized and correctly interpreted.

The First Signs Often Go Unnoticed

In modern IT landscapes, problems develop gradually.

The response times of a database slowly increase. An API takes longer and longer to respond. The error rate of a microservice slightly increases. A Kubernetes node consistently operates at its capacity limit.

Polycrate Integration in DevOps: Examples and Best Practices

Wed, 29 Jul 2026 09:39:22 +0000

TL;DR

polycrate-devops-integration enables independent, secure DevOps pipelines across cloud and cluster boundaries. By using Policy-as-Code, central gatekeepers, and standardized artifact management, governance, security, and compliance are automatically enforced. Practical examples show concrete patterns for CI/CD, secrets management, and multi-cloud deployments that minimize vendor lock-in.

Introduction

Thesis: Without clear patterns for Polycrate integrations, DevOps risks fragmentation. Common mistakes include monolithic CI/CD stacks, hard-coded provider policies, missing SBOMs, and uncontrolled secrets. Architecturally, this means high drift risk, security gaps, and rising operational costs. A structured integration of Polycrate as a policy and gate phase, combined with standardized artifacts, creates transparency and reusability across teams and clouds. The focus is on independence, security, and governance without compromising speed or compliance . The following article presents practical integration patterns that can be directly embedded into existing DevOps platforms.

Polycrate Workspaces: Structure, Projects, and Initial Workloads

TL;DR

A clear patch strategy is crucial for security and compliance in polycrate update management. It defines the patch level, governs rollouts, and ensures auditability. By using policy-driven processes, it reduces operational risks, minimizes unplanned downtime, and facilitates auditors’ evidence collection without compromising availability and security.

Without a clear patch strategy, security risks and compliance challenges increase significantly. A common mistake is to view patch management as an isolated activity that only reacts when a CVE is reported. In complex Polycrate environments, security can no longer be achieved through sporadic updates. The operational question is: How do you balance security, availability, and auditability in daily operations? The architectural decision lies in a policy-driven rollout policy that standardizes patch cycles, clearly distributes responsibilities, and firmly anchors change processes. This creates traceable patch levels and consistent compliance evidence without endangering operations.

Polycrate Installation: Requirements, Setup, and Projects

Wed, 29 Jul 2026 09:39:20 +0000

TL;DR

The Polycrate installation thrives on specific system requirements, a stable CLI setup, and a clear workspace structure. Poor decisions here delay start, increase operational costs, and complicate governance. This post explains the installation process, the initial project level, and the basic configuration from an architectural and operational perspective. Practically, this means consistent CLI versioning, defined workspace standards, and early mapping of dependencies.

Introduction

Without clear system requirements and a well-thought-out project structure, the Polycrate initialization becomes a stumbling block. Many teams trip over inconsistent libraries, outdated CLI versions, and unclear workspaces. This leads to deployments that are hardly reproducible and increases the effort for operations and audits. The architectural decision to establish a central template for workspaces early pays off in later steps. In this post, we focus on a practical sequence of requirements, setup, and the initial project structure so that companies can establish stable foundations and reduce operational risks early.

Monitoring is No Longer Enough – Why Observability is Becoming the Standard

Wed, 29 Jul 2026 09:37:56 +0000

The IT landscape has fundamentally changed in recent years. Applications no longer run on a single server but are distributed across containers , Kubernetes clusters , microservices, and numerous external services. This development brings enormous advantages but also makes operations significantly more complex.

Many companies still rely on traditional monitoring. CPU usage, memory, or disk capacity are monitored, and alarms are triggered when thresholds are exceeded. However, for modern applications, this is no longer sufficient.

Your SaaS is Growing – Is Your Infrastructure Keeping Up?

Wed, 29 Jul 2026 09:36:39 +0000

The first customers have been acquired, the product is evolving, and demand is increasing. What initially sounds like success presents a new challenge for many SaaS companies: The infrastructure must keep pace with growth.

With every new user, the demands on availability, performance, and security increase. At the same time, customers expect regular updates, a stable platform, and smooth operation—regardless of how much the application grows.

For many development teams, this means a balancing act. They want to develop new features and drive innovation but are spending more and more time on infrastructure, monitoring, updates, or resolving operational issues.

What Customers Really Expect from a SaaS Application Today

Wed, 29 Jul 2026 09:29:03 +0000

New features are important, but they no longer solely determine the success of a SaaS application.

Companies invest in software because it is expected to function reliably. They demand high availability, quick response times, and secure handling of their data. Whether an application runs in the background on Kubernetes or which cloud infrastructure is used is irrelevant to most users. The outcome is what matters.

For SaaS providers, this means: Not only must the software be convincing, but so must the operations behind it.

The 7 Most Common Mistakes in Hosting a SaaS Application

Wed, 29 Jul 2026 09:24:06 +0000

Developing a SaaS application is challenging. Operating it reliably is often the greater challenge.

With the first customers, expectations rise. The application must be available at all times, securely store data, handle peak loads, and be updated regularly—preferably without interruptions. At the same time, the development team should deliver new features and drive innovation.

In practice, the same mistakes often occur repeatedly. They lead to outages, security risks, or unnecessarily high operating costs. Avoiding them early lays the foundation for sustainable growth.

Successfully Running SaaS: What Really Matters

Wed, 29 Jul 2026 09:20:29 +0000

The first customers have been acquired, new features are regularly released, and the product is developing in the right direction. For many SaaS companies, this is exactly the moment when a new challenge arises: The operation of the application becomes increasingly complex.

While initially a single server or a simple cloud environment is often sufficient, the requirements for availability, security, and scalability increase with each new customer. Suddenly, it’s not just about developing software anymore—it’s about delivering it reliably and continuously.

High Availability with Kubernetes: Why Three Master Nodes Alone Are Not Enough

Wed, 29 Jul 2026 08:53:39 +0000

Many companies associate high availability in Kubernetes with a simple rule of thumb: Deploy three control plane nodes and the issue is resolved.

In practice, however, this is only a small part of a resilient architecture.

A highly available Kubernetes cluster consists of much more than a redundant control plane. The interaction of all components is crucial—from infrastructure and network traffic to backups and disaster recovery. If even one of these components fails, a cluster with three master nodes can no longer operate reliably.

Kubernetes Best Practices: How to Avoid Costly Operational Mistakes

Wed, 29 Jul 2026 08:49:54 +0000

Kubernetes is now considered the standard for running modern applications. The platform offers maximum flexibility, high scalability, and automated processes. However, with this flexibility comes increased complexity.

Many companies start with Kubernetes to future-proof their applications. In practice, however, it quickly becomes apparent: Kubernetes itself is not the problem, but its operation is.

The same mistakes repeatedly lead to security vulnerabilities, performance issues, or unplanned outages. The good news: most of these can be avoided.

Managed Kubernetes or Self-Managed Kubernetes?

Wed, 29 Jul 2026 08:45:44 +0000

Which Strategy Really Pays Off for Companies

Kubernetes has established itself as the standard for operating modern applications. Companies benefit from high scalability, automated deployments, and flexible container orchestration. However, the complexity of operations increases significantly.

Many companies face a fundamental decision: Should Kubernetes be operated with their own resources, or is a Managed Kubernetes solution the more economical and secure choice?

The answer depends on various factors—and extends far beyond mere infrastructure.

5 Reasons Why Partnering with ayedo is Worthwhile

Wed, 29 Jul 2026 08:44:03 +0000

Those Developing Modern Software Need a Partner for Reliable Operations

Cloud-native applications, Kubernetes , compliance requirements, and rising expectations for availability present ever-growing challenges for companies. While development teams want to focus on new features, the effort for infrastructure, security, and stable operations increases simultaneously.

This is where ayedo comes in.

The German company supports software manufacturers, SaaS providers, and enterprises in professionally operating cloud-native applications on Kubernetes—securely, scalably, and on European infrastructure. It’s not just about hosting but about a long-term partnership that relieves development teams while meeting the highest demands for security, compliance, and performance.

Weekly Backlog Week 31/2026

Fri, 24 Jul 2026 08:59:32 +0000

🧠 Editorial

This edition primarily focuses on digital sovereignty—from both a technical and political perspective.

I particularly recommend the guest article by Nish Sribavan, who explains why the real issue with the German government’s Microsoft expenses isn’t the cost, but the lack of exit capability. Also worth checking out is the LinkedIn Post of the Week by Klaus Wiedenmann, who shares his experiences with kDrive by Infomaniak as an alternative to OneDrive.

Weekly Backlog Week 30/2026

Tue, 21 Jul 2026 07:49:07 +0000

📰Tech-News:

The First Documented AI Agent Hack is Here

Hugging Face operates the world’s largest directory for open-source AI models. Millions of developers and companies use the platform daily.

The company has now disclosed an unusual security incident: For the first time, an attack has been documented that, according to Hugging Face, was entirely conducted by an autonomous AI agent system. The agent exploited vulnerabilities in data processing, gained access to internal systems, collected credentials, and independently navigated through multiple clusters.

Weekly Backlog Week 29/2026

Fri, 10 Jul 2026 08:04:27 +0000

🧠 Editorial

This week had it all: open databases, open GitHub repositories, open questions about data protection – and a surprisingly large number of organizations suddenly discovering that digital dependencies might not be such a good idea after all.

If you want to know why Mecklenburg-Vorpommern, the Swiss Army, and Max Schrems are all telling the same story, you’re in the right place.

Let’s get started.

Polycrate IaC fundamentals focus on declarative modeling, version control, and modular reusability. The text outlines key points, explains how to reconcile states, track changes, and utilize reusable modules. The goal is a clear reference architecture for stable platform operations, even in hybrid environments.

Introduction

Thesis: Infrastructure is not just code, but the desired state of the system. Imperative scripts often cause drift and complex onboarding processes. This introduction to Polycrate IaC fundamentals is about declarative modeling, version control, and modular reusability. The core is that models describe the desired state, not every execution step. This enables reproducibility and makes change management more transparent. We consider how declarative infrastructure increases operational stability, how modules facilitate reuse, and how Git-based workflows create auditability. For platform teams, this means a clear architectural decision instead of ad-hoc DevOps. ayedo accompanies such architectural processes, ensuring consistency and governance in productive environments.

Why Companies Systematically Underestimate the Effort for Kubernetes

Mon, 06 Jul 2026 15:04:06 +0000

Why Kubernetes Projects Become Complex Over Time – and How Companies Can Manage This Complexity

In the first part of this article, we explored why companies often systematically underestimate the effort surrounding Kubernetes. We saw that Kubernetes is primarily an orchestration system tasked with continuously enforcing the desired state of a container infrastructure. It also became clear that many tasks that enable stable platform operation are deliberately placed outside the core of Kubernetes.

Why Companies Systematically Underestimate the Effort for Kubernetes

Mon, 06 Jul 2026 14:57:50 +0000

The Myth of “Finished Kubernetes”

“We now have Kubernetes.”

Hardly any phrase is uttered more frequently in IT projects—and yet understood so differently.

For some, it means that the technical foundation for a modern application platform has been established. For others, it equates to the assumption that the most challenging part of the transformation is already behind them. Often, there is even the expectation that issues like high availability, scalability, security, or resilience are largely solved with the introduction of Kubernetes.

US Ruling on the FTC:

Mon, 06 Jul 2026 14:41:31 +0000

Why Donald Trump’s Increase in Power Puts Transatlantic Data Transfer into Question Again

On June 30, 2026, the United States Supreme Court made a decision in the case of Trump v. Slaughter that could extend far beyond American domestic politics. The court strengthened the powers of the US President over independent federal agencies, ruling that statutory restrictions on his dismissal powers are unconstitutional in certain cases.

The case was triggered by President Donald Trump’s dismissal of the two Democratic members of the Federal Trade Commission (FTC), Rebecca Slaughter and Alvaro Bedoya, at the start of his second term. Under existing law, FTC members could generally only be dismissed for important reasons—such as misconduct or gross dereliction of duty. However, Trump justified the dismissals solely on political differences and his administration’s priorities.

Why There Is No Cookie Banner on Our Website

Wed, 01 Jul 2026 10:14:42 +0000

Cookie banners have become a standard feature on almost every corporate website today. They are so ubiquitous that few question why they are necessary in the first place.

The ongoing discussion around the ePrivacy Regulation highlights how entrenched the debate has become. As reported by netzpolitik.org, both Germany and Google, among others, oppose the idea of managing consents centrally in the browser. Instead of a one-time decision, users will continue to face the same dialogues on every individual website.

Weekly Backlog Week 28/2026

Wed, 01 Jul 2026 09:58:44 +0000

🧠Editorial:

This week, it becomes clearer than ever that digital sovereignty is no longer an abstract debate. While a US Supreme Court ruling once again questions the stability of transatlantic data agreements and highlights European companies’ dependency on US clouds, concrete alternatives are emerging.

Mecklenburg-Vorpommern is turning to Nextcloud and European AI, Ubuntu is strengthening ARM64 as an equal platform, and German research institutions are developing an open RISC-V security chip. The direction is clear: Europe is beginning to not only discuss technological dependencies but to reduce them step by step.

Build or Buy Kubernetes? Part 3

Tue, 30 Jun 2026 12:58:34 +0000

Managed Kubernetes is Not the Same as Managed Platform: How Companies Remain Sovereign in the Long Term

Part 3 of our series “Build or Buy Kubernetes”

In the first two parts of this series, we examined why the introduction of Kubernetes is much more than an infrastructure decision and why the actual costs of a platform rarely appear on the cloud bill. This leaves one crucial question unanswered: Which operational model is the right one in the long run?

Build or Buy Kubernetes? Part 2

Tue, 30 Jun 2026 12:57:26 +0000

The Hidden Costs of Kubernetes: Why Infrastructure is Usually the Smallest Expense

Part 2 of our series “Build or Buy Kubernetes”

After exploring in the first part why the decision for Kubernetes goes far beyond choosing a [Container] orchestration platform, the next inevitable question arises: What does it actually cost to operate a Kubernetes platform?

Most companies start this consideration with the wrong numbers.

They compare prices for virtual machines, Managed-Kubernetes offerings, or cloud instances. Calculations include the costs of the Control Plane, Worker Nodes, storage, or outgoing data traffic. These items are easily measurable and appear on every monthly bill from the cloud provider.

Build or Buy Kubernetes? Part 1

Tue, 30 Jun 2026 12:55:58 +0000

Why the Real Decision Begins Long Before the First Cluster

However, this conclusion would be premature.

The current development mainly shows one thing: The real problem was never solely the law itself.

The Hetzner Price Increase Reveals Europe's True Dependency

Mon, 22 Jun 2026 13:15:20 +0000

When Hetzner announced a significant price increase for parts of its cloud portfolio in mid-June 2026, public discussion quickly focused on the most visible figure: some cloud servers will soon cost up to three times as much as before. For customers who need to calculate their infrastructure costs precisely, this is undoubtedly relevant news.

However, viewing this development solely as a price debate is too simplistic.

The real question is not why Hetzner is raising its prices. The more intriguing question is why a provider known for many years for its exceptional value is forced to take such a step.

Helpdesk Scales Elastically: Absorbing Support Peaks in the Kubernetes Cluster

Mon, 22 Jun 2026 09:19:47 +0000

In digital customer service, load is rarely linearly predictable. On a normal day, ticket volume usually trickles in quietly - the support team processes incoming requests routinely. However, there are those unpredictable moments when the infrastructure is under maximum stress: An unforeseen system outage, a critical security alert at the network edge, or a seasonal order surge floods the helpdesk with hundreds of simultaneous customer inquiries within minutes.

When such a peak hits a traditionally hosted ticket system, the domino effect threatens: The web interface responds sluggishly, background jobs for email retrieval pile up, and notifications are delivered with massive delays. In the worst case, the server capitulates completely. Attempting to mitigate this risk by permanently over-provisioning hardware is an unnecessary budget burn. The cloud-native solution lies in elastic resource allocation directly within the Kubernetes cluster .

The Anatomy of a Highly Available Helpdesk: How Stateful Backends Interact

Mon, 22 Jun 2026 09:12:18 +0000

Anyone leading a digital team knows that the support helpdesk is the operational nerve center of customer service. Emails, chat messages, and API tickets arrive simultaneously. Customers expect real-time responses, and support staff need split-second search results on historical records to assist efficiently. If the ticket system stalls, communication breaks down. Unsatisfied customers and stressed teams are the immediate consequence.

To operate such a business-critical application with absolute reliability and performance in your own Kubernetes cluster, it’s not enough to just scale the web interface. A helpdesk is a data-intensive application, whose stability heavily depends on the underlying architecture. Only the precise interplay of specialized stateful infrastructure backends—namely PostgreSQL, Redis, and OpenSearch—transforms a simple ticketing tool into a highly available enterprise platform.

Protecting Customer Data: Why Helpdesk Platforms Belong in Your Own Cloud

Mon, 22 Jun 2026 09:07:16 +0000

Organizing customer service for digital teams presents a significant challenge: Multi-channel ticketing systems process countless personal data daily. Every support email, chat transcript, and phone note contains sensitive customer information, attachments, or internal IT infrastructure details.

In many companies, these data streams are thoughtlessly outsourced to large, proprietary SaaS platforms. What seems convenient at first glance turns out to be a massive data protection and strategic risk upon closer inspection. Under tightened European regulations such as NIS-2 and the GDPR, the uncontrolled storage of customer data in third-country clouds is becoming increasingly untenable. The future-proof alternative is clear: Operating an open-source platform like Zammad as a dedicated instance in your own Kubernetes cluster .

Monitoring and Uptime Validation: Why Edge Checks Prevent Outages

Mon, 22 Jun 2026 08:48:35 +0000

Operators of modern container platforms and web applications often find themselves in a false sense of security due to internal cluster metrics. The dashboards in the internal control center (e.g., Prometheus or Grafana) consistently show green values: Pods are running stably, CPU load is optimal, and the local ingress controller reports no errors. However, this internal view overlooks a fundamental truth: It does not necessarily reflect the real user experience of end users.

Zero-Trust in GitOps: How Password Fortresses Secure Secrets

Mon, 22 Jun 2026 08:44:07 +0000

The transition to a modern GitOps architecture fundamentally changes the way IT teams operate. Instead of configuring infrastructure manually, the entire desired state of the data center is described declaratively in Git repositories. A continuous reconciler (like Argo CD) ensures that this state is mirrored one-to-one in the Kubernetes cluster . This brings maximum transparency, versioning, and speed.

However, this architectural approach poses a massive security risk: Every application and infrastructure component requires sensitive credentials to operate—be it database passwords, third-party API keys, or TLS certificates. Writing these secrets in plain text in YAML files and pushing them to a Git repository is reckless and violates all compliance requirements of NIS-2 and ISO 27001. The solution to this inherent conflict lies in Zero-Trust Secrets Management: the strict technological separation of declarative code and a central, highly secure password fortress.

Three Clouds Don't Make You Sovereign

Mon, 22 Jun 2026 08:41:10 +0000

Few concepts have experienced a rise comparable to Multi-Cloud in recent years. Hardly any strategic presentation is complete without architecture diagrams showing applications, data, and platform services distributed across multiple providers. The underlying message is usually the same: operating systems not exclusively with a single cloud provider reduces dependencies, increases resilience, and strengthens a company’s digital sovereignty.

The appeal of this argument is understandable. After all, the past few years have vividly demonstrated the risks that can arise when companies place central parts of their digital infrastructure in the hands of a few global providers. Discussions about the Cloud Act, geopolitical tensions, regulatory requirements, or the increasing concentration of technological power have led to the question of strategic dependencies being taken much more seriously today than just a few years ago.

The Closed Software Supply Chain: Container Registry and Repository in Harmony

Mon, 22 Jun 2026 08:38:49 +0000

The Closed Software Supply Chain: Container Registry and Repository in Harmony

In modern DevOps workflows, speed is key. Continuous Integration (CI) pipelines build code in minutes, automatically package applications into standardized Container images (OCI artifacts), and push them to a registry, from where they are directly deployed into production Kubernetes clusters. This automated data flow forms the backbone of modern software development.

However, this very speed and the increasing fragmentation of tools used pose significant risks. When source code is hosted by an external SaaS provider, build servers are operated in isolation, and container images end up in an unregulated third-party cloud, dangerous blind spots emerge. Securing the entire software supply chain has become a central obligation under tightened European regulations such as the Cyber Resilience Act (CRA) and NIS-2. The solution lies in a consistent architecture: the seamless integration of managed code repositories and private container registries on a sovereign platform.

S3 Object Storage in the European Legal Framework: Securing Data Sovereignty

Mon, 22 Jun 2026 08:33:02 +0000

Data is the most valuable asset of modern companies—and simultaneously their greatest regulatory risk. Whether it’s business-critical application data, tamper-proof compliance archives, or automated backup strategies for Kubernetes clusters: nearly every cloud-native application today relies on the standardized S3 protocol (Simple Storage Service) to store unstructured data flexibly and cost-effectively.

However, while the technical integration of an S3 endpoint usually requires only a few lines of code in practice, the choice of the underlying storage location carries immense strategic weight. Those who carelessly outsource their data to the storage infrastructures of international hyperscalers quickly find themselves in a legal minefield under European legislation such as NIS-2 and the GDPR. Establishing a sovereign, S3-compatible object storage within the European legal framework is therefore not a technological luxury but a fundamental prerequisite for true data sovereignty.

The Anycast Principle at the Edge: Resilient Traffic Entry Without Hyperscalers

Mon, 22 Jun 2026 08:28:33 +0000

Operators of business-critical web applications or platform services know: The availability and performance of an application are often determined at the outermost network boundary, the so-called edge. If routing at the entry point fails, even the best-scaled Kubernetes cluster in the background becomes unreachable to the outside world.

In traditional IT infrastructure, reliance is often placed on static IP addresses, which are tied to a single data center or specific virtual machine. If this location fails or falls victim to a large-scale DDoS attack, accessibility collapses. Those looking to minimize this risk have often turned to the proprietary ecosystem of US hyperscalers to use their global load balancer services. However, this convenience comes with opaque data traffic fees (egress costs) and technological vendor lock-in. The sovereign alternative, which guarantees maximum resilience and performance within the European legal framework, is based on a clever network principle: Anycast routing directly at the edge.

Europe's Lack of Operational Competence

Mon, 22 Jun 2026 07:58:58 +0000

The debate over digital sovereignty in Europe is often reduced to the wrong level. As soon as the dependency on American technology companies is discussed, it usually doesn’t take long before the demand for European or German hyperscalers arises. This is based on the assumption that Europe primarily lacks infrastructure. If only sufficiently large cloud providers were built, the existing dependency on AWS, Microsoft Azure, or Google Cloud could be overcome.

A "German Hyperscaler" Won't Solve Your Problem

Mon, 22 Jun 2026 07:28:26 +0000

The demand for German hyperscalers is currently gaining popularity. In light of increasing geopolitical tensions, discussions about the Cloud Act, regulatory requirements like NIS-2, DORA, or the Data Act , and the obvious market power of American cloud providers, the conclusion seems obvious: Europe must build its own hyperscalers to regain digital sovereignty.

However, this is where a discussion often begins that is based on a questionable assumption.

Before we discuss whether Germany or Europe needs its own hyperscalers, we should first answer a much more fundamental question: Do most companies even need the type of infrastructure for which hyperscalers were originally developed?

Weekly Backlog Week 26/2026

Mon, 22 Jun 2026 07:21:38 +0000

🧠 Editorial

While outside the asphalt is slowly turning into lava, the tech industry is once again discussing the truly important questions: How sovereign is Europe’s cloud? Do we need our own hyperscalers? And why is everything getting more expensive – including computing power?

This issue certainly has enough material for the next coffee break. It covers cloud dependencies, German alternatives, rising prices, and the realization that “we’ll deal with it later” is rarely a reliable infrastructure strategy.

On-Premises Kubernetes: Building Sustainable Expertise Within Your Team

Fri, 19 Jun 2026 07:48:51 +0000

The decision to operate a modern Kubernetes -based platform in your own data center is a milestone towards digital sovereignty for system integrators and mid-sized IT organizations. It ensures absolute control over the infrastructure, secures sensitive customer data, and maintains independence from the pricing dictates of international hyperscalers. However, companies almost always encounter the same critical bottleneck on this path: the acute lack of internal Cloud-Native know-how.

Kubernetes is considered powerful but also technologically complex. Attempting to introduce this platform evolution through traditional, theoretical frontal training or isolated sandbox environments creates a dangerous operational risk. If the team does not understand the platform at its core, it will not be able to manage it safely in critical situations. Successfully building genuine platform knowledge therefore requires a fundamental shift from purely academic theory to a guided enablement directly at the productive front.

Auditable Compliance in the Data Center: Structurally Anchoring NIS-2

Fri, 19 Jun 2026 07:37:55 +0000

The days when information security in medium-sized businesses was primarily treated as an internal, purely technical concern are definitively over. With the enforcement of stringent European cybersecurity directives like NIS-2 and DORA, regulatory compliance is now at the forefront for management and IT leadership. Affected companies and system houses are directly liable for the seamless protection of their digital infrastructures and supply chains.

Existing IT structures rarely fail audits due to a lack of goodwill or the general presence of security measures. The fundamental problem is the lack of evidence. What is not automatically documented, versioned, and exportable in systems simply does not exist for the auditor. Compliance should not be a bureaucratic add-on maintained manually in Excel sheets; it must be integrated as an automated, incorruptible control loop directly into the platform architecture.

SLA Management as a Control Tool: Why Error Budgets Make Operations Predictable

Fri, 19 Jun 2026 07:32:13 +0000

For IT service providers and system houses, agreeing on Service Level Agreements (SLAs) is standard business. Customers demand contractually guaranteed availabilities, such as 99.9% per year. In traditional infrastructure operations, this often leads to tedious, manual work at the end of the month: system administrators sift through log files and server histories to retroactively calculate downtime and compile it into a static report.

However, this type of SLA management misses its actual purpose. It is purely documentary, prone to errors, and offers no operational guidance during ongoing operations. Estimating availabilities only in hindsight rather than measuring them continuously means steering the platform blindly and risking serious contractual penalties. Modern platform engineering therefore brings SLA tracking from the reporting level directly to the operational front—through the introduction of Service Level Objectives (SLOs) and so-called Error Budgets.

From Binary Alerts to Observability: Revolutionizing Capacity Planning

Fri, 19 Jun 2026 07:27:39 +0000

In the history of medium-sized IT infrastructures and system houses, having one’s own data center was considered an undeniable competitive advantage for decades. Those who control the hardware have absolute data sovereignty, manage update cycles independently, and can flexibly address compliance questions. To manage the growing number of servers and customer applications, clever administrators early on relied on automation tools: VMware for virtualization, Ansible for provisioning, and custom shell scripts or cron jobs for recurring Day-2 tasks.

The End of Person-Dependent Automation

Managed Grafana: The Visualization and Alerting Platform for Your Kubernetes Ecosystem

Tue, 16 Jun 2026 09:06:54 +0000

Efficient management of modern Kubernetes platforms is akin to peering into a black box. Hundreds of microservices fly in containers across nodes, APIs communicate in milliseconds, and decentralized storage architectures handle constant read and write loads. Without a transparent, centralized control instance, operational management turns into a dangerous blind flight. Those who only notice errors when dissatisfied customers block support or critical subsystems have already collapsed endanger the existence of their digital business.

Managed GitLab: Sovereign All-in-One DevOps Platform in Your Own Cluster

Tue, 16 Jun 2026 08:49:40 +0000

Software development in the cloud-native era demands seamless processes. Code management, ticket tracking, CI/CD pipelines, artifact registries, and security scans must interlock like gears to bring software into production quickly and error-free. However, many IT organizations face fragmented tool chaos: code resides with an external cloud provider, tickets in a separate software silo, and build servers are operated in isolation. This not only slows down development speed but also creates unclear entry points for security risks.

External Secrets Operator (ESO): Secure Secret Management in Kubernetes

Tue, 16 Jun 2026 08:44:00 +0000

The dynamic orchestration of microservices on Kubernetes requires a constant supply of sensitive credentials, API keys, and passwords to applications. However, managing these secrets quickly becomes a security-critical and administrative burden in enterprise environments. Manually injecting secrets into the cluster or, even more dangerously, storing them in plaintext in Git repositories violates fundamental security principles and risks exclusion from Compliance audits under NIS-2 or DORA.

At the same time, modern enterprises often have established, centralized password fortresses (like OpenBao, HashiCorp Vault, or cloud provider key vaults) that serve as the Single Source of Truth for the entire organization. The architectural challenge is: How do you securely, declaratively, and fully automatically bring these external secrets into Kubernetes namespaces without overloading DevOps pipelines with complex API scripts? The answer is the External Secrets Operator (ESO). The Managed ESO solution by ayedo seamlessly integrates your existing secret stores, version-safe and fully automatic, directly into your cluster’s runtime environment.

Distributed Storage: How CEPH Makes Persistent Data in Kubernetes Resilient

Tue, 16 Jun 2026 08:37:22 +0000

The virtualization of computing power has reached an unprecedented level of maturity through Kubernetes . Containers are launched, moved, and scaled within seconds. As long as applications operate in a stateless manner, this dynamic works seamlessly. However, the reality in enterprise infrastructures is different: databases, content management systems, AI models, and e-commerce platforms require persistent storage media (stateful workloads). They need to store data permanently, performantly, and securely.

Relying on traditional, vendor-specific storage solutions or the network drives of individual cloud providers quickly leads to a technological dead end. If a cloud zone fails or an application is to be operated hybrid on its own hardware, the traditional storage infrastructure collapses. For business-critical workloads and under strict Compliance requirements such as NIS-2 or DORA, the storage must be as elastic, decentralized, and resilient as the Kubernetes cluster itself. The answer to this architectural challenge is CEPH. The Managed CEPH Distributed Storage by ayedo brings the world’s most powerful software-defined storage system directly into your cluster.

Weekly Backlog Week 25/2026

Tue, 16 Jun 2026 08:30:21 +0000

🧠 Editorial

This week, I repeatedly asked myself whether we in IT are actually solving problems or just swapping the names of the problems.

In the past, it was Vendor Lock-in, Shadow IT, and insecure plugins. Today, they are called AI assistants, digital sovereignty, and supply chain attacks. The result is astonishingly similar.

We look at a critical Copilot vulnerability, the major sovereignty debate surrounding Anthropic and US technology, Volkswagen’s European cloud plans, and a WordPress hack that shows why trust is sometimes the biggest vulnerability.

Managed ArgoCD: Declarative GitOps Automation for Agile Kubernetes Platforms

Tue, 16 Jun 2026 08:28:35 +0000

In traditional software deployment, the push principle was long considered standard: A CI/CD pipeline builds the code, generates the container images, and actively pushes the infrastructure manifests into the Kubernetes cluster using direct CLI commands (kubectl apply). However, as development cycles accelerate and more microservices operate in parallel on the systems, this approach becomes increasingly risky. Pipelines require extensive administrative rights in the cluster, there is a risk of a creeping configuration drift between the code repository and the live system, and in the event of an infrastructure failure, precisely restoring the desired state becomes a time-consuming patience game.

Managed Authentik: Cloud-Native Identity and Access Management for Kubernetes

Tue, 16 Jun 2026 08:18:25 +0000

In the cloud-native landscape, the number of internal tools, web apps, APIs, and external cluster services is rapidly growing. Each of these applications requires protection against unauthorized access. Allowing each team to maintain its own user database, manage passwords in silos, and only partially implement multi-factor authentication (MFA) creates a massive security risk. For business-critical platforms and under strict compliance regulations like NIS-2 or DORA, the central premise is: A single, incorruptible gate controls access to all digital resources.

WireGuard® Mesh: How NetBird is Revolutionizing Cloud-Native Network Security

Tue, 16 Jun 2026 08:10:09 +0000

The distributed nature of modern IT infrastructures has definitively dismantled traditional network boundaries. When Kubernetes clusters operate across different cloud regions, on-premises databases need to be connected, and decentralized development teams require secure access to internal APIs, conventional security concepts clash with reality. Relying on traditional, centralized VPN gateways in such scenarios not only creates performance bottlenecks but also risks massive security vulnerabilities due to overly broad network privileges in the age of NIS-2 and Zero Trust.

Managed RabbitMQ

Thu, 11 Jun 2026 08:08:57 +0000

In modern cloud-native systems, synchronous communication is a risk factor. When an application communicates directly and blocking via HTTP/REST interfaces with another application, it creates a rigid chain of dependencies. If a single service in the background fails (e.g., a payment API or a logistics system), the entire connection breaks down. The result is incomplete transactions, blocked users, and data loss. To design business-critical platforms, complex enterprise workflows, or data-intensive IoT pipelines to be fail-safe, applications must be isolated from each other and operated asynchronously.

Managed InfluxDB: High-Performance Time Series Databases at the Intersection of IoT and Kubernetes

Thu, 11 Jun 2026 07:55:41 +0000

The digital transformation of industrial companies, supply chains, and software platforms generates a relentless stream of data every second. Sensors in manufacturing halls measure machine vibrations, smart products transmit telemetry data, and Kubernetes infrastructures log utilization metrics. All this data shares a fundamental commonality: it is time-bound. To derive business-critical insights from these massive data volumes in real-time, traditional relational databases fail miserably. They are simply not designed for the enormous write load and continuous aggregation of historical data.

Managed OpenBao: Identity-Based Secret Management for Sovereign Kubernetes Platforms

Thu, 11 Jun 2026 07:47:19 +0000

In the dynamic world of Kubernetes , microservices, databases, and APIs are in constant exchange. This seamless data flow forms the heart of modern cloud-native applications. However, this openness poses a massive security risk: every connection, database access, and API call requires authentication—in the form of passwords, API keys, certificates, or encryption keys. These highly sensitive data, known as secrets, are the crown jewels of your IT infrastructure. If compromised, data leaks, system takeovers, and devastating reputational damage threaten.

The APM Stack by ayedo: Application Performance Monitoring Without the Licensing Cost Trap

Thu, 11 Jun 2026 07:18:47 +0000

Transparency over the performance of microservices and distributed architectures is no longer optional in the cloud-native era—it’s vital. When latencies rise or services silently throw errors, user experience suffers immediately. However, those seeking deep insights into their Kubernetes clusters quickly hit painful limits with established, proprietary APM suites (Application Performance Monitoring). They are often cumbersome, consume enormous amounts of expensive cluster resources, and ruin every IT budget with opaque licensing models.

Polycrate:

Wed, 10 Jun 2026 10:05:56 +0000

Why Digital Sovereignty Needs More Than Open Source

Digital sovereignty is one of the most frequently used buzzwords in recent years. Hardly any provider, cloud project, or digital strategy can do without the term today. At the same time, many companies’ dependency on a few global platforms continues to increase.

AWS, Microsoft, and Google control large parts of the digital infrastructure. Numerous business processes run on platforms that companies neither operate themselves nor fully control. The result: rising costs, limited ability to act, and increasing vendor lock-in.

12 Years of Kubernetes

Wed, 10 Jun 2026 08:19:10 +0000

How an Open-Source Project Became the Operating System of the Cloud

In June, Kubernetes celebrates its twelfth anniversary. What began in 2014 as an internal Google project named “Borg for everyone” is now the technical foundation of much of the modern digital economy.

Few other open-source technologies have developed into a global standard in such a short time. Whether it’s streaming platforms, banks, e-commerce providers, industrial companies, or AI platforms—wherever applications need to be operated reliably, scalably, and automatically, Kubernetes now plays a central role.

Elastic Video Architectures: How Container Orchestration Tames Volatile Streaming Workloads

Tue, 09 Jun 2026 08:46:40 +0000

Video streaming and real-time communication are considered the ultimate challenge in IT infrastructure. While traditional SaaS applications or database-driven web apps often absorb minor latency spikes and CPU bottlenecks unnoticed, video infrastructure reacts mercilessly: A minimal configuration error or brief CPU throttling immediately leads to visible artifacts, audio dropouts, or the complete interruption of a live stream, right before the audience’s eyes.

For operators of enterprise video platforms in the B2B sector, this problem is exacerbated by extremely volatile load profiles. A regular team meeting requires minimal resources, while a global product launch or a quarterly investor call with several thousand viewers can suddenly push the infrastructure to its limits. Relying on rigid infrastructures means either constantly paying for unused peak capacities or risking a business-damaging system collapse at the moment of maximum attention.

Secure by Design – Part 7

Fri, 05 Jun 2026 11:20:51 +0000

Why Platforms Have Become the Actual Security Architecture of Modern Infrastructures

In the previous parts of this series, we explored various aspects of modern platform architectures. We examined why control over infrastructure is increasingly shifting from the actual target systems to the automation layer, why reproducibility is a security requirement, the role of trust relationships and identities, why governance must be technically enforceable, and why standardization is the prerequisite for controllable platforms.

Secure by Design – Part 6

Fri, 05 Jun 2026 11:12:56 +0000

Why Standardization is Not a Limitation but a Security Strategy

Few terms are as frequently misunderstood in technical discussions as standardization.

For many developers and platform teams, standardization initially seems to be associated with limitations. It reduces individual degrees of freedom, limits technological diversity, and enforces common approaches. Especially in technically demanding environments, this quickly raises concerns that innovation might be slowed down and flexibility sacrificed.

However, this perspective is too narrow.

Secure by Design – Part 5

Fri, 05 Jun 2026 11:11:36 +0000

Why Governance Must Be a Feature of the Platform, Not Just a Policy

Governance is one of those terms that frequently appear in technical discussions yet are surprisingly rarely defined precisely. In many organizations, governance is primarily understood as an organizational discipline. Policies are formulated, processes documented, and responsibilities assigned. Architecture boards review decisions, security teams define standards, and compliance departments monitor adherence.

On paper, this often creates a quite convincing control model.

Secure by Design – Part 4

Fri, 05 Jun 2026 11:10:53 +0000

Why Secrets Are Not an Infrastructure Problem

When discussing the security of modern platforms, the topic of secrets inevitably arises sooner or later. API tokens, database passwords, SSH keys, certificates, cloud credentials, or service accounts form the foundation of nearly every infrastructure. Without them, systems cannot be operated or automated.

Despite their central importance, secrets are still primarily viewed as a technical detail in many organizations. They are seen as a necessary prerequisite for automation, as operational parameters, or as components of individual applications.

Secure by Design – Part 3

Fri, 05 Jun 2026 11:07:19 +0000

Why Reproducibility is a Security Requirement

In recent years, Infrastructure as Code has become one of the most crucial components of modern platform architectures. Hardly any organization today operates larger cloud or Kubernetes environments without Terraform, OpenTofu, Ansible, or similar tools. Infrastructure is described, versioned, and deployed automatically. From an operational perspective, this undoubtedly represents a significant advancement over manual processes.

At the same time, a remarkable assumption has taken hold: The mere use of Infrastructure as Code will automatically lead to reproducible and controllable systems.

Secure by Design – Part 2

Fri, 05 Jun 2026 11:06:49 +0000

Why the Most Critical Systems in Your Infrastructure Are Often Not Productive

In the traditional understanding of IT security, productive systems were always the focus of attention. Databases were hardened, network segments isolated, and applications secured against external attacks. The assumption behind this was as obvious as it was plausible: To protect critical data, you must protect the systems that process this data.

This perspective was correct for many years.

Secure by Design - Part 1

Fri, 05 Jun 2026 11:00:23 +0000

Why Modern Platforms Cannot Be Secured Retroactively

The discussion about IT security is still dominated by a misconception. Security is often seen as an additional layer applied to existing systems. Initially, applications are developed, infrastructures are built, and automation processes are established. Only then do firewalls, vulnerability scanners, endpoint protection, or compliance measures follow.

This model might still work acceptably in a world of static systems. However, in modern platform architectures, it inevitably leads to problems.

Weekly Backlog Week 24/2026

Fri, 05 Jun 2026 08:21:51 +0000

🧠 Editorial

The best time to think about digital sovereignty was ten years ago. The second best is after the next Microsoft audit.

Bavaria suddenly wants to become more independent from Microsoft.

Microsoft wants to know when you’re in the office.

Trump wants to get involved with OpenAI.

The wallet is coming - maybe?!

And all of Europe is discussing digital sovereignty, while half of the public administration probably couldn’t even make coffee without American cloud services.

Pride Month:

Tue, 02 Jun 2026 11:22:53 +0000

Openness is not a campaign. It is an attitude.

Every year in June, Pride Month highlights the visibility of the LGBTQIA+ community. For many companies, it is an opportunity to demonstrate a commitment to diversity and acceptance.

This is important.

Even more important, however, is the question of how we, as a society and as a workplace, interact with each other during the other eleven months of the year.

Kubernetes Dashboard is History

Tue, 02 Jun 2026 08:57:28 +0000

Why Headlamp is More Than Just a New UI

The Kubernetes Dashboard was the first visual entry point to Kubernetes for many teams. It made visible what was otherwise accessible only through kubectl, YAML files, and logs: Pods, Deployments, Services, Namespaces, states, errors. For developers, administrators, and platform teams, it was a low-threshold entry into a complex system for a long time.

Now this chapter is closed. The Kubernetes Dashboard has been archived. The Kubernetes community points to Headlamp as its successor—a modern interface that not only replaces the old Dashboard but responds to a significantly changed reality: Kubernetes is no longer just a single cluster technology but the operational foundation of distributed, hybrid, and increasingly business-critical platforms.

Integrated Anycast Ingress: Highly Available Kubernetes Load Balancing Without Cloud Provider Lock-in

Tue, 02 Jun 2026 08:50:31 +0000

Operating a Kubernetes cluster with one of the major US hyperscalers offers significant convenience at the network edge: a single click in the manifest or a simple ingress entry is all it takes, and the cloud platform automatically provisions a highly available external load balancer (like AWS ALB or Google Cloud Load Balancer). The application is instantly accessible worldwide.

However, this convenience comes with two major drawbacks: exorbitant, opaque costs and a technological vendor lock-in. The network infrastructure is inseparably intertwined with the proprietary ecosystem of the respective provider. Those wishing to migrate their cluster to another provider for cost, performance, or compliance reasons will find that the entire routing logic must be rewritten. Loopback breaks this dependency. By natively integrating provider-independent Anycast Layer-4 Load Balancers directly into the European platform network, highly available ingress load balancing is radically democratized, cost-transparent, and maximally resilient.

C5, ISO 27001, and GDPR: What BSI Security Criteria Mean for Sovereign Cluster Management

Tue, 02 Jun 2026 08:46:50 +0000

When medium-sized companies, government agencies, or critical infrastructure operators (KRITIS) migrate their applications to Kubernetes , compliance becomes a top priority. Under the pressure of current EU regulations such as NIS-2 and DORA, it is no longer sufficient in audits to simply claim: “Our systems are secure.” Regulatory authorities demand tangible, standardized proof of the physical and logical integrity of the entire software platform.

Many IT managers feel secure because they store their data within the European Union, thus seemingly meeting the requirements of the GDPR. However, this is often a short-sighted approach in Cloud-Native infrastructures. Those operating business-critical workloads must embed the interplay of European data protection, certified information security management (ISO 27001), and the stringent criteria of the Federal Office for Information Security (BSI C5) at the platform level. A sovereign cluster management like Loopback demonstrates how this rigorous compliance is natively integrated into the automated DevOps routine.

Bring Your Own Nodes: How the Loopback Agent Decouples the Hybrid Cloud

Tue, 02 Jun 2026 08:28:49 +0000

The BYON Paradigm (Bring Your Own Nodes): How the Loopback Agent Decouples the Hybrid Cloud

For a long time, scaling IT infrastructures was dictated by an either-or principle. Companies had to choose: Do they opt for the elastic, hassle-free scaling in the public cloud, accepting opaque costs, vendor lock-ins, and regulatory gray areas? Or do they invest in expensive, proprietary bare-metal hardware in on-premises data centers to retain full data control, sacrificing the valued flexibility of modern cloud advantages?

Geo-Replication and High Availability: Why Containerized Applications Need Local Registries

Tue, 02 Jun 2026 08:15:44 +0000

When companies distribute their business-critical workloads across multiple regions or in hybrid scenarios (cloud and on-premises), disaster recovery becomes a top priority. Kubernetes clusters are set up redundantly, databases are continuously mirrored, and data sets are synchronized. However, in practice, there is an architectural blind spot that can cripple the entire recovery strategy in an emergency: the availability and geographic placement of the container registry.

Using a central, singular registry for all global clusters creates a classic single point of failure and risks massive latency issues in everyday pipeline operations. To mathematically demonstrate compliance with regulations like NIS-2 or DORA, which demand ICT resilience (information and communication technology), container images must be strategically positioned close to the respective clusters. The technological solution for this is automated geo-replication based on standard-compliant enterprise registries like Harbor.

Why Data Transfer Fees (Egress) During Container Updates Drive Up Cloud Costs

Tue, 02 Jun 2026 08:10:01 +0000

When calculating the operating costs of their IT infrastructure in the cloud, most people take a standard look at the obvious items: What do virtual machines (compute) cost, and how much does the provider charge for pure storage space per gigabyte? Budgets are released and migration plans are forged based on these two variables. But once the containerized infrastructure goes live and modern CI/CD pipelines roll out fresh software releases several times a day, the end of the month often brings an unpleasant surprise when looking at the cloud bill.

Multi-Tenancy via OIDC and RBAC: Granular Access Control in Enterprise Registries

Tue, 02 Jun 2026 08:04:49 +0000

In the early stages of container projects, things are usually simple: A small development team builds a handful of microservices, shares a common access to the container registry, and pushes all images into one large, open repository. However, as the containerized infrastructure within a company grows, multiple departments work on clusters in parallel, or external service providers and agencies are integrated into the CI/CD pipelines, this unregulated model reaches dangerous limits.

Weekly Backlog Week 23/2026

Tue, 02 Jun 2026 08:04:29 +0000

🧠 Editorial

Welcome to the Weekly Backlog Week 23/2026.

This week had a remarkably clear theme: Control.

Control over data. Control over infrastructure. Control over standards. And the uncomfortable realization that while many organizations talk about digital sovereignty, they still view their key dependencies as inevitable.

Microsoft is under pressure over OOXML, the Netherlands is discussing data access by US authorities, Kubernetes is saying goodbye to one of its most well-known projects, and a new supply chain worm impressively shows that attackers are no longer targeting servers—but the processes behind them.

The Air-Gapped Paradigm: Security Architectures for Isolated On-Premise Environments

Tue, 02 Jun 2026 07:59:27 +0000

In discussions about cloud transformation, the narrative often suggests that the future of IT lies solely in globally connected, public cloud infrastructures. However, for operators of critical infrastructures (KRITIS), defense companies, research-intensive industries, or highly regulated sectors in finance and healthcare, the reality is entirely different. When systems control nuclear command centers, core medical areas, or sensitive state secrets, the risk of internet connectivity is simply unacceptable.

The ultimate level of security for such highly sensitive workloads is the Air-Gapped Paradigm—operating IT infrastructures in environments that are completely isolated from the internet both physically and logically. Yet, even in these “digital fortresses,” modern development teams want and need to use agile technologies like Docker , containerd , and Kubernetes . The architectural challenge is: How do you operate a highly available Container Registry when no package can ever “call home” or query public repositories (like Docker Hub)?

Digital Signatures at the Edge: Why Image Signing is the Next Step After CVE

Tue, 02 Jun 2026 07:54:41 +0000

To maximize the security of your container supply chain, automated CVE scanning at the cluster boundary is essential. The combination of registry scans and admission control ensures that code with known vulnerabilities never gets executed. This clears an important hurdle. However, a fundamental problem remains: a vulnerability scan only checks the content of a container at a specific point in time - it does not verify its origin and integrity.

Admission Control & CVE Scanning: How to Block Unsafe Images Before They Reach the Cluster

Tue, 02 Jun 2026 07:37:25 +0000

Continuous Integration and Delivery (CI/CD) has revolutionized software development. Code changes flow automatically through pipelines, are packaged into container images, and reach live systems in the Kubernetes cluster within minutes. However, this incredible speed carries an inherent risk: if you don’t secure your pipeline at critical points, you’re creating a highly efficient entry point for malware and security vulnerabilities.

A weekly report or a passive scanner that checks repositories once a day is no longer sufficient in the modern threat landscape and under the strict requirements of regulations like NIS-2 or the Cyber Resilience Act (CRA). Security cannot be a downstream check. True resilience in the software supply chain only emerges when the container registry and Kubernetes cluster work together through automated Admission Control and integrated CVE Scanning as active gatekeepers. Unsafe images must be blocked before they can start a single pod in the cluster.

The Role of DNS in Securing Critical Infrastructures (NIS-2 & Compliance)

Mon, 01 Jun 2026 12:57:12 +0000

The European cybersecurity directive NIS-2 (Network and Information Security) has significantly expanded the scope of regulated companies. While the previous KRITIS regulations primarily affected large corporations in the energy and water supply sectors, NIS-2 now mandates compliance for tens of thousands of medium-sized businesses and suppliers with 50 or more employees. Ignoring these strict requirements can result in personal liability for executives and hefty fines in the seven-figure range.

Unicast vs. Anycast DNS: When Is It Worth Switching Network Topology?

Mon, 01 Jun 2026 12:52:29 +0000

In the digital age, accessibility is everything. As a company grows, internationalizes its services, or operates critical infrastructures, IT departments invest significant budgets in scaling application servers and database clusters. However, a fundamental component often overlooked in scaling is the nameserver infrastructure. Every connection on the internet begins with a DNS query. If this first step is slow or error-prone, even the fastest backend in the background is of no use.

The LCU Cost Trap: How Opaque Billing Models in Cloud Routing Burden SMEs

Mon, 01 Jun 2026 12:44:23 +0000

When companies move their IT infrastructure to the cloud, they usually do so with a clear economic expectation: flexibility and full cost transparency. The principle of “Pay-as-you-go” is intended to transform unpredictable capital expenditures (CapEx) into predictable operational expenses (OpEx). However, the deeper companies are drawn into the ecosystems of the major US hyperscalers, the more complex and opaque the monthly billing becomes.

A prime example of this architectural and financial opacity can be found at the network boundary: the billing of load balancer capacities through artificial, combined metrics like the Load Balancer Capacity Unit (LCU). What initially sounds like a fair, usage-based model often turns out to be an unpredictable cost trap for growing medium-sized enterprises during peak loads or in IoT infrastructures. True economic sustainability therefore also requires a return to transparent, comprehensible pricing structures in network design.

Session Persistence for Stateful Workloads: Sticky Sessions in an Anycast Network

Mon, 01 Jun 2026 12:39:26 +0000

The architecture of modern cloud-native platforms ideally follows the principle of statelessness. Requests are distributed across a global Anycast network, and it doesn’t matter which backend system in a distant data center processes the request, as all instances access the same data base. This design is perfect for modern web APIs or static websites.

However, the reality in established corporate and industrial structures often looks different. Numerous stateful applications exist here: long-lived TCP connections from IoT sensors in production plants, traditional ERP systems, complex terminal sessions, or legacy databases. These systems expect a client to consistently communicate with the same backend server throughout the duration of its session. If this connection breaks or the next data packet lands on a neighboring server, the session context is lost, and the application fails with an error.

Percentile-Based Latency Monitoring: Why Averages Lie in Performance Analysis

Mon, 01 Jun 2026 12:34:08 +0000

In the operation of modern platforms, high-traffic APIs, or industrial IoT gateways, monitoring response times (latency) is one of the most critical metrics. When data flow in the network is delayed, user experience suffers immediately, automated processes are blocked, or critical timeouts in distributed systems are breached.

To evaluate performance, many IT managers default to a well-known mathematical metric in their monitoring dashboards: the average (mean). However, in modern Cloud-Native engineering and Anycast network analysis, the average is a dangerous illusion. It systematically smooths outliers and disguises significant infrastructure issues as seemingly stable systems. To truly understand the performance of edge infrastructure, one must transition to percentile-based latency monitoring (p50, p95, p99).

The Anatomy of the Proxy Protocol: Preserving Source IPs in Layer-4 Load Balancing

Mon, 01 Jun 2026 09:13:39 +0000

In modern Cloud-Native design , the principle of functional division of labor applies. As we saw in the first post of this series (Layer 4 vs. Layer 7 Load Balancing), load balancing at Layer 4 (TCP level) offers unbeatable advantages in terms of performance, latency, and IT security. Since the system does not open encrypted data packets at the network boundary but forwards them unseen at wire speed to the backends, the infrastructure remains lean and extremely resilient.

Bring Your Own IP: Strategies for Seamless and Provider-Independent Infrastructure Migration

Mon, 01 Jun 2026 09:07:38 +0000

When a medium-sized company or corporation decides to modernize its IT infrastructure, migration is almost always on the agenda. Workloads move from the old co-location data center to a modern European cloud provider, or services are relocated back to a private on-premises environment for cost reasons. While the migration of data and compute resources is well manageable today thanks to Container and modern storage technologies, a massive hurdle awaits at the network boundary: the IP address.

Autonomous Systems and BGP Peering: Why True Network Control Requires Its Own AS

Mon, 01 Jun 2026 09:01:03 +0000

In the digital age, one of the most important management principles is: “Do not outsource core competencies.” Companies invest millions to retain control over their software source code, sensitive customer data, and cloud infrastructure. However, as soon as data packets leave their data center to travel across the global internet to the end-user, almost all organizations relinquish control entirely. They blindly trust that major telecommunications companies and transit providers will somehow route the traffic quickly and securely to its destination.

Layer 4 vs. Layer 7 Load Balancing: When Less Complexity Means More Performance

Mon, 01 Jun 2026 08:21:18 +0000

In the architecture of modern, highly available IT infrastructures, load balancing is at the forefront. As applications scale and are distributed across multiple backends or data centers, an instance at the network edge must decide where incoming data streams are directed. At this point, system architects face a fundamental design decision: Should load balancing occur at Layer 4 (Transport Layer) or Layer 7 (Application Layer) of the OSI model?

Cloud Sovereignty Frameworks: Understanding the 8 Sovereignty Goals and SEAL-4 Level

Mon, 01 Jun 2026 08:12:07 +0000

When companies and government agencies discuss the cloud, the term “sovereignty” almost inevitably comes up. However, the more intense the debate, the more blurred the term becomes. For some, it’s enough if the servers are located in a German data center; for others, true autonomy is only achieved when the entire software stack is operated in their own basement.

To eliminate this ambiguity and make digital sovereignty measurable, assessable, and auditable for medium-sized businesses and regulated industries, structured concepts like the Cloud Sovereignty Framework have been established. A central benchmark in this framework is the so-called SEAL-4 Level (Full Digital Sovereignty). Understanding this standard quickly reveals that true sovereignty is not a vague feeling but a precise architectural discipline that follows eight clear objectives.

The Data Act Promise: How to Keep IT Infrastructures Portable Without "Egress Fees" and Barriers

Mon, 01 Jun 2026 08:02:57 +0000

A nightmare for any IT decision-maker is the phenomenon of vendor lock-in—the technological and economic captivity with a single IT service provider or cloud provider. What starts with flexible rates and quick deployments often ends in a dead end: storage costs rise, service quality declines, yet switching to another provider is internally declared “impossible.”

The barriers to switching are often artificial in nature. In addition to proprietary data formats, many large cloud corporations primarily use an economic barrier: so-called egress fees (data export fees). Anyone wishing to withdraw their own data from the platform is charged. To put an end to these anti-competitive practices, the European Union has enacted the Data Act. For companies, this regulation is a powerful tool to legally demand the full portability of their IT infrastructure, down to the network and DNS level.

Cyber Resilience Act (CRA) and the Software Supply Chain: Why Nameservers Are Under Scrutiny

Mon, 01 Jun 2026 07:57:55 +0000

When companies think about IT security, they usually focus on firewalls, encryption, or protection against phishing. However, legislators are now looking much deeper into the technological engine room. With the Cyber Resilience Act (CRA), the European Union has introduced a regulation that encompasses the entire software supply chain. Every digital product—from the firmware of an IoT sensor to a complex cloud platform—marketed in the EU must meet strict Security by Design criteria.

GitOps for Nameservers: Automating DNS Zones as Infrastructure as Code (IaC)

Mon, 01 Jun 2026 07:52:36 +0000

In modern DevOps teams and Cloud-Native architectures, manual server configuration via click interfaces is a thing of the past. Virtual machines, networks, and Kubernetes clusters are fully automated and defined as code (Infrastructure as Code, or IaC for short). However, when it comes to the Domain Name System (DNS), an anachronistic media break persists in many companies: developers must write tickets to the IT infrastructure department or manually log into web dashboards of domain registrars to add A-records, CNAMEs, or TXT entries for a new software release.

DORA-ready in the Financial Sector: What ICT Third-Party Risk Management Means for DNS

Mon, 01 Jun 2026 07:46:29 +0000

DORA-ready in the Financial Sector: What ICT Third-Party Risk Management Means for DNS

For banks, insurance companies, securities firms, and their direct service providers, the regulatory landscape has fundamentally tightened. With the Digital Operational Resilience Act (DORA), the European Union has established a binding legal framework that places the digital operational stability of the entire financial sector on a new foundation.

While many IT departments primarily focus on core banking systems, firewalls, and data encryption during implementation, regulatory audits are increasingly highlighting an often-overlooked component: the Domain Name System (DNS). Under the stringent DORA requirements for ICT Third-Party Risk Management (Chapter V), the unconsidered use of purely US-based DNS and Edge providers becomes a tangible compliance risk.

Multi-Provider DNS in Practice: Keeping Zones Synchronized Across 50+ Providers

Mon, 01 Jun 2026 07:38:34 +0000

In the world of IT infrastructure, there’s an unwritten rule: “Never trust a single route.” Companies naturally rely on redundancy for data centers, cloud providers, and internet connections. If one provider fails, another takes over. However, when it comes to the Domain Name System (DNS), this principle is surprisingly often ignored. Many organizations manage their business-critical domains with a single provider.

If this DNS service fails, whether due to a global misconfiguration, a widespread routing outage, or a massive cyberattack, the company is digitally cut off. No website loads, no API responds, no mail server is reachable. True failover capability, therefore, requires the step to Multi-Provider DNS. The challenge: How do you manage DNS zones centrally without falling into the administrative hell of manual copy-and-paste across dozens of different providers?

The "It's always DNS" Dilemma: Why Edge Infrastructure Determines Business Resilience

Mon, 01 Jun 2026 07:32:17 +0000

Among system administrators and platform engineers, there’s a well-known running gag: When an IT system goes down globally, the web app is unreachable, or internal APIs fail, the first diagnosis is almost always: “It’s always DNS”. What is humorously portrayed in memes has a serious background in the enterprise environment. The Domain Name System is the invisible nervous system of the internet. If it fails, even the best-replicated application servers in the background are of no use.

Weekly Backlog Week 22/2026

Tue, 26 May 2026 07:42:23 +0000

🧠 Editorial

This week, Europe’s tech debate feels like a reality check after ten years of cloud marketing.

While the Netherlands suddenly treats American access to state infrastructure as a security issue, SCHUFA seriously sells its AWS migration as “digital sovereignty.” Apparently, having “European” in the product name is enough for everyone to act as if the CLOUD Act was just a bad rumor.

Meanwhile, California realizes that Open Source doesn’t work like Big Tech. Kubernetes publicly declares that some security vulnerabilities will never fully disappear. And suddenly, it’s about something that has long been suppressed in IT: technical reality.

The New Platform Crisis is Organizational

Wed, 20 May 2026 11:44:04 +0000

Cloud Native was supposed to solve many problems of traditional enterprise IT.

Less rigid systems. Fewer monolithic dependencies. Faster deployments. More automation. Greater scalability. More portability.

And technically, that’s exactly what has happened.

Kubernetes , Infrastructure-as-Code, and GitOps have changed the way modern platforms are built and operated. Infrastructure can now be provisioned reproducibly, applications can be dynamically scaled, and deployment cycles have dramatically accelerated.

Yet, a new problem is emerging in many companies.

Kubernetes v1.36: Why a Small Route Metric Suddenly Becomes Strategically Relevant

Wed, 20 May 2026 11:37:47 +0000

Kubernetes regularly produces features that seem unspectacular at first glance—until you understand the actual infrastructure problem they address.

The new metric route_controller_route_sync_total in Kubernetes v1.36 falls exactly into this category.

Formally, it’s merely a new counter in the Cloud Controller Manager. The metric counts how often the Route Controller synchronizes its routing information with the respective infrastructure provider.

Sounds trivial at first.

In reality, however, this feature very well illustrates where Kubernetes operating models are currently heading—and why many modern clusters today fail less at compute limits than at unnecessary operational infrastructure communication.

Why Many Multi-Cloud Strategies Still End in Lock-in

Wed, 20 May 2026 11:23:19 +0000

Many companies today consider themselves technologically independent once their applications run on Kubernetes .

The argument initially sounds plausible. Containers abstract infrastructure, Kubernetes standardizes deployments, and workloads become inherently portable. In theory, applications can be run on AWS, Azure, Google Cloud, OpenStack, or on-premises without needing fundamental redevelopment.

Technically, this is even true.

Strategically, however, this perspective often falls short.

The real dependency in modern platform architectures no longer primarily arises at the infrastructure level. It emerges where companies begin to adapt their operational reality to proprietary platform logics. It is precisely at this point that control gradually shifts from the company itself to the platform provider.

Digital Sovereignty Requires Portability

Wed, 20 May 2026 10:29:35 +0000

Digital Sovereignty Requires Portability

The European debate on digital sovereignty has been stuck in a remarkably superficial loop for years. Discussions revolve around data center locations, GDPR compliance, US cloud providers, Gaia-X, “European alternatives,” and increasingly around regulatory frameworks like NIS2, DORA, or the Data Act .

What regularly gets overlooked is the core question: Who controls the digital value chain?

This is where it is decided whether companies, authorities, or entire economies can act technologically sovereign — or remain in a better-marketed form of the same dependency.

Long-term Artifact Persistence: Why a Dedicated Container Registry is Essential for AI Models

Tue, 19 May 2026 09:36:31 +0000

When IT decision-makers and data engineers discuss the deployment of machine learning and artificial intelligence, the focus is almost entirely on frameworks, algorithms, and GPU performance. However, one aspect is regularly underestimated in the early stages—with fatal consequences for stability in later production operations: artifact management.

In software development, versioning source code via systems like Git has been standard for decades. However, for AI and advanced analytics workloads, code alone is no longer sufficient. A productive model is the result of a specific code base, a precisely defined runtime environment (libraries, drivers, operating system dependencies), and the trained model weights (artifacts). If these components are not consistently and long-term encapsulated, the system risks breaking unnoticed with every automatic update running in the background. Therefore, a dedicated, internal container registry is the indispensable memory of any sovereign data platform.

Governance Meets Speed: Identity and Compliance in Modern Data Platforms

Tue, 19 May 2026 09:31:30 +0000

In many industrial and corporate structures, there is a constant tension between two departments. On one side are the data engineering and analytics teams demanding maximum agility: they want to test new tools, flexibly link data streams, and scale compute resources without bureaucratic hurdles. On the other side is IT security and compliance, whose core task is to minimize risks, prevent unauthorized data access, and ensure compliance with strict regulations (such as GDPR or ISO 27001 ).

Hybrid-GPU on Demand: How Compute-Intensive AI Workloads Flexibly Migrate Between On-Prem and Cloud

Tue, 19 May 2026 09:25:20 +0000

In industrial environments, those training machine learning models, optimizing neural networks, or running complex simulations inevitably encounter the same physical and economic bottleneck: the availability of graphics cards (GPUs). While standard CPUs are perfectly adequate for everyday applications, modern AI workloads demand massive, parallelized computing power.

In medium-sized businesses and large industries, this leads to a constant balancing act. If you purchase expensive high-end GPUs for your own highly secure on-premises data center, they often sit idle for months after the intensive training phase, tying up valuable capital. On the other hand, waiting for the approval and delivery of new hardware for each new project slows down the innovation speed of the specialized departments due to IT infrastructure constraints. The solution to this dilemma lies in a hybrid, cloud-agnostic layer architecture.

AI Without Loss of Control: Data Protection-Compliant Language Models in Your Own Platform Infrastructure

Tue, 19 May 2026 09:18:36 +0000

The hype around generative artificial intelligence (AI) and Large Language Models (LLMs) has become a tangible operational reality in medium-sized businesses. Whether it’s automated ticket summaries in support, intelligent email drafts in sales, or structured searching of thousands of internal project documents: the efficiency gains are undeniable.

However, with the rapid adoption of the technology, a fundamental concern is growing in executive suites and IT departments: those who use the popular, purely cloud-based AI services from overseas inevitably feed them with sensitive company data. For research-intensive companies, mechanical engineering, or businesses in regulated environments (KRITIS, FinTech), this uncontrolled data outflow is inherently prohibited. The solution lies in a paradigm shift: Local & Sovereign AI - artificial intelligence that operates entirely within its own digital territory.

Auditing in Transition: Achieving Verifiable Sovereignty in Customer Service

Tue, 19 May 2026 09:13:27 +0000

When a B2B company enters into contracts with highly regulated industries such as banking, insurance, or the automotive sector, the final decision rarely hinges on price or the best sales pitch. The ultimate hurdle is the supplier audit. Increasingly, it’s not just commercial decision-makers in procurement but specialized IT auditors meticulously examining the handling of sensitive data.

Particularly in customer service (helpdesk, support chats, ticketing), where unstructured, highly sensitive data flows daily—passwords, system error messages, personal customer data, or even design plans—the spotlight is on. Anyone who has to search for documents for days during an audit or presents unclear data flows risks the entire deal. With a standardized, sovereign platform architecture, this auditing process can be radically simplified.

Sovereignty as an Architectural Principle: A Guide to Future-Proof IT Structures

Tue, 19 May 2026 09:10:13 +0000

When companies decide to modernize their IT infrastructure, short-term criteria are usually at the forefront: What features does the software offer today? How quickly can it be deployed? What does it cost in the first year? This perspective falls short in an increasingly dynamic, regulated, and technology-dependent world.

To future-proof their IT, companies must understand sovereignty as a fundamental architectural principle. Digital sovereignty is not an afterthought or a mere compliance checkbox—it is an architectural attribute that must be firmly embedded in the foundation. This guide provides a concrete set of criteria for IT managers and executives to assess and manage the resilience and autonomy of their software landscape.

Case Study: How a Technical Service Provider with 180 Employees Regained Data Sovereignty

Tue, 19 May 2026 09:05:42 +0000

The discussion about digital sovereignty, the US CLOUD Act, and IT compliance is often conducted at a very theoretical level. However, the structured analysis of a transformation project at a technical service provider for plant maintenance and repair shows how urgent the need for action can become for medium-sized businesses.

With around 180 employees in the DACH region—most of them working in the field for various industrial companies—the company faced the challenge of making its established structures fit for the tightened market requirements. This case study documents the journey from a fragmented US-SaaS landscape to an integrated, sovereign business platform.

From SaaS Silos to API-First Platform: How Modern Business Tools Converge

Tue, 19 May 2026 08:58:30 +0000

In many medium-sized companies, the IT landscape resembles a collection of digital islands. There is one application for customer contact, another for internal communication, one for document storage, and yet another system for project management. Each of these tools serves its purpose individually. However, because they do not natively communicate with each other, isolated data silos—known as SaaS silos—emerge in daily operations.

The result: Employees spend valuable work time manually transferring data from one interface to another. This is not only inefficient but also increases the error rate in operational business. To overcome these hurdles, modern software architecture is shifting away from closed monoliths towards an API-First approach. Open, standardized interfaces are the connective tissue that forms an intelligent, seamless overall platform from individual applications.

Managed Open Source: The Middle Ground Between Maintenance Effort and Data Control

Tue, 19 May 2026 08:52:42 +0000

When medium-sized companies plan their IT strategy for the coming years, they often find themselves in a strategic dilemma. On one hand, there is the desire for maximum data control, independence, and legal certainty—arguments that clearly favor the use of open-source software within their own legal domain. On the other hand, there is the harsh reality of a skills shortage: internal IT departments are often already overwhelmed with daily support; they simply lack the capacity for complex in-house operations, patch management, and securing a modern server infrastructure.

Centralized Identity Management: The Bridge Between Security and User Convenience

Tue, 19 May 2026 08:47:09 +0000

In modern business IT, two departments often stand in stark opposition: IT security demands increasingly complex passwords, additional authentication factors, and strict access restrictions to protect the infrastructure from unauthorized access. Meanwhile, business departments demand speed, flexibility, and easy access to all the tools they need for their daily work.

As companies grow and introduce more digital tools, this tug-of-war without an overarching concept leads to risky sprawl. Employees become overwhelmed by the flood of access credentials, passwords are noted unsecured, and when leaving the company, accounts may remain active for weeks in the worst case. The solution to this dilemma lies in a centralized identity layer—an Identity & Access Management (IAM)—that acts as both an invisible security guard and a convenience guarantor.

The Anatomy of Seamless Workflows in Technical Field Service

Tue, 19 May 2026 08:27:58 +0000

In technical field service, whether in plant maintenance, mechanical engineering, or large-scale craft operations, every minute counts. When a production line is down or a customer reports a critical issue, information must flow flawlessly. However, the reality in many established medium-sized companies is different: information gets stuck in email inboxes, service technicians enter data twice, and the final signature on the maintenance report requires switching to an external US SaaS platform.

No More Logo Swapping: Why Digital Sovereignty Requires Platform Thinking

Tue, 19 May 2026 08:22:40 +0000

When medium-sized companies decide to break free from the dependency on major US SaaS providers, the migration process often follows a rigid, sequential pattern. They take the existing tool landscape and look for a suitable open-source replacement for each tool: Chat provider A is replaced by Chat provider B, file-sharing service X by file-sharing service Y.

In practice, this isolated approach—often mockingly referred to as “pure logo swapping” in software architecture—rarely leads to success. It is neither economical nor does it enhance productivity. True digital sovereignty and operational excellence only emerge when companies move from mere tool replacement to a holistic platform thinking.

Understanding Vendor Lock-in: The Invisible Chains of Modern Cloud Software

Tue, 19 May 2026 08:09:46 +0000

When companies think about IT security, cyberattacks, data loss, or server failures are usually at the forefront. A much more subtle but often strategically dangerous risk is easily overlooked: Vendor Lock-in (dependency on a provider).

In the early stages, entering a closed software ecosystem feels comfortable. The tools work seamlessly together, and implementation is swift. However, the deeper a medium-sized company integrates its core processes, data structures, and workflows into the proprietary infrastructure of a single, often US-based provider, the harder and more costly a potential switch becomes. A partnership business relationship gradually turns into a technological dead end.

The 40% Formula: How Open-Source Platforms Break the Licensing Spiral

Tue, 19 May 2026 08:05:57 +0000

When analyzing the IT costs of a growing medium-sized enterprise, one almost always encounters the same dynamic: the relentless progression of Software-as-a-Service (SaaS) licensing fees. What begins as a manageable subscription for a handful of employees evolves into one of the largest items in the IT budget as the workforce grows, new departments are added, and major providers regularly adjust prices.

For medium-sized businesses, the strategic question increasingly arises as to whether the classic “per-head licensing model” of large US monopolies is economically sustainable in the long term. Practice shows: Switching to integrated, self-determined platform structures based on open-source can reduce ongoing licensing and operating costs by up to 40%, while maintaining or even increasing process efficiency.

Standard SaaS as a Growth Inhibitor: When US Tools Cost the Major Client Contract

Tue, 19 May 2026 07:59:16 +0000

The use of established US SaaS solutions is standard in the mid-sized business sector. Whether for collaboration, customer support, or document management, the advantages are clear: the applications are ready to use immediately, require minimal in-house IT resources, and offer an excellent user experience.

However, in the B2B environment, the rules of the game are shifting. As soon as a mid-sized company seeks contracts with large corporations, banks, insurance companies, or operators of critical infrastructures (KRITIS), the developed software landscape suddenly turns from an accelerator to a brake. In strategically important tenders and security audits, the focus is increasingly not only on functional features but on demonstrable control over the digital legal space.

Weekly Backlog Week 21/2026

Mon, 18 May 2026 08:07:52 +0000

🧠 Editorial

I increasingly feel that Europe confuses digital sovereignty with infrastructure folklore.

US clouds suddenly become “sovereign” as soon as a German data center is set up and a Telekom logo is placed next to it — while the technology, platform control, and dependencies remain exactly the same.

That the Google/Telekom model apparently found no customers does not surprise me at all.

Because the crucial question is not where data resides. The crucial question is who controls the platform on which processes, automation, and business logic run.

Security in Demo Environments: Temporary Access and SSO for Prospects

Wed, 13 May 2026 08:58:55 +0000

When granting potential customers access to a test instance, you open a window into your technology. This is essential for closing sales but presents challenges for IT: How do you ensure access isn’t abused? How do you prevent a prospect from delving deeper into the system than they should? And how do you ensure access expires when the trial period ends?

Security in demo environments should not be a barrier to sales. With modern Identity and Access Management (IAM), security becomes an invisible, automated companion that protects both your intellectual property and your customers’ data.

Scaling Under Pressure: How to Run Dozens of Live Demos Simultaneously and Stably

Wed, 13 May 2026 08:46:06 +0000

Imagine your company is an exhibitor at the year’s most important trade show. The booth is packed, your sales team is highly motivated, and at every terminal, a potential major client is waiting for a live presentation. At this moment, the infrastructure is the weakest link in the chain.

In traditional environments based on a few fixed servers, panic often ensues under this load: Performance drops, instances freeze, and new demos can no longer be launched. What was planned as a marketing highlight turns into a technical debacle. A modern, Cloud-native infrastructure turns this stress scenario into routine.

Senior Developers Are Not Demo Admins: How to Reclaim 20% of Engineering Capacity

Wed, 13 May 2026 08:41:39 +0000

In many growing SaaS companies, there is an “invisible productivity killer.” It doesn’t have a technical name but manifests in phrases like: “Can you quickly fix the demo instance for client XY?” or “We need a new environment with the beta feature for tomorrow, can you set it up quickly?”

Often, this work falls to the most experienced senior developers—simply because they know the system best. What seems like a small favor for sales quickly turns into a massive economic problem. If your most expensive specialists spend 20% of their time acting as infrastructure assistants for sales, it slows down your entire product roadmap.

Test Data Management: How to Always Provide Up-to-Date and Relevant Scenarios in Your Demos

Wed, 13 May 2026 08:35:49 +0000

Imagine presenting a state-of-the-art production planning software to a potential customer. You click on the dashboard, and what the customer sees are empty tables or cryptic test entries like “Test 123” and “John Doe.” The focus is immediately lost. The customer has to laboriously imagine how the system would look with their data instead of experiencing the benefits directly.

In the SaaS world, it’s not just the best feature that wins, but the best scenario. A demo environment is only truly effective when filled with realistic, current, and industry-specific data. Through automated test data management , you transform an empty software shell into a vibrant solution.

GitOps for Sales: Infrastructure Manifests as the Basis for Scalable Product Presentations

Wed, 13 May 2026 08:32:18 +0000

In the traditional IT world, infrastructure was something “handcrafted.” An administrator would install servers, configure databases, and adjust settings manually. For sales, this meant every demo was unique - prone to errors and hard to reproduce.

The modern alternative to this is GitOps. Originally developed to manage highly available cloud applications , it is now proving to be the perfect operating system for software sales. GitOps allows the entire demo setup to be treated like code. The result is scalability that was previously unimaginable.

"Try Now" Buttons That Actually Work: Automated Lead Gen on Your Website

Wed, 13 May 2026 08:28:49 +0000

Every SaaS marketing manager dreams of it: A prospect lands on the website, clicks “Free Trial,” and can start immediately. But in the reality of complex business software (like ERP or PLM), this click often leads to a dead end. Instead of a trial version, the user sees a form with the note: “Thank you, our sales team will contact you in the next few days.”

In a world of “Software on Demand,” this delay is a massive conversion killer. When the competition is just a click away, the one who provides immediate access to the product wins. With an automated platform infrastructure, you turn this static button into a real lead accelerator.

True Isolation Instead of "Shared Demo": Why Every Prospect Deserves Their Own Namespace

Tue, 12 May 2026 11:33:10 +0000

Who hasn’t experienced this? In the middle of an important product presentation, unexpected data appears, the system responds extremely slowly, or the configuration doesn’t match what was prepared. The reason is usually a “Shared Demo” infrastructure: multiple salespeople use the same instance or database server for different customers.

In modern cloud architecture, this model poses a massive risk. The solution is Isolation through Namespaces. In a Kubernetes -based platform, each demo environment receives its own digitally fenced area. This is not just a technical gimmick but a prerequisite for professional sales performance.

From Ticket to Pipeline: How Sales Can Launch Their Own ERP Instances at the Push of a Button

Tue, 12 May 2026 11:30:19 +0000

In many SaaS companies, the process between sales and IT resembles a diplomatic exchange: Sales needs a demo environment for an important meeting, submits a ticket to development, and then the waiting begins. “We’re in the middle of a sprint,” “The database guy is on vacation,” or “The demo servers are currently full” are responses that slow down the sales routine.

The solution to this problem is as simple as it is revolutionary: Self-Service. By hiding the technical complexity behind a simple user interface (pipeline), we empower the sales team to manage infrastructure themselves—without writing a single line of code or opening a ticket.

Ephemeral Environments: Short-Lived Instances as a Secret Weapon for Complex Software Demos

Tue, 12 May 2026 11:25:13 +0000

Anyone who sells complex business software knows the problem of “data remnants.” In static demo environments, test entries, altered configurations, and half-finished scenarios accumulate over months. In the end, no one knows exactly what state the system is in. The result: Sales presents on a “cluttered” basis, and IT spends valuable time on tedious cleanup.

The solution to this chaos is Ephemeral Environments. Instead of maintaining an infrastructure that lives forever, we rely on instances that operate on the “Build-to-Burn” principle: they are created at the push of a button and automatically disappear once they have fulfilled their purpose.

The 'Demo Bottleneck': Why Manual Environments Hinder Your Sales Success

Tue, 12 May 2026 11:22:12 +0000

In the world of complex B2B software and ERP systems, the live demo is the crucial moment of truth. It’s where a prospect decides whether they understand the solution’s potential or walk away frustrated. While marketing teams invest heavily to generate leads, the process often gets stuck in a technological bottleneck after the inquiry: the provisioning of the demo environment.

If your sales team has to wait for the IT department to set up a fresh instance for a customer, you’re losing more than just time. You’re losing momentum, credibility, and ultimately revenue.

The "Software Operations" as a Product: Why DevOps is More Than Just Infrastructure Maintenance

Tue, 12 May 2026 09:26:58 +0000

In many companies, IT operations are still viewed merely as a cost center - the department that ensures “the servers are running.” However, in the world of Software-as-a-Service (SaaS), this perception has fundamentally changed. Today, running a successful platform means understanding infrastructure not as a static foundation but as its own dynamic product.

This paradigm shift - often summarized under the term DevOps - is the crucial lever to reduce technical debt, increase innovation speed, and sustainably ensure software quality. But what does it concretely mean to understand operations as a product?

Asynchronous Workflows: How RabbitMQ and Redis Speed Up Your SaaS Application

Tue, 12 May 2026 09:22:56 +0000

Have you ever used an application that froze for 10 seconds when you clicked “Export” or “Save”? In the world of modern SaaS, that’s a “no-go.” Users expect instant feedback. However, when a user generates a complex PDF file, exports thousands of records, or sends an email series to an entire building authority, it takes time.

The secret to faster applications lies in decoupling these heavy tasks from the actual user request. Instead of making the user wait until the server is done, we send the task to a queue. We make the workflows asynchronous.

Audit-Ready by Design: How Modern Platforms Automate Compliance Reports

Tue, 12 May 2026 09:19:26 +0000

For many SaaS providers, compliance checks by a new major client or an official audit (like ISO 27001 ) or SOC2 are daunting projects. Logs are scrutinized for weeks, manual lists of software versions are created, and backups are painstakingly documented. The problem: This documentation is often outdated by the time it is submitted.

In a modern platform architecture, compliance is not a downstream effort but a byproduct of daily operations. By utilizing Kubernetes and specialized tools, the infrastructure becomes “audit-ready by design.” We show you how you can demonstrate at the push of a button that your platform is secure, up-to-date, and GDPR -compliant.

Horizontal Pod Autoscaling: Navigating the Monday Morning Peak with Ease

Tue, 12 May 2026 09:15:00 +0000

Every SaaS operator knows it: the dreaded load peak. Whether it’s Monday morning when all users simultaneously update their project plans, or a sudden surge following a marketing campaign - traditional infrastructures quickly reach their limits.

In a classic VM environment, responding to load is often sluggish. Either you run permanently oversized (and thus expensive) servers to be prepared for peaks, or the system buckles until manual intervention occurs. Horizontal Pod Autoscaling (HPA) breaks this vicious cycle with an infrastructure that “breathes” in real-time.

Production-like Staging: Why "Almost the Same" Isn't Enough in Software Development

Tue, 12 May 2026 08:24:41 +0000

“It worked on my machine!” This phrase is a classic in software development. However, the real problem usually lies a step further: in the staging environment (the test environment before going live). In many established SaaS companies, staging resembles more of a “light version” of production: smaller servers, simpler network paths, no replica databases, and often outdated datasets.

When staging and production are only “almost the same,” dangerous blind spots emerge. Errors that only occur under load, in multi-server operations, or with specific database configurations remain undetected until they hit production with the end customer. A true, production-identical staging is not a luxury but the life insurance for your release quality.

Backup is Not Restore: Why Only Tested Recovery Truly Matters

Tue, 12 May 2026 08:21:35 +0000

“We have a nightly backup.” In many SaaS companies, this phrase is the standard response to questions about data security. However, the harsh reality in a disaster scenario often looks different: corrupted backup files, missing configuration data, or recovery times that consume entire business days.

In the modern SaaS world—especially when serving clients from the public sector, healthcare, or enterprise areas—merely having backups is no longer sufficient. What matters is recoverability. A backup that hasn’t been regularly tested for real-world scenarios is essentially worthless. We show you how to turn “hope for data” into a verifiable process.

From "Fear Deployment" to Routine: Zero-Downtime Releases with GitOps

Tue, 12 May 2026 08:18:37 +0000

In many mature SaaS infrastructures, the day of a software release is a day of tension. The engineering team has worked for weeks on new features, but the moment of rollout becomes a nail-biter. When deployments are manually pushed to virtual machines (VMs) via SSH scripts or Ansible playbooks, the risk is high.

The result: Deployments are artificially limited to Tuesday and Thursday evenings after 8:00 PM to minimize the impact of potential downtime. A faulty release often means hours of manual troubleshooting and a tedious rollback. This slows down innovation and burdens the team. However, there is a way to make deployments an invisible background routine - during operation, without user impact.

Cloud vs. On-Premise: An Operating Model for Both Worlds

Tue, 12 May 2026 08:15:33 +0000

For many SaaS providers, winning a large enterprise client or a public sector contract is a double-edged sword. On one hand, there’s the attractive revenue; on the other, the demand: “We don’t use public cloud. We need an on-premise installation in our own data center.”

Suddenly, the engineering team faces a monumental task. The existing cloud infrastructure cannot simply be duplicated. “Special solutions” arise, manual update processes, and a dangerous lag between the cloud version and the on-premise instance. However, there is a way to serve both worlds with exactly the same effort.

When Your Infrastructure Becomes a Growth Staller: Signs It's Time to Switch to a Platform Model

Tue, 12 May 2026 08:07:13 +0000

In the early stages of a SaaS company, pragmatism is the most important currency. You build what works. Often, this is a classic setup of a few virtual machines (VMs), a load balancer, and a database server. This model is cost-efficient, easy to understand, and gets the product to market quickly.

But with success comes the load. What ran smoothly with 20 customers becomes a daily stress factor with 200 customers—and a potential existential risk with 2,000 users.

Lobby Map

Fri, 08 May 2026 07:02:25 +0000

The Big Tech Lobby in Germany is Larger Than Many Believe

The new lobby map from the Center for Digital Rights and Democracy visualizes a problem that has been visible in Europe for years — but rarely depicted so concretely: the structural influence of major US tech companies on political decision-making processes in Germany.

The map is based on public data from the German lobby register. So, the information itself is not new. What is new is how clearly the connections suddenly become visible.

Weekly Backlog Week 20/2026

Fri, 08 May 2026 06:25:15 +0000

🧠Editorial

Europe has been discussing digital sovereignty for about as long as companies have been “briefly testing” Kubernetes clusters in production.

Yet much of the current debate still feels like an infrastructure remake of “We have no alternative”.

This week makes that particularly clear.

The new lobby map reveals how deeply Big Tech is now embedded in political and economic networks. Anyone talking about Cloud , AI, or platform regulation in Berlin is almost inevitably speaking in an environment shaped by the very corporations whose power they aim to limit.

Infrastructure as Code: How GitOps Makes Operating Complex Video Platforms Manageable

Wed, 06 May 2026 10:04:26 +0000

In the modern IT world, video is the crown discipline. A high-performance video infrastructure today must be many things at once: elastically scalable, strictly tenant-isolated, and absolutely fail-safe. However, with this technical superiority comes increased complexity. Hundreds of namespaces, individual resource limits for different customers, complex network policies, and constantly changing versions of video engines can no longer be managed “by hand.”

Anyone working here with manual scripts or CLI commands unknowingly builds a “snowflake infrastructure”: Each component is unique, no one knows exactly how it came about after six months, and quick recovery in the event of a disaster becomes impossible. The solution to this dilemma is GitOps.

Beyond Uptime: Why Traditional Monitoring is Blind to Video Quality

Wed, 06 May 2026 10:00:39 +0000

In traditional IT, a glance at CPU load or HTTP status code often suffices: If the server responds and the CPU isn’t at 100%, the system is considered “healthy.” For video workloads, this perspective is fatal. A streaming server can run perfectly while viewers see only still images because network latency (jitter) is too high or the source bitrate drops.

True Video Monitoring (Observability) must delve deep into the protocols. We need to know what’s happening within the stream, not just whether the process is running. With a modern stack of VictoriaMetrics, Grafana, and specialized exporters, we make invisible quality losses visible.

Stable Performance for Everyone: Why Tenant Isolation Determines SLA for Video Workloads

Wed, 06 May 2026 09:56:37 +0000

In a multi-tenant environment (many customers on one platform), video is a selfish workload. If Customer A starts a massive live event with 10,000 viewers, it must not cause Customer B’s confidential meeting to stutter or Customer C’s video recording to take hours longer.

The problem with classic hosting is the “Noisy Neighbor” effect: one application consumes so many resources that others starve. In the video world, “starving” means immediate quality loss. With Kubernetes , we rely on strict, multidimensional isolation to ensure guaranteed Quality of Service (QoS) for each tenant.

Digital Sovereignty in Streaming: Video Processing Without US Cloud Dependency

Wed, 06 May 2026 09:51:55 +0000

Video data is highly sensitive. Whether it’s internal strategy meetings, confidential investor calls, or patient data in healthcare, the question of where this data is processed and stored is now a strategic decision.

Many streaming platforms use US-based services in the background for transcoding or delivery. However, this poses a problem for European companies: Due to the US Cloud Act, US authorities potentially have access to data stored on servers of US companies, even if they are physically located in Europe. True digital sovereignty means retaining control over the entire stack—from ingest to storage.

Economic Scaling: How Node Autoscaling Makes Video Workloads Affordable

Wed, 06 May 2026 09:47:54 +0000

One of the biggest cost drivers in the video business is the gap between provisioned and actually used capacity. Video workloads are extremely “hungry”: A single HD transcoding job or a WebRTC bridge can demand multiple CPU cores. Rigid planning either leads to paying for unused servers (over-provisioning) or risking system crashes during peak loads (under-provisioning).

The solution is a two-tier autoscaling model that precisely adjusts the infrastructure to the application’s needs. We demonstrate how to configure the mechanics behind Kubernetes to achieve both economic and technical harmony.

Elastic Transcoding: How Automated Workflows Accelerate On-Demand Availability

Wed, 06 May 2026 09:45:01 +0000

A live event often ends in a digital mess: massive raw files in the highest quality are left on the servers. However, the client doesn’t want to receive the recording manually via a download link in three days—they expect the video to appear immediately in the media library, optimized for all devices from smartphones to 4K TVs.

This “shrinking” and converting of video data (transcoding) is one of the most computationally intensive tasks in IT. Relying on static servers here presents an unsolvable choice: either block your entire infrastructure for hours, or leave the client waiting indefinitely. The solution lies in an elastic processing pipeline on Kubernetes .

Multi-Destination Streaming: How to Serve YouTube, LinkedIn, and More Directly from the Cloud

Wed, 06 May 2026 09:40:31 +0000

In modern event communication, streaming “only” on your own website is rarely enough. Marketing teams want to be where their audience is: on LinkedIn for B2B contacts, on YouTube for the general public, or on Twitch for the younger audience.

In the past, this meant the technician on-site had to run multiple encoder instances in parallel. This requires massive upload bandwidth at the event location and expensive hardware—a high risk for connection dropouts. The solution is cloud-based restreaming. Here, the producer sends a single high-quality stream to your platform, and the infrastructure takes care of distribution.

From "Single Point of Failure" to Resilience: Making Live Ingest Unbreakable

Wed, 06 May 2026 09:37:19 +0000

In the world of live streaming, ingest is the most critical moment. This is when the video signal is transmitted from the producer (from the studio or event location) to the platform. If this connection breaks or the receiving server crashes, the event ends for all viewers. There is no “buffer” to bridge a total source failure.

In traditional bare-metal environments, this ingest is often a massive Single Point of Failure (SPOF). The stream is sent to a fixed IP address of a single server. If this server fails, the curtain falls. With a Cloud-Native architecture on Kubernetes , we transform this bottleneck into a highly available, self-healing pipeline.

WebRTC at Scale: Transitioning from Jitsi to LiveKit on Kubernetes

Wed, 06 May 2026 09:32:47 +0000

Real-time video communication today relies almost exclusively on WebRTC. However, WebRTC is not a finished product but a set of protocols. How this set is implemented determines whether a platform struggles with 100 concurrent participants or processes thousands of streams simultaneously with stability.

Many providers start with Jitsi. It is open source, well-known, and offers a ready-made interface. However, those who want to operate a video platform as a scalable product—and not just as an internal meeting room—often encounter architectural limits with Jitsi. The transition to LiveKit marks the shift from an application perspective to a true Cloud-Native infrastructure .

Video Tolerates No Errors: Why 'Bare Metal' Hits Its Limits in Live Streaming

Wed, 06 May 2026 09:28:16 +0000

Compared to classic web applications, video is a completely different type of workload. While a web server can often cushion a brief load spike with slightly delayed response times, video is absolutely intolerant. A CPU spike of just a few milliseconds in a live stream does not lead to ‘waiting’ but to visible artifacts, audio dropouts, or—in the worst case—the complete disconnection of the stream.

Many companies historically rely on bare-metal servers for their video platforms. The logic behind this: “I need the full power of the CPU without virtualization overhead.” However, what sounds like performance in theory becomes an operational and economic nightmare in practice as user numbers grow.

Economics of Precision: Why Seemingly Cheap Monitoring Becomes Expensive in the End

Tue, 05 May 2026 09:25:22 +0000

In IT procurement, monitoring is often viewed as a commodity—a standard product that should cost as little as possible. “A ping is a ping,” is the misconception. However, those who focus only on the price per check overlook the massive downstream costs caused by imprecise signals, lack of integration, and administrative friction.

True endpoint monitoring is not a cost factor but an efficiency investment. In this final part, we demonstrate why choosing a high-quality, precise solution reduces the total cost of ownership (TCO) of IT operations.

Data with Added Value: How Raw Monitoring Signals Become Reliable SLA Reports

Tue, 05 May 2026 09:22:25 +0000

Monitoring data often has a short half-life: An alert pops up, the issue is resolved, and the alert disappears. However, for a managed hosting provider or a critical infrastructure operator, these data hold much more potential. They are the objective proof of the performance delivered.

The challenge lies in processing the enormous amounts of metrics produced by global endpoint monitoring every second in a way that is understandable to both technicians and customers. The solution is seamless integration into the existing observability stack using Prometheus and Grafana.

Seamless Automation: Endpoint Discovery as the Backbone of Dynamic Infrastructures

Tue, 05 May 2026 09:19:48 +0000

In traditional infrastructures, monitoring was a manual process: a new server was rented, an application installed, and then manually added to the monitoring system. In the era of Kubernetes and microservices, this approach no longer works. Endpoints can appear and disappear within minutes.

The greatest risk for managed hosting providers is the monitoring gap: a developer deploys a new service or ingress object but forgets to include it in the monitoring. If an error occurs, the team is blind. The solution is a system that “breathes” with the platform - automatic endpoint discovery.

GDPR & Monitoring: Why Uptime Checks Are Not for US Providers

Tue, 05 May 2026 09:17:16 +0000

When thinking about monitoring, many first consider technical metrics. However, monitoring endpoints inevitably involves data processing, bringing legal security into focus. Many of the most well-known uptime services originate from the USA. What may seem like a harmless tool at first glance can, upon closer inspection, pose a significant compliance risk.

For European companies, especially in managed hosting and critical infrastructure sectors, using US-based monitoring solutions is often hardly legally defensible. This is not only due to storage locations but also the nature of the data flowing through monitoring.

Performance as an Early Warning System: When "Slow" Becomes the New "Down"

Tue, 05 May 2026 09:14:37 +0000

In traditional IT monitoring, the binary principle prevailed for a long time: a system is either up or down. However, in the modern digital world, this perspective is dangerous. An endpoint that returns an HTTP status 200 but takes 10 seconds to load is practically as useless to a user as a complete outage.

Studies show that users become impatient and drop off after just three seconds of loading time. For e-commerce, portals, and APIs, poor performance directly translates to a loss of revenue and trust. Therefore, monitoring must not stop at status codes—it must understand latency as a critical health indicator.

Stop Regional Blindness: Why DNS and Peering Errors Require Global Monitoring

Tue, 05 May 2026 09:12:22 +0000

The internet is not a homogeneous entity but rather a patchwork of thousands of autonomous systems communicating via the Border Gateway Protocol (BGP). For an IT manager in Frankfurt, their application might be perfectly accessible, while for a user in Munich or London, it might effectively not exist.

This regional blindness is one of the greatest risks in modern web hosting. Measuring from just one location relies on a single perspective and remains blind to the complex network issues affecting users outside one’s own “bubble.”

Continuous Compliance: How Continuous Monitoring Minimizes Audit Risk

Tue, 05 May 2026 09:06:33 +0000

In many companies, preparing for an IT security audit is a massive effort: systems are manually checked for weeks, configurations are reconciled, and documentation is updated. The problem is timeliness. An audit certifies the security status at an exact point in time. But what happens the day after?

In modern infrastructures, change is constant. A brief update to the load balancer, a new ingress route in Kubernetes , or a manual fix can be enough to inadvertently undermine painstakingly established security standards. The solution is to move security checks from the “audit folder” directly into continuous monitoring.

Scheduled Security: How Proactive TLS Management Ends Emergency Mode

Tue, 05 May 2026 09:03:08 +0000

It’s a classic in IT operations: A critical service suddenly becomes unreachable, browsers display warning messages, and customers escalate. The cause? An expired TLS certificate. This often happens when attention is at its lowest - late Friday afternoon or during a holiday.

Certificates are the foundation of trust and security on the web. Yet, their management is often underestimated. Despite automation tools like Let’s Encrypt, there remains a residual risk due to misconfigurations, failed DNS challenges, or expired root certificates. The solution is to understand TLS management not as a “background task” but as an actively monitored security status.

The End of False Alarms: How Multi-PoP Validation Ensures Team Peace

Tue, 05 May 2026 08:59:49 +0000

Nothing is more frustrating for an operations team than a 3 AM alarm that turns out to be a “phantom” upon investigation. A brief hiccup in the monitoring provider’s network or a temporary overload of a single internet node is often enough to trigger a chain of alarms.

When such incidents occur regularly, a dangerous habituation effect sets in: real emergencies are overlooked amidst the supposed false alarms. The solution to this problem lies in a democratic decision at the network level - Multi-PoP Validation.

The Paradox of Internal Monitoring: Why You Need to Check Your Endpoints from the Outside

Tue, 05 May 2026 08:56:25 +0000

Many IT departments feel secure because their monitoring dashboards consistently show “green.” The servers are up, CPU load is low, and processes are running. Yet, while the internal team is satisfied with the monitors, customer support is flooded with complaints: “The site won’t load,” “Login impossible,” “API timeout.”

We call this phenomenon the Monitoring Paradox: A system can appear to function perfectly from an internal perspective while being effectively offline for the actual user.

Business Continuity for NIS-2: From Manual Runbooks to Automated Mechanics

Tue, 05 May 2026 07:25:16 +0000

With the enactment of NIS-2 and the tightening of national security laws (such as BSIG 2.0), the playing field for KRITIS operators has changed. It is no longer sufficient to file theoretical emergency plans in folders. Regulations now demand proof of business continuity—and under real conditions.

The problem for many organizations: their “Disaster Recovery” is based on manual runbooks. In an emergency, people would have to execute complex command chains under extreme stress. In today’s interconnected world, this approach is too slow and error-prone. True resilience is achieved when business continuity shifts from a human task to an architectural mechanism.

GitOps for Multi-Region Platforms: Enforcing Consistency with ArgoCD

Tue, 05 May 2026 07:18:34 +0000

A multi-region architecture is only as strong as the consistency of its locations. If Region A uses a different configuration, security patches, or application version than Region B, failover becomes an unpredictable risk. This is known as “Configuration Drift”—a gradual divergence of environments that can lead to serious errors in critical situations.

To prevent this, infrastructure should no longer be managed manually or through isolated scripts. The solution is GitOps.

Maintenance Without Windows: How Multi-Region Operations Eliminate Planned Downtimes

Mon, 04 May 2026 11:16:05 +0000

In the traditional IT world, maintenance windows are a necessary evil. They usually occur at night or on weekends to minimize disruption. However, in the world of Critical Infrastructures (KRITIS), where systems must be available 24/7, there is no “good time” for downtime. Every planned downtime is a security risk and a compliance issue.

A multi-region architecture fundamentally changes this paradigm. Maintenance is no longer planned around availability; instead, it is made invisible by the architecture itself.

Data Replication in the Tension Field: Strategies for Consistency and Performance

Mon, 04 May 2026 11:13:05 +0000

In a multi-region architecture, managing data is the ‘final boss’. While stateless applications can be easily distributed across locations, databases are subject to the hard laws of physics. The speed of light limits how fast information can travel from Region A to Region B.

For KRITIS operators, this creates a dilemma: We need maximum data security (consistency), but cannot sacrifice system response times (performance). The solution lies in a differentiated replication strategy that distinguishes between local high availability and global fault tolerance.

Connected Security: How Cluster Mesh Connects Regions Without Risk

Mon, 04 May 2026 11:09:31 +0000

In a multi-region architecture, we face a paradox: we want to isolate clusters as much as possible to avoid cascading failures, yet we must also connect them to replicate data and ensure services are accessible across locations.

Traditional approaches like VPN tunnels or complex ingress routing often hit their limits—either in performance or in the clarity of security policies. The solution to this problem is a Cluster Mesh, which enables seamless and secure communication at the network level without sacrificing the independence of the clusters.

Stretched Cluster vs. Multi-Region: The Architectural Choice for Maximum Resilience

Mon, 04 May 2026 11:03:50 +0000

When planning cross-site infrastructure, architects often face a fundamental decision: Do we stretch a single Kubernetes cluster across two geographic locations (Stretched Cluster) or operate an independent cluster in each region?

The idea of a Stretched Cluster initially seems elegant: There is only one control plane, and Kubernetes automatically distributes workloads across both locations. However, what sounds simple in theory often proves to be a risky complexity trap in critical infrastructure environments.

Failover Without DNS: How Anycast & BGP Reduce RTO to Under 30 Seconds

Mon, 04 May 2026 10:59:41 +0000

When critical infrastructure fails, every second counts. The key metric here is the RTO (Recovery Time Objective). In many disaster recovery concepts, the bottleneck is not server performance, but the Domain Name System (DNS).

Relying on DNS record switching during a site failure means battling caching times (TTL) and the latency of global name servers. In the KRITIS environment, where time-sensitive data flows and rigid firewall rules dominate, this approach is often too slow and unreliable. The solution lies a layer deeper: in the routing protocol of the internet itself.

The Frankfurt Dilemma: Why Location Redundancy Isn't Enough for Critical Infrastructure

Mon, 04 May 2026 10:55:11 +0000

Operators of critical infrastructures (KRITIS) invest heavily in fail-safety. However, this planning often ends at the data center’s property line. A typical setup in Frankfurt or Berlin looks like this: redundant power supply, two fire compartments, a highly available Kubernetes cluster across multiple racks, and replicated databases.

On paper, this achieves an availability of 99.99%. Yet for KRITIS-relevant systems, this is often a dangerous illusion. This model assumes that the entire location will never fail.

Smart Factory: From Isolated Machines to a Connected Kubernetes Platform

Thu, 30 Apr 2026 12:40:08 +0000

The vision of a fully connected “Smart Factory” is impressive, but to many production managers, it seems like an unattainable mammoth project. Where do you start when reality consists of a mix of isolated computers, paper lists, and different generations of machines?

The path to a connected factory is not a “big bang,” but a strategic development in stages. With Kubernetes as the technological foundation, this path can be pursued modularly and without risk to ongoing operations.

Making Legacy Hardware Smart: Containers for Existing Machinery

Thu, 30 Apr 2026 12:23:08 +0000

In the theory of Industry 4.0, everything is interconnected, speaks OPC-UA, and delivers clean data streams. The reality in German factory halls is different: milling machines, presses, and injection molding machines that are 10, 15, or even 20 years old. This “legacy hardware” performs mechanically perfectly but is a digital black box.

For OT decision-makers, the question arises: Do I need to renew the machinery park with million-dollar investments to benefit from AI and data analysis? The answer is: No. With edge containers, we build a digital bridge between old mechanics and modern IT.

The Digital Shield: Zero Trust Strategies for a Secure Shopfloor

Thu, 30 Apr 2026 12:19:53 +0000

The days when machines on the shop floor were protected by an “Air Gap”—the physical separation from the internet—are definitively over. Industry 4.0 demands data flow. However, every external connection is a potential entry point for ransomware, which in the worst case can cripple the entire production for weeks.

For OT decision-makers, the question arises: How do we network our systems without risking the security of physical processes? The answer is Zero Trust.

Edge Kubernetes: Local Autonomy in the Factory Secures Production

Thu, 30 Apr 2026 12:16:43 +0000

In Industry 4.0, the cloud is a powerful ally for data analysis and AI. However, for daily operations on the shop floor, a strict rule applies: Production must never stop - especially not due to an internet connection failure.

Many OT decision-makers hesitate with digitalization because they fear losing control over their critical processes to external data centers. The solution to this dilemma is Edge Kubernetes. This approach brings the intelligence of the cloud directly to the machine without giving up local autonomy.

Weekly Backlog Week 19/2026

Wed, 29 Apr 2026 12:42:21 +0000

🧠Editorial

The Tech World is Writing Its Own Rules

The German Armed Forces reject Palantir because software is no longer just software. Microsoft begins embedding AI visibly into commit histories, quietly altering one of the most important conventions of open source. Europe is once again discussing digital taxes, despite being deeply entrenched in the very platforms it seeks to limit.

And while all this is happening, a Linux vulnerability quietly reveals how fragile many of our security assumptions have become beneath the surface.

Kubernetes v1.36:

Wed, 29 Apr 2026 10:34:36 +0000

How Staleness Mitigation Finally Makes Controllers More Deterministic

Kubernetes is an open-source platform for orchestrating containerized applications. It automates deployment, scaling, and operations, forming the foundation of modern cloud-native infrastructures. At its core, Kubernetes is based on a declarative model: the desired state is described, and controllers continuously ensure that this state is achieved and maintained.

With version 1.36, a topic comes into focus that has long been underestimated but deeply impacts the reliability of Kubernetes: Staleness in Controllers. The innovations may seem technically unspectacular at first glance, but conceptually they are a significant step towards more robust and comprehensible systems.

Real-Time Data Ingestion: Apache Kafka as the Nervous System of Industry 4.0

Wed, 29 Apr 2026 10:33:46 +0000

In traditional data processing, “batch processes” dominated for a long time: data was collected throughout the day and processed in large batches overnight. For modern industrial applications, this is too slow. When a turbine in a factory shows anomalies or an eCommerce system needs to react to inventory changes, every second counts.

Apache Kafka has established itself as the standard for event streaming. It acts as a highly available buffer and distribution center, receiving data from producers (sensors, web apps) and forwarding it in real-time to consumers (ClickHouse, ML models, dashboards).

Time-Series & Big Data: Why ClickHouse is the Turbocharger for Your Analytics

Wed, 29 Apr 2026 10:29:48 +0000

In the world of data engineering, there’s a saying: “Storing data is easy, querying it quickly is the art.” When we talk about petabytes of industrial sensor data or billions of eCommerce events, traditional relational databases like PostgreSQL or MySQL surrender.

This is where ClickHouse comes into play. As a column-oriented database management system (OLAP), it is designed to process analytical queries at lightning speed. In this post, we explore why ClickHouse is the heart of modern data engineering platforms on Kubernetes .

S3 Storage in Your Own Data Center: Scalable Data Architecture with CEPH

Wed, 29 Apr 2026 10:25:24 +0000

For those building modern data engineering pipelines, S3 (Simple Storage Service) is indispensable. It is the industry standard for accessing unstructured data, model checkpoints, and data lakes. But what if data must remain on-premise for compliance reasons or if the hyperscalers’ egress costs are breaking the budget?

The answer for cloud-native architectures is CEPH. As a highly scalable, software-defined storage system, CEPH enables companies to operate an S3-compatible storage infrastructure on standard hardware within their own data center.

From Onboarding Frustration to Instant Productivity: Standardized Dev Environments

Wed, 29 Apr 2026 10:21:03 +0000

In software development, the problem has long been solved: Code is versioned in Git, isolated in containers , and deployed identically across different environments via CI/CD pipelines. In data engineering and AI workloads, the reality is often different.

Data scientists work locally on their workstations, using individually installed Python libraries or maintaining Jupyter notebooks that only run in their specific configuration. The result: A model that performs excellently on the developer’s laptop fails in production or cannot be retrained after three months because no one remembers which library versions were active back then.

Overcoming GPU Shortages: Hybrid Cloud Strategies for AI Workloads

Wed, 29 Apr 2026 10:16:09 +0000

In theory, Artificial Intelligence is a boon for the industry. In practice, implementation often stumbles over a mundane hurdle: hardware availability. Those who need high-end GPUs (like the NVIDIA H100 or A100) for model training or complex simulations today face long delivery times or astronomical fixed costs in their own data centers.

For companies, this creates a dilemma: On-premise infrastructure offers data sovereignty and cost control for base loads but is too rigid for peak loads. The solution lies in the Hybrid Cloud—not as a laborious manual migration, but as a seamless, Kubernetes native extension.

Scaling Data Engineering Pipelines: Apache Airflow on Kubernetes Best Practices

Wed, 29 Apr 2026 10:12:48 +0000

In the world of data engineering, Apache Airflow is the undisputed champion for workflow orchestration. However, with success come scaling pains: local executors hit CPU limits, Celery worker clusters are cumbersome to maintain, and resources sit idle when no DAGs are running.

The solution? Apache Airflow on Kubernetes . By leveraging the Kubernetes Executors or the KubernetesPodOperators, Airflow transforms from a rigid scheduler into an elastic computing powerhouse.

The Architecture: Why Kubernetes is the Ideal Host for Airflow

Traditional Airflow setups often suffer from “Dependency Hell”: one team needs Python 3.11 for an ML model, another team requires outdated libraries for a legacy ETL job. On static workers, this leads to conflicts.

When Customer Systems Are on Fire, We Act Fast

Wed, 29 Apr 2026 10:06:40 +0000

– but what if there’s a real fire?

When customer systems are on fire, we act like firefighters—quickly, methodically, and solution-oriented. But what happens when there’s a real fire in our own company?

This is exactly the question we asked ourselves. The answer: Preparation is everything.

Fire protection is not a side issue

In many companies, fire protection is still underestimated. Yet the risks are real in everyday life—especially in technology-driven environments with constantly running infrastructure.

Weekly Backlog Week 18/2026

Mon, 27 Apr 2026 10:35:00 +0000

🧠 Editorial

This issue can also be read as follows: Software is no longer just a tool – it is power infrastructure.

While Palantir openly articulates how states should function in the future, Germany debates how long IP addresses should be stored – consistently underestimating the technical reality. At the same time, attempts are made to bring order with the Germany-Stack, but they stumble over precisely the questions that are better left unasked.

Weekly Backlog Week 17/2026

Mon, 20 Apr 2026 08:00:31 +0000

🧠 Editorial

This week clearly shows where things are tipping:

We talk about digital sovereignty – and simultaneously realize how deeply we are still entangled in dependencies. Whether it’s messengers, cloud, or infrastructure: control is lacking exactly where it would be critical.

The Vercel hack, new governmental messengers, discussions about “sovereign” cloud, and Big Tech’s influence on EU regulations are not isolated incidents. It’s a pattern.

We have outsourced infrastructure – and with it, a piece of decision-making capability.

Transforming Mature Ansible Structures into a Scalable Polycrate Platform Architecture

Fri, 17 Apr 2026 09:39:00 +0000

Transforming Mature Ansible Structures into a Scalable Polycrate Platform Architecture

1. The Strategic Necessity of Transformation

In modern enterprise IT environments, traditional, long-established Ansible structures are increasingly reaching their limits. What often began as an efficient solution for ad-hoc automation has now manifested as an unwieldy “playbook sprawl” and the infamous “Python dependency hell.” The manual maintenance of virtual environments on individual administrator workstations (“snowflake workstations”) leads to inconsistencies, complicates onboarding, and poses a significant compliance risk. Polycrate acts as a strategic enabler: it transforms automation from a script-based activity into a scalable platform architecture. This not only ensures operational excellence but also strengthens digital sovereignty through provider-independent, reproducible processes that decouple deployment tooling from the underlying cloud infrastructure.

Multi-Tenancy on Kubernetes: Strategies for Clean Tenant Isolation

Wed, 15 Apr 2026 10:04:29 +0000

Operating Software-as-a-Service (SaaS) or complex eCommerce solutions presents an economic and architectural challenge: the cost structure demands shared infrastructure (multi-tenancy), while compliance and stability require strict separation of customers (isolation).

In a standard Kubernetes installation, “isolation” is a flexible term. Without explicit configuration, a cluster is a “flat” network where everyone can communicate with everyone else and, theoretically, steal resources from neighbors. To achieve enterprise-grade multi-tenancy, we must delve deep into the abstraction layers of Kubernetes.

Growth Inhibitor: VM Scripting - Why Bash Scripts Are Ruining Your SaaS Scaling

Wed, 15 Apr 2026 09:58:12 +0000

In the early stages of a SaaS product or an eCommerce solution, speed is everything. To go live quickly, the path through virtual machines (VMs) and a few well-intentioned Bash scripts is often the path of least resistance. It works—for the first customer, the second, and maybe even the fifth.

However, those who grow successfully realize: What began as a pragmatic solution becomes a strategic risk when you reach a double-digit number of customer instances. In this post, we explore why traditional VM hosting becomes a “growth inhibitor” and how switching to declarative infrastructure paves the way for real scaling.

Put an End to Alert Fatigue: How Precise Endpoint Monitoring Saves Operational Performance

Wed, 15 Apr 2026 09:28:45 +0000

Monitoring alerts have become background noise in many IT organizations. When the phone rings at 3 AM, the first reaction is often annoyance rather than adrenaline—followed by the expectation that it’s just a false alarm. This alert fatigue is not a human failing but the result of an outdated monitoring strategy. A system that escalates with every transient network jitter is not a protective mechanism but an operational burden that ties up resources and significantly increases the risk of errors during real incidents.

Turbo for Sales: Why On-Premises Capability Halves Your Sales Cycle

Mon, 13 Apr 2026 10:54:08 +0000

In the fintech world, there’s a well-known phenomenon: the software is great, the team is convinced, but the legal and compliance department of a major bank stalls the deal for months. The reason is almost always the same: the outsourcing risk. When a bank moves its critical processes to your cloud-native environment, it loses a piece of control - and this is where DORA and internal policies set extremely high hurdles.

Audit Trail Instead of Excel List: Compliance as a Byproduct of GitOps Operations

Mon, 13 Apr 2026 10:50:11 +0000

When you ask an Ops team in a fintech about the most stressful event of the year, the answer is usually: “The annual IT audit.” For weeks, manual lists are created, Jira tickets are searched, and screenshots of configurations are taken to prove to the auditor that processes were followed. In the world of DORA and NIS-2, this manual approach is not only inefficient but also risky—anything that has to be manually documented is prone to errors and vulnerabilities.

Sovereignty Through Architecture: Exit Strategies Without a Months-Long Big Bang

Mon, 13 Apr 2026 10:47:15 +0000

In regulatory discussions with BaFin or during due diligence by major banks, the term exit strategy inevitably comes up today. For a long time, this topic was neglected—often a theoretical document sufficed, describing how one would “theoretically” move to another provider.

DORA (Digital Operational Resilience Act) has raised the bar. An exit strategy can no longer be a PowerPoint promise but must be an architectural reality. The problem: deeply embedding proprietary services from hyperscalers (like AWS Lambda, Azure SQL, or Google Secret Manager) into your code creates a technological dead end. Moving then takes not weeks, but quarters.

The DORA Deadline: Why Hyperscaler Certificates Are No Longer Enough for Audits

Mon, 13 Apr 2026 10:44:20 +0000

In recent years, the strategy for many fintechs was clear: “Managed first.” Those looking to grow quickly used the ready-made building blocks of the major US hyperscalers—from Kubernetes to databases to identity management. Technically, this is brilliant as it massively accelerates product development. However, with the enforcement of DORA (Digital Operational Resilience Act) in January 2025, the regulatory landscape has fundamentally changed.

Many companies are lulled into a false sense of security because their cloud provider presents hundreds of certificates (ISO, SOC2, etc.). But for regulators, that’s only half the truth.

Multi-Tenancy & Observability: Tenant-Aware Monitoring for DBaaS Customers

Mon, 13 Apr 2026 10:31:33 +0000

In a shared infrastructure environment like a DBaaS platform, transparency is a balancing act. On one hand, the provider’s operations team needs to keep an eye on the entire fleet to proactively respond to bottlenecks. On the other hand, customers expect detailed insights into the performance of their specific instances—without seeing their “neighbors’” data.

The solution lies in a tenant-aware observability stack that combines scalability with strict data separation.

Point-in-Time Recovery (PITR) as a Product Promise: Backup Strategies at Scale

Mon, 13 Apr 2026 10:28:34 +0000

In the world of databases, there’s a significant difference between a “backup” and “recoverability.” For a DBaaS provider, a daily snapshot of data is not enough. If a customer accidentally deletes an important table at 2:05 PM, a backup from 2:00 AM is only partially helpful—they would lose an entire morning’s work.

The true product promise of a modern database platform is Point-in-Time Recovery (PITR). It allows restoration to any second within the retention period.

Automated Database Lifecycle: CloudNativePG as the Heart of a DBaaS Platform

Mon, 13 Apr 2026 10:24:32 +0000

Operating a DBaaS platform presents a mathematical trap: If the operational effort per database increases linearly with the number of customers, the business model is not scalable. A team of ten engineers might be able to manually “manage” 50 databases - but never 500 or 5,000.

The solution is to shift from manual operation to declarative orchestration. In our project, we achieved this by using CloudNativePG - a Kubernetes Operator that not only installs PostgreSQL but automates the entire lifecycle.

Storage Design for Database Platforms: Performance vs. Capacity with Ceph

Mon, 13 Apr 2026 10:21:22 +0000

When scaling a DBaaS platform, storage quickly becomes the most critical bottleneck. Databases have two opposing demands on storage infrastructure: on one hand, they require extremely low latencies for read and write operations (I/O), and on the other, backups and transaction logs (WAL) generate massive amounts of data that need to be stored cost-effectively.

Relying on “one-size-fits-all” storage means either paying too much for backup space on expensive SSDs or sacrificing database performance on slow archival disks. The solution for a sovereign European provider lies in an intelligent, software-defined design with Ceph.

DBaaS is More Than Just Postgres: Why the Infrastructure Backbone Determines Market Success

Mon, 13 Apr 2026 10:17:34 +0000

At first glance, the business model “Database as a Service” (DBaaS) seems deceptively simple: take a proven open-source database like PostgreSQL, add a web interface, and sell the operation as a managed service. However, those who attempt to launch this model with a few manually set up virtual machines (VMs) hit an invisible wall with the first ten customers.

The harsh reality in the cloud business is: The success of a DBaaS offering is not determined by the database itself, but by everything that happens “around it.”

Kubernetes v1.36 Explained Clearly

Mon, 13 Apr 2026 08:36:11 +0000

Kubernetes might initially seem like a purely developer-centric topic—complex, technical, and far removed from everyday work life. However, this is a misconception. At its core, Kubernetes is about something very fundamental: How modern software is reliably operated.

Or put more simply: Kubernetes ensures that digital applications—from online shops to internal company systems—run stably, even when changes are constantly happening in the background.

This makes Kubernetes a kind of operating system for digital infrastructure.

France Pulls the Plug on Microsoft

Mon, 13 Apr 2026 08:08:25 +0000

France is taking digital sovereignty seriously. The government has announced plans to phase out Windows in administration and replace it with Linux. Leading the charge is the digital agency Dinum, with other key players like the cybersecurity agency and state procurement to follow. A concrete migration plan is expected by fall 2026.

This is not a symbolic step but a structural intervention in the technological foundation of state IT.

Weekly Backlog Week 16/2026

Fri, 10 Apr 2026 09:11:37 +0000

🧠 Editorial

This week, tech feels less like progress and more like a dose of reality.

The same pattern everywhere: Things that were “good enough” for a long time suddenly become real problems. Dependencies that were ignored become political. Security that was postponed becomes urgent. And tools that just worked reveal themselves as quite complex power factors.

France is trying to operationally free itself from precisely such dependencies. Kubernetes consciously takes away convenience to enforce more control. LinkedIn is under scrutiny, not just as a platform but potentially as a market observer. And AI? It simply elevates the whole security topic to a new level.

Digital Sovereignty Under Pressure

Tue, 07 Apr 2026 11:50:35 +0000

What the New EU-US Dialogue Platform Really Means

Digital sovereignty has been a focus of political and regulatory initiatives in Europe for years. With tools like the Digital Services Act (DSA) and the Digital Markets Act (DMA), the EU has consciously begun to set global standards—particularly in dealing with dominant platforms.

However, recent developments show how fragile this position is.

New Dynamics in Transatlantic Relations

In the context of trade negotiations between the EU and the US, a new form of collaboration is emerging: A planned dialogue platform is set to intensify the exchange on digital markets and regulatory issues.

Making Digital Sovereignty Measurable:

Tue, 07 Apr 2026 11:28:22 +0000

How the ayedo Sovereignty Score Provides Guidance

Digital sovereignty is politically mandated and has long been more than an abstract guideline in regulatory terms. Yet, it remains elusive for many organizations, especially when it comes to assessing their own starting point.

In practice, there is much discussion about data sovereignty, vendor lock-in, and European alternatives. What is often missing is a reliable classification of one’s own system landscape: Which parts of the IT are actually interchangeable? Where are the critical dependencies? And where is the ability to act less than previously assumed?

Weekly Backlog Week 15/2026

Tue, 07 Apr 2026 09:10:40 +0000

🧠Editorial

Europe is negotiating with the USA again over Big Tech regulation.

Not public, not officially decisive – but close enough to touch the processes that should actually be independent.

At the same time, we are trying to finally turn “digital sovereignty” into something measurable. With criteria, scores, and the hope that a political buzzword will eventually become a solid basis for decision-making.

The timing is… interesting.

Because while new spheres of influence are emerging politically, it is only becoming clear operationally how intangible all this has been so far. We discuss independence – and often don’t even have a clear answer to how dependent we actually are.

GitOps for Multi-Region: Consistency through ArgoCD and Multi-Cluster Management

Tue, 07 Apr 2026 08:58:55 +0000

In a multi-region architecture, “configuration drift” is the greatest enemy of resilience. Drift occurs when an urgent hotfix is applied at location A, a firewall rule is adjusted, or a certificate is renewed—and one forgets to replicate this change at location B. In a critical situation, traffic may then switch to a region that is not ready, is outdated, or simply does not function.

To eliminate this risk, we use GitOps as the binding operational model. Here, Git (e.g., GitLab or GitHub) becomes the sole “Source of Truth” for the entire infrastructure and all applications at both locations.

Chaos Engineering as Audit Evidence: Automating Failover Tests

Tue, 07 Apr 2026 08:55:49 +0000

In the world of Critical Infrastructures (KRITIS), having a sophisticated high availability concept in the drawer is not enough. Auditors and regulators today demand the technical proof that theoretical fail-safety is effective in practice. A disaster recovery plan that is tested only once a year (or not at all) is considered a high risk from a regulatory perspective.

To provide this evidence not just laboriously on paper but systematically and measurably, we rely on Chaos Engineering.

Maintenance Without Windows: Rolling Upgrades Through Regional Decoupling

Tue, 07 Apr 2026 08:52:19 +0000

In the traditional IT world, maintenance windows are often a necessary evil. Operating system updates, Kubernetes upgrades , or critical database patches are usually performed at night or on weekends to minimize user disruption. However, in a KRITIS environment that requires 24/7 availability, this model poses a high risk: if something goes wrong during maintenance, the system comes to a halt, and redundancy is often suspended during the process.

Through our multi-region architecture with separate clusters, we transform the risk of “maintenance” into a standard process with zero downtime.

Seamless Handover: Session Persistence in Failover Scenarios

Tue, 07 Apr 2026 08:48:42 +0000

In the world of critical infrastructures (KRITIS), the success of a disaster recovery concept is often measured by hard metrics like the RTO (Recovery Time Objective). However, there is a “soft” metric that determines acceptance or chaos in practice: The user experience at the moment of switchover.

Imagine an operator in a network control center coordinating a critical switching operation via a web interface. In the background, a data center fails, and traffic shifts to the backup location within seconds. If the operator suddenly lands on a login page and loses their session, the technical failover may have succeeded, but the operational process is dangerously interrupted.

Data Diplomacy: How Asynchronous Replication Solves Latency Issues in Critical Infrastructure

Tue, 07 Apr 2026 08:34:24 +0000

In a multi-region architecture for critical infrastructures (KRITIS), data consistency is the greatest technical challenge. While we can easily double computing power (Kubernetes pods), data cannot be kept “live” in two places at once without effort. The speed of light limits us: Every synchronous confirmation of a write operation over hundreds of kilometers creates latencies that can destabilize an application.

For a resilient platform, we therefore use a differentiated strategy for different data types - from relational databases to caches and message brokers.

Cilium Cluster Mesh: Seamless Networking Across Cluster Boundaries

Tue, 07 Apr 2026 08:23:41 +0000

Operating highly available platforms for critical infrastructures (KRITIS) presents an architectural challenge: To achieve maximum fault tolerance, services are often deployed in multiple geographically separated data centers on independent Kubernetes clusters . However, in practice, these isolated worlds often need to communicate with each other—whether for querying metrics, accessing redundant databases, or coordinating workloads.

The solution to securely connect these clusters without building complex VPN constructs at the application level is Cilium Cluster Mesh.

GitOps Platform Independence through Polycrate Automation

Mon, 30 Mar 2026 11:31:38 +0000

GitOps Platform Independence through Polycrate Automation

Understanding the automation layer that creates a coherent, reproducible deployment pipeline from decentralized specifications for multi-cloud and hybrid environments.

For companies pursuing the following goals, this approach offers clear advantages:

Operational simplification through consistent deployments across clouds.
Faster onboarding of new platforms or regions without redeveloping pipelines.
Improved governance, auditability, and digital sovereignty through policy-first launches and traceable artifacts.
Economic benefits through reduced computational and administrative effort as well as lower error rates.

Companies are facing a new reality: sovereignty is no longer optional. It is verifiable.

The Myth of the Secure Cloud:

Mon, 30 Mar 2026 10:54:16 +0000

Why Encryption Alone Is Not Enough

Introduction

Encryption is considered the pinnacle of modern IT security. Data is protected, access is controlled, systems are secured – at least in theory.

In many companies, this has led to a comforting assumption: If data is sufficiently encrypted, regulatory risks can also be managed.

This assumption is dangerous.

Because it overlooks a central tension in modern cloud architectures: Security is not only a technical category but also a legal one.

US Cloud in Use:

Mon, 30 Mar 2026 10:47:36 +0000

What Risks Companies Specifically Underestimate

Introduction

The use of US cloud services is commonplace for many companies today. Platforms like Microsoft 365, AWS, or Google Cloud are deeply integrated into business processes and often seem irreplaceable—at least at first glance.

At the same time, a recurring pattern emerges in practice: the actual risks of this usage are systematically underestimated.

Not because they are unknown—but because they are misjudged.

Between Comfort and Loss of Control

Cloud solutions promise efficiency, scalability, and innovation speed. For many IT departments, they are the key to modernization.

Why European Cloud Strategies Must Be Rethought Without US Risk

Mon, 30 Mar 2026 10:47:12 +0000

Introduction

Many cloud strategies in European companies are based on an assumption long considered a pragmatic compromise: As long as data is stored in European data centers, regulatory risks can be controlled.

This assumption is no longer tenable.

At the latest, insights from the University of Cologne’s report on the US legal situation concerning FISA, CLOUD Act, and RISAA make it clear that the risk profile has fundamentally shifted. It is not the physical data location that determines access possibilities—but rather who can exercise control over this data.

US Access to Cloud Data:

Mon, 30 Mar 2026 10:41:14 +0000

Why Control is More Important than Server Location

Introduction

Cloud computing is far more than just an infrastructure topic. For many companies, the cloud today forms the foundation of their digital value creation—from software development to data-driven business models and AI applications. At the same time, with the outsourcing to external platforms, a central question increasingly comes to the forefront: Who has access to this data if necessary?

A legal opinion from the University of Cologne in March 2025, commissioned by the Federal Ministry of the Interior, provides a sobering answer. A detailed analysis of the results can be found at https://datenrecht.ch/us-zugriffsbefugnisse-auf-daten-in-der-cloud-gutachten-uni-koeln-vom-maerz-2025/ and served as the substantive basis for this article. It shows that many common assumptions about data protection, data location, and technical isolation prove to be deceptive in practice.

Bring-Your-Own-IP (BYOIP) in Regulated Networks: Sovereignty in Routing

Mon, 30 Mar 2026 09:27:09 +0000

In a traditional cloud environment, customers receive their IP addresses from the cloud provider. This is convenient but creates a dangerous dependency (“Vendor Lock-in”). For operators of critical infrastructures, this dependency is a strategic risk: those who do not own their IP addresses cannot easily move their platform to another provider in a crisis without manually adjusting hundreds of firewall rules and VPN tunnels for all customers (network operators, municipal utilities, authorities).

Stretched Cluster vs. Multi-Region: Architectural Decisions for Maximum Resilience

Mon, 30 Mar 2026 09:21:56 +0000

When companies decide to distribute their Kubernetes platform across two data centers, they face a directional decision: Do they build a single, “stretched” cluster (Stretched Cluster) that spans both locations, or do they operate two completely separate clusters (Multi-Region)?

What sounds elegant on paper—a single logical cluster where you can easily move pods from A to B—often proves to be a risky misstep in critical infrastructure environments. For our project, we consciously chose the Multi-Region model. Here is the rationale behind this architectural decision.

Failover Without DNS Latency: BGP Anycast for Critical Infrastructure Platforms

Mon, 30 Mar 2026 09:16:14 +0000

In traditional high availability scenarios, DNS (Domain Name System) is the standard tool for failover. If location A fails, the DNS entry is redirected to the IP of location B. However, in the critical infrastructure world, especially in the control of electricity or gas networks, this approach encounters three critical limitations:

TTL Delay: DNS entries are cached worldwide. Even with a low “Time to Live” (TTL), it takes minutes to hours for every client to adopt the new IP.
Strict IP Requirements: Many network operators use rigid firewall rules or VPN tunnels programmed to a fixed IP address. Changing the IP at the destination requires coordinated manual work with dozens of customers simultaneously.
Client Behavior: Some SCADA systems or IoT gateways permanently cache IP addresses (“Sticky DNS”) and only notice a change after a manual restart.

The solution to this problem is BGP Anycast. Here, the switch from the application level is moved directly to the foundation of the internet: routing.

Single Point of Failure Location: Why One Data Center Isn't Enough for Critical Infrastructure

Mon, 30 Mar 2026 09:10:01 +0000

In the world of critical infrastructures (KRITIS), “high availability” is not just a buzzword but a legal and societal obligation. Those who operate control systems for electricity, gas, or heating networks work in an environment where failures can have immediate impacts on public supply security.

Many companies feel secure because their platform is redundantly built within a data center (DC): multiple server racks, redundant power supplies, mirrored databases, and a local Kubernetes cluster with multiple control plane nodes. However, this architecture has an Achilles’ heel: it protects against the failure of a component but not against the failure of the location.

The Hybrid Data Platform: Kubernetes as a Universal Abstraction Layer

Mon, 30 Mar 2026 08:53:13 +0000

Industrial corporations today face a paradoxical challenge: they must adapt the agility and innovative power of cloud startups while maintaining the uncompromising stability, security, and data sovereignty of their on-premise environment. Digital transformation in data engineering often fails because teams are torn between these worlds.

Building a data engineering platform based on Kubernetes resolves this paradox. Kubernetes acts as a universal abstraction layer that decouples computing power, storage, and networking from the underlying hardware. It is the link that merges the “server in the basement” and the “GPU instance in the cloud” into a single, logical resource.

Artifact Management for Data Science: Versioning Models and ETL Jobs with Harbor

Mon, 30 Mar 2026 08:48:16 +0000

In software development, versioning code is standard. However, in data engineering and AI projects, this is not sufficient. A model consists not only of code but also of a specific combination of training data snapshots, library dependencies (Python packages), and the weighted parameters of the model itself.

When an AI model makes an incorrect decision in production quality control, the IT department must be able to demonstrate without gaps: Which code version was running in which Container ? Which versions of the libraries were installed? This is where Harbor comes into play - an enterprise-grade Container registry that is much more than just a storage location for images.

S3-Compatible Storage On-Prem: CEPH as a Scalable Backend for Data Lakes

Mon, 30 Mar 2026 08:20:33 +0000

In a modern data engineering platform, storage needs are not only vast but also diverse. We need space for raw sensor data, finished AI models, container images , and backups. Classic file servers (NFS) quickly reach their limits, especially when it comes to parallel access from hundreds of Kubernetes pods .

The solution for our industrial corporation is CEPH. As a highly available, distributed storage system, CEPH transforms standard server hardware into a powerful storage network. The key feature: it offers an S3-compatible interface directly within the data center.

Analytical Databases in the Cluster: ClickHouse and TimescaleDB for High-Volume Data

Mon, 30 Mar 2026 08:12:34 +0000

In an industrial concept, millions of data points are generated daily. When these data flow into Apache Kafka, the next critical question arises: Where do we store them so that engineers and data scientists can efficiently query them? A conventional relational database quickly reaches its limits with billions of rows. Queries over periods of months often take minutes there - unacceptable for interactive dashboards or AI models.

The solution on our Kubernetes platform is the use of specialized analytical databases like ClickHouse and TimescaleDB. These systems are designed to aggregate and analyze massive amounts of data (Big Data) at lightning speed.

Real-Time Ingestion: Apache Kafka as the Event Streaming Backbone for Industry

Mon, 30 Mar 2026 08:07:23 +0000

In modern manufacturing, data is generated not in batches, but as a continuous stream. Sensors on rolling mills, flow meters in chemical reactors, and logistics systems produce status messages every second. Those who analyze this data only in nightly batch runs miss the opportunity for immediate reaction—whether in the case of quality deviations or impending machine failures.

To harness this “data tsunami,” we rely on Apache Kafka within the Kubernetes cluster. Kafka acts as a highly available digital nervous system that ingests, stores, and distributes events in real-time to the appropriate analysis tools.

Scalable Data Pipelines: Apache Airflow in Orchestrated Kubernetes Operations

Mon, 30 Mar 2026 07:58:54 +0000

In industrial data processing, ETL processes (Extract, Transform, Load) are the nervous system of production. When sensor data from plants worldwide needs to be consolidated, cleaned, and fed into analytical models, a simple cron job is no longer sufficient. In a global industrial corporation, thousands of dependencies must be monitored, errors automatically intercepted, and resources dynamically allocated.

Apache Airflow has established itself as the standard for workflow management. However, Airflow’s true strength is realized when it is operated natively on Kubernetes rather than on a static VM. Only through this combination does a sequential task list become an elastic data factory.

Polycrate API for Teams: Centralized Monitoring and Remote Triggering

Mon, 30 Mar 2026 00:00:00 +0000

TL;DR

The Polycrate API transforms individual workspaces into a team platform: all workspaces, action runs, and SSH sessions are centrally visible—ideal for operations, compliance, and audits.
Remote triggering via the API replaces local CLI installations in CI/CD pipelines and on jump hosts: build agents communicate with Polycrate via HTTP, and the rest runs in standardized containers.
Workspace validation and centralized encryption key management become reusable services for your entire team; platform HTTP endpoint monitoring runs through the API and Polycrate Operator (not via a block in workspace.poly).
The Polycrate API web dashboard provides team leads and compliance officers with a clear overview: who triggered what, when, and where—including reporting functions.
ayedo offers an enterprise feature with the Polycrate API that seamlessly integrates into your platform engineering initiatives—including support from our consulting .

Polycrate API as a Team Platform Instead of Individual CLI

With plain Ansible, automation often looks like this:

Auditable Operations: SSH Sessions and CLI Activities with Polycrate API

Sun, 29 Mar 2026 00:00:00 +0000

TL;DR

Polycrate not only logs Action Runs (Ansible playbooks) but also SSH sessions, workspace syncs, and CLI instances – all centrally accessible via the Polycrate API.
SSH session logging answers the classic incident response question: Who accessed which server via SSH, when, for how long, and with what exit code?
Workspace sync logs capture Git branch, commit SHA, encryption status, and sync results, making changes to automation traceable and audit-proof.
The Polycrate API allows for centralized management of encryption keys for encrypted workspaces – a crucial component for NIS-2 and GDPR-compliant operational processes.
ayedo provides an auditable operations stack with Polycrate, the API, and accompanying platform engineering services that can be integrated into existing compliance and security processes.

Why Operations Audit is a Top Priority Today

Both NIS-2 and GDPR increase the pressure for traceable, documented IT operational behavior:

Action Runs and Polycrate API: Every Automation with Audit Log

Sat, 28 Mar 2026 00:00:00 +0000

TL;DR

Polycrate automatically captures every polycrate run execution as an “Action Run” – including block, action, exit code, timestamp, duration, CLI version, hostname, and OS user.
Through simple configuration in ~/.polycrate/polycrate.yml, the Polycrate CLI sends these Action Runs to the Polycrate API – without additional logging or audit tooling.
In the Polycrate API (web UI and HTTP API), you can centrally see who ran which action on which workspace and when, track deployments across workspaces, and selectively re-trigger individual Action Runs. PolyHub is the marketplace for blocks; Action Runs and audit data live in the API.
The fail-safe design ensures that API issues never block the actual automation – infrastructure changes always proceed, the audit log is “best effort”.
ayedo connects these API capabilities with proven Platform Engineering approaches to bring automation, compliance, and collaboration together in teams of any size.

Why Action Runs are Crucial for Compliance

“Who restarted the production database on Friday evening?”
“When did version 1.4.3 actually reach production?”
“What changes were made before the incident last night?”

GPU Elasticity Without Lock-in: Hybrid Cloud Strategies for AI Workloads

Fri, 27 Mar 2026 11:11:21 +0000

In industrial AI development, the GPU (Graphics Processing Unit) is the new gold. Whether for training complex neural networks for quality control or for large-scale simulations for energy optimization, projects come to a halt without massive computing power.

The problem in many corporations: On-premise hardware is expensive, has long delivery times, and is often rigidly dimensioned. When three data science teams want to train a model simultaneously, a bottleneck occurs. The solution lies in a hybrid Kubernetes architecture that utilizes local resources but seamlessly and confidently shifts to the cloud during peak loads.

On-Demand Development Environments: Reproducible Stacks with Coder on Kubernetes

Fri, 27 Mar 2026 11:06:37 +0000

In many data engineering teams, starting a new project follows a frustrating pattern: First, Python versions, R libraries, SQL drivers, and CUDA toolkits for GPU usage must be painstakingly configured on the local workstation or a static VM. The result is often the infamous “It works on my machine” syndrome—code that runs locally but fails in production or on a colleague’s setup.

In a global industrial corporation with complex security policies and changing project teams, this manual setup effort becomes a massive time sink. The solution is to decouple the development environment from the hardware by using Coder on a central Kubernetes platform.

AI in E-Commerce: Securely Operating Local LLMs for Text Generation

Fri, 27 Mar 2026 10:53:20 +0000

Artificial Intelligence is no longer a hype in e-commerce but a tool for scaling. Whether it’s generating product descriptions from technical features, rewriting SEO texts, or automating customer support responses, Large Language Models (LLMs) save hundreds of work hours.

Yet, many agencies and brands hesitate: Are my internal product data being used by third-party providers to train models? Where do my customers’ inquiries end up legally? The solution to this dilemma is operating open-source models like Llama 3 or Mistral directly within your own e-commerce infrastructure - using Ollama on Kubernetes .

Sovereign Tracking: Server-Side Google Tag Manager in Your Own Container

Fri, 27 Mar 2026 10:48:36 +0000

In modern e-commerce, data is the foundation for every growth decision. However, traditional client-side tracking is reaching its limits: ad blockers, browser Intelligent Tracking Prevention (ITP), and increasingly strict data protection regulations mean that up to 30% of user data simply does not reach the marketing backend.

The solution for professional shop operators is to switch to server-side tracking. Instead of the user’s browser sending data directly to third parties like Google or Meta, your own server in the Kubernetes cluster takes control. We operate the Google Tag Manager (GTM) as a sovereign container instance directly on the e-commerce platform.

Performance Boost for Search: OpenSearch and Typesense in Cluster Operation

Fri, 27 Mar 2026 10:41:07 +0000

In modern e-commerce, the search function is much more than just an input field. It is the most important salesperson in the shop. Users who use the search have a clear purchase intention - but this intention quickly fades if the results take seconds to appear or are irrelevant.

Many agencies either use the standard database search (which quickly buckles under large catalogs) or external SaaS search solutions. However, the latter often incur high monthly costs, additional latencies due to external API calls, and data protection issues. The solution: High-performance search engines like OpenSearch or Typesense, which are operated as an integral part directly in the Kubernetes cluster .

Shopware High Availability: Strategies for 99.9% Uptime

Fri, 27 Mar 2026 10:33:41 +0000

For an online shop in the mid-sized business or D2C sector, downtime is much more than a technical nuisance. Every minute of unavailability means direct revenue loss, decreased customer trust, and wasted budget on ongoing marketing campaigns.

Agencies aiming to grow and manage larger brands cannot avoid the demand for Service Level Agreements (SLAs) of 99.9%. However, this level of availability cannot be physically guaranteed with a classic single-server setup. A hardware defect, a stalled database process, or a simple kernel panic on the host system immediately leads to a standstill. High availability requires a rethinking of architecture: moving away from single servers to distributed systems.

From Isolated Instances to an E-Commerce Platform: Why Traditional Hosting Doesn't Scale

Fri, 27 Mar 2026 10:27:01 +0000

In the early stages of an e-commerce agency, the approach is usually pragmatic: each new client shop gets its own hosting package. One shop with provider A, the next with provider B, the third on a dedicated root server. This works excellently at first, as each project can be quickly and independently launched.

However, with success comes complexity. Once you reach a double-digit number of shops, this model gradually turns into an operational burden. What started as flexibility becomes a trap of inconsistent environments and unpredictable maintenance efforts.

Efficient Background Processes: How Redis and RabbitMQ Relieve Your App

Fri, 27 Mar 2026 10:16:07 +0000

Have you ever experienced this? A user clicks “Generate PDF Export” or “Create Monthly Report” in your SaaS app, and suddenly the loading icon spins for 10, 20, or 30 seconds. In the worst case, the connection times out, or the entire application becomes sluggish for all other users.

In the early stages of an application, such tasks are often executed directly in the so-called “request-response cycle.” This means the server pauses its response to the user until the heavy task is completed. For a technical SaaS provider in construction planning serving hundreds of users simultaneously, this approach inevitably leads to a bottleneck. The solution is consistent decoupling through asynchronous background processes.

The Anatomy of a Sovereign Business Platform: How Nextcloud, Zammad, and Others Integrate

Fri, 27 Mar 2026 09:39:45 +0000

When building a modern IT infrastructure today, one faces a strategic decision: either buy into the convenience (and dependency) of large US SaaS monoliths, or build a sovereign platform. However, “self-hosting” has long sounded like a risky DIY project to many IT managers—characterized by manual updates, security gaps from forgotten patches, and unstable scripts.

A different approach is demonstrated by the architecture of a technical service provider with 180 employees. Here, software wasn’t simply installed on servers. An orchestrated platform architecture was created, which feels like a modern cloud solution but operates entirely under one’s own control in German data centers. The technological core of this freedom is Managed Kubernetes.

Mattermost in Industry: ChatOps for Field Service Instead of Private Messengers

Fri, 27 Mar 2026 09:30:26 +0000

In many technical service teams, there is a dangerous pragmatism when it comes to communication: When things need to move quickly on-site or at the machine, private smartphones are used. Photos of defects, location data, and agreements on maintenance protocols end up in WhatsApp groups.

What seems efficient at the moment is a massive problem for the company. Not only from a GDPR perspective but also operationally: Information gets lost in private silos, is not documented for the headquarters, and is lost when an employee leaves the company. The solution for modern industrial service providers is Mattermost - integrated as a sovereign “ChatOps” hub.

Your First Productive Polycrate Workspace: A Checklist for Getting Started

Fri, 27 Mar 2026 00:00:00 +0000

TL;DR

A well-named, clearly structured Polycrate workspace is half the battle: a consistent name (e.g., acme-corp-automation) and a simple directory structure prevent chaos before it starts.
Start with a few well-chosen blocks – depending on the role, e.g., Linux patching, Windows baseline management, or Kubernetes deployment – and consistently pin block versions instead of ever using :latest.
Enable workspace encryption early, set up Git, and build your first custom block – this checklist makes onboarding reproducible and auditable.
Common pitfalls include unencrypted secrets, hosts: localhost instead of correct inventories, and missing version pins; with Polycrate and best practices, you avoid these mistakes from the start.
ayedo supports you with Polycrate , practical best practices, projects, and consulting to turn your first workspace into a sustainable automation platform.

Why the First Workspace Matters

The first productive workspace is more than a test balloon. It sets the stage for how you will automate in the future:

The Polycrate Ecosystem: PolyHub, API, MCP, and the Future of Automation

Thu, 26 Mar 2026 00:00:00 +0000

TL;DR

Polycrate is more than just a CLI tool: With PolyHub, an API platform, and MCP, it forms an ecosystem where reusable automation blocks, monitoring, and AI integration come together.
PolyHub acts as a marketplace for versioned blocks—from Linux patching to Windows management to Kubernetes—while the Polycrate API makes workspaces, runs, and alerts centrally visible and manageable.
MCP (Model Context Protocol , polycrate mcp) gives AI clients Hub, docs, and schema tools—execution stays in your CLI; see the MCP documentation .
This article series has shown how Linux, Windows, IoT, and enterprise teams can evolve from initial playbooks to structured, encrypted, shareable automation platforms with Polycrate.
ayedo accompanies this journey as an experienced partner with Polycrate expertise , platform engineering offerings , and consulting services —from the first demo to managed blocks and API integration.

Overview of the Polycrate Ecosystem

Polycrate was created as a pragmatic response to a well-known problem: Ansible is powerful, but the surrounding setup can be cumbersome. Python versions, local setups, playbook sprawl, lack of structure, compliance approvals—all of these consume time.

Weekly Backlog Week 14/2026

Wed, 25 Mar 2026 14:11:10 +0000

Editorial

This week feels like a reality check for multiple narratives at once.

AI is suddenly not just innovation, but a cost issue. Digital sovereignty is not just a strategy, but a contradiction within one’s own operations. And Open Source is not an ideology, but a question of convenience.

In short: The beautiful concepts meet operational reality.

🚨 The Tech News of the Week

The End of OpenAI?

OpenAI has shut down its video AI “Sora” without warning.

Legally Secure Signing: Digital Signatures Without Data Leakage Overseas

Wed, 25 Mar 2026 13:30:27 +0000

In many companies, the process of digital signing is the last “analog island” or a dangerous compliance breach. Maintenance logs are created digitally but then uploaded to US platforms like DocuSign or Adobe Sign to obtain a signature.

The problem: The moment a technical service provider has a log signed via a US cloud, sensitive data (customer name, facility location, technical details) leaves its legal jurisdiction. For customers in critical infrastructure sectors or highly regulated industries, this “brief excursion” into the US cloud is often a deal-breaker in audits.

Zammad vs. Zendesk: When Switching to Open-Source Ticketing Makes Sense

Wed, 25 Mar 2026 13:17:01 +0000

In customer service and technical support, the ticketing system is the central nervous system. Many companies instinctively turn to market leaders like Zendesk. The reasons are understandable: It is quick to set up, offers countless features, and just works.

However, as volume increases and data protection requirements grow, many of our clients—especially technical service providers in the industrial sector—hit a glass ceiling. This is where Zammad, the modern open-source alternative from Germany, comes into play.

Digital Sovereignty as a Competitive Advantage in B2B Sales

Wed, 25 Mar 2026 12:26:33 +0000

For a long time, IT infrastructure in B2B sales was a peripheral issue. Companies relied on major US SaaS providers because they were considered the “standard.” But the tide has turned: In times of tightened compliance regulations like NIS-2 or DORA, the question of “where and how” data processing occurs becomes a decisive factor in contract awards.

Especially technical service providers working for operators of critical infrastructures (KRITIS) face a new reality today: Those who can prove that project-related data never leaves the European legal space not only gain trust but secure a tangible market advantage.

Sovereign AI: Why LLMs (vLLM/Ollama) Must Be Self-Hosted

Wed, 25 Mar 2026 12:10:33 +0000

Since the breakthrough of ChatGPT, it’s clear: AI can do more than just analyze numbers. It can write reports, summarize maintenance instructions, and explain anomalies in human language. Sensor data analysis software uses LLMs to provide technicians on the shop floor with precise instructions: “Vibration at bearing 4 indicates a lack of grease - please re-lubricate by the end of the shift.”

However, this raises a critical question of data protection and sovereignty: Do you want your internal machine data, process secrets, and maintenance reports to run through the API of a US provider? For the German industry, the answer is usually a clear no. The solution: Self-hosted LLMs on your own infrastructure.

Observability for MLOps: More Than Just Monitoring CPU and RAM

Wed, 25 Mar 2026 12:05:24 +0000

In the traditional IT world, things are binary: A server is either running or it’s not. A database either responds or throws an error. In the world of machine learning, it’s trickier. A model can be technically running perfectly (CPU at 20%, 200 OK status code), yet produce completely incorrect nonsense.

We call these “Silent Failures”. When sensors suddenly fail to predict a machine outage, even though all systems show “green,” it’s often due to phenomena like Model Drift. Without a specialized observability strategy , ML operations remain a shot in the dark.

Edge vs. Cloud: The Optimal Distribution of AI Workloads in Manufacturing

Wed, 25 Mar 2026 11:59:17 +0000

In the industry, a fundamental architectural question arises: Should AI make decisions directly at the machine (Edge) or should the data be sent to a central system for deeper analysis (Cloud)?

Anyone attempting to push terabytes of raw sensor data to the Cloud in real-time through a narrow internet connection will fail due to latency. Similarly, trying to train complex models on a small industrial PC at the machine will fail due to insufficient computing power.

Cloud Cost Hygiene: Why Unused GPUs Are Draining Your Budget

Wed, 25 Mar 2026 11:54:00 +0000

In the realm of IT infrastructure, few things are as costly as a modern NVIDIA GPU doing nothing. An H100 or A100 instance with major hyperscalers often costs as much per hour as an entire office team consumes in coffee. When data scientists forget to shut down their instances after training, or when clusters idle while reserving expensive resources, costs can skyrocket within days.

The issue with AI projects is often not the model itself, but the lack of transparency and control over the hardware. “FinOps for ML” is not a luxury but a necessity for economic viability.

Experiment Tracking vs. Model Registry: Navigating the AI Jungle

Wed, 25 Mar 2026 11:49:24 +0000

In software development, Git is the “Source of Truth.” When something goes wrong, you check the commit history. In the world of artificial intelligence, that’s not enough. A model is not just code; it’s a combination of code, data, and hyperparameters.

Without systematic management, what happens at Sensoriq (and many others) is this: A data scientist trains a model that delivers excellent results. Three weeks later, this model is to be put into production - but no one remembers exactly which dataset it was trained on or what exact settings were used. The model is a “black box” without a birth certificate.

Inference Under Pressure: How to Guarantee Industrial SLAs of < 500 ms

Wed, 25 Mar 2026 11:43:15 +0000

In a pilot project, many things are forgiven in AI. If an anomaly prediction takes two seconds, it’s not the end of the world. But in industrial manufacturing - such as monitoring high-speed presses or robotic arms - time is not a relative concept, but a strict contractual parameter (SLA).

When a sensor analysis software promises to predict failures within 500 ms, the infrastructure must not become the bottleneck. A simple Python process on a server is no longer sufficient. We need an architecture that responds to peak loads before the user notices them.

Open Source Becomes the Standard:

Wed, 25 Mar 2026 11:27:16 +0000

Why the EVB-IT Reform is a Turning Point for Government IT

Public IT procurement in Germany has long been characterized by a structural contradiction. Politically, digital sovereignty was demanded, but in practice, proprietary solutions were preferred. Not out of conviction, but due to legal uncertainty.

With the reform of the EVB-IT model contracts, this contradiction is resolved. Open Source is no longer an exception for new software but the standard. This fundamentally shifts the logic of government IT.

Reproducibility is No Accident: Standardized Workspaces with JupyterHub

Wed, 25 Mar 2026 11:24:50 +0000

In many data science teams, the workday begins with frustration: A shared notebook won’t run because a library is missing. A model trained on colleague A’s machine yields different results on colleague B’s server. And onboarding new team members takes days until all CUDA drivers, Python venv environments, and paths are correctly configured.

The problem is local fragmentation. When everyone works on their own “island setup,” reproducibility remains a happy accident. The solution: JupyterHub on Kubernetes .

Kafka on VMs vs. Kubernetes: Why the 'Operator Approach' is Revolutionizing Streaming

Wed, 25 Mar 2026 11:19:39 +0000

In industrial AI, such as predictive maintenance for sensor data analysis software, data streams are the lifeblood. Thousands of sensors provide measurements every second that need to be filtered, aggregated, and passed on to inference models. Apache Kafka has established itself as the heart of this pipeline.

However, many teams start with Kafka on traditionally managed Virtual Machines (VMs). What begins small quickly becomes an operational burden with increasing load, such as during a rollout for a major customer. Transitioning to a Kubernetes -native operation with the Strimzi Operator is often the decisive breakthrough.

GPU Famine in the Team? How Scheduling and Quotas Ensure Peace

Wed, 25 Mar 2026 11:13:01 +0000

In many machine learning teams, an unwritten rule prevails: first come, first served. Whoever starts the first training job in the morning occupies the GPU—often for the entire day. The remaining data scientists wait, switch to slow CPU instances, or book expensive shadow IT in the public cloud.

This “Wild West scenario” in hardware usage is not only inefficient, it stifles innovation and causes costs to skyrocket. The solution lies not in more hardware, but in intelligent GPU scheduling and resource quotas.

From Notebook to Production: Why "Productization" Shouldn't Be a Manual Step

Wed, 25 Mar 2026 11:06:13 +0000

In the world of Artificial Intelligence, there’s a phenomenon we often refer to as the “Wall of Confusion.” On one side is the data science team developing brilliant models in Jupyter Notebooks. On the other side is the ops team responsible for stability, latency, and SLAs in production.

The critical point: The transition from experimental code in the notebook to a stable service in the cloud is often a manual, error-prone process. Manually rewriting models into Flask scripts and deploying them on dedicated servers creates a technical dead end.

Sovereignty or Illusion?

Wed, 25 Mar 2026 10:00:08 +0000

A Term Without Substance

An open letter from 25 European cloud and digital companies reveals what European digital policy has been avoiding for years: The term “digital sovereignty” is consistently used without its prerequisites being met.

The Reality of the Market

The market reality leaves no doubt about this. US hyperscalers like AWS, Microsoft Azure, and Google Cloud control around 70 percent of the European market, while European providers collectively account for about 15 percent. This distribution is not simply the result of technological superiority but a reflection of political decisions—particularly in regulation and public procurement.

France's Open Source Strategy

Wed, 25 Mar 2026 09:34:48 +0000

Structure Instead of Symbolic Politics

Since 2021, the French government has been pursuing a well-structured approach to the digital transformation of the state with the action plan “Free Software and Digital Commons.” Open Source is not treated as a technical detail but as a strategic tool to strengthen state capabilities and technological independence.

The plan is politically anchored, organizationally secured, and operationally differentiated. This exact combination is missing in many other European countries.

Polycrate vs. plain Ansible: What You Gain – and Why It's Worth It

Wed, 25 Mar 2026 00:00:00 +0000

TL;DR

Plain Ansible is a powerful tool for ad-hoc automation, quick scripts, and simple setups – but teams quickly hit limits with dependencies, structure, and sharing.
Polycrate builds on Ansible, neatly encapsulates it in a container, and introduces a block/workspace model that systematically addresses dependency chaos, playbook sprawl, and secret handling.
Instead of “ansible installed somewhere,” with Polycrate you get a reproducible, containerized toolchain, sharable automation via OCI registry, workspace encryption, and guardrails for larger teams.
There are valid scenarios where plain Ansible is the better choice – such as for very small environments, temporary scripts, or restricted environments without containers.
ayedo supports you in finding the right mix of Ansible and Polycrate – from initial tests to comprehensive Platform Engineering with automated compliance and operational security.

Polycrate and Ansible in Direct Comparison

Ansible has been a de facto standard for automation for years – from Linux servers to Windows hosts to network components and IoT. Polycrate picks up exactly there: It doesn’t replace Ansible but structures and operationalizes it.

Polycrate MCP: Connecting AI Assistants with Live Infrastructure Context

Tue, 24 Mar 2026 00:00:00 +0000

TL;DR

The Model Context Protocol (MCP) is an open standard: AI clients talk to helper programs over stdin/stdout (stdio) using JSON-RPC.
polycrate mcp starts such an MCP endpoint: the client launches it on demand as a subprocess—not a separate service you cd into a workspace to “bring up,” and not a polycrate mcp server command (that does not exist).
Built-in tools include the Polycrate Hub (search, inspect, list versions), official documentation (docs_get), schema helpers for workspace.poly / block.poly / CHANGELOG.poly / secrets.poly, guides (Ansible, registry, debugging, best practices), and CLI metadata (versions, artifacts).
Local workspace files (playbooks, inventory.yml, logs) are not mirrored by Polycrate MCP. Your IDE (e.g. Cursor) already loads the project—together with MCP tools you get full context.
Full reference: MCP Server Integration .

Why plain AI hits limits without Polycrate context

AI assistants excel at generic Ansible or YAML questions—but struggle with your platform standards, approved blocks on the Hub, and correct *.poly shapes. Without up-to-date docs and Hub data, models guess.

Enterprise Automation: Building, Versioning, and Sharing Blocks Within Teams

Mon, 23 Mar 2026 00:00:00 +0000

TL;DR

In many enterprise organizations, each team builds its own Ansible environment—without clear versioning, without central reuse, without governance. This does not scale organizationally.
Polycrate turns Ansible playbooks into reusable, versioned blocks that can be published in an internal OCI registry (e.g., Harbor or registry.acme-corp.com) and used by any team.
The block model creates guardrails: clear interfaces, semantic versioning, CHANGELOG.poly, and simple actions instead of playbook sprawl—including compliance mechanisms to ensure only approved block versions are used in production.
With Polycrate’s containerized execution, local Ansible setups and Python or dependency chaos are eliminated. Every developer workstation uses the same toolchain; blocks can be safely shared and versioned in the registry.
ayedo supports you with Platform Engineering , Polycrate expertise, and an Enterprise Platform Workshop to build a company-wide automation ecosystem that empowers teams and meets compliance requirements.

If you look at a larger company today, you often see the same pattern:

Managing Raspberry Pi and Edge Nodes with Polycrate in IoT and Edge Computing

Sun, 22 Mar 2026 00:00:00 +0000

TL;DR

You can centrally manage hundreds of Raspberry Pis and other edge nodes with Ansible—without an agent on the devices, just via SSH.
Polycrate handles the entire Ansible setup for you: No need for Python or Ansible installation on your laptop, everything runs reproducibly in a container.
With a single Polycrate block, you can build idempotent OTA updates (apt upgrade) including service restarts and distribute sensor and logging configurations across your device fleet.
Using serial: 10, you can safely roll out updates in waves, for example, 50 Raspberry Pis in groups of 10—ideal for factory halls, smart home fleets, or Industry 4.0 setups.
ayedo supports teams with practical workshops, ready-made Polycrate blocks, and consulting around IoT and edge automation—including compliance topics and secure workspace encryption.

The IoT Management Problem in Practice

Imagine a typical factory hall:

Workspace Encryption: Managing Secrets in GDPR Compliance – Without External Tooling

Sat, 21 Mar 2026 00:00:00 +0000

TL;DR

Unencrypted SSH keys, plaintext passwords, and credentials in wikis pose a compliance risk—especially under GDPR (since 25.05.2018) and NIS-2 (effective 17.10.2024).
Polycrate includes workspace encryption: All secrets are stored as files in the workspace, encrypted with age, and can be securely versioned in the Git repository.
secrets.poly holds sensitive block configuration (overrides to workspace.poly); together with files under artifacts/secrets/, everything is encrypted with a single workspace encryption key (primarily via the Polycrate API or WORKSPACE_ENCRYPTION_KEY) using age; at runtime Polycrate exposes decrypted paths—access in playbooks via workspace.secrets[...].
The workflow is simple: polycrate workspace decrypt to work, secure changes before committing with polycrate workspace encrypt—no external tools, no additional secret management system.
ayedo combines workspace encryption with Platform Engineering : Polycrate offers a containerized toolchain, guardrails through the block model, and an API-enabled ecosystem that considers security and compliance requirements from the start.

The Secrets Problem: When Convenience Becomes Liability

Anyone who has worked extensively with Ansible, shell scripts, or manual administration is familiar with typical patterns:

Security Flaw? No – A Structural Information Problem

Fri, 20 Mar 2026 09:54:22 +0000

The recent warnings from CISA and Amazon about active attacks on Cisco FMC, Microsoft SharePoint, and Zimbra initially appear to be a routine process in IT security: vulnerabilities are identified, assessed, published – and then patched.

This perspective is convenient. And it is wrong.

Because it overlooks the crucial part: the period during which attacks are already underway without anyone knowing.

When Attacks Begin Before the Warning

This problem is particularly evident in the case of Cisco.

Policy as Code: Automating Compliance Requirements with Polycrate

Fri, 20 Mar 2026 00:00:00 +0000

TL;DR

Manual compliance checking with Excel lists is slow, error-prone, and hardly reproducible – with Policy as Code, you describe your requirements once and then have them automatically checked.
With Polycrate, you encapsulate Ansible entirely in a container: no local installation, no Python version conflicts, the same tooling version for everyone involved – ideal for repeatable compliance checks.
A dedicated “Compliance Block” separates checking (check) and correcting (remediate), generates audit reports as JSON/CSV, and stores them structured in the workspace – including Git history as an audit trail.
NIS-2 (measures applicable from 18.10.2024) and GDPR (effective since 25.05.2018) require demonstrable technical and organizational measures. With Policy as Code, you can automatically check specific controls (e.g., CIS Benchmarks).
ayedo supports you with open-source tooling, Platform Engineering , and specially tailored workshops to bring compliance automation safely and understandably into your organization.

Why Manual Compliance Checking Hits Its Limits

Many compliance teams still work with Excel checklists or Word documents:

Helm Charts as a Polycrate Block: More Control Over Chart Deployments

Thu, 19 Mar 2026 00:00:00 +0000

TL;DR

Deploying Helm charts directly via CLI works – but only with Ansible and Polycrate do deployments become truly idempotent, versioned, and team-friendly.
block.config makes your Helm values a central, versioned configuration point – including a Jinja2 template that cleanly generates complex values.yaml structures.
With Ansible modules like kubernetes.core.helm_repository, kubernetes.core.helm, kubernetes.core.helm_rollback, you get upgrade, diff, and rollback logic as reusable actions in a Polycrate block.
Polycrate solves the dependency problem: Helm, kubectl, Python, Ansible collections run in the container – no local installation sprees or version conflicts, workspaces can be encrypted.
ayedo supports teams with proven patterns, tooling, and workshops around Helm, Ansible, and Polycrate – including tailored Kubernetes solutions .

Why Helm via Ansible and Polycrate?

Helm is the standard tool for deploying complex applications on Kubernetes. Many teams start with:

Weekly Backlog Week 13/2026

Wed, 18 Mar 2026 13:45:45 +0000

🧠 Editorial

This week feels a bit like an infrastructure reality check.

While Germany suddenly wants to build data centers on an industrial scale, Europe continues to debate what “sovereignty” actually means – and the USA casually shows us how quickly security standards can soften when dependencies become too large.

Spoiler: It’s all the same problem.

Just from three perspectives.

📰Tech-News:

German Government Plans Massive Expansion of Data Centers by 2030

Germany wants to massively expand data centers: AI capacities are to quadruple by 2030, and traditional infrastructure is to at least double.

SSH Sessions and kubectl Debugging: Polycrate as an Operations Tool

Wed, 18 Mar 2026 00:00:00 +0000

TL;DR

Polycrate is not just a deployment tool: With polycrate ssh and block actions for kubectl, it becomes a central operations tool for Linux, Windows, and Kubernetes environments.
SSH sessions run directly from the workspace – with inventory-based host selection, tab completion, and no “Where’s the password?” questions. All sessions are logged in an auditable way via the Polycrate API.
Kubernetes debugging becomes a repeatable process: polycrate run myapp debug runs Ansible playbooks with kubernetes.core.k8s_log and k8s_info in the container – always with the correct kubeconfig from the workspace.
This solves several problems of classic setups: no local Ansible, no kubectl chaos, no shared kubeconfigs, clear audit trails for SSH access and K8s operations.
ayedo supports you with Polycrate, tailored platform engineering and consulting so you can align operations and compliance – from the first demo to production.

Polycrate as an Operations Tool, Not Just a Deployment Helper

Many teams use Ansible and kubectl primarily for provisioning and deployments. However, day-to-day operations look different:

Kubernetes as the Foundation of Digital Sovereignty

Tue, 17 Mar 2026 12:37:00 +0000

Digital sovereignty is often discussed in abstract terms, but it can be technically delineated quite clearly: the key is what systems are bound to. Once applications depend on specific infrastructures, proprietary APIs, or non-standardized operating models, a coupling arises that can only be resolved later with significant effort. In practice, this means that many architectures are formally portable but are not actually moved.

Kubernetes addresses this issue not through additional layers of abstraction in the classical sense but through a different operational model. Instead of defining processes, a desired state is described, which is then continuously maintained by the system itself. This shift towards declarative state definitions is crucial because it allows systems to be formulated independently of their execution environment.

Kubernetes Image Promoter:

Tue, 17 Mar 2026 10:09:45 +0000

The Invisible Modernization of Critical Infrastructure

It’s often not the visible features that determine the stability of modern platforms, but the inconspicuous systems in the background—those components that must function reliably without attracting attention. One such system is the focus of a recent post from the Kubernetes Blog: the Kubernetes Image Promoter—and its comprehensive, deliberately “invisible” redevelopment.

What is particularly remarkable here is that one of the most critical components of the Kubernetes -release pipeline was fundamentally rebuilt—faster, more robust, and leaner—and ideally, no one noticed. That was precisely the goal.

AI Gateway in the Kubernetes Ecosystem:

Tue, 17 Mar 2026 10:02:54 +0000

Why the Next Evolutionary Stage of the Platform Has Already Begun

The discussion around AI infrastructure is noticeably shifting: away from mere model questions, towards the real challenge of how AI can be integrated into existing platforms in a controlled, secure, and efficient manner. A recent post from the Kubernetes Blog on the new AI Gateway Working Group provides an insightful impetus for this – and makes it clear that the Cloud-Native world is already preparing for the next generation of architecture.

CloudFest 2026

Tue, 17 Mar 2026 09:38:38 +0000

Why We Consciously Don’t Have a Booth This Year – and Expect More Than Ever Before

CloudFest is one of the few events where the term “industry meeting” is not an exaggeration. This is where the layer of IT that builds, operates, and sells infrastructure comes together. Anyone who wants to understand where hosting, cloud, and platform economy are heading cannot miss this event.

We participated in 2025 as exhibitors in the start-up area.

Multi-Cluster Kubernetes with Polycrate: Why One Cluster, One Workspace

Tue, 17 Mar 2026 00:00:00 +0000

TL;DR

In Polycrate, multi-cluster automatically means multi-workspace: one workspace manages exactly one Kubernetes cluster . That keeps responsibilities, kubeconfigs, and access rights clearly separated.
Shared logic lives in reusable blocks in an OCI registry. Staging and production use the same block type but different, explicitly pinned versions—that is the promotion mechanism.
Deploy workflow: pull the new block version into the staging workspace, test with polycrate run, then pin the same block version in production and run again. Rollback means: revert the version in that workspace and rerun the action.
Each block deploys into its own namespace—technical isolation, fewer shared-state effects, and simpler audits per workspace and per block.
ayedo supports you with Polycrate, best practices, and services to build multi-cluster setups cleanly as a multi-workspace architecture—from the first demo to production.

Why one workspace = one Kubernetes cluster

Polycrate follows a clear convention: a workspace represents a self-contained automation domain. For Kubernetes solutions , that means: one workspace = one cluster.

Creating Your Own Kubernetes App as a Polycrate Block: A Step-by-Step Guide

Mon, 16 Mar 2026 00:00:00 +0000

TL;DR

In this post, you’ll create a complete Polycrate block for your own Kubernetes app – including block.poly, an Ansible playbook, and three Kubernetes templates for Deployment, Service, and Ingress.
block.config serves as the single source of truth for image, replicas, namespace, and domain; the upgrade workflow is reduced to: change the image tag in the workspace, run polycrate run myapp install, and you’re done.
Thanks to Polycrate’s container execution, you don’t need Ansible, Python, or kubectl locally – the entire toolchain is provided in the container and is identical for the whole team.
With the block model featuring actions install, uninstall, and status, you get a clean, reusable interface instead of loosely distributed playbooks; the block can be versioned and shared in an OCI registry.
ayedo supports teams with proven Kubernetes solutions , workshops, and best practices around Polycrate and Ansible – from the first app to comprehensive platforms.

Why Creating Your Own Kubernetes Block Makes Sense

Many Kubernetes teams start with Helm charts and a few YAML files in the Git repo. Once multiple internal services, different environments, and compliance requirements come into play, things get confusing:

Deploy Kubernetes Apps from the PolyHub: From Idea to Deployment in Minutes

Sun, 15 Mar 2026 00:00:00 +0000

TL;DR

PolyHub functions like an app store for infrastructure: Ready-made ayedo blocks for Kubernetes apps (nginx, cert-manager, external-dns, and many more) can be pulled directly from the registry cargo.ayedo.cloud into your workspace and used without a local Ansible setup.
In this post, you’ll build a complete ingress stack (nginx + cert-manager + external-dns) solely by configuring your workspace.poly and executing a few polycrate commands – including clean Kubeconfig handling and versioned blocks.
You’ll learn how an official ayedo Kubernetes block is structured (block.poly + Ansible playbook), why version pinning (:0.2.2 instead of :latest) is mandatory in production, and how to leverage the extensive ecosystem on PolyHub for your own workspaces.
Polycrate solves the classic Ansible dependency problem by running all playbooks in a predefined container with a complete toolchain (kubectl, Helm, Python, Collections) – identical on every workstation, without Python chaos and without manual setup.
ayedo provides a tested, reusable foundation for Kubernetes solutions with Polycrate and the official blocks on PolyHub, which you can directly adopt and adapt to your environment.

PolyHub as an App Store for Kubernetes Infrastructure

If you’ve ever set up an ingress stack manually with plain Ansible or Helm, you know the pattern:

Automating Azure Infrastructure with Polycrate: VMs, Resource Groups, and Networking

Sat, 14 Mar 2026 00:00:00 +0000

TL;DR

In this post, we build a Polycrate workspace that manages on-premise servers and Azure VMs in a shared inventory—including Resource Groups, VNet/Subnet, and virtual machines (Linux & Windows).
Azure resources (Resource Group, VNet, VMs) are provisioned with Ansible modules from azure.azcollection, encapsulated in Polycrate blocks—no local Python or Ansible installation required.
A dynamic inventory playbook writes newly provisioned Azure VMs into the central inventory.yml so you can continue with polycrate ssh (Linux) or WinRM (Windows) immediately afterward.
Additional blocks cover backups/artifacts in Azure Blob Storage and cost control via stop/start patterns for non-production VMs.
ayedo supports you with proven Polycrate workspaces and Azure building blocks—from the first demo to enterprise-wide hybrid automation.

Azure as a Hybrid Target for Polycrate

Many teams sit somewhere between traditional data centers and the cloud: hundreds of Linux servers on-premise, Active Directory on Windows Server, plus some workloads in Azure. This is where Polycrate shines:

Automating Azure Entra ID: Users, Groups, and Apps with Ansible

Fri, 13 Mar 2026 00:00:00 +0000

TL;DR

Ansible can fully automate Azure Entra ID (formerly Azure AD) via the azure.azcollection: users, groups, app registrations, and even documentation of your Conditional Access Policies.
With Polycrate, all playbooks run in a reproducible container: no local Ansible/Python installation, no version chaos, no “works on my machine” issues – the complete Azure toolchain is defined in the Dockerfile.poly.
A dedicated Service Principal serves as an automation account – with clearly limited rights (Least Privilege) and securely encrypted credentials in the workspace.
Every change to Entra ID becomes code: pull requests, reviews, and Git history serve as a technical audit trail for compliance, e.g., in the context of GDPR or internal policies.
ayedo supports you with Polycrate, best practices, and a specialized Azure automation workshop where we industrialize your Entra ID management together.

Why Automate Entra ID?

For Windows admins and Azure admins, the center of identity management has long shifted from classic on-prem AD to Azure Entra ID. Users, groups, and app registrations are increasingly managed directly there – often still via portal clicks.

Weekly Backlog Week 12/2026

Thu, 12 Mar 2026 11:55:30 +0000

Sovereign Washing, AI Investigations, and the Illusion of Control

🧠 Editorial

This week in the backlog: AWS delivers certificates instead of answers, Germany discusses AI investigations, and Europe once again realizes that it has everything—except consistency.

Additionally, perhaps the most important insight: Digital sovereignty rarely fails due to technology. Almost always due to decisions.

Wed, 11 Mar 2026 00:00:00 +0000

TL;DR

You can implement standardized Windows software deployment without expensive SCCM infrastructure – using Chocolatey as a package manager and Ansible as the control center.
Polycrate packages Ansible, Python, and the entire toolchain into a container, solving the dependency problem and bringing structure to your automation through reusable blocks.
A software baseline is modeled as a Polycrate block: Office, Developer, and Server profiles are versioned, reproducible, and executable via polycrate run – without a local Ansible installation.
Through groups in the inventory, you can implement a rolling rollout: first test workstations, then broad deployment into production.
ayedo supports teams in modeling such scenarios in a practical software deployment workshop and sustainably bringing them into operation.

The SCCM Problem: When Overhead Outweighs Benefits

Many Windows admins know the dilemma: Microsoft Endpoint Configuration Manager (formerly SCCM) is powerful, but:

Automating Active Directory: Users, Groups, and OUs with Ansible

Tue, 10 Mar 2026 00:00:00 +0000

TL;DR

Active Directory changes via GUI or non-versioned PowerShell scripts are error-prone, hard to track, and not very collaborative. With Ansible and Polycrate, they become reproducible, versioned, and team-friendly.
We build a Polycrate block for AD management that handles users, groups, and OUs using the modules community.windows.win_domain_user, community.windows.win_domain_group, and community.windows.win_domain_ou—including CSV-based bulk onboarding and offboarding playbook with audit log.
Each run leaves traces in the Git repository (CSV, playbooks, audit logs) and is automatically committed with polycrate workspace sync: A clean audit trail for compliance requirements like GDPR, effective since 25.05.2018.
Polycrate encapsulates Ansible completely in a container, including all Windows/AD dependencies; no more Python/Ansible chaos on admin laptops and clearly structured blocks instead of playbook sprawl.
ayedo supports you in establishing such AD automations as reusable, compliance-capable building blocks in your organization—from conception to integration into existing processes.

Why AD Automation Has Been So Tedious

If you manage a classic Active Directory today, the daily routine often looks like this:

Why Europe Doesn't Need Hyperscalers

Mon, 09 Mar 2026 12:56:54 +0000

But Rather Better Cloud Architectures

For years, the European cloud debate has been dominated by a seemingly simple question: Does Europe need its own hyperscalers?

Politics, business, and media regularly discuss whether Europe should build a technological counterpart to the major platform providers from the USA. Billion-dollar programs, funding projects, and initiatives aim to create a “European cloud” that can compete with the large global platform ecosystems.

But perhaps this question has been wrong from the start.

Sovereign Cloud Instead of Hyperscaler Ecosystem:

Mon, 09 Mar 2026 12:50:11 +0000

Europe’s Missed Opportunity – and Why It’s Not Yet Lost

Over the past decade, the cloud has evolved into the central infrastructure of the digital economy. Applications, data platforms, development environments, and increasingly AI systems are predominantly operated on a few global platforms today.

The market structure is remarkably clear. A large portion of the digital infrastructure of Western companies runs on platforms of a few hyperscalers. These providers have created enormous technical ecosystems – with thousands of services, global infrastructure, and an impressive pace of innovation.

The Exit Test:

Mon, 09 Mar 2026 12:43:39 +0000

Mon, 09 Mar 2026 12:38:57 +0000

Why European Companies Need to Rethink Their Infrastructure Strategy

Artificial intelligence is currently transforming not only products, processes, and business models but also the structure of digital dependencies. While many companies are still grappling with understanding traditional cloud lock-in risks, a new form of technological dependency is emerging—deeper, more complex, and harder to dissolve in the long term.

The reason is that AI is not just an additional software component. AI systems deeply integrate into data architectures, development processes, and platform structures. Integrating AI automatically changes your infrastructure.

Compliance-by-Design Instead of Audit Theater:

Mon, 09 Mar 2026 12:35:35 +0000

Why Regulation is an Architectural Issue

Few topics are currently causing as much turmoil in IT as new regulatory requirements. GDPR, NIS-2, DORA, Cyber Resilience Act, or Data Act expand the framework within which digital systems must operate. For many companies, this development initially seems like an additional burden. New documentation requirements, additional audits, new processes—all of this seems to hinder innovation.

But this perspective is too short-sighted.

Regulation is not just an administrative problem. It is primarily an architectural challenge. Viewing compliance as a downstream audit process inevitably creates bureaucracy. However, when compliance is considered as part of the system architecture, many requirements can be technically resolved—often more elegantly than with traditional governance processes.

Why Hetzner is the Strategically Smarter Cloud for Many Workloads

Mon, 09 Mar 2026 12:31:13 +0000

For years, the cloud debate has been dominated by a simple narrative: those who want to run modern software cannot bypass the major hyperscalers. Their platforms are considered indispensable, their range of functions the benchmark for the entire industry. For many companies, the decision seems to be made before it is even posed.

But this image is beginning to crumble.

More and more organizations are realizing that the actual needs of many applications are far less spectacular than the marketing slides of the major platforms suggest. Not every software requires a global platform ecosystem with hundreds of specialized services. Many applications primarily need one thing: stable infrastructure, transparent costs, reliable performance, and the ability to operate systems without structural dependencies.

Open Source is Not Synonymous with Sovereignty

Mon, 09 Mar 2026 12:28:59 +0000

Why License Freedom Alone Does Not Create Control

In the European digital debate, Open Source is often seen as synonymous with digital sovereignty. The reasoning is understandable: if the source code is open, anyone can review, modify, and operate it independently. This seems to automatically reduce dependencies on individual vendors.

However, this equation is too simplistic.

Open Source can be an important building block for sovereign IT. But Open Source alone guarantees neither control nor independence. There is a significant gap between freely available code and truly sovereign operation.

Multi-Cloud is Not Automatically Sovereign

Mon, 09 Mar 2026 12:24:58 +0000

Why Two Clouds Do Not Mean Independence

In many companies, Multi-Cloud is now considered a shortcut to digital sovereignty. The common assumption is that distributing workloads across multiple providers automatically reduces dependencies and regains control. This sounds plausible. In practice, it is often a misunderstanding.

Because Multi-Cloud and sovereign Cloud do not describe the same thing. One is primarily an architectural model. The other is a claim to control, portability, legal clarity, and actual capability to act. Equating the two confuses technical distribution with strategic independence.

Vendor Lock-in in the AI Era:

Mon, 09 Mar 2026 12:20:36 +0000

Why Dependencies Are Becoming More Dangerous

Cloud lock-in is not a new topic. For years, companies have been discussing how challenging it can be to migrate infrastructure, data, or applications from one provider to another. However, with the rise of AI platforms, this issue is taking on a new dimension.

What was once a technical architecture problem is increasingly becoming a strategic dependency.

From Infrastructure Lock-in to AI Lock-in

Traditional cloud lock-in usually arises from proprietary infrastructure services: databases, messaging systems, identity services, or serverless platforms that are heavily tied to a provider. Those who make extensive use of such services must rebuild applications, migrate data, and adjust operational processes when switching providers.

Evolving Cloud Strategies: Between Hyperscalers and Sovereignty

Mon, 09 Mar 2026 12:00:27 +0000

The cloud market is entering a new phase. For a long time, the equation was simple: those who wanted to scale went to the hyperscalers. Those who needed global availability chose AWS, Microsoft, or Google. Those who needed innovation bought it as a service. It was efficient, convenient, and often economically plausible.

This logic only partially holds in the AI era.

Traditional storage solutions (and Ceph) are often monolithic: A huge controller manages everything. If the controller crashes, the cluster is down.

MailHog: The Reference Architecture for Secure Email Testing and Debugging

Mon, 09 Mar 2026 09:37:09 +0000

TL;DR

Email delivery is one of the most critical functions of modern applications (password resets, invoices). However, testing is risky: a wrong config entry in the staging environment, and thousands of real customers receive test emails. MailHog completely eliminates this risk. It acts as an SMTP server that accepts emails but does not deliver them. Instead, it captures them in a web interface. It is the ultimate “airbag” for developers – secure, fast, and API-controllable.

MariaDB: The Reference Architecture for Open Relational Databases (RDBMS)

Mon, 09 Mar 2026 09:36:34 +0000

TL;DR

Relational databases are the backbone of almost every business application. However, the market leader MySQL is now owned by Oracle, and cloud providers like AWS RDS charge a premium for hosting (“Managed Service Premium”). MariaDB is the legitimate, community-driven successor to MySQL. It is fully compatible but often technologically superior (faster query optimizer, more storage engines). Running MariaDB in your own cluster provides enterprise performance without license costs and without the constraints of proprietary cloud services.

MinIO: The Reference Architecture for High-Performance Object Storage & S3 Compatibility

Mon, 09 Mar 2026 09:34:48 +0000

TL;DR

The S3 protocol is to data storage what HTTP is to websites: the universal standard. However, “S3” is not synonymous with Amazon. MinIO decouples the API from the cloud provider. It is an extremely high-performance object storage that enables cloud-native applications to store data wherever it is needed—whether in the local data center, at the edge, or in Kubernetes clusters . Using MinIO retains full S3 compatibility while eliminating the dreaded “egress costs” and latencies of the public cloud.

MongoDB: The Reference Architecture for Flexible Document Databases (NoSQL)

Mon, 09 Mar 2026 09:32:48 +0000

TL;DR

Relational databases force developers to squeeze data into rigid tables. MongoDB breaks this mold. It stores data as modern applications use it: as flexible JSON documents. While cloud providers like AWS offer ‘DocumentDB’, often just outdated emulations lacking features, a true, self-hosted MongoDB instance delivers full power: the latest features, genuine BSON performance, and the freedom to adapt data structures agilely without locking the database for hours (‘Schema Migration’).

Windows Automation with Polycrate: Ansible and WinRM Without Pain

Mon, 09 Mar 2026 00:00:00 +0000

TL;DR

Set up WinRM properly once with HTTPS, certificate, and firewall rules, and you’ll have a stable foundation for Ansible automation on Windows servers.
With Polycrate, Ansible runs with all WinRM and Python dependencies in a container—no pywinrm chaos, no local installations, no version debates within the team.
Windows automation is already built into the Polycrate Ansible image: including the ansible.windows collection (e.g. win_service, win_updates), pywinrm, and the matching Ansible bundle—no custom Dockerfile, no manual ansible-galaxy installs for typical use. You only configure the workspace, inventory, and playbooks.
A dedicated Polycrate block for Windows forms your reusable “Windows toolbox”: manage services, install features, adjust the registry, distribute software, apply patches—all as clearly structured actions.
Passwords and other secrets are stored in secrets.poly and secured via built-in workspace encryption with age—not in inventory.yml.
ayedo supports Windows teams with practical automation blueprints, Polycrate implementation, and a focused Windows automation workshop—from WinRM basics to scalable patch management.

Why Windows Admins Should Consider Polycrate + Ansible

Many Windows admins view Ansible skeptically:

Automated Updates and Backups as Polycrate Workflows

Sun, 08 Mar 2026 00:00:00 +0000

TL;DR

You build a reusable Polycrate workflow that automatically executes backup → update → verify on your Linux servers – including rollback via Ansible block/rescue.
Backups run as pg_dump + tar + upload to S3 with rclone (S3-compatible object storage), updates via apt upgrade plus service restart and health checks, verification through Systemd status and HTTP response.
Polycrate workflows give your Ansible actions a name, an order, and documentation – instead of loosely distributed playbooks and README files.
Everything runs in the container: No local Python/Ansible chaos, consistent toolchain on every admin workstation, workspaces are fully encrypted if needed.
ayedo supports teams in establishing such operational processes as code – from the first block structure to company-wide shared workflows and operations automation demos .

Polycrate Workflows: Operational Processes Instead of CI/CD Pipelines

When you hear “workflow,” you might think of GitHub Actions or GitLab CI. Polycrate workflows are something different:

Many Servers, One Truth: Multi-Server Management with Polycrate Inventories

Sat, 07 Mar 2026 00:00:00 +0000

TL;DR

Managing a single server with Ansible is quick and easy, but once you add 10, 50, or 200 hosts, the inventory becomes a critical scaling factor. Polycrate enforces a centralized, YAML-based inventory per workspace, preventing sprawl.
Think of workspaces as environments: they bundle logically related infrastructure. If you have 100 web servers—10 dev, 10 test, 80 prod—you would ideally create three workspaces (e.g. web-dev, web-test, web-prod) and list only the hosts for that environment in each inventory.yml. Shared automation lives in blocks (block sharing), not in one giant inventory.
In Polycrate, inventory.yml sits in the workspace root and is the single source of truth for all blocks and actions in that workspace. A lean Ansible inventory (e.g. all.vars, clear groups) structures hosts for playbooks within that environment—Polycrate itself has no first-class parameters for Ansible tags or for selecting inventory groups; polycrate run … always applies to the entire workspace.
Modeling complex conditionals with Ansible tags or an overloaded inventory is not best practice. Express the same intent through workspace and block segmentation and block instance configuration (see best practices ).
Polycrate always runs Ansible in a container, resolving typical dependency chaos (Python versions, Ansible version, modules). Once defined, workspaces and inventories can be reproducibly used across the entire team.
In ayedo’s multi-server workshops , we show admin teams in formats such as Platform Architecture and Platform Operations how to transition existing Ansible automation to Polycrate, consolidate inventories, and perform fleet updates safely and transparently.

From Single Server to Fleet: The Real Scaling Problem

As long as you’re managing only one or two Linux servers, Ansible often feels like a better SSH: one playbook, one host, done.

Detecting Infrastructure Drift: When Reality No Longer Matches the Code

Fri, 06 Mar 2026 11:20:20 +0000

In a perfect world, your Infrastructure as Code (IaC) repository is the absolute “Source of Truth.” Every change to load balancers, DNS entries, or firewall rules is managed through Git commits and automated pipelines. In reality, things often look different: an administrator fixes an urgent issue in the middle of the night directly via the cloud console, or an automatic update changes a configuration in the background.

This discrepancy between the defined desired state (in code) and the actual state (in the cloud) is what we call Infrastructure Drift. Undetected drift is one of the biggest risk factors for the stability and security of modern platforms.

European Tech Map:

Fri, 06 Mar 2026 11:14:08 +0000

How a Platform Makes European Technology Visible

Digital sovereignty has become one of the central topics in European technology policy. In political strategies, economic committees, and IT departments, there is increasing discussion on how Europe can make its digital infrastructure more independent.

A frequently mentioned argument in many discussions is that there are simply no European alternatives for many technologies.

However, those who delve deeper into the European tech ecosystem quickly realize that this statement only describes part of the reality. In many areas, powerful providers from Europe already exist—from cloud infrastructure to collaboration software to cybersecurity or AI platforms.

From Model to Service: MLOps Pipelines with ArgoCD and Kubeflow

Fri, 06 Mar 2026 10:49:43 +0000

In traditional software development, CI/CD (Continuous Integration / Continuous Deployment) has long been established as a standard. However, in the world of Artificial Intelligence, this is not enough. AI models are not static artifacts; they are based on code, data, and parameters that constantly change. Without an automated pipeline—known as MLOps—many models end up as “experiments” in the drawer instead of delivering real business value.

At loopback.cloud, we rely on the symbiosis of Kubeflow for orchestrating training and ArgoCD for modern GitOps deployment. This transforms the AI lifecycle from manual tinkering into an industrial process.

Vector Databases on K8s: The Memory for Your Agentic AI

Fri, 06 Mar 2026 10:43:07 +0000

A Large Language Model (LLM) without access to current enterprise data is like a brilliant professor without a library: it has the world’s knowledge but doesn’t know your specific projects, documents, or customer histories. To make AI agents truly useful, we use Retrieval Augmented Generation (RAG). The core of this architecture is the vector database.

However, operating systems like Milvus, Qdrant, or Weaviate in Kubernetes presents new challenges for DevOps teams. It’s not just about storing data but providing a performant, persistent “long-term memory” for AI agents.

Data Security for AI: Encrypted Datasets in Multi-Tenant Clusters

Fri, 06 Mar 2026 10:37:01 +0000

In the gold rush surrounding Artificial Intelligence, a critical aspect is often overlooked: the security of the underlying data. When companies train or operate AI models in shared infrastructures (multi-tenant clusters), entirely new attack vectors emerge. A compromised model or malicious container must never be able to access the training data or IP assets of other departments or customers.

Particularly in light of the NIS-2 Directive and the EU AI Act, data security will become a legal obligation for medium-sized businesses by 2026, moving from a “nice-to-have” option.

Infrastructure as Code for AI: Cluster Configuration for Heavy Workloads

Fri, 06 Mar 2026 10:32:00 +0000

Those deploying Large Language Models (LLMs) or complex deep learning pipelines in production quickly realize: A standard Kubernetes cluster immediately reaches its limits with these “heavy workloads.” When terabytes of weights need to be loaded into VRAM and billions of checkpoints flow across the network, nuances in infrastructure configuration determine success or a technical disaster.

To achieve real performance gains, simply adding GPUs to the nodes is not enough. We need to break through Kubernetes’ hardware abstraction and optimize the stack down to the kernel level using Infrastructure as Code (IaC).

GPU Slicing & Kubernetes: How to Efficiently Share Expensive AI Resources

Fri, 06 Mar 2026 10:24:36 +0000

In modern IT infrastructure, the GPU has become the new CPU. Whether it’s Large Language Models (LLMs), computer vision, or complex data analysis, the demand for computing power on graphics cards has massively increased in the mid-market. However, while CPUs have been efficiently virtualized and shared for decades, GPUs often present platform engineers with a dilemma: A high-end graphics card (like an NVIDIA H100 or A100) is often oversized for a single microservice, yet too expensive to leave idle.

Managing Docker Stacks on Linux Servers with Polycrate

Fri, 06 Mar 2026 00:00:00 +0000

TL;DR

Docker Compose remains a sensible, pragmatic solution for many Linux server setups, especially if you are managing individual hosts or small groups and do not wish to introduce Kubernetes.
With Polycrate, you can package your Docker Compose stack into a reusable block: block.poly for configuration, docker-compose.yml.j2 as a template, Ansible playbook as an action—all neatly structured and team-friendly. This post uses the same registry convention as Nginx and Let’s Encrypt as a reusable Polycrate block (registry.acme-corp.com/infra/…, version pinned via from: …:0.1.0 in the workspace, publishing with polycrate blocks push …).
Secret values do not belong in docker-compose.yml or in the readable workspace.poly; they live in secrets.poly using the same YAML shape as workspace.poly (merged at runtime). That file is protected by workspace encryption ; templates reference block.config.db_password after the merge.
Rolling updates and (nearly) zero-downtime deployments on Linux servers become reproducible and easy for colleagues to execute with Ansible community.docker.docker_compose, health checks, and Polycrate actions.
ayedo supports you with Polycrate, best practices, and custom Docker automation solutions—from local Docker Compose to complete platform setups.

Docker Compose on Linux Servers: When It Makes Sense

Not every team needs Kubernetes right away. Many system admins today operate:

API Governance in Kubernetes:

Thu, 05 Mar 2026 14:06:14 +0000

Why Stable Interfaces Are Crucial for the Ecosystem

Kubernetes is now much more than a Container orchestrator. A vast ecosystem has developed around the platform, with tools, extensions, platform solutions, and automations all built on the same foundations. These foundations are APIs. They form the interfaces through which clusters are managed, resources are defined, and components communicate with each other.

As this ecosystem grows, a central question becomes increasingly important: How can a system with thousands of contributors continue to evolve in a way that allows for innovation without jeopardizing existing users? This is where a part of the Kubernetes community comes into play, often working in the background but playing a central role in the stability of the entire project: API Governance.

End of Ingress-NGINX: Why a Simple Migration Often Isn't Enough

Thu, 05 Mar 2026 13:33:10 +0000

March has begun – and with it, the final phase for one of the most widely used components in the Kubernetes network stack: Ingress-NGINX is officially being deprecated this month.

For many companies, this moment comes surprisingly close. In countless Kubernetes clusters, Ingress-NGINX has been running stably and reliably in the background for years. This is precisely what makes the situation deceptive. Many setups rely on implicit behaviors and historical defaults, which are not automatically carried over during a migration to the Gateway API.

Weekly Backlog Week 11/2026

Thu, 05 Mar 2026 09:03:02 +0000

🧠 Editorial

Schleswig-Holstein. The real North. is kicking Microsoft out of administration. Nextcloud suddenly becomes a serious workplace tool in the c’t practical test. The Schwarz Group is building a European cloud with hyperscaler ambitions. Meanwhile, Europe is discussing developing its own social platforms.

The exciting part: The discussion is shifting.

For a long time, the sovereignty debate focused mainly on one question: Are there even alternatives to the big platforms?

Nginx and Let's Encrypt as a Reusable Polycrate Block

Thu, 05 Mar 2026 00:00:00 +0000

TL;DR

You build a reusable Polycrate block that automates the deployment of Nginx and Let’s Encrypt (via community.general.certbot) on a Linux server – including a generic nginx.conf as a Jinja2 template.
The block parameterizes domain, contact email, and upstream port through block.config.* and can be used in any workspace with different values – without code duplication or wiki tinkering.
Polycrate containerizes Ansible and the entire toolchain: no local Ansible, no Python chaos, no individual setups – the same block runs identically on every developer workstation.
Through a registry (from: cargo.ayedo.cloud/ayedo/infra/nginx-letsencrypt:1.0.0 in workspace.poly), you share the block with colleagues: before pushing, name in block.poly must be the full OCI reference without a tag; polycrate blocks push uses that name plus version as the tag – sharing instead of screenshots.
ayedo supports teams in building such standardized, shareable automation blocks – from designing the block structure to operating a registry and integrating into existing processes.

The Real Problem: The Forgotten Nginx Config

Many admins know the scenario: An Nginx has been running on web01.acme-corp.com for years, the nginx.conf was “quickly” adjusted back then, Let’s Encrypt was set up somewhere with certbot – and no one remembers exactly how.

Linux Servers on Autopilot: System Management with Polycrate and Ansible

Wed, 04 Mar 2026 00:00:00 +0000

TL;DR

With Polycrate, you create a single inventory.yml in the workspace root to centrally manage all Linux servers—without needing your own Ansible setup on your laptop.
Each workspace should use its own SSH key pair (not your personal ~/.ssh/ key): Polycrate creates it when you run workspace init with --with-ssh-keys , stores it under artifacts/secrets/, and wires Ansible so the private key is used without ansible_ssh_private_key_file in the inventory—unlike plain Ansible.
A basic playbook handles package updates, service checks, and log rotation; a dedicated hardening block takes care of SSH hardening, firewall (ufw), and fail2ban—idempotent and executable as often as needed.
Compared to ansible-playbook -i inventory.yml hardening.yml, with Polycrate a polycrate run linux-baseline hardening suffices—inclusive of container toolchain and central inventory.yml (plain YAML, no Jinja2 in the inventory; see Ansible integration ).
ayedo supports you with Polycrate, Platform Engineering expertise, and workshops on Polycrate and automation (for example Polycrate Essentials ) to set up your Linux server management in a structured and repeatable manner.

Starting Point: Many Linux Servers, Little Time

A typical day as a Linux admin: dozens (or hundreds) of Ubuntu servers, security updates looming, requests from departments, logs filling up—and you actually need a new script for the next special case.

Weekly Backlog Week 10/2026

Tue, 03 Mar 2026 11:49:27 +0000

🧠 Editorial: Cloud is political. Period.

This issue focuses on a topic often wrapped in technical jargon: digital sovereignty.

But this week has clearly shown that it’s not just a whitepaper term.

Microsoft opens a “Sovereignty” studio in Munich – yet remains a US corporation under US jurisdiction.
Two AWS data centers in the UAE are hit by drones – Availability Zones don’t protect against geopolitics.
The German government plans a central citizen app – the crucial question is: on what infrastructure?
Schools in Saxony-Anhalt demonstrate that Linux works in everyday life.
A hosting provider has been running its own servers in Germany for years – without hyperscalers in the background.

This is not a cultural battle of “USA vs. Europe.” It’s about control, legal jurisdictions, dependencies, and physical reality.

Blocks, Actions, and Workspaces: The Modular Principle of Polycrate

Tue, 03 Mar 2026 00:00:00 +0000

TL;DR

Polycrate structures Ansible automation into three building blocks: Blocks, Actions, and Workspaces – eliminating the classic playbook sprawl and making automation discoverable and shareable.
Blocks come with their own configuration, playbooks, templates, and artifacts. Workspace configuration overrides block defaults via deep-merge – ideal for reusable standards plus project-specific customizations.
All blocks run in containers: No local Ansible setup, no Python version turbulence, and a unified toolchain for the entire team. Distribution is via an OCI registry and the PolyHub .
Compared to Ansible Roles, Polycrate Blocks are self-contained, versionable, shareable via registries, and provide a clear execution and configuration framework – including workflows for more complex processes.
ayedo develops Polycrate and provides a practical platform with official block collections in the PolyHub and documentation on Polycrate Blocks that scales from individual admins to large platform teams.

Block, Action, Workspace: The Core Principle

Polycrate builds on Ansible but gives automation a clearer form. Three concepts are central:

Install Polycrate and Build Your First Ansible Block in 15 Minutes

Mon, 02 Mar 2026 00:00:00 +0000

TL;DR

Install Polycrate with a single curl command – no pip, no virtualenv, no local Ansible installation required.
Initialize a workspace, understand its structure, and create your first Ansible block webserver within it.
Build a meaningful Hello-World playbook that installs, starts, and checks the status of nginx on a Linux host.
See how Polycrate always runs Ansible in a container – your team shares a clean, reproducible toolchain instead of Python chaos on every machine.
Learn how ayedo provides a structured, shareable automation platform with Polycrate, scaling from individual admins to enterprise teams while addressing compliance requirements.

Why Start with Polycrate and Ansible?

For many admins and engineers, Ansible has long been the Swiss Army knife for automation: configurations, patches, deployments, Windows management, networking – everything is possible with playbooks.

Know Ansible, Use Polycrate: Why This Duo is Transforming Automation

Sun, 01 Mar 2026 00:00:00 +0000

TL;DR

Ansible is a strong foundation: agentless, idempotent, human-readable YAML, and a vast module ecosystem make it the de facto standard for automation—across Linux, Windows, Cloud, and Edge.
In practice, teams often hit limits with “plain” Ansible: dependency chaos on admin desktops, lack of structure for reuse, hard-to-share playbooks, and open questions about the supply chain of roles and collections.
Polycrate addresses these issues: Ansible runs reproducibly in a container, including a complete toolchain (kubectl, Helm, Python, etc.), with clear guardrails through the block model, sharable automation via registry, and integrated workspace encryption.
This article series is intentionally aimed not only at DevOps and Kubernetes solutions teams but also at Linux and Windows admins, compliance officers, enterprise architects, and IoT specialists—all benefit from the same clean, shareable automation foundation.
ayedo develops Polycrate, supports organizations with Platform Engineering approaches, and will show in the next 25 articles how to go from “knowing Ansible” to “productively using Polycrate”—from single machines to regulated enterprise environments.

Why Ansible is the Right Base—but Not Enough on Its Own

Anyone managing infrastructure today can hardly avoid Ansible. Whether you’re patching Linux servers, integrating Windows servers into a new Active Directory, configuring IoT devices, or managing Kubernetes clusters: Ansible is often the tool of choice—and for good reasons.

The Automated Auditor: Real-Time Reporting for ISO 27001 on Kubernetes

Thu, 26 Feb 2026 08:49:47 +0000

Preparing for an ISO 27001 audit in many companies still resembles a manual Sisyphean task. For weeks, screenshots of configurations are taken, Excel lists are reconciled, and permission matrices are manually validated. In the dynamic world of Kubernetes , where workloads can change by the second, this static approach is not only inefficient but a significant security risk. Realizing that policies are ineffective only at the audit appointment means losing control over governance.

Sovereign Monitoring for Legacy Systems: Integrating SNMP & IPMI into Prometheus

Thu, 26 Feb 2026 08:44:46 +0000

The Cloud-Native transformation is in full swing, yet the reality in German data centers often looks different: alongside cutting-edge Kubernetes clusters, dedicated bare-metal servers, core switches, and uninterruptible power supplies (UPS) perform their duties. These components are critical for operations but often escape the modern observability stack as they do not natively deliver Prometheus metrics over HTTP/OpenMetrics.

By 2026, seamless monitoring of these “Non-Cloud-Native” assets is no longer a luxury but a regulatory requirement under frameworks like NIS-2 and DORA. Noticing hardware failures or network bottlenecks only when an application is down jeopardizes digital sovereignty. The solution lies in bridging protocol worlds: by using specialized exporters, we seamlessly integrate SNMP and IPMI data into the ayedo Managed Stack of Prometheus and Grafana.

K3s as a Strategic Standard for Decentralized Cloud-Native Infrastructures

Thu, 26 Feb 2026 08:39:17 +0000

The digitalization of manufacturing and the networking of decentralized locations present a fundamental challenge for the German SME sector: Full-scale Kubernetes clusters are often too cumbersome for the resource constraints in factory halls or branch offices. However, if applications are managed manually or through proprietary legacy systems, isolated IT islands are created that are neither scalable nor secure.

In the context of the year 2026, characterized by the stringent requirements of NIS-2 and the need for real-time data processing for Agentic AI at the edge, unified orchestration is indispensable. The solution lies in a radical reduction of complexity while fully maintaining Kubernetes API compatibility. K3s has established itself as the decentralized standard for efficiently and securely operating Cloud-Native workloads directly at the data’s point of origin.

Secrets Management: Why Vaultwarden Bridges the Gap Between Dev and Ops

Thu, 26 Feb 2026 08:33:30 +0000

In modern software development, the unsecured handling of credentials—so-called “Hardcoded Secrets” (static secrets) in Git repositories—is one of the most critical security risks. With the tightening of regulatory requirements in 2026, particularly through NIS-2 and DORA, the protection of API keys, database passwords, and SSH certificates is no longer just a best practice but a mandatory compliance requirement. Mid-sized companies face the challenge of ensuring security without hindering the agility of their DevOps teams.

Distributed Tracing 2026: Eliminating Performance Bottlenecks with OpenTelemetry (OTel)

Thu, 26 Feb 2026 08:26:48 +0000

The complexity of modern microservice architectures has reached a point in 2026 where traditional monitoring hits its limits. While metrics tell us that a system is slow, and logs reveal why a single instance throws an error, causality across service boundaries often remains obscure. In an era where regulations like NIS-2 and DORA demand not only security but also resilience and recoverability of IT systems, blind troubleshooting is no longer a viable business risk.

Post-Quantum Readiness: Why SMEs Must Harden Their Ingress Strategy Now

Wed, 25 Feb 2026 10:46:04 +0000

The era of “Harvest Now, Decrypt Later” has begun. While quantum computers capable of breaking commonly used asymmetric encryption methods like RSA or ECC are still in development, encrypted data streams are already being recorded by actors today. For German SMEs under the pressure of NIS-2 and DORA, Post-Quantum Cryptography (PQC) is no longer a futuristic scenario but an immediate requirement for digital sovereignty.

In 2026, the agility of infrastructure is the decisive security factor. Those using hardwired, outdated crypto stacks risk not only the loss of intellectual property but also their compliance capability . The solution lies in a hybrid migration strategy that combines classical methods with quantum-resistant algorithms without sacrificing the performance of the Cloud-Native infrastructure .

Strategic Network Security: ZeroTrust Mesh Networks with Headscale and Netbird as a VPN Replacement

Wed, 25 Feb 2026 10:39:53 +0000

By 2026, the threat landscape for medium-sized businesses has fundamentally worsened. Regulatory requirements such as NIS-2 and DORA no longer demand just superficial security but proof of granular access controls and minimization of the blast radius in security incidents. Traditional client-to-site VPNs, based on the “Castle-and-Moat” principle, are reaching their limits: once authenticated, a compromised VPN access often allows fatal lateral movement opportunities across the entire subnet.

The solution lies in the paradigm of Zero Trust Networking. Instead of trusting the location, each device and service is individually identified and authorized. By using mesh technologies based on WireGuard®—specifically implemented through open-source solutions like Headscale or Netbird—companies eliminate the vulnerabilities of traditional gateway architectures and create a high-performance, sovereign infrastructure without vendor lock-in.

Green Ops: Measurable Sustainability in Data Centers through eBPF and Managed Grafana

Wed, 25 Feb 2026 10:35:43 +0000

In 2026, sustainability in the IT sector is no longer a “nice-to-have” for marketing but a regulatory necessity. With the tightening of CSRD reporting obligations and the full implementation of NIS-2, along with specific energy efficiency requirements for data centers, the mid-sized sector is under pressure. Companies must not only estimate the energy consumption of their digital value chain but also accurately demonstrate it at the workload level.

The challenge: Traditional monitoring solutions usually capture only the total consumption of a host, which is worthless in dynamic Kubernetes clusters with hundreds of microservices. The solution lies in deep system integration via eBPF (Extended Berkeley Packet Filter). In combination with Prometheus and Grafana, we transform abstract CPU cycles into reliable ESG data (Environmental, Social, and Governance) without impacting application performance through sidecars.

Data Sovereignty 2026: Sovereign Data Exchange under the EU Data Act

Wed, 25 Feb 2026 10:31:02 +0000

In 2026, regulatory requirements for the European economy have reached a new level of quality. With the fully effective EU Data Act and the tightened requirements from NIS-2 and DORA, companies face the challenge of not only storing data but making it controllably shareable in federated data spaces. The focus has shifted from mere storage to granular access control and interoperability.

Many organizations face the dilemma: How can valuable data assets be shared with partners or authorities without falling into the dependency of proprietary cloud ecosystems (vendor lock-in) or losing physical sovereignty over the information? The solution lies in an architecture based on sovereign interfaces and dedicated API gateways, decoupled from the major US hyperscalers.

Self-Healing Infrastructure: When ArgoCD and AI Agents Close Autonomous Correction Loops

Wed, 25 Feb 2026 10:26:38 +0000

The era of purely manual intervention in infrastructure incidents is coming to an end. While GitOps with ArgoCD defines the state-of-the-art for declarative deployment, the intelligent bridge between observability data and automated remediation has been missing. In 2026, driven by the regulatory requirements of NIS-2 and DORA for the resilience of critical systems, Infrastructure-as-Code (IaC) transforms into Self-Healing Infrastructure.

The pain point is well-known: despite highly available Kubernetes clusters, misconfigurations or unforeseen load spikes often lead to nighttime pager alerts. The solution lies in combining ArgoCD as the “Source of Truth” with dedicated AI agents that not only report anomalies but autonomously correct them via GitOps workflow.

Identity-First Security: Why Keycloak is the Heart of Your NIS-2 Strategy

Wed, 25 Feb 2026 10:20:41 +0000

In 2026, the threat landscape for European SMEs is more precarious than ever. Identity theft has become the number one attack vector, as traditional perimeter security models have failed in decentralized Cloud-Native structures . At the same time, regulators are increasing the pressure: The NIS-2 directive and DORA demand not only abstract security concepts from companies but also proof of strict access controls and the integrity of digital identities.

The solution lies in an Identity-First approach. It’s no longer about protecting the network but verifying every single identity and every API call. Within a sovereign IT infrastructure, Keycloak plays a central role. As an open-source standard, it allows companies to maintain full control over their user data while implementing modern security standards that go far beyond simple passwords.

WebAssembly (Wasm) in the Cloud: The Next Stage After Containers?

Wed, 25 Feb 2026 10:05:33 +0000

The cloud-native landscape has consolidated. While Kubernetes stands as the de facto standard for orchestration, the boundaries of runtime efficiency are shifting. In 2026, CTOs and Infrastructure Architects face the challenge of operating increasingly complex microservices architectures while meeting rising demands for energy efficiency (ESG compliance) and performance.

Docker containers were the revolution of the 2010s, but they carry legacy baggage: orchestrating a complete root filesystem and an operating system userland just for a small Go or Rust binary is often inefficient in the context of edge computing and serverless scenarios. This is where WebAssembly (Wasm) comes in. Originally developed for the browser, Wasm is on its way to transforming the backend—not as a replacement for containers , but as their high-performance evolution.

From Cost Center to Value Driver

Wed, 25 Feb 2026 09:58:18 +0000

From Cost Center to Value Driver

By 2026, the mere promise of cloud scalability has given way to a harsh reality: those who do not economically manage their Cloud-Native infrastructure lose control over their margins. In times of NIS-2 and DORA, resilience and compliance are mandatory, yet economic efficiency—the “Unit Economics” per workload—has become the decisive competitive advantage. Simply monitoring cloud bills at the end of the month is a relic of the past.

Kubernetes as an AI Backbone: Efficient GPU Orchestration for Local LLMs

Wed, 25 Feb 2026 09:52:14 +0000

The hype around proprietary SaaS AI models gives way to a sober cost-benefit analysis by 2026. While companies initially paid token fees to hyperscalers willingly, rising OpEx, strict latency requirements, and tightening regulatory frameworks like the EU AI Act and NIS-2 force a rethink. Sovereignty over one’s data and control over inference costs lead to a massive shift of AI workloads back to their own Cloud-Native infrastructure.

Kubernetes has established itself as the operating system for AI workloads. It not only offers the necessary scalability but also, through modern abstraction layers, the ability to precisely control expensive hardware resources like NVIDIA H100 or L40S GPUs. Those who want to run local Large Language Models (LLMs) cannot avoid deep integration of GPU resources into the Kubernetes scheduler.

From Reactive Patching to Active Resilience: The Cyber Resilience Act (CRA) 2026

Wed, 25 Feb 2026 09:46:50 +0000

In September 2026, the transition period for the Cyber Resilience Act (CRA) ends. What began as a regulatory framework has evolved into the toughest test for European IT infrastructures. Companies are now obligated to secure the entire supply chain of their digital products—from the first line of code to productive deployment—without gaps. Those who disregard the required security standards and reporting obligations risk not only draconian fines but also losing market access within the EU in case of non-compliance.

Is Sovereignty Becoming Unaffordable Now?

Wed, 25 Feb 2026 09:39:16 +0000

Is Sovereignty Becoming Unaffordable Now?

Hetzner will increase prices for its entire portfolio starting April 1, 2026. In the cloud sector, many rates will rise by 30 to 35 percent.

The CX11 in Germany: from €3.92 to €5.34 per month.
The CAX11: also from €3.92 to €5.34.
The CCX63: from €342.71 to €445.64.
Load Balancer 11: from €6.41 to €8.91.
Volumes: from €0.0524 to €0.0681 per hour.
Snapshots: from €0.0131 to €0.0170 per hour.

Infrastructure-as-Code with Polycrate: Never Configure SOPS Again

Mon, 23 Feb 2026 12:00:00 +0000

Anyone seriously running Infrastructure-as-Code knows the problem: the workspace in the Git repository contains kubeconfigs, SSH keys, passwords, and API tokens – files that must never end up unencrypted in a remote repository. The cloud-native ecosystem’s usual answer: another tool.

SOPS, git-crypt, sealed-secrets, Vault Agent – each tool solves the problem while simultaneously adding new ones. More configuration files, more key backends, more mental overhead, more things that can break. Polycrate does it differently.

Observability Without Blind Spots: Full-Stack Insight with Grafana, Prometheus & Loki

Mon, 23 Feb 2026 11:04:05 +0000

Anyone managing modern Cloud-Native infrastructures knows the problem: data is everywhere, but insights are rare. A system is only considered ‘observable’ when you can understand its internal state solely by analyzing its external output data. To achieve this, we rely on the proven trio of the Cloud-Native standard.

1. Prometheus: The Time-Series Engine for Metrics

Prometheus is the industry standard for collecting numerical time-series data. Unlike old push systems, Prometheus uses a pull model. It scrapes metrics from endpoints provided in the /metrics format.

Polycrate CLI: Helpful Tools for Developers and Platform Engineers

Mon, 23 Feb 2026 10:00:00 +0000

Anyone working with Polycrate daily inevitably runs into recurring tasks: checking TLS certificates, verifying DNS records, calculating subnets, debugging tokens. Until now, that meant installing tool after tool and switching context constantly. With polycrate tools, that’s a thing of the past.

polycrate tools is an integrated toolkit with 11 specialized helpers – no separate install, no context switching, no external dependency management. Just launch, select a tool, or call it directly as a subcommand.

ayedo x [STREAMLAB](https://streamlab.net)

Fri, 20 Feb 2026 15:46:25 +0000

Digital Sovereignty in Live Streaming: How ayedo Strategically Strengthens STREAMLAB ’s Cloud Operations

Live streaming has long been critical business infrastructure. Broadcasting executive speeches, town halls, or hybrid events is far more than just a communication tool: it involves business-critical processes whose infrastructure must meet the highest standards of availability, security, and compliance . This is precisely where the collaboration between STREAMLAB and ayedo comes into play.

STREAMLAB has a clear mission:
“Our customers always retain control over their communication data—from the camera to the viewer.”

Three Times NO to Microsoft's 'Recall'

Fri, 20 Feb 2026 11:19:58 +0000

With ‘Recall’, Microsoft integrates a feature into Windows 11 that takes screenshots of all open applications at short intervals, analyzes their content using AI, and stores them permanently for searchability. Documents, emails, chats, health, or bank data can thus become part of a comprehensive usage log. What is marketed as a productivity gain is technically a new level of system surveillance: the operating system itself becomes a permanent logging instance.

Video Processing

Thu, 19 Feb 2026 11:05:47 +0000

From Bare-Metal Tinkering to Elastic Video Infrastructure: How ayedo Made Streambase Scalable for Large Live Events

Video is the crown jewel of infrastructure.

While many SaaS applications are relatively forgiving, video is ruthless: A small configuration error immediately manifests as stuttering. A CPU spike causes audio dropouts. An unpredictable surge in demand doesn’t result in “a bit slower,” but in a stream cut-off—live, in front of an audience.

Streambase Media operates a video platform for businesses: Live streaming of corporate events, hybrid meetings, and an on-demand library in one solution—as a European alternative to Zoom Events and Vimeo Enterprise. Around 120 corporate clients use the platform, from town halls with 50 participants to product launches with several thousand viewers.

SaaS Apps

Thu, 19 Feb 2026 11:05:01 +0000

From VM Operation to Platform: How ayedo’s Planwerk Led to Scalable, Auditable SaaS Operations

Many SaaS platforms grow as they are built: step by step, pragmatically, “works for now.” This is appropriate in the early phase. But at some point, it tips over. Pragmatic infrastructure becomes a risk—not because it’s bad, but because the product has outgrown it.

Planwerk develops a platform for digital construction planning and project management. Architecture firms, developers, and public clients use it to plan collaboratively, document decisions, and manage construction projects. Around 8,000 active users across approximately 200 clients—from small offices to municipal building authorities with hundreds of users. Additionally, there were three enterprise clients running the platform in a dedicated on-premise instance for regulatory reasons.

Machine Learning

Thu, 19 Feb 2026 10:46:06 +0000

From GPU Bottlenecks to Industrial-Scale MLOps: How ayedo Led Sensoriq to a Kubernetes-Based ML Platform

Predictive Maintenance sounds like “train a model and you’re done.” In practice, many projects fail not because of the model, but because of what comes after: data streams, inference SLAs, reproducible experiments, and an infrastructure that scales without each new customer project triggering a new operational project.

Sensoriq develops AI-based solutions for the manufacturing industry. The software analyzes sensor data in real-time and predicts failures before they occur. The product consists of edge components at the machine, a streaming pipeline, and a cloud platform for training, inference, and visualization.

eCommerce

Thu, 19 Feb 2026 10:43:53 +0000

From Single-Server Shops to a Highly Available E-Commerce Platform: How ayedo Restructured Nordlicht Commerce

E-commerce agencies often grow faster than their infrastructure.

Nordlicht Commerce specializes in Shopware projects for medium-sized retail companies and D2C brands. Twelve customer shops in operation, six proprietary plugins in the Shopware Store, a growing project business – strong in expertise, technically committed.

What worked for a long time became a risk with an increasing number of customers and higher SLA requirements.

Preview Environments

Thu, 19 Feb 2026 10:42:13 +0000

From Staging Bottleneck to Continuous Delivery: How ayedo Built Automated Preview Environments for Vantara

Continuous Delivery is not a tool problem.
It’s a feedback problem.

Vantara Digital is developing a cloud-based platform for digital contract management. Three feature teams work in parallel on frontend, backend/API, and integrations. The management’s goal: weekly releases – with a long-term perspective of Continuous Delivery.

On paper, the development process was well-organized: feature branches, pull requests, code reviews, merge into the main branch, deployment to a shared staging environment. A classic Git-Flow model.

Demo Environments

Thu, 19 Feb 2026 10:33:48 +0000

From 3 Business Days to 90 Seconds: How ayedo Fully Automated the Demo Process of an ERP Provider

Product demos are a necessary sales component for many SaaS companies. For Signalwerk, they were the central growth driver—and simultaneously the biggest operational bottleneck.

Signalwerk develops a modular ERP solution for medium-sized manufacturing companies. Production planning, inventory management, quality management—complex processes that cannot be explained on a PowerPoint slide. The product needs to be experienced.

Business Tools

Thu, 19 Feb 2026 10:33:01 +0000

Sovereign Business IT Instead of US SaaS Dependency: How ayedo Strategically Uncoupled a Technical Service Provider

Standard SaaS is convenient. Until it becomes a strategic risk.

Many medium-sized companies rely on Microsoft 365, Zendesk, or DocuSign—not out of conviction for US cloud infrastructure, but because it is readily available and works without an in-house IT team. The systems run, updates are automatic, and the operational effort seems minimal.

However, once customers from regulated industries come into play, the criteria shift. It’s no longer about features, but about control. About legal jurisdiction. About traceability. And about who can enforce access to business-critical data in an emergency.

Data Engineering

Thu, 19 Feb 2026 10:22:28 +0000

From Ticket Infrastructure to On-Demand AI: How ayedo Built a Kubernetes -Based Data Engineering Platform for an Industrial Corporation

Data-driven innovation rarely fails due to a lack of ideas. It fails due to infrastructure.

Many industrial companies invest in Data Science, AI models, and Advanced Analytics—only to find that their platform doesn’t scale. GPU resources are scarce, development environments are rigid, and ETL processes are hard to scale. Every new use case becomes an infrastructure project.

Monitoring

Thu, 19 Feb 2026 10:20:28 +0000

From Log Debugging to True Observability: How ayedo Stabilized a SaaS Platform with APM on Kubernetes

Many SaaS companies invest early in clean architecture: containerized workloads, Kubernetes , Infrastructure as Code, GitOps. Technically, everything seems modern. Yet, a crucial component is often missing: transparency over the actual runtime behavior of the application.

In this post, we demonstrate through an anonymized project how ayedo built a scalable Application Performance Monitoring (APM) for a SaaS provider with several million active users, based on VictoriaMetrics, VictoriaLogs, Grafana, and OpenTelemetry—fully integrated into the existing Kubernetes infrastructure.

Internal Developer Platform

Thu, 19 Feb 2026 10:17:05 +0000

From GitHub Deployments to Continuous Confidence: How ayedo Built an Internal Developer Platform for Enterprise Delivery

Many teams today deliver containerized software, use GitHub, automate builds—and yet don’t feel “platform-ready.” This is rarely due to the code. It’s because CI/CD is understood as pipeline logic, not as a system. As long as deployments directly impact server states from build pipelines, delivery remains fragile: hard to reproduce, hard to audit, hard to operate.

Edge Computing

Thu, 19 Feb 2026 10:06:26 +0000

Kubernetes at the Edge with GitOps: How ayedo transformed a distributed IoT fleet from SSH deployments to controlled rollouts

Edge Computing is not just hype for IoT, Industry 4.0, and Smart Grid scenarios; it’s operational reality. Data is generated not in the data center, but out in the field: at measurement points, in transformer stations, at gateways in municipal networks, or in industrial plants. To reliably bring this data into a central data hub, software must be operated at hundreds of locations—often with unstable connectivity, limited maintenance windows, and high demands on availability and integrity.

Multi-Tenant App Hosting

Thu, 19 Feb 2026 10:02:43 +0000

Multi-Tenant Kubernetes for eCommerce: How ayedo Guided a Software House Without a DevOps Team from VM Scripting to a Developer Platform

In many eCommerce teams, the bottleneck is not feature development but operations. Not because developers write poor software, but because the operational model doesn’t scale. What starts as “a few servers and a few scripts” becomes a business risk at scale: each customer instance evolves differently, deployments are no longer reproducible, maintenance windows accumulate, and developers’ time is spent firefighting rather than adding product value.

Compliant Software Hosting

Thu, 19 Feb 2026 09:55:25 +0000

From Hyperscaler Dependency to DORA-Proven Sovereignty: How ayedo Migrated a Fintech Platform to Be Auditable

In recent years, many fintechs have rapidly grown on US hyperscalers. Managed Kubernetes, Managed Databases, Identity services, Monitoring – these accelerate product development significantly. Technically, this almost always works. Regulatively, it increasingly becomes a breaking point.

Since the implementation of DORA in January 2025, this breaking point is no longer hypothetical for many financial service providers and their critical IT service providers, but audit-relevant. Concentration risks, exit strategies, supply chain security, auditability: Those who cannot provide reliable answers here not only lose trust but also business foundations.

Multi-Region Infrastructure

Thu, 19 Feb 2026 09:54:50 +0000

Multi-Region Kubernetes for Critical Infrastructure: How ayedo Transformed a Single-Site Platform into an Active/Active Anycast System

Operating critical infrastructure requires more than just “good availability”—it demands demonstrable resilience against failures. This need extends beyond a single data center to encompass multiple locations. Many platforms, although technically sound, fail in this regard because they have historically evolved within a single region: redundant in the rack, redundant in the cluster, redundant in the database—yet still a single point of failure at the site level.

Global Endpoint Monitoring

Thu, 19 Feb 2026 09:45:40 +0000

Taking Endpoint Monitoring Seriously Again: How ayedo Led a Hosting Company from False Alarms to Multi-Region Security

Monitoring is not just a tool for managed hosting—it’s part of the product. Customers are not just buying infrastructure; they are buying the assurance that availability, security, and responsiveness are always maintained. This is where many monitoring setups fail as they grow: what is initially “sufficient” becomes an operational bottleneck and, at worst, the cause of escalations.

DBaaS - Database as a Service

Thu, 19 Feb 2026 09:37:57 +0000

DBaaS for PostgreSQL: How ayedo Led a European Provider to a Scalable Platform in Weeks

Database as a Service sounds simple on paper: customers click to get a PostgreSQL instance, receive backups, monitoring, and high availability – and that’s it. In reality, DBaaS is one of the most challenging platform disciplines. Not because of PostgreSQL, but because everything around it must function reliably: isolation, storage, backup strategies, observability, automation, auditability – and all this for hundreds to thousands of instances.

In-House Operations Platform

Wed, 18 Feb 2026 13:48:54 +0000

How ayedo Guided a System Integrator from Evolved Operations to an Auditable Operations Platform

Operating your own data center was long considered a competitive advantage—especially for system integrators who not only develop but also manage customer applications. Mastering operations allows for guaranteed availability, controlled updates, data sovereignty, and confident responses to compliance questions .

In practice, however, this advantage often flips exactly when it becomes most crucial: when the portfolio grows, demands increase, and customers expect not just “it works” but measurable SLAs, traceable operational processes, and auditable evidence.

Weekly Backlog Week 09/2026

Wed, 18 Feb 2026 12:51:00 +0000

🧠 Editorial: The Week of Sovereignty Simulations

This week had it all: operating systems wanting to take screenshots of everything. Management platforms without clear architecture. Municipalities with their own sovereignty scores. Corporations swapping US cloud for US cloud—and calling it “independence.”

And in between, a European telco alliance quietly building exactly what others have been discussing in panels for years.

Digital sovereignty is a question of power. And it is decided not in PowerPoints, but in architecture diagrams, procurement policies, and pricing models.

Make Cloud Yours Again

Tue, 17 Feb 2026 11:38:23 +0000

Why Digital Sovereignty is Less Radical Than Many Believe

Geopolitical tensions, extraterritorial laws, sanction regimes – all these have long been part of the reality in which IT strategies are developed today. Companies and public institutions face a new question: Is functional cloud infrastructure enough, or is strategic control also necessary?

In many discussions with IT leaders, a recurring pattern emerges: The awareness of dependencies is there. The arguments for more sovereignty are understandable.

Kubernetes as the Foundation of Digital Sovereignty

Tue, 17 Feb 2026 10:14:17 +0000

Why the Open-Source Technology is More Than Just Container Orchestration

When digital sovereignty is discussed today, one name almost always comes up: Kubernetes. And for good reason. The open-source technology has become the de facto standard for operating modern applications in recent years—from SaaS startups to government data centers and critical infrastructures.

But what makes Kubernetes technologically so relevant? And why does it play a key role in strategic IT architectures?

Toxic Tech Dependency:

Mon, 16 Feb 2026 12:04:31 +0000

Why Germany’s Digital Sovereignty Has Become a Security Issue

Digital sovereignty is no longer just an industrial policy buzzword. It is a matter of state resilience. Relying on technologies from a few US corporations for central administrative processes, police work, military systems, and communication infrastructures creates a strategic dependency that becomes a risk under changing geopolitical conditions.

This is the situation.

US clouds dominate the European market. Microsoft, Amazon, and Google structure the digital basic services of authorities and companies. Analysis platforms like Palantir are operational reality in several federal states. Meanwhile, the political tone from Washington is intensifying. The Trump administration openly attacks European regulation, targets the Digital Services Act, and asserts influence over the EU. Tech CEOs demonstratively seek proximity to power.

Trump Cards Against Trump:

Mon, 16 Feb 2026 10:27:33 +0000

Europe’s Economic Power

The trade conflict with the USA is reflexively narrated in Europe as a power asymmetry. Washington imposes tariffs, threatens sanctions, or uses its technological dominance as leverage – and Brussels reacts. The image: a dependent continent, caught between security policy ties and economic vulnerability.

A recent research paper by the think tank “Dezernat Zukunft” questions this narrative. The analysis comes to a clear conclusion: The European Union has significantly more economic leverage over the USA than is commonly assumed. The problem is not a lack of power. It is a lack of strategic use.

Why Classical Public-Key Cryptography is Structurally Phasing Out

Mon, 16 Feb 2026 10:09:54 +0000

The BSI draws a clear line: From the end of 2031, the sole use of classical key agreement methods like RSA and ECC will no longer be recommended. For applications with very high protection needs, the deadline is already by the end of 2030. Digital signatures should be implemented in a hybrid manner by 2036 at the latest. TR-02102 thus effectively becomes the migration roadmap for Post-Quantum Cryptography (PQC).

Microsoft, Monocultures, and Power:

Mon, 16 Feb 2026 10:01:50 +0000

Why Digital Sovereignty Without Competition Remains an Illusion

The debate on digital sovereignty in Europe is often oversimplified. It usually centers around whether European states and companies should distance themselves more from American technology providers. IT security lawyer Dennis-Kenji Kipker warns in an interview with the Börsen-Zeitung against blanket demands to ban big tech companies from the USA. His argument focuses on a nuanced perspective: Digital sovereignty is not achieved through origin bans, but through effective competition, interoperability, and clear regulatory frameworks.

Wero

Mon, 16 Feb 2026 09:57:04 +0000

Europe is Working on Its Own Digital Payment Infrastructure

The European payment landscape has long been dominated by international providers. A significant portion of card and mobile payments within the European Union is processed through networks like Visa, Mastercard, Paypal, or Alipay. According to the European Central Bank (ECB), 56 percent of cashless payments in EU member states are card payments. Visa and Mastercard process transactions estimated at around 24 trillion USD annually.

Digital Sovereignty as a Question of Power

Mon, 16 Feb 2026 09:36:52 +0000

Europe’s Structural Dependence on Big Tech

The debate on digital sovereignty is no longer a technological detail. It is a question of political agency. Since the visible rapprochement of leading US tech entrepreneurs with the Trump administration, it has become clear how closely economic platform power and political influence are intertwined.

Dutch digital expert Marietje Schaake clearly categorizes this development: Technology is not just an economic factor but a tool of power. Europe has long underestimated this dimension.

Weekly Backlog Week 8/2026

Mon, 16 Feb 2026 09:20:33 +0000

🧠 Editorial

If you’ve noticed: The Weekly Backlog looks a bit different. Now even more personal, colorful, louder, and with much more recognition value. Content-wise, everything remains the same: Cloud, power, security, open source, politics. Just served fresher.

And that’s necessary.

Because this week had a guiding theme that runs through almost all the reports: Digital infrastructure is power. Not metaphorically. Not academically. But very concretely – economically, security-politically, geopolitically.

Human-Machine Trust: How We Make AI Decisions in IT Understandable

Fri, 13 Feb 2026 08:48:20 +0000

In a traditional IT infrastructure, there was a clear causal chain: an administrator changed a line of code, and the system responded. In the world of Agentic AI, the AI makes autonomous decisions (e.g., terminating instances or rerouting traffic) based on billions of parameters. Without a strategy for Explainability, the infrastructure becomes unpredictable.

Human-Machine Trust means building systems that not only act but can also justify their actions to humans at any time.

Data Mesh vs. Data Silo: The Federated Infrastructure for the Modern Enterprise

Fri, 13 Feb 2026 08:41:22 +0000

The classic “Data Lake” model has failed. Companies have invested millions in infrastructure to collect data in one place, only to find that this data “rots” there due to lack of context. The Data Mesh breaks with this paradigm: instead of pouring data into a central lake, it remains where it is generated—in the responsibility of the respective domain (e.g., logistics, sales, production).

Technically, the infrastructure is shifting from a monolithic storage architecture to a decentralized microservice architecture for data.

Post-Quantum Cryptography: Securing Infrastructure Against Tomorrow's Threats

Fri, 13 Feb 2026 08:36:14 +0000

Today’s internet security relies almost entirely on the difficulty of factoring large numbers into prime factors (RSA) or computing discrete logarithms on elliptic curves (ECC). A sufficiently powerful quantum computer uses the Shor algorithm to solve these problems trivially.

The problem for companies today is: “Harvest Now, Decrypt Later”. Attackers are storing encrypted data streams today to decrypt them in 5 to 10 years using quantum computers. Anyone transmitting sensitive data (patient records, state secrets, IP) today must switch to quantum-safe methods now.

500 Million Euros for Microsoft Licenses

Thu, 12 Feb 2026 11:27:14 +0000

And what this figure means for Europe’s digital capability.

The federal administration spent 481.4 million euros on Microsoft licenses in 2025. In 2023, it was 274.1 million euros, and in 2024, it was already 347.7 million. Over two years, spending has increased by more than 75 percent.

This dynamic is more than a budgetary footnote. It is an indicator of structural dependencies—and a digital procurement practice that has long ignored strategic questions.

Agentic AI & Infrastructure: When AI Manages Resources Itself

Thu, 12 Feb 2026 10:55:44 +0000

Until recently, infrastructure automation was reactive: when CPU usage exceeded 80%, Kubernetes would start a new pod (autoscaling). This is efficient but dumb. It does not recognize contexts and cannot solve complex problems.

In 2026, AI agents take the helm. An agent “understands” the goal (e.g., “Ensure availability at minimal cost”) and autonomously executes a chain of actions: it analyzes traffic patterns, detects an impending DDoS attack, distinguishes it from a real user surge, adjusts firewall rules, and simultaneously books cost-effective spot instances in the Cloud .

Compliance as Code: Why Your Next Audit Will Be a Push of a Button

Thu, 12 Feb 2026 10:49:48 +0000

Until now, compliance has been the natural enemy of agility in many companies. While software development scales in milliseconds thanks to Cloud-Native and DevOps , compliance checks have taken weeks: manual controls, random configuration screenshots, and thick folders full of documentation that were already outdated before the ink was dry.

In 2026, this manual system finally collapses under the weight of new regulatory requirements like NIS-2, DORA, or the EU AI Act. Those still relying on Excel lists today risk not only fines but also losing the ability to act quickly in the market. The solution is a radical shift to Compliance as Code (CaC).

Software Supply Chain Security: The Immune System of Your CI/CD Pipeline

Thu, 12 Feb 2026 10:30:16 +0000

In the past, securing the front door (the firewall) was enough. But today, threats come “delivered to your door”—hidden in the thousands of dependencies we load into our systems daily via npm, pip, or docker pull. A single compromised component in an open-source library can cripple your entire infrastructure from within.

Software Supply Chain Security (SSCS) means continuously monitoring and verifying the path of code from the developer’s first keystroke to the running Container in the cluster.

FinOps 2.0: Cloud Cost Control in the Era of Expensive AI Workloads

Thu, 12 Feb 2026 10:23:15 +0000

The hype around Artificial Intelligence has ushered in a new era of IT spending. Those who train or operate LLMs (Large Language Models) today quickly realize: The costs for Graphics Processing Units (GPUs) follow entirely different rules than traditional CPU instances. A single H100 instance in the cloud can cost as much per month as a small car.

FinOps 2.0 is the evolution of cloud cost management. It’s no longer just about shutting down unused instances, but about managing the company’s most expensive resources – AI computing power – with surgical precision.

Cyber Resilience Through Deception: Why Your Cluster Needs Honeypots

Thu, 12 Feb 2026 10:15:33 +0000

In IT security, the “fortress” principle long prevailed: high walls, deep moats (firewalls). But the reality in 2026 shows: Once an attacker is inside the network (e.g., through stolen credentials), they often move horizontally through the infrastructure unnoticed for weeks. This is where Deception Technology comes in. Instead of just blocking, we turn the infrastructure into a digital minefield of deceptions.

The goal: To make the attacker reveal themselves by interacting with resources that shouldn’t actually exist.

Ingress-NGINX is Phasing Out: How to Migrate Smoothly by March 2026

Wed, 11 Feb 2026 11:26:23 +0000

The Ingress-NGINX Controller maintained by the Kubernetes community (repository kubernetes/ingress-nginx) will officially reach its end of life in March 2026. After this date, there will be no more releases, bug fixes, or security patches. Existing installations won’t “break” immediately, but they will continue uncontrolled: new CVEs, new Kubernetes versions, new incompatibilities – without upstream fixes.

Important: This does not affect NGINX as a web server. It concerns the Kubernetes controller from the community (ingress-nginx), not the NGINX project.

European Cloud Platforms vs. Hyperscalers

Wed, 11 Feb 2026 10:28:11 +0000

European Cloud Platforms vs. Hyperscalers

Sovereignty, Scalability, Security, and Strategic Reality in the Corporate Context

Few IT topics are currently as emotionally debated as the question of the “right” cloud: European cloud providers or global hyperscalers like AWS, Microsoft Azure, and Google Cloud?

The debate revolves around digital sovereignty, data protection, geopolitical dependencies, and innovation capability. However, there is often a gap between political rhetoric and technical reality.

For companies—especially in the SME and enterprise segments—it’s not about symbolism. It’s about:

Edge Computing in the Enterprise Context: Opportunities and Limitations

Wed, 11 Feb 2026 09:59:21 +0000

Edge Computing in the Enterprise Context: Opportunities and Limitations

Architectural Models, Security Implications, and Operational Reality

Edge computing is often touted as a logical evolution of the cloud. Processing power closer to the data source, reduced latencies, more efficient processing of large data volumes – that’s the theory.

In practice, however, it becomes clear: Edge is not a replacement for central cloud architectures but a complement with clearly defined use cases. Implementing edge computing in the enterprise context requires rethinking architecture, security, operations, and governance.

Multi-Cloud Strategies for SMEs and Enterprises

Wed, 11 Feb 2026 09:38:48 +0000

Multi-Cloud Strategies for SMEs and Enterprises

Architectural Principles, Governance, Security, and Operational Reality

Multi-Cloud is no longer just a trend. It has become an operational reality—often intentional, sometimes evolved, rarely fully thought through.

While startups build their workloads relatively homogeneously on one platform, the situation in SMEs and enterprises is significantly more complex: Microsoft 365 here, AWS workloads there, SAP in a hyperscaler environment, Kubernetes clusters on-premises, backup in a third cloud, plus specialized solutions for AI, data analysis, or IoT.

Pharma Instead of Stagnation: New Year Kickoff by IHK and Economic Development

Wed, 11 Feb 2026 08:35:25 +0000

The Saarlouis Economic Development and the IHK Saarland invited to the economic policy kickoff of the year at the RAG representation in Ensdorf. The location was deliberately chosen—and it fit.

Outside: old mining walls. Inside: a modern, glass-walled space.

A building-within-a-building concept that not only describes transformation but makes it visible. The architects have made a strong statement here. The contrast between industrial history and clear, modern architecture was impressive. Along with attentive service, excellent catering, and an organization that functioned smoothly from reception to closing remarks, this is how a New Year kickoff should look.

Weekly Backlog Week 7/2026

Tue, 10 Feb 2026 11:32:56 +0000

Editorial:

This week has shown one thing above all: Digital sovereignty is not a strategy paper, but everyday work.

Politically, there is much talk of unity—in Saarland, in the federal government, in Europe. Practically, people often stick to what is “proven.” At the same time, examples like Bavaria with Visavid or the Opendesk pilots show: Technically, the transition is already possible. It is rarely a lack of software, almost always a lack of consistency.

GDPR-Compliant Website Analytics with nginx, VictoriaLogs and Grafana

Mon, 09 Feb 2026 18:00:00 +0000

TL;DR

Google Analytics, Matomo Cloud and other SaaS tracking tools are problematic from a GDPR perspective: data flows to third parties, cookie banners annoy visitors, and the legal grey area persists.
nginx access logs already contain all relevant data for website analytics – page views, visitor IPs, referrers, user agents, response times.
With structured JSON logging, VictoriaLogs as a log backend and Grafana as a dashboard, you get full website statistics without a single tracking pixel.
All data stays on your own infrastructure. No cookie banner needed. No third-party dependency.
VictoriaLogs , Grafana and Kubernetes are available as managed services from ayedo – including Bring-your-own-App for your web applications.

The Problem with Traditional Analytics Tools

Most website operators reach for Google Analytics or similar SaaS solutions. This creates three fundamental problems:

The Brain Model: Why the Von Neumann Architecture Will Soon Be Obsolete at the Edge

Tue, 03 Feb 2026 11:50:07 +0000

For decades, almost all computers have followed the Von Neumann architecture: a strict separation of processor (CPU) and memory. Data must constantly be shuttled back and forth between these two units. In the era of cloud computing and desktop PCs, this was efficient enough. However, for the edge intelligence of tomorrow, this model is a bottleneck—both in terms of speed and massive energy consumption.

The human brain, on the other hand, works completely differently: memory and processing are one. It is “neuromorphic.” This is precisely the approach we are now copying for the next generation of IoT infrastructure.

Infrastructure as an Asset: How IT Architecture Enhances Company Value

Tue, 03 Feb 2026 11:41:22 +0000

In traditional business economics, IT infrastructure is often seen as a necessary evil—a cost center to be minimized. However, in the age of digital disruption, this mindset is dangerous. A modern, scalable infrastructure is not a cost factor but a strategic asset.

Companies with an agile Cloud-Native architecture are significantly more valuable in the market than competitors with outdated legacy systems. The reason is simple: the architecture determines time-to-market, scalability, and risk profiles.

Edge-to-Core: Why Your IT Intelligence is Moving to the Edge

Tue, 03 Feb 2026 11:34:03 +0000

In the past decade, the direction was clear: all data and processes were moving to the central cloud. However, we are reaching physical and economic limits. When an autonomous system in a factory reacts to an obstacle or AI-driven quality control on the assembly line makes millimeter decisions, the path to a remote data center is too far. Latency becomes a safety risk, and the costs of data transport explode.

Shadow IT in Town Halls: When Employees Turn to Dropbox & Co. Out of Desperation

Tue, 03 Feb 2026 11:14:36 +0000

A silent act of rebellion occurs daily in German offices. When the official process for data exchange with an architectural firm via the “secure mailbox” takes three days and requires five manual approvals, the clerk instead sends the plan via their private WeTransfer account. When coordination in the crisis team is too slow over official phone calls, a WhatsApp group is created.

This Shadow IT is the fever of a sick IT system. It arises wherever the official infrastructure hinders rather than supports employees. The problem: The moment data leaves the “safe harbor” of government IT, the state loses sovereignty over its citizens’ information.

Digital Burnout in Public Offices: How Poor IT Exacerbates the Talent Shortage

Tue, 03 Feb 2026 10:56:20 +0000

Public administration has a massive image problem among IT talents. Young Cloud Architects and DevOps Engineers often associate the public sector with a “legacy hell,” fax machines, and rigid hierarchies. In a market where experts can choose their employer, the public sector wins not with the highest salary, but with two factors: Impact (meaningfulness) and the tech stack.

Continuing with outdated infrastructure leads to a vicious cycle: the burden on existing teams increases (digital burnout), projects are delayed, and the best minds migrate to the private sector.

Public Money, Public Code: Why Taxpayer-Funded Software Should Belong to Everyone

Tue, 03 Feb 2026 10:43:01 +0000

Every year, billions of taxpayer dollars are funneled into the digitalization of public administration. Yet, this money often ends up in proprietary solutions: software with secret source code, maintained by a single provider, and incurring new licensing fees for every minor adjustment. When the public sector funds software development, it raises the moral and economic question: Why isn’t the outcome accessible to everyone?

The initiative “Public Money, Public Code” demands exactly that: publicly funded software must be made available as Open Source. This is not an ideological luxury but a technical necessity for a sovereign state.

The Operating System of the City: IoT Architectures for the Smart City

Tue, 03 Feb 2026 09:51:00 +0000

A Smart City is a vast, distributed data ecosystem. Sensors measure air quality, soil moisture in parks, parking occupancy, or traffic flows. The challenge: This data is generated at thousands of endpoints, using various wireless protocols (LoRaWAN, NB-IoT, 5G) and must be processed in real-time to provide value.

A robust Smart City architecture must solve the problem of data heterogeneity and geographical distribution.

The 3-Layer Architecture: From Sensor to Dashboard

1. Connectivity Layer: LoRaWAN and LPWAN Integration

In the city, many sensors are battery-powered and installed in hard-to-reach places.

OZG 2.0 & EfA: The Technical Architecture for the Digital State

Tue, 03 Feb 2026 09:38:56 +0000

The goal of the Online Access Act is ambitious: all administrative services should be digitally available. However, the implementation often failed in the first phase due to the fragmented federal structure. The solution for the second phase (OZG 2.0) is the EfA principle. One state develops a service (e.g., the parental allowance procedure) and provides it centrally as a cloud service for all other municipalities.

Technically, this is a massive scaling and integration problem. It requires a shift from local “island servers” to a modern, multi-tenant cloud-native platform.

Sustainable Logistics IT: Achieving the "Green Warehouse" with Cloud-Native Technology

Tue, 03 Feb 2026 09:31:59 +0000

The logistics industry has ambitious goals: carbon-neutral fleets and green warehouses. While discussions revolve around alternative drives and photovoltaic systems on warehouse roofs, the background often features an inefficient IT infrastructure. Servers running at full capacity 24/7, even when no packages are sorted at night, not only waste money but also produce unnecessary emissions.

Sustainable Logistics IT means having an infrastructure as flexible as the business itself. Cloud-Native technologies are key to drastically reducing the digital footprint.

API-First in the Supply Chain: Partner Integration in Record Time

Tue, 03 Feb 2026 09:25:15 +0000

In a globally connected economy, no logistics company is an island. Success depends on how efficiently information flows between shippers, freight forwarders, warehouses, and end customers. However, in reality, onboarding a new partner is often a tedious process: manual data entry, incompatible file formats (EDI issues), and lengthy IT coordination delay the operational start by weeks.

The answer to this integration dilemma is an API-First strategy. By building infrastructure around interfaces (Application Programming Interfaces), IT transforms from a closed fortress into an open, agile platform.

Digital Sovereignty in Logistics

Tue, 03 Feb 2026 09:08:04 +0000

Data is the gold of modern logistics. Knowing when and where each package is, who calculates the most efficient routes, and who controls the interfaces to the customer holds the power in the supply chain. However, many logistics companies are gradually slipping into a dangerous dependency. When core processes run on proprietary platforms of large US providers, companies often unknowingly relinquish control over their most important asset: their strategic independence.

Polycrate API 0.11.27 released: Pod Status, DataSource & SLO Dashboard

Mon, 02 Feb 2026 14:00:00 +0000

Polycrate API 0.11.27 is a major feature release focusing on K8sApp pod status tracking, DataSource integration, and UI modernizations.

K8sApp Pod Status Tracking

The operator now sends real-time pod health data for K8sApps:

Aggregated Metrics: Total, Ready, Available, Unavailable Pods
Container Restarts: Sum of all restarts
Pod Details: JSON with detailed pod information
Redeploy Detection: Via Pod UID and Owner UID

The data is used during reconciliation for automatic downtime detection.

3 Steps to Greater Digital Sovereignty

Mon, 02 Feb 2026 12:37:22 +0000

Digital sovereignty is not a stance or a strategic paper. It is the result of concrete technical decisions. Those who operate software inevitably decide in which legal jurisdiction data resides, who effectively has access, and how easily or difficult dependencies can be dissolved later. These decisions often have long-lasting effects, regardless of whether they were made consciously or not.

This post describes three steps companies can take to practically implement digital sovereignty. The focus is not on promises, but on verifiable characteristics of architecture, operations, and processes.

Polycrate CLI 0.29.16 released: Pod Status Discovery & MCP Knowledge Base

Mon, 02 Feb 2026 12:00:00 +0000

Polycrate CLI version 0.29.16 brings comprehensive improvements for monitoring Kubernetes workloads and a new knowledge base for AI-assisted development.

K8sApp Pod Status Discovery

The operator now collects real-time pod health data for each K8sApp and sends it to the backend for SLI-based downtime detection.

New Metrics:

Pod counts (Total, Ready, Available, Unavailable)
Aggregated container restarts
Redeploy detection via Pod UID/Owner UID

Pod Watch for Real-Time Updates:

The controller now also watches pods. Changes immediately trigger K8sApp reconciliation - no more waiting during rolling updates.

Scaling at the Limit: How Track & Trace Processes Millions of Events in Real-Time

Mon, 02 Feb 2026 10:44:08 +0000

Scaling at the Limit: How Track & Trace Processes Millions of Events in Real-Time

During the “Peak Season” – from Black Friday to Christmas – data volume in logistics suddenly multiplies. Tracking platforms are flooded with millions of status updates (events) per hour: from scanners in distribution centers, fleet telematics systems, and millions of customers anxiously clicking the “refresh” button in their browsers.

A classic database architecture would collapse under this load (deadlocks, high IO latencies). To process these data masses losslessly and in real-time, a Cloud-Native Streaming Architecture is required.

Milliseconds Matter: Why Edge Computing is the Brain of the Modern Warehouse

Mon, 02 Feb 2026 10:40:04 +0000

In a highly automated logistics center, time is the most critical currency. When an autonomous guided vehicle (AGV) approaches an intersection or a high-speed sorter scans a package, the decision on the next path must be made in milliseconds. A delay of just half a second—caused by signal travel time to a distant cloud (latency)—would disrupt the entire flow of goods or lead to physical collisions.

Edge Computing is the technological answer to this challenge. It brings computing power away from the distant data center and directly to the “edge” of the action: into the local network of the warehouse.

Weekly Backlog Week 6/2026

Mon, 02 Feb 2026 10:34:58 +0000

Regulation becomes code, Open Source becomes infrastructure, Sovereignty becomes… marketing?

🧠 Editorial

2026 is often marketed as a transition year. Transition to what remains mostly unclear. In practice, 2026 is more the year when excuses no longer work. Regulation no longer comes as a PDF but as a feature requirement. Security is no longer an IT issue but a boardroom matter. And digital sovereignty? Continues to be preached – while new dependencies are being cemented in parallel.

Business Continuity in Logistics: When IT Stops, the Supply Chain Stops

Mon, 02 Feb 2026 10:29:47 +0000

In logistics, success is measured in cycle rates. A modern logistics center is a high-frequency clockwork of Warehouse Management Systems (WMS), Transport Management (TMS), and automated sorting systems. If the IT infrastructure fails for even 15 minutes, a domino effect occurs: trucks pile up at the ramps, delivery promises in e-commerce are broken, and in the worst case, production lines at industrial customers come to a halt.

“Resilience” in logistics IT is not a buzzword but a survival strategy. It’s about creating an infrastructure with built-in fault tolerance.

IT Laws 2026:

Mon, 02 Feb 2026 10:21:51 +0000

The Year European Regulation Becomes Operational

2026 is not a year of new grand digital policy announcements. It is the year when European digital laws leave their comfort zone and penetrate the operational everyday life of companies. Not as abstract guidelines, but as concrete requirements for products, processes, decision-making paths, and responsibilities.

The crucial point: Europe no longer regulates “technology” in general. It regulates technical characteristics. Those who underestimate this will spend a lot of time on deadlines in 2026 and a lot of money on retrofitting in 2027.

Skill Shortage in Hospital IT: Managed Platforms as a Strategic Lever

Mon, 02 Feb 2026 10:11:38 +0000

Mon, 02 Feb 2026 09:02:54 +0000

1. Executive Summary

Retail is undergoing the greatest transformation in its history. The separation between brick-and-mortar and e-commerce no longer exists. Customers expect real-time availability, personalized experiences, and absolute reliability. This document summarizes how modern software infrastructure turns these demands from a risk into a competitive advantage.

2. The Five Pillars of Digital Retail Infrastructure

I. Business Continuity & High Availability

The Core: A system failure at the point of sale is not an IT issue, but a business emergency.
The Solution: Self-healing systems and geographic redundancy secure revenue, even if individual components fail.

II. Elasticity and Scaling

The Core: Rigid server capacities are either too expensive or too weak during peak loads (Black Friday).
The Solution: Cloud-Native structures that automatically scale with customer traffic ensure performance at optimized costs.

III. Digital Sovereignty

The Core: Dependence on large US hyperscalers (like AWS) often means financing your biggest competitor.
The Solution: Utilizing open-source standards and European hosting to regain control over business data and strategic freedom.

IV. The Intelligent Store (Edge Computing)

The Core: Omnichannel often fails due to weak networking of physical stores.
The Solution: Edge computing brings cloud technology to the store – for real-time inventory, offline resilience, and centralized control.

V. Agility and Time-to-Market

The Core: Long release cycles hinder innovation.
The Solution: Automated software delivery (CI/CD) enables new features to go live in hours instead of months.

3. Strategic Roadmap for Decision Makers

Status Quo Audit: Identification of legacy bottlenecks and single points of failure.
Sovereignty Check: Assessment of dependencies on third-party providers.
Gradual Modernization: Gentle transformation instead of a “Big Bang”.

FAQ: Strategic IT Investments in Retail

Yesterday, the European Parliament made a decision that goes far beyond the usual Brussels symbolic politics in its scope. With a broad, cross-party majority, the EPP, Social Democrats, Liberals, and Greens adopted a report that unmistakably names Europe’s digital reality: technological dependence on US corporations is not an operational accident, but a strategic risk. And it is no longer politically acceptable.

The report marks a change of course. For the first time, it collectively formulates the demand to understand Europe’s digital infrastructure as a sovereign task – comparable to energy supply or transport. Cloud, artificial intelligence, and software are no longer treated as neutral market products, but as power factors. Which is exactly what they have long been.

Retail Sovereignty: Why You Shouldn't Entrust Your Platform to Your Biggest Competitor

Mon, 26 Jan 2026 09:55:17 +0000

In modern retail, the fiercest competition no longer takes place on the shelves, but at the data level. Understanding what the customer will want tomorrow is key to winning. However, while retailers are investing millions in their digital transformation, many are making a critical strategic mistake: building their entire digital existence on the infrastructure of Amazon Web Services (AWS).

The paradox is obvious: you pay hefty monthly fees to the very company that, with aggressive pricing, private labels, and unbeatable logistics, seeks to displace brick-and-mortar stores and independent e-commerce brands. At ayedo, we show you how to achieve technological excellence without selling your independence to a competitor.

No Fear of Black Friday: How Your Retail Infrastructure Automatically Scales with Your Customers

Mon, 26 Jan 2026 09:48:41 +0000

It’s the nightmare of every e-commerce manager and retail CTO: Black Friday is approaching, marketing campaigns are in full swing, and just at the moment of the biggest customer rush, the online store crashes. Load times explode, checkouts fail, and the painstakingly acquired customers end up frustrated with the competition.

The problem is often a rigid infrastructure designed for “normal operations” but collapses like a house of cards during extreme load spikes. With the ayedo Software Delivery Platform, this scenario is a thing of the past. We make your infrastructure elastic.

When the Checkout Stops: Why High Availability Decides the Survival of Retail

Mon, 26 Jan 2026 09:42:06 +0000

In retail, timing is ruthless. A system failure on a Saturday afternoon, during the peak sales hours, is not just an “IT problem” for a retailer – it’s a business-critical emergency. When the checkout system fails, the online inventory doesn’t sync, or the loyalty program app doesn’t deliver data, the customer walks away. And most of the time, they don’t come back that day.

In a world where online and offline seamlessly merge (Omnichannel), IT is the nervous system of commerce. But how do you ensure that this system remains absolutely fail-safe even under maximum load?

Weekly Backlog Week 5/2026

Mon, 26 Jan 2026 09:40:36 +0000

🧠 Editorial

This week marks a shift. Away from the question of whether digital dependencies are problematic, towards the question of how long Europe can afford them. Whether in Strasbourg, Bern, or Berlin: It is becoming clear everywhere that Cloud, software, and digital infrastructure are no longer neutral tools, but instruments of power. Those who control them set the rules. Those who use them live with the consequences.

The good news: The problem is no longer discussed solely on a technical level. The bad news: The consequences are greater than many have been willing to admit.

Polycrate CLI 0.29.15 released: TLS Serialization Fix

Fri, 23 Jan 2026 15:30:00 +0000

With Polycrate CLI 0.29.15, we have resolved the root cause of a persistent bug where endpoints with tls: false were not correctly serialized into the Kubernetes CRD from the API.

Root Cause: omitempty + default=true

The issue was in the CRD definition of the endpoint type:

// Before (faulty)
// +kubebuilder:default=true
TLS bool `json:"tls,omitempty"`

With TLS=false (Go zero-value for bool), the field was not serialized into JSON due to omitempty. Kubernetes then applied the CRD default true—effectively ignoring the update.

Polycrate CLI 0.29.13 released: Debug Logging & NetworkPolicy Fix

Fri, 23 Jan 2026 15:00:00 +0000

Polycrate CLI version 0.29.13 introduces debug logging for operator startup and an important NetworkPolicy fix.

Startup Debug Logging

Previously, during slow operator startup, it was unclear which controller was being registered. With loglevel: 2, detailed logs are now displayed:

Registering SoftwareDeliveryPlatform controller...
Registering EndpointDiscovery controller...
Checking Velero CRDs...
BackupDiscovery controller skipped (Velero CRDs not installed)
...

NetworkPolicy Fix

The NetworkPolicy has been set to Egress ALLOW ALL to resolve CNI compatibility issues. Different CNI implementations (Cilium, Calico) handle API server traffic differently, leading to timeouts during CRD discovery.

Polycrate CLI 0.29.14 released: Backup & Endpoint Fixes

Fri, 23 Jan 2026 14:30:00 +0000

With version 0.29.14, we have implemented two important bug fixes in the Polycrate Operator that significantly enhance the reliability of backup schedule synchronization and endpoint monitoring.

BackupSchedule K8sCluster UUID Fix

The BackupSchedule Controller previously sent a null UUID to the API, resulting in the following error:

Failed to create backup schedule in API
error: "Invalid pk \"00000000-0000-0000-0000-000000000000\""

With this fix, backup schedules are now correctly synchronized with the registered cluster ID.

Endpoint TLS Default Fix

A subtle bug caused HTTP-only endpoints to be mistakenly treated as HTTPS:

Polycrate API 0.11.23 released: API Key Fix & Contact Role

Fri, 23 Jan 2026 14:00:00 +0000

Polycrate API 0.11.23 introduces crucial fixes for API key authentication and enhances contact management.

API Key Authentication Fix

User API keys (Knox-based) could not be used for API access. The error message was:

{"detail":"Authentication error: Invalid agent token - credential not found"}

Cause: The agent token authentication mistakenly blocked subsequent authenticators.

Solution: The authentication chain now functions correctly - user API keys are processed by Knox.

API Key Admin UI

User API keys are now visible in the Django Admin:

Polycrate CLI 0.29.12 released: Operator Stability & Loglevel Fix

Fri, 23 Jan 2026 14:00:00 +0000

Polycrate CLI version 0.29.12 addresses critical operator stability issues and corrects debug logging.

Operator Startup Fix

The operator was being killed during slow Kubernetes startups because health probes were only activated after controller registration. This led to CrashLoopBackOff in clusters with many CRDs or slow APIs.

Fix: Health checks are now registered immediately after manager setup—prior to controller registration.

Loglevel V-Level Fix

Loglevel 2 (Debug) and 3 (Trace) did not display additional information. The V-levels in controller-runtime have now been correctly mapped:

Polycrate CLI 0.29.11 Released: TLS Debug Logging

Fri, 23 Jan 2026 12:00:00 +0000

Polycrate CLI version 0.29.11 enhances the diagnosis of TLS issues in API-managed endpoints.

TLS Type-Cast Debug Logging

In API-managed endpoints, there could be instances where the TLS value was incorrectly transmitted (tls: false → tls: true). This led to the operator constructing HTTPS URLs on port 80, resulting in 404 errors.

With the new debug logging, type-cast errors become immediately visible:

WARN: httpSpec[tls] type cast to bool failed
      endpoint: example.com
      tlsType: string
      tlsValue: "false"

These messages only appear when a type-cast fails and assist in root cause analysis.

AWS CloudWatch & Azure Monitor vs. APM Stack (Considering Your Observability Needs)

Wed, 21 Jan 2026 10:13:58 +0000

Considering Real Observability Needs

Observability determines how well systems can be understood, operated, and evolved. It is not an add-on for operations but a core capability of modern platforms. Accordingly, the question of where observability is anchored is relevant: as a consumed cloud service or as an independent, controllable architecture.

AWS CloudWatch and Azure Monitor are the native observability services of the major hyperscalers. Open stacks based on Grafana, VictoriaMetrics, VictoriaLogs, and OpenTelemetry take a different approach. Both deliver metrics, logs, and alerts—but they do so with fundamentally different implications for cost, portability, and control.

AWS CodePipeline vs. Argo CD: CI/CD as a Service or an Architectural Decision

Wed, 21 Jan 2026 10:11:43 +0000

Service or Architectural Decision?

CI/CD is often treated as a tool question: Which service, which pipeline, which provider? In reality, CI/CD is an architectural principle decision. It defines how deployments are conceptualized, how tightly platforms are bound to providers, and how controllable systems remain in the long term.

AWS CodePipeline and Argo CD exemplify two very different approaches. One is a cloud service for orchestrating deployments. The other is an operational model that structurally redefines deployments.

AWS IAM & Azure Entra ID vs. authentik

Wed, 21 Jan 2026 10:09:32 +0000

Identity Management as a Control Instrument or Open Infrastructure

Identity management is far more than just login and user administration. It defines who gains access to systems, under what conditions this access occurs, and how security, automation, and compliance can be technically enforced. Thus, identity becomes one of the central power factors of modern IT architectures.

AWS IAM, Azure Entra ID (formerly Azure Active Directory), and authentik all solve the same fundamental problem: managing identities and controlling access. Architecturally, however, they represent two fundamentally different approaches. One embeds identity deeply within a platform, while the other views it as an independent, open infrastructure.

Individual Provider Block Storage vs. Ceph

Wed, 21 Jan 2026 10:06:36 +0000

Storage as a Cloud Feature or as a Controllable Platform

Persistent storage is one of the most inconspicuous yet powerful layers of modern platforms. It determines whether applications remain scalable, whether data is portable, and how costly a later change of direction will be. Block storage from cloud providers often appears as a neutral infrastructure feature. In reality, it is deeply embedded in the respective platform logic.

Provider block storage and Ceph solve the same fundamental problem: reliably storing stateful data. Architecturally, however, they represent two opposing models. One ties storage to the cloud. The other makes it an independent, controllable platform component.

AWS Certificate Manager vs. cert-manager

Wed, 21 Jan 2026 10:03:35 +0000

Certificates as a Cloud Service or as Part of the Platform Architecture

TLS certificates are often considered a necessary security detail. However, in modern platform architectures, they are much more than that. Certificates define where trust ends, how services communicate, and whether security mechanisms are consistently automated or only applied sporadically.

AWS Certificate Manager (ACM) and cert-manager solve the same fundamental problem: issuing, renewing, and managing certificates. Architecturally, however, they pursue two fundamentally different approaches. One shifts certificate management to a cloud service, while the other integrates it directly into the platform.

AWS Redshift vs. ClickHouse

Wed, 21 Jan 2026 10:00:30 +0000

Data Warehouse as a Cloud Product or as an Open Analytical Platform

Analytical data is no longer just an appendage to reporting. It forms the basis for product decisions, operational optimization, and strategic management. Thus, the question of how analytical platforms are built—and who owns them—is highly relevant.

AWS Redshift and ClickHouse address the same fundamental problem: efficiently analyzing large volumes of data. Architecturally, however, they represent two very different models. One deeply integrates analytics into a Cloud Platform . The other deliberately decouples analytical capabilities from individual providers.

AWS Secrets Manager vs. External Secrets Operator

Wed, 21 Jan 2026 09:57:07 +0000

Secrets as a Cloud Service or as Part of the Kubernetes Platform

Secrets are among the most sensitive components of modern applications. Credentials, API keys, tokens, or certificates determine whether systems communicate securely—or whether security boundaries effectively do not exist. Thus, the question of where and how secrets are managed and consumed is far-reaching.

AWS Secrets Manager and the External Secrets Operator address this very issue, albeit from fundamentally different perspectives. One anchors secrets in the cloud platform. The other deliberately integrates them into Kubernetes as a central control plane. The difference is not functional—it’s architectural.

AWS CodePipeline vs. Flux

Wed, 21 Jan 2026 09:55:08 +0000

Pipeline Orchestration or GitOps as an Operational Model

CI/CD is often treated as a tool question: Which pipeline, which runner, which service? In modern platform architectures, this view falls short. The key is not how deployments are triggered, but which operational model is behind them.

AWS CodePipeline and Flux both address the path from code to production. However, they approach it from fundamentally different directions. One orchestrates execution steps within a cloud. The other establishes GitOps as a permanent operational model. Failing to distinguish this difference clearly can lead to pipelines that work in the short term but create platforms that are difficult to maintain in the long term.

AWS CodeCommit vs. GitLab

Wed, 21 Jan 2026 09:48:23 +0000

Version Control as a Cloud Component or Platform Core

Version control is often reduced to a technical minimum: store code, track changes, done. In modern platform architectures, however, Git is much more than a developer tool. It is a control instance, an integration point, and often the place where technical truth is defined.

AWS CodeCommit and GitLab both address Git-based version control. Architecturally, however, they represent two fundamentally different approaches. One subordinates Git to a cloud platform. The other makes Git the central core of the platform.

AWS CloudWatch & Azure Monitor vs. Grafana

Wed, 21 Jan 2026 09:43:46 +0000

Monitoring as a Cloud Function or as an Open Observability Layer

Monitoring and Observability have long surpassed being mere operational tools. They determine how systems are understood, evaluated, and managed. AWS CloudWatch and Azure Monitor are the native monitoring and observability services of their respective hyperscalers. Grafana takes a fundamentally different approach.

The difference is not in whether metrics, logs, or events are captured. It lies in who defines how this data is structured, correlated, and utilized. Monitoring is thus not purely a technical question—it is a matter of architectural sovereignty.

Provider Load Balancer vs. HAProxy

Wed, 21 Jan 2026 09:41:30 +0000

Traffic Control as a Cloud Service or as a Controllable Platform Component

Load balancers are the silent foundations of modern infrastructures. They determine how traffic is distributed, secured, and controlled—often without being consciously noticed in everyday life. Whether AWS Elastic Load Balancer, Azure Load Balancer, or similar services: Provider load balancers are now a standard component of almost every cloud architecture.

They operate reliably, scale automatically, and can be quickly integrated. This is precisely why they are often not considered an architectural decision but a given. However, with increasing platformization, especially in the Kubernetes environment , this attitude becomes problematic.

AWS ECR vs. Harbor

Wed, 21 Jan 2026 09:35:30 +0000

Container Registry as a Cloud Service or a Controllable Platform Component

Container registries may seem like a technical detail at first glance. Images are built, stored, pulled—done. In practice, however, registries are a central component of modern platform architectures. They determine how images can be distributed, secured, versioned, and moved between environments.

AWS Elastic Container Registry (ECR) and Harbor solve the same fundamental problem: storing and providing container images. Architecturally, however, they represent two fundamentally different models. One subordinates the registry to the cloud. The other makes it a controllable part of your own platform.

AWS Secrets Manager vs. HashiCorp Vault

Wed, 21 Jan 2026 09:33:28 +0000

Secret Management as a Cloud Function or as a Standalone Security Architecture

Secrets are not a fringe topic. Credentials, API keys, tokens, and certificates define how systems are allowed to communicate—and where security boundaries actually lie. AWS Secrets Manager and HashiCorp Vault address this issue from two fundamentally different perspectives.

The difference is not in the ability to store secrets encrypted. It lies in the question of whether secret management is part of a cloud function or represents a standalone security architecture. This decision directly impacts portability, governance, and long-term control.

AWS Secrets Manager vs. Infisical

Wed, 21 Jan 2026 09:28:05 +0000

Secrets as a Hyperscaler Service or as an Open Developer Security Platform

Secrets are among the most inconspicuous yet critical components of modern platforms. Credentials, API keys, tokens, or certificates determine who can access systems—and who cannot. AWS Secrets Manager and Infisical address this very issue. Technically, both store secrets securely. Architecturally, however, they pursue fundamentally different approaches.

The difference does not lie in encryption but in the question of to whom secret management is subordinated: the cloud infrastructure or the application and platform logic. This is not a trivial question but a strategic decision.

AWS Timestream vs. InfluxDB

Wed, 21 Jan 2026 09:24:31 +0000

Managed Convenience vs. Technical Control

AWS Timestream and InfluxDB solve the same fundamental problem: efficiently storing, querying, and analyzing time-series data. In architecture diagrams, both appear interchangeable. In practice, they represent two fundamentally different approaches to infrastructure.

The difference is not in the database category, but in the power dynamics behind the technology. It’s not about a technical beauty contest, but about architecture, dependency, and long-term manageability.

AWS Timestream: Time-Series as a Consumed Service

AWS Timestream is a fully managed service. No servers, no versions, no operations. Data is written, queries are made, and the rest happens automatically. AWS handles scaling, retention, storage tiering, and performance optimization.

AWS MSK vs. Apache Kafka

Wed, 21 Jan 2026 09:20:49 +0000

Consume or Control Infrastructure

AWS MSK and Apache Kafka do not compete on a feature level. They represent two fundamentally different approaches to infrastructure. One model promises relief through managed services. The other focuses on technical control, portability, and design freedom. Those who underestimate this difference rarely pay immediately—but almost always later.

Kafka is much more than a messaging system. It is a data backbone, an integration platform, and often a critical component of business logic. The decision to consume or operate Kafka is therefore far-reaching.

Azure Entra ID vs. Keycloak

Wed, 21 Jan 2026 09:17:02 +0000

Identity as a Service or as Infrastructure

Azure Entra ID and Keycloak address the same core issue: managing identities, controlling access, and securing authentication. In many architectures, both appear as “Identity Providers” and are thus functionally equated. This view is too simplistic.

The difference lies not in individual features, but in control, dependency, and strategic significance. Identity is not a side function. It determines who gets access, how systems interact, and ultimately where the sovereignty over digital identities lies. Identity is power over systems.

Azure Monitor vs. Loki

Wed, 21 Jan 2026 09:09:01 +0000

Observability as a Service or as Your Own Infrastructure

Azure Monitor and Loki take two fundamentally different approaches to monitoring and logging. Both provide insights into systems, metrics, and logs. However, the key difference is not in visibility, but in who retains control over data, costs, and architecture.

Observability is not a comfort feature. It determines how quickly systems can be understood, errors analyzed, and incidents processed. Making incorrect assumptions here not only leads to a loss of transparency but also, in the long run, to a loss of control.

Individual Provider Block Storage vs. Longhorn

Wed, 21 Jan 2026 09:04:56 +0000

Buying Dependency or Building Resilience

Block storage is one of the invisible yet most critical layers of any cloud and Kubernetes architecture. Whether it’s AWS EBS, Azure Managed Disks, or similar provider-specific offerings: they work reliably—as long as you stay within the respective ecosystem. This assumption is rarely questioned.

With the increasing platformization of Kubernetes, block storage evolves from a detail to a strategic decision. Longhorn challenges the fundamental assumption that persistent storage must be tied to a single provider.

AWS RDS vs. MariaDB

Wed, 21 Jan 2026 09:00:31 +0000

Consuming or Mastering Databases

AWS RDS and MariaDB do not represent competing products but rather two fundamentally different models for handling databases. One promises relief through managed services, while the other demands responsibility—and in return, offers control. Those who make this decision too hastily rarely pay immediately, but almost always later.

Databases are not interchangeable infrastructure components. They store not only data but also business logic, history, dependencies, and implicit assumptions about scaling, availability, and consistency. The implications of whether you consume or master a database are correspondingly far-reaching.

AWS S3 vs. MinIO

Wed, 21 Jan 2026 08:57:56 +0000

Consuming or Controlling Object Storage

On paper, AWS S3 and MinIO fulfill the same technical task: providing highly available, scalable object storage. In many discussions, the comparison ends early—at the API. Both speak S3. Thus, the decision seems trivial. In practice, it is not.

Object Storage is no longer just a technical component. It is an infrastructural foundation, cost factor, compliance component , and strategic dependency all at once. The crucial question is not whether object storage works, but who owns the operation, data, and architecture.

AWS DocumentDB vs. MongoDB

Wed, 21 Jan 2026 08:49:10 +0000

Why API Compatibility Is Not a Database Strategy

AWS DocumentDB and MongoDB are regularly equated. The reason is quickly stated: Both are supposed to speak the same API. For many decision-making processes, this statement is enough to check a box. “Compatible” sounds like interchangeable, low risk, flexible. This assumption is exactly the core of the problem.

A database is not a protocol and not an interface. It is complex system behavior. Those who focus solely on an API ignore architecture, performance characteristics, feature development, and long-term dependencies. In the case of AWS DocumentDB and MongoDB, this regularly leads to poor decisions that only become visible in production.

Polycrate CLI 0.29.10 released: Security Hardening

Tue, 20 Jan 2026 23:30:00 +0000

Polycrate CLI version 0.29.10 focuses on security, bringing comprehensive Kubernetes hardening for the Operator according to NIST SP 800-190 and CIS Benchmark.

Kubernetes Security Hardening

The Operator image has been hardened according to common security standards and is now available as a rootless image by default:

Security Features:

Non-root User (UID 1000)
Read-only Root Filesystem
Dropped Capabilities (ALL)
Seccomp RuntimeDefault
NetworkPolicy for Namespace Isolation

# New Security Configuration
blocks:
  - name: polycrate-operator
    config:
      security:
        enabled: true
        run_as_non_root: true
        read_only_root_filesystem: true
        network_policy:
          enabled: true

Compliance:

Polycrate API 0.11.22 released: LoadBalancer Metrics Fix

Tue, 20 Jan 2026 17:00:00 +0000

Polycrate API 0.11.22 fixes the LoadBalancer metrics query. The detail UI now shows correct bandwidth data.

LoadBalancer Metrics Fix

The LoadBalancer instance detail UI showed no bandwidth data - “No bandwidth data available” for all time periods.

Cause: The VictoriaMetrics query used incorrect label names.

Solution: Corrected labels:

loadbalancerinstances_polycrate_io_id (UUID)
workspaces_polycrate_io_id (UUID)

→ Full Release Notes

polycrate-api Block

The polycrate-api block has been updated to version 0.5.26 (API 0.11.22):

polycrate pull cargo.ayedo.cloud/ayedo/k8s/polycrate-api
polycrate run polycrate-api install

Update Now

polycrate run polycrate-api install

Or download the Docker image directly:

Polycrate API 0.11.21 released: Ceph Metrics + Filter Fix

Tue, 20 Jan 2026 16:00:00 +0000

Polycrate API 0.11.21 addresses two critical issues: S3 buckets with Ceph backend now display correct storage metrics in the detail UI, and the filters for Organization and Workspace are functional again in the ActionRun and Agent tables.

S3 Bucket Metrics for Ceph

S3 buckets with Ceph backend (RadosGW) did not show storage metrics in the detail UI, although the list view displayed the values correctly. The issue: The RadosGW Admin API only provides snapshots, not historical data like VictoriaMetrics with MinIO.

Polycrate API 0.11.17 released: Timeline Chart Debugging

Tue, 20 Jan 2026 14:00:00 +0000

With Polycrate API 0.11.17, we enhance the diagnostic capabilities for the timeline charts in the detail UIs.

The Problem

After the 0.11.16 release, it was observed that the timeline charts in S3 Bucket Detail and LoadBalancer Instance Detail were not displaying data - even though the aggregated values (average, maximum) were correctly calculated.

The Paradox: Both calculations use the same VictoriaMetrics response. _calculate_average_from_metrics() works, but _extract_storage_timeline() returns an empty list.

The Solution

1. Consistent Parsing

The timeline extraction now uses exactly the same syntax as the working average calculation - proven code instead of variation.

Polycrate API 0.11.20 released: LoadBalancer Fix + Debug

Tue, 20 Jan 2026 14:00:00 +0000

Polycrate API 0.11.20 fixes a JavaScript error and adds debug logging to identify the cause of empty timeline data.

Fix: Chart resize TypeError

In the browser console, the following error appeared during window resize:

Uncaught TypeError: bandwidthChart?.resize is not a function

The event handler now explicitly checks if the chart object exists and if the resize method is a function.

Debug: Empty Timeline Data

The LoadBalancer detail UI showed no data for 1h/24h tabs, although data was available for 30d. This version adds extensive debug outputs:

Polycrate API 0.11.19 released: Storage in the Bucket Overview

Tue, 20 Jan 2026 13:00:00 +0000

Polycrate API 0.11.19 enhances the S3 Bucket Table UI with Storage and Objects columns and introduces consistent bar charts for all timeline visualizations.

Storage & Objects directly in the Overview

The S3 Bucket Table now shows the current storage usage and object count directly in the overview:

Storage: Formatted as KB, MB, GB, or TB
Objects: With thousand separators for better readability

This information was previously only available in the detail view and is now visible directly in the list.

Polycrate API 0.11.16 released: Critical Bugfixes

Tue, 20 Jan 2026 12:00:00 +0000

With Polycrate API 0.11.16, we address two critical bugs that could occur in production environments.

🔥 S3 Bucket Reconciliation Fix

The Issue: S3 Buckets remained permanently in the DEGRADED status and were never created at the provider (MinIO). The logs showed no error—only a misleading info message about missing metrics.

The Cause: During the migration to run_reconciliation() in 0.11.12, early returns were introduced, skipping the REPAIRS section. For new buckets without metrics, create_bucket() was never called.

Polycrate API 0.11.18 released: Hotfix & Bar-Charts

Tue, 20 Jan 2026 12:00:00 +0000

Polycrate API 0.11.18 fixes a critical error in timeline data extraction and changes the chart style to bar charts.

Hotfix: timezone.utc AttributeError

After deploying 0.11.17, the following error appeared in production:

Error extracting storage timeline: module 'django.utils.timezone' has no attribute 'utc'

Django’s timezone module does not have a utc attribute. 0.11.18 now uses datetime.timezone.utc from the Python standard library.

UI: Bar-Chart Style

The timeline charts for S3 Buckets and LoadBalancer Instances have been switched from area charts to bar charts to ensure consistency with the Endpoint Detail UI.

Polycrate API 0.11.15 released: KaTeX Fix

Mon, 19 Jan 2026 15:00:00 +0000

With Polycrate API 0.11.15, we resolve the last remaining collectstatic error in production environments.

KaTeX/LaTeX Removed

The Milkdown Editor CSS included styles for LaTeX Math-Rendering, referencing ~30 font files. These fonts were not present in the Static Files directory.

Why did it work locally? Development uses the default Django Storage Backend without post-processing. Production uses Whitenoise’s CompressedManifestStaticFilesStorage, which resolves all CSS references—and crashes when files are missing.

The Solution: The build script was adjusted to exclude KaTeX and LaTeX styles. We do not use math rendering in Notes, so this is not a loss of functionality.

Polycrate API 0.11.14 released: Certificate Sync Fix

Mon, 19 Jan 2026 14:30:00 +0000

With Polycrate API 0.11.14, we address two critical bugs that could occur in production environments.

Certificate API Upsert

The Polycrate Operator synchronizes cert-manager certificates to the API. In certain scenarios (operator restart, status loss), UniqueConstraint violations could occur if a certificate already existed in the API.

The solution: The Certificate API now implements upsert logic. If a certificate with the same name, namespace, and k8s_cluster already exists, it will be updated instead of throwing an error.

Polycrate API 0.11.13 released: collectstatic Hotfix

Mon, 19 Jan 2026 13:00:00 +0000

With Polycrate API 0.11.13, we address critical production issues that emerged after the 0.11.12 release.

collectstatic Fix

The milkdown-theme/ directory contained CSS files with @import statements for NPM packages:

@import '@milkdown/kit/prose/gapcursor/style/gapcursor.css';
@import 'katex/dist/katex.min.css';

These paths only exist during development in node_modules/, but not in the production build. Whitenoise’s collectstatic post-processing attempted to resolve these imports and failed.

The solution: The entire milkdown-theme/ directory was removed. It was redundant since the template only loads the bundled milkdown-crepe.css.

AWS ElastiCache vs. KeyDB

Mon, 19 Jan 2026 12:50:54 +0000

Managed Cache or Controlled Data Structure

AWS ElastiCache and KeyDB address the same need: extremely fast in-memory data storage for caching, queues, sessions, and real-time access. In architecture diagrams, both are often drawn as interchangeable components. This assumption falls short.

The difference between the two lies not primarily in latency, but in the question of who owns the architecture, costs, and further development. In-memory stores are not an incidental performance trick. They determine response times, system stability, and scalability of entire platforms .

Polycrate API 0.11.12 released: Editor & UI Modernization

Mon, 19 Jan 2026 10:00:00 +0000

Polycrate API Version 0.11.12 brings extensive UI modernization with the new Milkdown Editor, S3 Media Storage, and significant performance improvements for the System State Loop.

Highlights

Milkdown Editor - Modern Markdown editor with @Mention support for Notes
S3 Media Storage - Media files are now stored in S3
V2 Table Filter - New filter UI with URL-state persistence
Toast System - Modernized notification system with Polycrate.toast API
System State Loop - Optimized from 5-15s to 1-3s

Milkdown Editor

The previous plaintext editor for Notes has been replaced by Milkdown - a modern, Markdown-based WYSIWYG editor with @Mention support for user references.

Flux: The Reference Architecture for Continuous Delivery & Infrastructure Automation

Mon, 19 Jan 2026 09:38:19 +0000

TL;DR

Kubernetes clusters should not be managed manually or with fragile scripts. While AWS CodePipeline tries to enforce deployments through external commands (“Push”), Flux turns this model around. As a native Kubernetes controller , Flux pulls the desired state directly from Git or OCI repositories (“Pull”). The result is a self-healing system that keeps infrastructure and applications in sync without requiring external CI servers to access the cluster.

1. The Architecture Principle: The Cluster Manages Itself

Traditional CI/CD tools (like AWS CodePipeline or Jenkins) operate imperatively: “Build the image, connect to the cluster, execute kubectl apply”.

GitLab: The Reference Architecture for the Complete DevOps Platform

Mon, 19 Jan 2026 09:37:48 +0000

TL;DR

Modern software development requires more than just code hosting. While hyperscalers like AWS attempt to lock developers into their platforms with a fragmented chain of individual services (CodeCommit, CodeBuild, CodePipeline), GitLab follows the ‘Single Application’ approach. It combines Source Code Management (SCM), CI/CD, Security Scanning, and Package Registry into a single, coherent interface. This reduces complexity, accelerates feedback loops, and ensures that your intellectual property (the code) and processes remain portable.

Google Tag Manager (Server-Side): The Reference Architecture for First-Party Data & Compliance

Mon, 19 Jan 2026 09:37:16 +0000

TL;DR

Classic browser-based tracking (‘Client-Side’) is dying. Browser restrictions (ITP), AdBlockers, and GDPR make data collection unreliable and legally risky. Server-Side Tagging (SST) shifts the logic from the user’s device to a dedicated server. This gives companies full control back: Data is cleansed before being sent to third parties (Google, Meta), and website performance increases massively. Running GTM Server-Side in your own cluster transforms tracking from a security risk into a controlled data stream.

Gotenberg: The Reference Architecture for PDF Generation as a Microservice

Mon, 19 Jan 2026 09:36:43 +0000

TL;DR

PDF generation is often a technical debt in modern web development. Outdated tools like wkhtmltopdf are no longer maintained, and embedding headless browsers in application containers unnecessarily bloats them and creates security vulnerabilities. Gotenberg radically solves this problem: it encapsulates the complexity of Chromium and LibreOffice in a stateless API. Instead of painstakingly building PDF logic into every microservice, delegate the task to a central, scalable service that converts HTML, Markdown, and Office documents with pixel-perfect precision.

Grafana: The Reference Architecture for Unified Observability

Mon, 19 Jan 2026 09:34:21 +0000

TL;DR

In modern distributed systems, it’s no longer enough to just know if a server is up or down. You need to understand why it’s slow. While AWS CloudWatch provides a solid view of the infrastructure, visibility often ends at the cloud boundary. Grafana breaks through these silos. It acts as a universal visualization layer, unifying data from hundreds of sources (Prometheus, SQL, logs, traces) into a single interface. Those who use Grafana gain true end-to-end observability, regardless of where the data resides.

Polycrate API 0.11.11 released: Performance Optimization

Thu, 15 Jan 2026 19:00:00 +0000

Polycrate API version 0.11.11 delivers massive performance improvements by removing the unused discovery phase and optimizing activity tracking.

Highlights

Discovery Removal - 500+ DB queries per control_loop cycle eliminated
Activity Tracking Optimization - SELECT query in save() eliminated through caching
K8sAppInstance Cleanup - Obsolete model removed from reconciliation
API Endpoint Cleanup - discover_object task and API endpoint removed

Discovery Phase Removed

The control_loop (every 10 seconds) previously called discover_class() for 5 model types, leading to over 1000 DB queries per cycle - even though the discovery methods mostly contained only pass. This phase has been completely removed.

Polycrate API 0.11.10 released: Endpoint Monitoring Fixes

Thu, 15 Jan 2026 18:00:00 +0000

Polycrate API version 0.11.10 addresses several UI bugs and performance issues in the endpoint monitoring system.

Highlights

Agent Detail Lazy Loading - Monitored Endpoints Table with pagination for improved performance
Agent Capacity Logic Fix - max_endpoints now uses SystemConfig instead of the outdated effective_capacity
VictoriaMetrics Query Optimization - Corrected query step from 30s to 60s
Agent Info Box Cleanup - Removed redundant and erroneous fields
Ingress Discovery Disabled - Operator is the single source of truth

Agent Capacity Fix

The max_endpoints property used the old effective_capacity field, which is no longer updated. This led to incorrect capacity calculations. Now, the SystemConfig value is used directly (default: 300 endpoints per agent).

Polycrate CLI 0.29.9 released: Agent Health Redesign

Thu, 15 Jan 2026 16:00:00 +0000

Polycrate CLI version 0.29.9 brings significant improvements to endpoint monitoring with a complete redesign of Agent Health data.

Agent Health Data Redesign

The operator’s health data is now stored directly on the Agent Model. This eliminates unnecessary database joins and allows faster access to current metrics in the UI.

New Agent Fields:

Health Status (healthy/degraded/unhealthy)
Monitored Endpoints Count
Checks per Minute
Total/Failed/Successful Checks

Check Result Submission

The operator collects all Check Results and submits them along with the Health Report to the API:

Weekly Backlog Week 4/2026

Thu, 15 Jan 2026 11:22:06 +0000

🧠 Editorial

This week feels like a reality check for everyone who thought digital sovereignty was just a grant program with a pretty cover. Cloud is power politics. Software is foreign policy. And dependency is not an operational accident, but a strategic decision. While hyperscalers rebrand ‘sovereignty,’ presidents threaten tariffs, and CEOs openly talk about killing, one thing is clear: Europe’s comfort zone is over. Welcome to the year when tech becomes definitively geopolitical.

SaaS Everywhere: Dedicated SaaS Instances at the Push of a Button

Thu, 15 Jan 2026 11:17:59 +0000

The classic SaaS model is simple: one cloud, one architecture, all customers share the resources. However, as a SaaS provider becomes more successful in the enterprise segment, a phrase is often heard in sales conversations: “We love your software, but for compliance reasons, the data must reside in our own Azure tenant (or on-premise).”

For many SaaS teams, this is the moment when scaling breaks. Suddenly, “special solutions” need to be maintained, manually installed, and painstakingly updated. Polycrate resolves this dilemma by decoupling application logic from infrastructure.

Margin Killer: Cloud Costs? How SaaS Providers Can Maximize Infrastructure Efficiency

Thu, 15 Jan 2026 11:03:33 +0000

In the growth phase of a SaaS company, there is a dangerous curve: the Cost of Goods Sold (COGS). As user numbers increase, cloud costs often explode disproportionately. The reason: inefficient resource allocation, unused “zombie” instances, and lack of cost transparency per customer (Unit Economics).

When infrastructure costs grow faster than revenue, the margin decreases. By 2026, FinOps is no longer an option but a survival strategy. Polycrate provides SaaS providers with the technical frameworks to embed efficiency directly into the deployment process.

AWS European Sovereign Cloud in Brandenburg:

Thu, 15 Jan 2026 10:29:24 +0000

How Sovereign is Europe’s Data Really?

Amazon Web Services is putting the “AWS European Sovereign Cloud” into operation in Brandenburg. Cloud campuses are being established in Baruth/Mark and Finsterwalde, initially through leased data centers, prospectively with their own infrastructure. Operations are carried out via a German GmbH, the data centers are located exclusively in the EU, and the staff employed are resident in Europe. The claim is clearly formulated: operation, control, and responsibility are to be entirely European.

Polycrate API 0.11.7 released: Host String Representation

Wed, 14 Jan 2026 17:00:00 +0000

Polycrate API version 0.11.7 corrects the representation of host objects.

Host String Representation

The base model ManagedObject uses display_name as the primary string representation. For hosts, this is unsuitable because the technical name is more informative.

The Host model now overrides __str__() and always returns name. This ensures hosts are consistently represented by their technical name in lists, logs, and API responses.

→ Full Release Notes

polycrate-api Block 0.5.8

The polycrate-api block has been updated to version 0.5.8:

Polycrate API 0.11.6 released: UniqueValidator Fixes

Wed, 14 Jan 2026 16:30:00 +0000

Polycrate API version 0.11.6 addresses critical validation errors that prevented updates via the operator.

UniqueValidator Fixes

K8sApp Block Validation

When updating a K8sApp, the following error occurred:

{"block": ["Kubernetes App with this block already exists."]}

The issue: Django REST Framework automatically adds a UniqueValidator to OneToOneField, which does not exclude the current record during updates.

Host Unique Constraints

A similar issue occurred with hosts using the constraints unique_host_per_workspace and unique_hostname_per_workspace.

Solution

Both serializers now override the validation to exclude the current record during updates.

Polycrate CLI 0.29.7 released: API Schema Fix

Wed, 14 Jan 2026 16:00:00 +0000

With version 0.29.7, Polycrate receives important bug fixes for the operator’s API communication.

API Schema Update

The API client has been regenerated with the corrected schema. The k8s_cluster field in list responses is now correctly treated as an object, not as a string.

This fixes the error:

json: cannot unmarshal object into Go struct field K8sAppList.kubernetes_apps.k8s_cluster of type string

Enhanced Error Diagnostics

API errors now display the full response body, significantly easing the diagnosis of 400/500 errors.

Polycrate CLI 0.29.8 released: Comprehensive API Error Diagnosis

Wed, 14 Jan 2026 16:00:00 +0000

Polycrate CLI version 0.29.8 significantly improves error diagnosis for all API operations.

Enhanced API Error Diagnosis

All 42 API client functions have been updated to display the full response body on errors:

// Before:
unexpected status code: 400

// After:
unexpected status code: 400, body: {"field": ["Validation error details..."]}

This affects all resource types:

K8sCluster, K8sApp
Host, Certificate
Backup, BackupSchedule
Workspace, Block
and all others

Faster Issue Resolution

With detailed error messages, validation issues can now be identified immediately without having to search through API logs. The Polycrate Operator particularly benefits from this with clearer log outputs.

Polycrate API 0.11.5 released: Bugfixes & UX Improvements

Wed, 14 Jan 2026 14:00:00 +0000

With version 0.11.5, the Polycrate API receives important bugfixes and UX improvements. Tables now refresh faster, and objects can be directly accessed via URL.

Bugfixes

CLI Compatibility

The internal polycrate run command has been updated to be compatible with newer CLI versions. The error Error: unknown shorthand flag: 'o' in -o=yaml is now resolved.

Ingress Controller Validation

Clusters are no longer marked as “degraded” if there is no nginx Ingress Controller present. Endpoint discovery now functions independently of the Ingress Controller type.

Polycrate CLI 0.29.6 released: API Client Type Fix

Wed, 14 Jan 2026 14:00:00 +0000

With version 0.29.6, Polycrate receives a critical bug fix: The operator was unable to synchronize K8sApp objects with the API.

The Problem

The Polycrate Operator could not synchronize K8sApps with the API and returned the following error:

json: cannot unmarshal object into Go struct field K8sApp.workspace of type *uuid.UUID

The Cause

The generated API client expected a UUID as a string for the workspace field, but the API returned a complete object with id, name, url, etc.

Polycrate API 0.11.4 released: Dynamic Tables, Info Drawer & UI Improvements

Wed, 14 Jan 2026 10:00:00 +0000

With version 0.11.4, the Polycrate API receives extensive UI improvements for better clarity and faster navigation. The new Dynamic Tables, Info Drawer, and collapsible sidebar make daily work more efficient.

Dynamic Tables with Auto-Refresh

All list views have been fundamentally revamped:

Real-time updates: Tables automatically refresh every 30 seconds
Faster navigation: Sort and search without page reloads
Live status: Status changes are immediately visible
More compact display: More entries at a glance

Info Drawer

A new, unified info area for all objects:

True Digital Sovereignty: Reclaim Cloud Freedom with Polycrate

Tue, 13 Jan 2026 13:05:15 +0000

The promise of the cloud has always been flexibility. Yet, the reality in many IT departments is different: Vendor Lock-in. Those who build their entire automation exclusively on AWS APIs, Azure-specific scripts, or Google Cloud tools find themselves in a “golden trap.” Switching providers or even distributing workloads to a European provider like STACKIT or Hetzner becomes an unaffordable mammoth task.

True digital sovereignty means retaining control over your own infrastructure logic. Polycrate is the tool that fulfills this promise.

How Polycrate Tames Heterogeneous Tool Stacks

Tue, 13 Jan 2026 12:45:23 +0000

Operating a modern IT infrastructure today often feels like being a mechanic who needs a different workshop for every screw. We use Terraform for cloud resources, Ansible for server configuration, Helm for Kubernetes apps, and a handful of Bash scripts to somehow hold everything together.

The result? The “cognitive load” for platform teams becomes overwhelming. No one on the team masters all the tools perfectly, knowledge is siloed, and errors in handoffs between tools are inevitable.

External Secrets Operator: The Reference Architecture for Hybrid Secrets Management

Tue, 13 Jan 2026 12:12:33 +0000

TL;DR

Tue, 13 Jan 2026 10:53:16 +0000

TL;DR

Authentik redefines identity management: moving away from proprietary cloud silos towards a unified identity layer. As an open-source solution, it integrates authentication, enrollment, and authorization in a highly flexible engine. Unlike cloud providers that lock user data in closed “user pools,” Authentik ensures full data sovereignty and portability of digital identities across all infrastructure boundaries.

1. The Architecture Principle: Unified Identity Layer

In traditional cloud setups, identity management is often fragmented. Applications use different logins or are tightly coupled to the cloud provider’s identity provider (IdP). This leads to “identity sprawl” and security gaps.

Observability 2.0: Gaining Deep Insights with eBPF

Tue, 13 Jan 2026 10:51:57 +0000

Until now, monitoring was often a compromise: Those who wanted to know exactly what was happening in their applications had to install “agents” or instrument the code with libraries (SDKs). This costs performance, makes the containers heavier, and annoys developers.

By 2026, eBPF has established itself as the standard that solves this problem. eBPF allows us to run programs directly in the Linux kernel—securely, efficiently, and completely transparently to the application. It’s like having an X-ray machine for our entire cluster.

No More Idle Time: Rightsizing Tools for Efficient Kubernetes Clusters

Tue, 13 Jan 2026 10:46:15 +0000

In the traditional server world, the mantra was: “Better too much RAM than too little.” In Kubernetes , this mindset leads directly to a bloated cloud bill. Since Kubernetes schedules Pods based on their Resource Requests, you pay for the space you reserve—regardless of whether your application actually uses it.

We call this phenomenon “Slack”. On average, enterprise Kubernetes clusters are overprovisioned by 30% to 50%. Rightsizing is the process of closing this gap between reservation and actual usage.

FinOps: Cloud Exchange - Safely Using Spot Instances in Kubernetes

Tue, 13 Jan 2026 10:40:35 +0000

Imagine getting the same computing power for 70% to 90% less cost. The catch? The cloud provider can take the server away from you at any time with just two minutes’ notice (AWS) or even just 30 seconds (Azure).

What is a nightmare for traditional servers is a huge opportunity for Kubernetes workloads. Since Kubernetes is fundamentally designed for pods to die and be reborn elsewhere, Spot Instances (or “Preemptible VMs”) are the perfect partner for a cost-effective cloud strategy in 2026.

ArgoCD: The Reference Architecture for Declarative GitOps on Kubernetes

Tue, 13 Jan 2026 10:29:24 +0000

TL;DR

ArgoCD has established itself as the industry standard for Continuous Delivery in Kubernetes . By implementing the GitOps paradigm, it transforms infrastructure management from imperative pipelines to declarative state management. This enables automated synchronization (“Self-Healing”), seamless auditability, and a strict separation of CI (Continuous Integration) and CD (Continuous Delivery).

1. The Architectural Principle: Pull Instead of Push

Traditional deployment tools operate on a “push-based” model. An external pipeline (e.g., Jenkins or GitLab CI) accesses the cluster and executes commands to apply updates. This poses a security risk as CI servers require extensive permissions within the cluster.

FinOps in Kubernetes - 20 Answers

Tue, 13 Jan 2026 10:00:19 +0000

FinOps in Kubernetes - 20 Answers

1. Why is the standard cloud bill for Kubernetes costs unusable? Cloud providers issue bills for instances (VMs). However, Kubernetes distributes these instances across many teams and apps. Without K8s-native tools, you only see the total sum, but not which service is causing the costs.

2. What is the difference between “Showback” and “Chargeback”? Showback makes costs visible to teams (raising awareness). Chargeback actually bills these costs to the teams or departments (financial responsibility).

Event-Driven Scaling with KEDA: When the Message Queue Controls the Cluster

Tue, 13 Jan 2026 09:10:32 +0000

The classic Horizontal Pod Autoscaler (HPA) of Kubernetes is like a thermostat: When the room gets too warm (CPU > 80%), the air conditioning kicks in. This works well for standard web apps but fails in modern, event-driven architectures.

What if your CPU load is low, but there are 10,000 unprocessed jobs in your Kafka queue? Or if your system needs to respond to a sudden spike of webhooks? This is where standard scaling reaches its limits. The solution for 2026 is KEDA (Kubernetes Event-driven Autoscaling).

Vault, External Secrets & CSI: The Ultimate Guide to Secret Management in K8s

Tue, 13 Jan 2026 08:58:21 +0000

“Base64 is not encryption.” This phrase should be displayed prominently in every platform engineering team. Default Kubernetes Secrets are merely encoded, not encrypted. Anyone with access to the API or the etcd backend can read passwords, API keys, and certificates in plain text.

By 2026, professional Secret Management is a fundamental requirement to meet Compliance mandates and minimize the risk of data theft through “Lateral Movement” within the cluster. We explore how to securely manage sensitive data without disrupting your developers’ workflow.

Policy-as-Code: Automating Compliance Enforcement

Mon, 12 Jan 2026 14:29:44 +0000

In 2026, compliance is no longer a “paper tiger.” With regulations like the Cyber Resilience Act or certifications such as ISO 27001 and TISAX, IT leaders face a daunting task: proving that security policies not only exist but are enforced seamlessly and continuously in their Kubernetes clusters.

Those relying on manual checks will fall behind. The solution is Policy-as-Code (PaC). This involves encoding organizational policies into machine-readable code, which is directly checked by the cluster gatekeeper (Admission Controller). The principle: “No deployment without a compliance check.”

Old Iron, New Shell: How to Modernize Legacy Monoliths with Kubernetes Sidecars

Mon, 12 Jan 2026 10:40:52 +0000

“We can’t move that to the cloud, it’s a monolith.” We hear this sentence often. However, modernization in 2026 doesn’t necessarily mean breaking down a mature Java or .NET application into tiny microservices (refactoring). Often, the faster and more economical route is re-platforming using the sidecar pattern.

Instead of touching the old code, we use Kubernetes to easily “attach” modern requirements like security, observability, and connectivity.

The Sidecar Approach: Help from the Side

In Kubernetes, multiple containers can run within a pod and share resources like the network (localhost). The main container (your monolith) remains untouched, while one or more sidecar containers take on supportive tasks.

K8s at the Point of Sale: Why Manufacturing and Retail are Turning to Edge Clusters

Mon, 12 Jan 2026 09:04:46 +0000

For a long time, Kubernetes was considered the operating system for the “big” data center. But in 2026, the most exciting developments are happening at the network’s edge. Whether it’s image processing in a factory’s quality control or inventory management in hundreds of retail stores, centralized cloud solutions are reaching their limits.

Latency issues, bandwidth costs, and the need for autonomy (offline capability) are driving Kubernetes out of the cloud and directly onto local hardware.

Developer Experience (DevEx): Why Your Platform Fails If It Doesn't 'Deliver'

Mon, 12 Jan 2026 08:55:36 +0000

When companies invest in Platform Engineering, 90% of resources often go into technology: Kubernetes clusters, CI/CD pipelines, and security scanners. However, the success of a platform is determined not by uptime, but by the Developer Experience (DevEx).

By 2026, DevEx is no longer a luxury topic for Silicon Valley giants. For the German Mittelstand, it is the only answer to the shortage of skilled workers. A platform that slows developers down with complex YAML deserts and ticket wait times will be ignored—or worse: it leads to frustration and turnover.

What Does an API Call Cost? Unit Economics for IT Decision Makers

Mon, 12 Jan 2026 08:48:23 +0000

In the traditional IT world, budgeting was simple: you bought a server, depreciated it over five years, and recorded the costs as a fixed expense. In the Cloud-Native world of 2026, this predictability is gone. Cloud bills are dynamic, complex, and often decoupled from actual business success.

Today, those using Kubernetes must ask more than just: “What is the monthly bill?” The crucial question is: “How much infrastructure cost does a single sale, an API call, or an active user incur?” Welcome to the world of Cloud Unit Economics.

Supply Chain Security with SBOM and Sigstore

Mon, 12 Jan 2026 08:42:03 +0000

Imagine buying a ready-made meal at the supermarket without an ingredient list. For years, this was the standard in software development: we download container images from the internet and trust that what’s inside matches the label. However, incidents like Log4j have shown that a single compromised library in the supply chain can cripple global infrastructures.

In 2026, Supply Chain Security is no longer a “nice-to-have.” With regulations like the EU Cyber Resilience Act (CRA), transparency over the software supply chain becomes a mandatory task for medium-sized businesses.

Disaster Recovery Strategies for Business-Critical K8s Workloads

Mon, 12 Jan 2026 08:37:24 +0000

Many IT managers in medium-sized businesses feel secure because they “do backups.” However, in a serious incident—such as a massive cloud provider outage, a ransomware attack, or a human error in the root config—they realize: A backup is not a recovery plan.

In the Cloud-Native world, Disaster Recovery (DR) means more than just restoring data. It means quickly restoring the entire application topology.

Backup vs. Disaster Recovery: A Crucial Difference

A backup is a copy of data. Disaster Recovery is the process framework to restore business operations within a defined time. Two key metrics play a major role:

Polycrate CLI 0.29.5 Released: Wildcard Endpoint API Sync Fix

Fri, 09 Jan 2026 15:00:00 +0000

With version 0.29.5, Polycrate receives a critical bug fix: Endpoints with wildcard hostnames like *.example.com can now be correctly synchronized with the API.

The Problem

Endpoints from Ingress resources with wildcard hostnames could not be synchronized with the Polycrate API. The API rejected the name with a 400 error:

unexpected status code: 400, response: {"name":["Name doesn't match RegEx..."]}

The Cause

The operator only replaced dots with dashes during endpoint creation, but not the wildcard asterisk:

Polycrate API 0.11.3 released: Workspace UUID Filter Fix

Fri, 09 Jan 2026 14:30:00 +0000

With version 0.11.3, the Polycrate API addresses a critical bug in the K8sCluster filter that impacted operator communication.

The Problem

The K8sClusterFilter only accepted workspace names for the workspace query parameter. However, the Polycrate Operator sends workspace UUIDs.

Consequence: The operator attempted to create a new cluster on each reconcile, even though one already existed:

IntegrityError: duplicate key value violates unique constraint "unique_k8s_cluster_per_workspace"

The Solution

The new filter_workspace() method automatically detects whether the value is a UUID or a name:

Polycrate CLI 0.29.4 released: Operator API Sync & TLS Port Fixes

Fri, 09 Jan 2026 14:00:00 +0000

With version 0.29.4, Polycrate receives critical bug fixes for the operator: Correct cluster detection with workspace UUIDs, automatic TLS port synchronization, and improved Node RBAC permissions.

Cluster API Filter Fix

The workspace filter in cluster search only accepted names, not UUIDs. Since the operator sends workspace UUIDs, existing clusters were not found, and the operator attempted to create a new cluster on each reconcile.

Fix: The filter now automatically detects whether the value is a UUID or a name and filters accordingly.

GreenOps on Kubernetes: Measuring and Optimizing CO2 Emissions per Microservice

Fri, 09 Jan 2026 13:45:25 +0000

In the IT world of 2026, sustainability is no longer just a marketing buzzword. With the expansion of EU reporting obligations (CSRD), IT decision-makers face a new challenge: they must not only estimate but accurately document the carbon footprint of their digital infrastructure.

The cloud was long considered “clean,” but the reality is more complex. An inefficiently scaling Kubernetes cluster is not only expensive but also wastes valuable energy. This is where GreenOps comes in—the discipline of integrating energy efficiency as a primary metric in the DevOps lifecycle.

Serving at the Limit: LLM Inference with vLLM and Triton on Kubernetes

Fri, 09 Jan 2026 12:39:00 +0000

When an AI model leaves the training phase, the real challenge begins: productive inference operation. Serving a Large Language Model (LLM) in a standard container is inefficient. Latencies are too high, and GPU utilization is often poor because traditional web servers are not built for the sequential nature of token generation.

To operate LLMs economically and efficiently in the mid-market, we need to combine Kubernetes with specialized Inference Engines and intelligent Batching.

Polycrate CLI 0.29.3 released: SSH-Agent Auto-Mount, Git Branch-Aware & Operator Fixes

Fri, 09 Jan 2026 12:00:00 +0000

With version 0.29.3, Polycrate introduces Host SSH-Agent Auto-Mount for seamless Git operations within the container, branch-aware Git commands, and important operator fixes.

Action Run Output Capture

Container output was not being sent to the Polycrate API with --docker-native (default since 0.28.0). The stdout field in ActionRun objects was empty.

Fix: NativeDockerBackend.Run() now uses io.MultiWriter to display and capture output simultaneously.

Block Config Submission

The block.poly configuration was not correctly submitted to the API, resulting in missing block configurations in the API.

Vector Databases on K8s: Performance Tuning for RAG Applications

Fri, 09 Jan 2026 11:16:53 +0000

In a Retrieval Augmented Generation (RAG) architecture, the vector database (Vector DB) is the core component. It provides the Large Language Model (LLM) with context from your enterprise data. However, while traditional databases are primarily optimized for disk I/O, vector databases like Qdrant, Weaviate, or Milvus impose entirely new demands on your Kubernetes infrastructure.

When the search for relevant documents takes too long, even the fastest GPU for inference is of no use. The User Experience (UX) of your AI app hinges on the latency of your vector search.

AI Observability: Monitoring LLMs and RAG Pipelines in Kubernetes

Fri, 09 Jan 2026 11:03:20 +0000

Anyone operating traditional microservices knows: metrics, logs, and traces are the lifeline. However, conventional monitoring approaches hit their limits with AI workloads. A CPU utilization of 10% tells us nothing about whether the response quality of a language model is currently dropping or if the vector search is inefficient.

To productively operate an AI platform in medium-sized businesses, we need an expanded understanding of Observability that bridges the gap between infrastructure (GPU/K8s) and model performance (LLM).

Europe's Export Hit: Personal Data

Fri, 09 Jan 2026 10:05:45 +0000

Europe likes to see itself as a global guardian of data protection and fundamental rights. GDPR , NIS2, AI Act – the regulatory claim is high, the rhetoric confident. In operational reality, however, a different picture emerges: personal data of European citizens and companies is systematically outsourced to infrastructures lying outside European legal and control spheres. Not illegal, but politically shortsighted. Not out of necessity, but out of convenience.

The current debate about Microsoft 365 in Switzerland and Bavaria exemplifies the pattern. Thirty Swiss data protection officers are openly warning against its use with sensitive data. In Bavaria, the state government under Markus Söder is nevertheless considering a long-term commitment to Microsoft. The arguments are everywhere the same: proven software, fast implementation, compatibility. The consequences are ignored.

Polycrate API 0.11.1 released: Alert Notification Loop disabled

Fri, 09 Jan 2026 10:00:00 +0000

With version 0.11.1, the automatic Alert Notification Loop in the Polycrate API is temporarily disabled. This is a patch release aimed at controlling notification behavior.

Changes

Alert Notification Loop Disabled

The periodic Celery task alert_notification_loop, which automatically sent notifications about incoming alerts every 5 minutes, has been temporarily disabled.

Before:

Task ran automatically every 5 minutes
Sent notifications via configured Notification Sinks (Mattermost, Slack, Email)

After:

Task is disabled and no longer runs
No automatic notifications for new alerts

Not Affected

The following features remain fully active:

Zero Trust for AI Workloads: Data Sovereignty in the Era of LLM and GPU Clusters

Fri, 09 Jan 2026 09:43:41 +0000

The introduction of Artificial Intelligence in small and medium-sized enterprises has opened a new security front. When we train LLMs or build RAG systems (Retrieval Augmented Generation), we move massive amounts of sensitive data through our Kubernetes cluster—often directly onto powerful GPU nodes.

The problem: The classic “perimeter defense” fails completely here. If an attacker gains access to a less secured monitoring pod, they must not be able to intercept training data or exfiltrate model weights. Zero Trust for AI is not a luxury but a prerequisite for productive use.

Advanced GPU Strategies for Efficient AI Clusters

Fri, 09 Jan 2026 09:30:14 +0000

Integrating an NVIDIA H100 or A100 into your cluster today quickly reveals that the classic 1-to-1 allocation (one pod reserves an entire GPU) often results in massive capital waste in a production environment. While training LLMs fully utilizes the hardware, GPUs often idle at 10% utilization during inference operations or in development environments.

To reduce the TCO (Total Cost of Ownership) of your AI infrastructure, we must move beyond simple allocation and delve deep into Resource Management.

Cloud-Native AI Pipelines: MLOps with Kubeflow vs. Ray

Fri, 09 Jan 2026 09:12:32 +0000

The excitement around Large Language Models (LLMs) and generative AI has brought a fundamental question back to IT departments: How do we scale Machine Learning (ML) workloads without creating parallel shadow IT?

Kubernetes has established itself as a foundation, but the choice of framework determines whether your data scientists work efficiently or get bogged down in infrastructure details. Kubeflow and Ray are two heavyweights with fundamentally different philosophies.

Kubeflow: The Orchestral Heavyweight

Kubeflow aims to provide a complete end-to-end MLOps platform based on Kubernetes. It is less of a single tool and more of a loosely coupled collection of components (Pipelines, Training Operator, Katib for hyperparameter tuning, KServe).

Internal Developer Platforms - Architectures for True Self-Service

Fri, 09 Jan 2026 08:55:58 +0000

In the past two years, “Internal Developer Platform” has become a buzzword. However, while Gartner praises the IDP as a remedy for developers’ cognitive overload, many internal projects end up as rigid abstraction layers that create more problems than they solve.

True self-service is not achieved through a fancy GUI but through a well-thought-out technical foundation that views infrastructure as a product.

The Core Issue: The “Abstraction Paradox”

Many platform teams make the mistake of completely hiding Kubernetes from developers. They build complex wrappers around Helm charts or use proprietary portals that cover only 80% of use cases. As soon as a team needs the remaining 20%—such as specific ingress tuning or a sidecar config—the model breaks down, and the manual ticket process returns.

From Server Keeper to Platform Architect: The Evolution of the IT Department

Thu, 08 Jan 2026 13:59:46 +0000

When discussing the shift to Cloud-Native and Kubernetes , we often focus on architecture, providers, and costs. However, the most critical variable in this equation is not the tech stack—it’s your team.

In the mid-sized business sector, experienced administrators often harbor an underlying skepticism towards the cloud. The fear of being replaced by automation or losing control over “their” hardware is real. As an IT decision-maker, it is your task to transform this fear into curiosity and pave the way from the classic admin to the modern Platform Engineer.

High Availability in Medium-Sized Businesses: Escaping the Cost Trap with Kubernetes

Thu, 08 Jan 2026 13:12:48 +0000

For critical applications, “down-time” is no longer just a technical issue for medium-sized businesses, but a direct business risk. However, the traditional response to high availability (HA) has been: Double infrastructure = double costs. A model that breaks many budgets.

With Kubernetes (K8s), this paradigm shifts. HA is no longer an expensive add-on but a native feature of orchestration—provided you understand the levers for economic redundancy.

HA is not a binary state but a design decision

IT decision-makers today must define which service level (SLA) is truly business-critical for each application. Kubernetes allows us to implement high availability in a modular and thus affordable way. Instead of maintaining monolithic clusters redundantly, we use K8s mechanisms for intelligent failover management.

Efficiency Over Cost Shock: Why Kubernetes is the Heart of Your FinOps Strategy

Thu, 08 Jan 2026 12:56:47 +0000

We don’t need to explain that FinOps is the answer to uncontrolled cloud spending. The challenge for IT decision-makers in medium-sized businesses today lies elsewhere: How can cost responsibility and technical scalability be intertwined so that the cloud doesn’t become a bottomless pit?

The answer often doesn’t lie in the billing tools of the hyperscalers, but in how you orchestrate your Kubernetes infrastructure . Kubernetes is more than a container tool—when properly configured, it is your most efficient FinOps machine.

AWS EKS Alternative: Carefree Kubernetes with ayedo

Thu, 08 Jan 2026 12:01:51 +0000

Kubernetes has long been the standard when it comes to scalable and highly available software platforms. Anyone wanting to operate Kubernetes in the cloud sooner or later ends up at AWS EKS (Elastic Kubernetes Service) – one of the best-known managed Kubernetes offerings worldwide.

But especially for companies based in Germany or the EU, different questions than just performance and feature lists are increasingly arising:

How sovereign is the operation really? How does it stand with data protection, compliance , and auditability? How transparent are costs and support?

Digital Sovereignty in Live Operation: Why Schleswig-Holstein Sets Standards with Open Source

Thu, 08 Jan 2026 10:46:58 +0000

The decision by the state government of Schleswig-Holstein to consistently switch its administration to open source software is more than a political signal. It is a real, technically demanding transformation of a complex IT landscape – under full load, with around 60,000 employees, ongoing judicial and administrative operations, and clear strategic goals. This is precisely why this step is exemplary.

The oft-cited phrase “open source is difficult” falls short. The actual statement of this project is: Digital sovereignty is achievable – if you are willing to take responsibility for your own IT.

Sovereignty Barometer: How Dependent Public IT Really Is

Thu, 08 Jan 2026 10:20:27 +0000

Digital sovereignty has long been part of every public sector digital strategy. However, the Sovereignty Barometer of public IT by next:public shows how large the gap between aspiration and reality is. The study provides resilient figures – and they paint a clear picture of structural dependency.

1. The Core Finding: Dependency Is the Normal State

The barometer is based on a survey of public sector IT managers. The central finding is unambiguous:

Data Leakage from Owncloud & Nextcloud: Operations Failed, Not the Software

Thu, 08 Jan 2026 09:23:54 +0000

Current reports of massive data leakage from self-hosted Owncloud, Nextcloud, and ShareFile instances are technically unspectacular – and that is exactly what makes them so problematic. There was no zero-day, no compromised encryption, no architectural flaw in the software. Access was gained using valid user accounts. In some cases, with credentials that were years old.

Those who derive an “open source problem” from this fundamentally misjudge the situation.

What Happened?

Attackers used credentials that were previously snatched from end devices via so-called infostealer malware. Redline, Lumma, Vidar, and similar variants extract stored passwords, browser data, and session information. This data does not end up in attacks immediately, but often for months or years in log collections traded on underground marketplaces.

Weekly Backlog Week 3/2026

Thu, 08 Jan 2026 08:57:54 +0000

🧠 Editorial

Digital sovereignty is often invoked as long as it remains abstract. As a target image. As a vision. As a strategy paper. However, as soon as it demands concrete decisions—different providers, different contracts, different responsibilities—it becomes uncomfortable. This week, it becomes very clear who truly means sovereignty and who merely manages it.

Studies, reports, and real projects paint a consistent picture: The dependencies are known, the alternatives exist, the knowledge is available. What is missing is consistency. And the willingness to trade short-term convenience for long-term control.

GPU Orchestration: The Foundation for Scalable AI

Wed, 07 Jan 2026 10:29:14 +0000

Almost every modern company is working on an AI strategy today. Whether it’s Large Language Models (LLMs), image recognition in quality control, or predictive analytics, the demand for computing power is enormous. However, while algorithms are becoming increasingly precise, IT departments face a new, physical challenge: GPUs (graphics processing units) are expensive, hard to come by, and their management differs fundamentally from traditional IT infrastructure.

Without intelligent GPU orchestration, companies risk their AI projects either failing due to skyrocketing costs or being stuck in rigid silos that don’t allow for scaling.

Polycrate API 0.11.0 released: Downtime Detection & Notification System

Wed, 07 Jan 2026 10:00:00 +0000

With version 0.11.0, the Polycrate API gains two key new features: Downtime Detection & Logging for automatic capture and SLA tracking of service outages, and a Notification System for multi-provider notifications.

Downtime Detection & Logging

Centralized capture and tracking of service downtimes with full SLA integration.

Highlights:

Automatic Downtime Detection: Downtimes are automatically created when ManagedObjects transition to an unhealthy state
SLA Tracking: Calculation of actual availability based on target SLA
Multi-Object Support: A downtime can track multiple affected objects
Activity Aggregation: All activities during a downtime are automatically linked
Post-Mortem via Notes: Integration with the notes system for documentation

Downtime Kinds:

Scaling Without Falling into a Cost Trap: Infrastructure Optimization for Growing Businesses

Wed, 07 Jan 2026 09:40:29 +0000

“The cloud grows with your needs.” This promise is both a blessing and a curse. For growing businesses, cloud scalability is essential to keep up with increasing user numbers and data volumes. However, in practice, rapid growth is often followed by shock: the monthly bills from hyperscalers rise faster than revenue.

To scale successfully, it’s not enough to simply book more resources. Infrastructure must be optimized to remain efficient and cost-transparent. Learn why traditional management approaches can become cost traps when scaling and how intelligent orchestration can help you grow healthily.

Zero Trust in Production: Why the Firewall Alone Is No Longer Enough

Wed, 07 Jan 2026 09:05:25 +0000

Zero Trust in Production: Why the Firewall Alone Is No Longer Enough

For decades, the security strategy in industry was clearly defined: A strong “moat” (the perimeter firewall) protects the internal machine network from the outside world. But in the connected Industry 4.0, this model is crumbling. Once malware—such as through an infected technician’s laptop or a compromised remote maintenance interface—enters the internal network, it often has free rein. This is where the Zero Trust model comes in. The principle: “Trust no one, verify everyone.” Learn how micro-segmentation within Kubernetes prevents a small incident from becoming a fatal production halt. The problem: The risk of lateral movement In traditional, “flat” networks, compromised systems can communicate freely with other devices in the same segment. Hackers exploit this for so-called lateral movement: They jump from a less critical system (e.g., a display panel) to the central controls of the production line. The dangers of flat network structures:

Polycrate CLI 0.29.2 released: Operator Bugfixes and Self-Reference Panic Fix

Tue, 06 Jan 2026 18:00:00 +0000

With version 0.29.2, Polycrate receives an important bugfix release with corrections for the Kubernetes Operator and critical panic fixes.

Operator: Log Level is Respected

The Operator previously always used DEBUG logging, regardless of configuration. Now the --loglevel flag is correctly respected:

Log Level	Output
1 (default)	INFO, WARN, ERROR
2	DEBUG messages visible
3	Maximum verbosity

Operator: Metrics Use API ID

The Prometheus metrics of the Operator (polycrate_io_endpoint_id) previously used the Kubernetes UID instead of the Polycrate API ID. This led to mismatches when correlating metrics with API data.

NIS2 in the Factory Hall: Compliance through Automation

Tue, 06 Jan 2026 15:11:39 +0000

The grace period for cybersecurity in the industry is coming to an end. With the new EU directive NIS2 (Network and Information Security Directive), significantly more companies are now classified as “essential” or “important” entities. This means that the responsibility for the security of Operational Technology (OT) is directly in the focus of management – with the threat of severe fines. However, NIS2 should not only be seen as a regulatory burden. It is an opportunity to replace outdated, insecure structures in production with modern, resilient standards.

Avoiding Production Downtime: How Self-Healing Infrastructures Relieve OT

Tue, 06 Jan 2026 14:55:28 +0000

Avoiding Production Downtime: How Self-Healing Infrastructures Relieve OT

In the world of Operational Technology (OT), equipment availability is the most crucial metric. An unplanned downtime in the production line often costs several thousand euros per minute. Previously, a software error or the crash of an edge gateway meant waiting for a technician, manual troubleshooting, and a lengthy restart. Modern Cloud-Native technologies bring a concept to the factory floor that radically minimizes this risk: Self-Healing. Learn how an intelligent infrastructure detects and resolves software errors before the worker on the line even notices. The problem: The “silent” failure in production.

Air-Gapped Kubernetes: Cloud-Native Power for Closed Production Networks

Tue, 06 Jan 2026 14:48:59 +0000

In modern software development, “always online” is the standard paradigm. However, in industrial manufacturing (OT), healthcare, or critical infrastructure, the reality is often different: systems are operated in air-gapped environments. This means these networks are physically or logically completely isolated from the public internet—a proven method for protection against cyberattacks and industrial espionage. This isolation was long considered an obstacle to modern IT methods. But today, it is clear: Cloud-Native technologies like Kubernetes can be successfully deployed in isolated networks if the architecture is fundamentally adapted.

Digital Security in a Foreign Jurisdiction: Why the BSI Portal on AWS Is a Political Mistake

Tue, 06 Jan 2026 14:27:29 +0000

A portal for more security – on an insecure foundation? With the launch of the central BSI portal for NIS2 reports, the Federal Office for Information Security (BSI) is pursuing an important goal: more overview, faster reactions, and a clear point of contact for operators of critical infrastructure. A “one-stop shop” for cybersecurity is to be created – and that is fundamentally to be welcomed.

But what sounds like progress at first glance raises serious questions upon closer inspection. Because: the new portal runs, of all things, on the cloud infrastructure of Amazon Web Services (AWS) – a US hyperscaler that is not subject to the European legal framework. What sounds like a technical detail is in truth a strategic and political decision with far-reaching consequences.

Polycrate CLI 0.29.1 released: Ansible Upgrade and Secrets Registry Merge

Tue, 06 Jan 2026 14:00:00 +0000

With version 0.29.1, Polycrate receives an important maintenance release with an Ansible upgrade for kubernetes.core compatibility.

Python & Ansible Upgrade

Upgrade from Python 3.11 to 3.12 and Ansible 10.7.0 to 13.2.0 to access modern Ansible modules.

Component	Old	New
Python	3.11	3.12
Ansible	10.7.0	13.2.0
ansible-core	2.17.x	2.20.1
kubernetes.core	~3.x-5.x	>= 6.1.0

Background: The take_ownership parameter for kubernetes.core.helm was added in version 6.1.0. This allows the takeover of existing Kubernetes resources during Helm upgrades.

Weekly Backlog Week 2/2026

Tue, 06 Jan 2026 13:16:41 +0000

Editorial: Patching is not a Nice-to-have

Week 2 feels like a déjà vu on repeat. Critical security vulnerabilities, political dependencies, cloud lock-ins – all known, all documented, yet everything continues as before. While conferences on digital sovereignty are held, productive systems remain unpatched online. While reliance is placed on “proven platforms,” prices and dependencies rise. And while authorities often point to responsibility, it surprisingly often ends exactly at their own jurisdiction.

Europe Outsourcing Its Administration to Microsoft – and Losing Control in the Process

Tue, 06 Jan 2026 12:52:25 +0000

A critical analysis of digital sovereignty in Germany and Switzerland

While European governments emphasize the importance of digital sovereignty in Sunday speeches, the reality of public IT infrastructure tells a different story: authorities at all levels continue to systematically rely on Microsoft – and thus on a US corporation that has factually become the digital backbone of entire administrative units. Not out of necessity, but out of convenience. Not for lack of alternatives, but despite better options.

MongoBleed: When Negligence Becomes a Security Flaw

Tue, 06 Jan 2026 12:36:19 +0000

Germany in Third Place – But Not in Patching

Shortly before the end of 2025, what had long been practice became known: Over 11,500 MongoDB instances in Germany are freely accessible via the internet and vulnerable to a critical security flaw known as MongoBleed. Globally, Germany thus occupies a sad third place – right behind China and the USA. Particularly piquant: No hoster worldwide counts more vulnerable instances than Hetzner, a German provider.

Why Ingress-NGINX Should Have Been Retired – and Why It Lives On Anyway

Tue, 06 Jan 2026 12:28:40 +0000

The announcement by Kubernetes SIG Network to retire Ingress-NGINX was not an operational accident. It was the result of years of structural overload – and it was right. Not convenient, not popular, but necessary. The fact that this retirement is now being cushioned by Chainguard does not change the diagnosis. But it prevents an overdue decision from becoming an operational disaster.

Ingress-NGINX was for a long time the backbone of the Kubernetes ingress world. Available early, flexible, usable everywhere. It was precisely these properties that made it the quasi-standard. And that is exactly where the problem lay. The enormous adoption was in no proportion to the actual maintenance base. Critical infrastructure processing billions of requests was factually carried by a handful of maintainers – often unpaid, often on the side, often under permanent alert readiness.

GitOps in the Factory: Software Rollouts for 100 Locations Simultaneously

Tue, 06 Jan 2026 12:01:21 +0000

In the software world, “Continuous Delivery” is standard. However, in the industrial sector, the reality is often different: Updates for machine controls or edge gateways are frequently still applied manually via USB stick or through insecure VPN connections – site by site. With 100 plants worldwide, this is not only inefficient but also a massive security risk. The solution to this scaling problem is GitOps. Learn how we at ayedo use tools like ArgoCD to make software rollouts in the factory as secure and simple as they are on the web.

Making Legacy Machines Cloud-Ready: Retrofitting with Container Gateways

Tue, 06 Jan 2026 11:31:48 +0000

Making Legacy Machines Cloud-Ready: Retrofitting with Container Gateways

In many German factories, the backbone of our industry stands strong: reliable machines that have been operating efficiently for 10, 15, or even 20 years. Mechanically, these systems are often in top shape, but technically isolated. They don’t speak Cloud-Native, don’t understand JSON, and are invisible to modern data analysis. However, replacing a million-dollar investment is often uneconomical. The solution is Industrial Retrofitting using Container Gateways . Learn how to integrate your PLCs (Programmable Logic Controllers) into a modern Kubernetes infrastructure without touching the hardware. The problem: When the PLC doesn’t speak to the cloud.

Edge Computing with Kubernetes: Container Orchestration on the Factory Floor

Tue, 06 Jan 2026 11:25:46 +0000

In theory, the cloud sounds like the perfect solution for everything. In the practice of industrial manufacturing, however, it often reaches its limits—and those are the limits of physics. When milliseconds determine the quality of a component, the path to a remote data center is too far. The solution: Edge Computing. And the tool of choice to manage this efficiently? Kubernetes . Why the cloud alone is not enough in the factory

Cloud-Native Without Cloud Lock-in: Why Portability is the New Security

Tue, 06 Jan 2026 11:21:50 +0000

Cloud-Native Without Cloud Lock-in: Why Portability is the New Security

When discussing modern IT infrastructure today, it’s impossible to overlook the big names like AWS, Google Cloud, or Azure. They offer convenience, speed, and an almost endless list of features. However, this convenience often comes at a high price: Vendor Lock-in.

In this post, you’ll learn why independence from a specific provider (portability) is no longer a “nice-to-have” but a strategic security component for every digital enterprise.

From Sensor to Cloud: Scalable Infrastructures for Industry 4.0

Tue, 06 Jan 2026 11:14:51 +0000

In modern manufacturing, the question is no longer if data is collected, but how it can be used efficiently. While machines (OT – Operational Technology) deliver gigabytes of telemetry data every second, many companies struggle to bridge the gap to the IT world.

The path from the sensor to the Cloud is the critical lifeline for Industry 4.0. But how do you build an infrastructure that not only works today but also scales with increasing data volumes?

Polycrate CLI 0.29.0 released: Operator Auto Workspace Resolution and Tools Overhaul

Tue, 06 Jan 2026 10:00:00 +0000

With version 0.29.0, Polycrate receives significant improvements for the Kubernetes Operator and integrated CLI tools.

Operator Auto Workspace Resolution

The Polycrate Operator now automatically detects the associated Workspace and Organization based on the Agent Token. No more manual UUID configuration required!

Before (< 0.29.0):

spec:
  api_sync:
    enabled: true
    credentials_ref:
      secret_name: polycrate-api-creds
      token_key: token
    workspace_id: "550e8400-e29b-41d4-a716-446655440000"  # Manual!
    organization_id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"  # Manual!

After (0.29.0+):

spec:
  api_sync:
    enabled: true
    credentials_ref:
      secret_name: polycrate-api-creds
      token_key: token
    # workspace_id and organization_id are automatically derived!

Benefits: Easier installation, fewer sources of error, and automatic synchronization with the Polycrate API.

Polycrate CLI 0.28.0 released: Workspace Encryption, Kubernetes Operator, Endpoint Monitoring

Sun, 04 Jan 2026 12:00:00 +0000

With version 0.28.0, Polycrate receives its most comprehensive feature update yet. Three core areas are in focus: secure workspace encryption, an integrated Kubernetes Operator for automated cluster management, and real-time endpoint monitoring.

Workspace Encryption: Securely Manage Sensitive Data

Infrastructure-as-Code often means that sensitive information like credentials, API keys, or certificates end up in the repository. With the new Workspace Encryption, you can now securely store this data in an encrypted secrets.poly.

Weekly Backlog Week 53/2025

Wed, 31 Dec 2025 04:51:55 +0000

🧠 Editorial – New Year’s Eve with Residual Logfiles

December 31, 2025. While many tech year-in-reviews pretend everything was a feature release, these last days of the year deliver an uncomfortably clear message: We don’t have a knowledge problem. We have an execution problem.

Whether it’s the Chaos Communication Congress, domain chaos at the federal level, or the Germany Stack – analyses, warnings, and alternatives are laid out openly everywhere. Yet digital sovereignty remains a political footnote, an organizational pilot project, and technically often a fig leaf on proprietary platforms.

Weekly Backlog Week 52/2025

Wed, 24 Dec 2025 05:39:34 +0000

Editorial

Christmas Eve is traditionally the moment when you convince yourself that nothing critical will happen this year. The pagers are silent, the deployment windows are closed, and somewhere a “fix after the holidays” is hastily noted in a ticket.

2025 does not adhere to this convention. Instead of a year-end review, Week 52 delivers a condensed lesson on what it was all about: Trust in infrastructure, power over rules, and the question of who really controls systems.

Weekly Backlog Week 51/2025

Mon, 15 Dec 2025 09:30:17 +0000

Editorial

Anyone who still claims this week that security, resilience, or digital sovereignty are mere implementation details hasn’t been paying attention. Or didn’t want to. The topics in this issue have nothing to do with zero-days or “highly complex attacks.” They are about valid credentials, deliberate political decisions, and structural convenience.

The common thread: Control is delegated—to tools, providers, processes, or simply to “later.” And later is surprisingly often exactly when things go wrong.

MinIO in Maintenance Mode

Thu, 04 Dec 2025 11:12:26 +0000

What Operators Face Now – and Which Alternatives Are Truly Viable

MinIO has put its Community Edition into maintenance mode. The note in the README is brief, but the implications are large: a project that for ten years was a central tool for on-premise S3 is stopping development as of now. For many teams, this is more than a minor note – it affects productive systems, backup strategies, Kubernetes workloads, and in some cases entire data flows.

Weekly Backlog Week 50/2025

Thu, 04 Dec 2025 10:26:57 +0000

🧠 Editorial

There are weeks when tech not only makes headlines but causes tectonic shifts. Open Source is losing crucial pillars, hyperscalers are making their dependencies truly expensive for the first time, critical infrastructure repeatedly shows cracks – and while Europe is waking up to security policy, Washington openly uses technology as a geopolitical leverage. In short: The coming years will be less about tools and more about power dynamics.

Operating Nextcloud Sovereignly: Why the "How" is Decisive

Mon, 01 Dec 2025 11:22:20 +0000

Nextcloud stands for digital independence, European data protection standards, and an open, trustworthy alternative to US-based collaboration solutions like Microsoft 365 or Google Workspace. No wonder, then, that more and more providers are advertising Managed Nextcloud services – often combined with attractive entry-level prices and the promise of full sovereignty.

But a closer look at the offers is worthwhile. Because the question is not just whether Nextcloud is used, but how it is operated: Who has control over infrastructure and data? How transparent are the costs? How flexible is the solution in practice?

Sovereign Washing

Thu, 27 Nov 2025 10:06:37 +0000

How Seemingly “Sovereign” Cloud Offerings Disguise Dependencies – and What ZenDiS Clarifies

Digital sovereignty has taken a firm place in political strategies, administrative modernization, and IT planning in recent years. In light of geopolitical tensions, growing cyber risks, and international legal conflicts, the question of control over digital infrastructures is no longer abstract. It determines the ability to act, security, and economic stability.

With its new whitepaper, the Center for Digital Sovereignty of Public Administration (ZenDiS) shows how large the gap between marketing promises and actual technical independence is for many cloud offerings. The term “Sovereign Washing” describes a problem increasingly visible in the market: services are advertised as sovereign but fulfill the necessary requirements only to a very limited extent.

Weekly Backlog Week 49/2025

Thu, 27 Nov 2025 09:22:54 +0000

Editorial

Europe has been discussing digital sovereignty for over a decade. One might assume that the debate is now conducted at a certain altitude: sober, realistic, strategic. Yet instead of a vision, we are witnessing a poor reboot of old discussions.

This week exemplifies where we stand:

ZenDiS patiently reiterates what sovereignty actually means.
Switzerland draws very clear conclusions.
GitLab reminds admins that security teams cannot rest.
And in the EU Parliament, some prefer to discuss keyboards over infrastructure.

Europe is not too late – but time is running out.

Bavaria's Digital Strategy: Mia san Microsoft

Tue, 25 Nov 2025 10:13:29 +0000

With the new digital strategy, Bavaria wants to technically mesh state and municipalities more closely, reduce IT security risks, and build a uniform digital infrastructure. At the center are a central IT architecture, a stronger role for the State Office for Security in Information Technology (LSI), and a reorganization of the municipal IT landscape. However, the draft shows above all one thing: a strategic restraint towards European technology – combined with a high level of trust in American platform providers.

ayedo Shows What Resilient Infrastructure Should Look Like

Fri, 21 Nov 2025 09:44:32 +0000

The recent outages of central internet services have not only disrupted websites and APIs. They have revealed a structural problem that has been emerging for years: Europe’s digital economy builds on infrastructures that are globally distributed but centrally controlled. When such platforms waver, it’s not just a tool that stands still – it shows how fragile the basic supply really is.

In such moments, it becomes clear what many companies push aside: they operate software, but they do not own their operational stability. Resilience does not arise through trust in large platforms, but through architectural control. And precisely here, ayedo delivers an approach that thinks of the term “infrastructure” more technically and more European than most providers in the market.

Weekly Backlog Week 48/2025

Wed, 19 Nov 2025 08:56:57 +0000

Editorial

This week, Europe once again loudly proclaimed ‘Digital Sovereignty!’—only to often do the opposite in practice. Austria delivers, Germany holds conferences, Bavaria capitulates to Microsoft, and the EU tries to simplify regulation while opening new gray areas in critical spots. Meanwhile, a U.S. sanctions case shows how quickly a European judge can be digitally disempowered. None of this is coincidental. It reflects the state of a region that preaches sovereignty but still fails to make decisive choices. It’s high time to clear the fog.

NIS2 in Germany: A Law Between Late Implementation and Structural Half-Heartedness

Fri, 14 Nov 2025 10:16:13 +0000

Germany has transposed the European NIS2 directive into national law with considerable delay. The late implementation alone would already be politically problematic – it stands for years of standstill in cybersecurity and for a structural inability to transpose European minimum standards quickly and coherently into German law. But the substantive decisions weigh heavier than the time lag.

The new law is intended to better protect critical infrastructures, harmonize cybersecurity requirements, and give the Federal Office for Information Security (BSI) more extensive supervisory powers. Provisions include reporting obligations for security incidents within 24 hours, mandatory emergency plans, risk analyses, and technical protective measures. Around 29,000 companies are expected to fall under these requirements in the future – significantly more than before.

Kubernetes Announces the End of Ingress NGINX

Thu, 13 Nov 2025 13:15:12 +0000

Kubernetes SIG Network and the Security Response Committee have announced the official end for Ingress NGINX. The component, which for years was among the most used ingress controllers in the Kubernetes ecosystem, will only receive best-effort maintenance until March 2026. After that, no releases, no bugfixes, and no security updates will be provided. Existing installations will continue to work, and all artifacts will remain available – however, without any guarantee for future security or stability.

Runtime Bugs: Threat to Docker Hosts

Thu, 13 Nov 2025 11:18:11 +0000

Containers are the backbone of modern cloud infrastructure. They offer developers and ops teams unmatched agility and efficiency, based on the promise of robust isolation. However, this foundation is regularly tested. The discovery of critical runtime bugs that allow attackers to escape a container and gain root access on the host system is a serious warning.

The Crack in Isolation

The core principle of container technologies is separation: the container should not have access to the host operating system. This isolation is primarily ensured by Linux features like namespaces and cgroups and managed by the so-called container runtime (runc is a well-known example).

Transatlantic Access to Biometric Data: Disagreement Among EU Member States

Thu, 13 Nov 2025 10:57:25 +0000

The US government has been demanding a comprehensive agreement on access to biometric police data from Europe for several years. The basis is the planned “Enhanced Border Security Partnership” (EBSP), which is intended to apply to all 43 states of the American Visa Waiver Program. Anyone who does not sign a corresponding agreement by the end of 2026 risks losing visa-free entry to the USA.

A council document published by the NGO Statewatch now shows how differently EU members assess the US demands. The majority of states signal fundamental willingness to negotiate but demand clear conditions and limitations. The range extends from strict rejection of direct US access to far-reaching openness for automated queries.

Weekly Backlog Week 47/2025

Thu, 13 Nov 2025 10:42:34 +0000

Weekly Backlog #47 — Digital Sovereignty? I have a few questions…

Editorial

Welcome to a week where Europe once again demonstrates how to 1) sell rights, 2) neglect infrastructure, 3) dilute laws, and 4) still believe in being digitally sovereign. Meanwhile: Kubernetes abandons a central component of its ecosystem, the German government suddenly discovers billions in the sofa, and Cloudflare decides to briefly shut down the internet.

In short: A classic week.

BSI: Guide to Avoiding Evasion Attacks on LLMs

Thu, 13 Nov 2025 10:41:35 +0000

Evasion Attacks on LLMs: A BSI Guide to Defending Against Prompt Injections and Jailbreaks

Large Language Models (LLMs) have become established in many areas from customer support to software development, but they also bring new security risks. A growing and subtle threat is posed by so-called Evasion Attacks. In these attacks, adversaries attempt to manipulate the model during operation to provoke undesirable or dangerous behaviors. In the literature, these attacks are often referred to as (indirect) Prompt Injections, Jailbreaks, or Adversarial Attacks.

Weekly Backlog Week 46/2025

Mon, 10 Nov 2025 09:28:22 +0000

Editorial

Digital sovereignty used to be a tech topic. In 2025, it’s power politics: Whoever controls GPUs, clouds, and networks controls value creation. This week: Pinocchio PR in the Valley, Bavaria hands out loyalty points at Microsoft, the Louvre time travels with Windows 2000, and Munich declares AI training not a legal vacuum. Europe, find a plan, not a label.

The Tech News of the Week

Sam Altman, the Pinocchio of Silicon Valley

“A lie keeps growing and growing, until it’s as plain as the nose on your face.” What Disney once taught children is now an apt description of Sam Altman’s communication style.

LLMs as Weapons: A New Era of Cyber Threats

Mon, 10 Nov 2025 08:49:27 +0000

The rapid development of Artificial Intelligence, particularly Large Language Models (LLMs) like Google Gemini or OpenAI’s ChatGPT, has the potential to revolutionize our world. Unfortunately, these powerful tools have not gone unnoticed by cybercriminals. Threat actors have long moved from mere productivity enhancement (e.g., crafting better phishing emails) to the active weaponization of AI in malware and attack methods.

The Google Threat Intelligence Group (GTIG) warns that we are entering a new phase of AI-driven cyber warfare.

From Zero to Production: The Complete ayedo SDP Workflow in an Example

Sun, 09 Nov 2025 12:00:00 +0000

TL;DR

Starting point is a multi-tenant Django SaaS application, which is taken from the first line of code to production operation on the ayedo Software Delivery Platform (SDP).
The workflow follows a clear path: GitLab repository → Packaging with ohMyHelm → GitLab CI/CD → Container and Chart Registry in Harbor → Secrets in Vault via External Secrets Operator → GitOps deployment with ArgoCD on Kubernetes → TLS with Cert-Manager → Network security with Cilium → Observability with VictoriaMetrics and central logs → Alerting → Backups and disaster recovery with Velero .
Along this path, the requirements from GDPR , NIS-2 , DORA , Cyber Resilience Act , Data Act , and European cloud sovereignty are systematically addressed: data minimization, traceability, security-by-design, resilience, and portability.
Result: A production-ready, observable, and hardened platform solution for multi-tenant SaaS, technically and organizationally prepared for European regulation.
ayedo provides a pre-configured, auditable platform with the SDP and supports teams with architecture, implementation, and end-to-end demos so that this workflow is not theoretical but can be productively used in your own company.

The Scenario: Bringing a European Django SaaS to Production

Imagine you are responsible for a multi-tenant Django SaaS product for companies in regulated industries: personal data, business-critical workflows, demanding customer audits. The application must run tenant-secure, highly available, and auditable – ideally on a European, sovereign platform.

Multi-Tenant vs. Whitelabel: Deployment Strategies for SaaS Providers

Sat, 08 Nov 2025 12:00:00 +0000

TL;DR

Multi-Tenant deployments consolidate many customers in a shared environment with logical isolation (e.g., via namespaces), enabling economies of scale, easy updates, and unified security and compliance controls.
Whitelabel deployments rely on one installation per customer with dedicated infrastructure, supporting maximum isolation, flexible customer specifications, and clear responsibilities for regulatory requirements such as GDPR , NIS-2 , and DORA .
From a compliance perspective, both Multi-Tenant and Whitelabel can be cleanly designed – the key is conscious architectural decisions regarding tenant isolation, data sovereignty, and ICT third-party risk in light of the Cyber Resilience Act and Cloud Sovereignty Framework .
The ayedo SDP supports both scenarios: Multi-Tenant with secure namespace isolation, network policies, and fine-grained RBAC; Whitelabel with a cluster-per-tenant approach, ArgoCD ApplicationSets, and automated provisioning via Polycrate.

Multi-Tenant vs. Whitelabel: Architectural Decisions with a Compliance Focus

Deployment strategies are no longer just a technical detail for SaaS providers. They directly influence:

Managed Backing Services: PostgreSQL, Redis, Kafka on ayedo SDP

Fri, 07 Nov 2025 12:00:00 +0000

TL;DR

Managed Backing Services on the ayedo SDP shift the focus from operations to usage: PostgreSQL, Redis/Valkey, and Kafka are available as robust, integrated services without your teams having to manage clusters themselves.
CloudNativePG brings PostgreSQL as a Kubernetes-native engine to your platform: automated backups, high availability, connection pooling, and Vault integration cover key requirements from GDPR , NIS-2 , and DORA .
Redis/Valkey and Kafka ideally complement PostgreSQL: caching, message queues, and event streaming are available as standardized, highly available building blocks that integrate seamlessly into existing application landscapes.
Compliance requirements such as encryption, backup strategies, business continuity, and disaster recovery can thus be implemented as platform functions rather than project-specific solutions – reusable for all teams.
On the ayedo SDP, you receive these backing services as managed components of your Kubernetes landscape – including technical and organizational compliance support and a curated backing services portfolio in the Backing Services Catalog.

Managed Backing Services: Usage over Operations

For many engineering leaders, the primary goal is clear: deliver functional features, not operate databases and message brokers. Yet, the operations, patches, backups, and HA design of PostgreSQL, Redis, or Kafka often fall to the same teams that should be advancing business logic.

Polycrate: Deployment Automation for Kubernetes and Cloud Migration

Thu, 06 Nov 2025 12:00:00 +0000

TL;DR

Polycrate is an Ansible-based framework for deployment automation that containerizes all necessary tools, enabling reproducible deployments across different environments—from bare metal to Kubernetes.
Core concepts like Blocks, Workspace, and Actions allow for modular, versionable, and auditable representation of complex cloud migrations and Day-2 operations.
For cloud migrations, PolyHub provides free Blocks to migrate managed services from hyperscalers like AWS RDS, ElastiCache, or S3 to Kubernetes-native alternatives like CloudNativePG, Redis, or MinIO—a practical lever for Data Act-compliant cloud switching.
Polycrate supports the implementation of requirements from the Data Act , NIS-2 , DORA , and the Cyber Resilience Act by enabling reproducible, documented, and provider-independent deployments.
ayedo uses Polycrate and the PolyHub to pragmatically support companies in cloud migration, Kubernetes platform development, and compliance-oriented infrastructure automation.

Polycrate as a Framework for Deployment Automation

Polycrate addresses a common but structural problem in modern infrastructures: the actual complexity rarely lies in a single tool but in the integration and operation of entire toolchains—across multiple providers, regions, and environments.

Kubernetes Make or Buy – Considerations for Decision Makers

Thu, 06 Nov 2025 11:30:46 +0000

Kubernetes Make or Buy – Considerations for Decision Makers

In few other technology sectors is there such passionate debate about self-management versus outsourcing as with Kubernetes .

The technology is young, powerful, standardized – and at the same time, relentlessly complex. It symbolizes progress, modernity, and sovereignty.

But a closer look reveals: Kubernetes is not the new “vSphere” that you install once and then “just let it run.” It is a living, rapidly evolving platform that resembles a software ecosystem more than an infrastructure.

Kubernetes is the Operating System of the Sovereign Cloud

Thu, 06 Nov 2025 10:16:35 +0000

Kubernetes is the Operating System of the Sovereign Cloud

Few technologies have fundamentally transformed modern IT as much as Kubernetes . Originally launched as a Container orchestration system, it has evolved into one of the central pillars of digital infrastructure in less than a decade. Today, Kubernetes is no longer just a tool for distributing workloads – it is a universal abstraction layer over the cloud itself.

In a world where organizations increasingly stumble over the question of who actually owns their data, systems, and platforms, this feature becomes a strategic key function. Kubernetes is thus far more than just another cloud tool: It is the operating system of the sovereign cloud – a common language for operating software, regardless of where it runs.

Delos Cloud vs. Stackit Workspace – Wolves in Sheep's Clothing

Thu, 06 Nov 2025 09:38:26 +0000

Delos Cloud vs. Stackit Workspace – Wolves in Sheep’s Clothing

The discussion around digital sovereignty in Germany and Europe is in full swing. Few other topics are currently being driven as strongly by politics, administration, and business alike. The demand is clear: Europe should become more independent, especially from the major American hyperscalers – namely AWS, Microsoft Azure, and Google Cloud.

However, while the term “sovereignty” gains weight in public communication, it loses substance. The buzzwords sound like control, autonomy, and data protection. The reality often looks different.

Cloud Brokering for True Sovereignty

Thu, 06 Nov 2025 09:01:57 +0000

Cloud Brokering for True Sovereignty

The discussion about digital sovereignty in Europe is old, but it is more relevant than ever. Especially since the geopolitical and regulatory tightening of recent years, it has become clear that the question of where and how data is processed is no longer just a technical one, but a strategic one.

States, companies, and authorities are beginning to understand that digital independence means more than data protection and requires more than an EU data center.

Docker Swarm is Not Kubernetes for Beginners

Thu, 06 Nov 2025 08:54:39 +0000

Docker Swarm is Not Kubernetes for Beginners

When discussing container orchestration today, two terms quickly come up: Docker Swarm and Kubernetes. Both promise to run containers across multiple machines, scale services, and automate deployments. And because Kubernetes has a reputation for being complex, many organizations initially turn to Docker Swarm, hoping to ease into the world of container orchestration with less effort.

This decision seems reasonable at first glance. Swarm is quick to set up, the syntax is familiar, and the learning curve is gentler. It feels like a natural extension of Docker: a few additional commands, some new YAMLs, and you’re in the world of clusters. But this simplicity is deceptive.

DevOps Still Isn't Working

Thu, 06 Nov 2025 08:45:18 +0000

DevOps Still Isn’t Working

Why ego, responsibility, and reality continue to thwart the dream of ‘shared ownership’.

Over a decade ago, DevOps was hailed as a liberation. A cultural shift meant to tear down the old walls between development and operations. A shared understanding: developers and operations work as one team, sharing responsibility, tools, processes, and goals. Today, more than ten years later, the promise is broken in many organizations. The separation persists—just more subtly. And in many cases, the divide is even greater than before.

Docker Here, Docker There – I'm Going Back to the Old Ways

Thu, 06 Nov 2025 08:21:04 +0000

Docker Here, Docker There – I’m Going Back to the Old Ways

You hear it more and more often, half-serious, half-annoyed: “Docker here, Docker there – I’m going back to the old ways.”

And those who say it usually mean: I’m tired of the next big “simplification” that ends up making everything more complicated. Another new tool, new terms, new YAML files. In the past, you just installed software. An apt install, a service start, done.

Docker Swarm or Kubernetes - Which Causes Less Pain?

Thu, 06 Nov 2025 08:15:45 +0000

In many discussions with IT leaders, sysadmins, and architecture decision-makers, a recurring pattern emerges: The question of “Swarm or Kubernetes ” is not only a technological one but also strategic. Which platform offers less operational pain, more scaling potential, and long-term stability? After years of operational experience, ayedo has a clear preference – Kubernetes . However, this doesn’t mean Swarm lacks validity. On the contrary, one shouldn’t believe that choosing Swarm today as a long-term solution will bypass the Kubernetes learning curve. Eventually, you’ll find yourself with Kubernetes, facing the typical “and suddenly” problems that Swarm brings, especially in larger environments.

Docker vs. VM – What Is Actually the Difference?

Thu, 06 Nov 2025 07:50:40 +0000

Many people nod knowingly when the conversation turns to “containerization” or “virtual machines” – but honestly: those who can truly explain where exactly the difference lies are rarer than you think.

And that’s perfectly fine. Because the differences are less “magical” than often claimed – they lie deep in the way we isolate, operate, and scale systems.

1. Virtual Machines: Heavyweights with Lots of Control

Virtual Machines (VMs) are the classic of the infrastructure world. A VM is essentially a complete computer – just virtual. It has its own operating system, its own virtual hardware, and runs on a so-called hypervisor like VMware, Hyper-V, or KVM.

Alerting & Incident Response: From Anomaly to Final Report

Wed, 05 Nov 2025 12:00:00 +0000

TL;DR

Effective alerting is more than just a few emails at 80% CPU: It requires clean metrics, clear severity levels, thoughtful routing, and throttling to reliably detect relevant incidents without overwhelming the team.
Incident Response only works as a defined process: Detection → Triage → Investigation → Mitigation → Resolution → Postmortem. Each phase has different goals, actors, tools, and artifacts.
NIS-2 and DORA require not just “any response”, but traceable, documented procedures – including early warning within 24 hours, initial report after 72 hours, and final report within 30 days.
With VictoriaMetrics/Grafana for alerting, VictoriaLogs for forensics, and GitLab (Issues & Wiki) for tracking and postmortem reports, you can build an Incident Response chain that is both technically robust and auditable.
ayedo combines a Cloud-Native platform with integrated monitoring, logging, and compliance components, allowing European organizations to pragmatically implement NIS-2 and DORA-compliant incident processes and work with a practical Incident Response playbook.

Why Structured Alerting and Incident Response Are Mandatory Today

As the European tech industry, we are at a point where professional Incident Management is no longer “nice to have” but a regulatory standard.

Weekly Backlog Week 45/2025

Tue, 04 Nov 2025 14:58:39 +0000

🗞 Weekly Backlog – Week 45/2025

Europe discovers that digital independence is not an ideal but a maintenance issue.

Editorial

This week, digital sovereignty took center stage in multiple arenas—from administration to research and justice. While Microsoft’s DNS issues knocked out half the infrastructure, the Federal Ministry for Digital Affairs celebrated its TYPO3 success as a symbol of state emancipation. The DFG is pulling data from US clouds, the International Criminal Court is replacing Microsoft with OpenDesk, and the industry is calling ‘Stop the clock’ to buy time on the AI Act.

Observability in Detail: VictoriaMetrics, VictoriaLogs, Grafana

Tue, 04 Nov 2025 12:00:00 +0000

TL;DR

Observability is based on three pillars – metrics, logs, and traces – and is translated into a practical monitoring model for modern, often distributed systems through the four Golden Signals (Latency, Traffic, Errors, Saturation).
VictoriaMetrics serves as a Prometheus-compatible, high-performance time-series database providing the foundation for metrics with long-term retention, scalable throughput, and native integration into Kubernetes via ServiceMonitors.
VictoriaLogs complements this perspective with structured, tamper-proof logs based on LogQL, integrating seamlessly with Grafana , thus efficiently meeting technical and regulatory requirements (e.g., traceability, immutability).
Grafana acts as a central observability console: Dashboards, alerting, and multi-datasource capabilities allow consistent visualization of Golden Signals for applications like Django services across metrics and logs.
ayedo supports you in building a well-thought-out observability setup based on VictoriaMetrics, VictoriaLogs, and Grafana – from architecture and operations to dashboards and integration into your platform and compliance strategy.

Why Observability is Indispensable Today

Modern applications rarely consist of a monolith. More typical are dozens to hundreds of services distributed across containers, /kubernetes/ clusters, databases, and external APIs. Flawlessness in such environments is an illusion – what matters is how quickly and reliably you can detect, categorize, and resolve issues.

Digital Independence: ICC Transitions to OpenDesk

Mon, 03 Nov 2025 13:32:45 +0000

The International Criminal Court (ICC) in The Hague is taking a significant step in response to recent political tensions with the USA: it is ending its collaboration with American technology providers like Microsoft and will now rely on the open-source platform OpenDesk developed by the German government. This move marks a turning point in how international institutions handle digital dependency and underscores the strategic importance of technological sovereignty.

According to a report by Handelsblatt, the decision was triggered by concerns over political influence from the USA. Under President Donald Trump’s administration, Washington imposed sanctions on ICC staff, including Chief Prosecutor Karim Khan. Consequently, Microsoft blocked Khan’s email access, directly impacting the court’s operational capability. This incident highlighted the vulnerability of international institutions reliant on foreign cloud and communication services for critical operations. Digital infrastructure, once considered a neutral service, has become a geopolitical tool.

Between Ambition and Reality: Is the Launch of the AI Act Delayed?

Mon, 03 Nov 2025 12:06:40 +0000

The European AI Act, the first comprehensive regulation for artificial intelligence worldwide, was originally set to come into full effect by August 2026. However, there are increasing indications that this timeline might be postponed. Industry associations and large tech companies are calling for an extension, while civil society organizations warn of a setback in European digital policy.

Background: The Regulation Timeline

The EU adopted the AI Act in August 2024. Since then, the regulation has been coming into effect gradually:

DFG Pulls the Emergency Brake: German Research Reclaims Its Data from the US Cloud

Mon, 03 Nov 2025 12:03:17 +0000

The German Research Foundation (DFG) has sent a clear message: it is launching a funding program to retrieve endangered research data from foreign cloud storage—primarily from the data centers of Amazon, Google, and Microsoft. What sounds like a technical detail is, in fact, an overdue political decision.

For years, central data repositories of German and European science have been stored on the servers of American corporations. The reason is simple: these providers offer convenient, scalable, and widespread solutions. However, they are not sovereign.

Guardrails in Action: Policy-Based Deployment Validation with Kyverno

Mon, 03 Nov 2025 12:00:00 +0000

TL;DR

Guardrails are automated guidelines around your deployments: They prevent typical misconfigurations, enforce security by default, and enhance operational safety without disempowering your teams.
With Kyverno as a policy engine, security, reliability, and operational guardrails can be centrally defined and enforced in enforce mode—directly at the admission interface of your Kubernetes cluster.
Security guardrails such as “no privileged containers,” “only trusted registries,” mandatory network policies, and consistent security contexts support compliance with requirements from Art. 32 GDPR , NIS-2 , and BSI IT-Grundschutz.
Reliability and operational guardrails (resource requests/limits, minimum replica count, PodDisruptionBudgets, avoidance of load balancers, local storage, and uneven pod distribution) stabilize your platform and reduce manual operational efforts.
ayedo uses Kyverno-based guardrails as an integral part of the platform architecture to help organizations establish secure, resilient, and auditable deployments—from policy definition to ongoing compliance proof.

Guardrails as Guidelines for Modern Deployments

Modern software landscapes are highly distributed. In a typical cluster, hundreds to thousands of pods run, managed across dozens of namespaces and teams. In this complexity, it is no longer realistic to manually check every configuration.

ArgoCD Deep Dive: GitOps Deployments for Multi-Environment Scenarios

Sun, 02 Nov 2025 12:00:00 +0000

TL;DR

GitOps describes an approach where Git serves as the central, versioned source for the desired state of your infrastructure and applications; ArgoCD implements this approach in your Kubernetes landscape by continuously reconciling with the clusters.
ArgoCD works with declarative objects like Applications and ApplicationSets, complemented by Sync Policies (Auto vs. Manual) and Health Checks – enabling you to establish multi-environment deployments (dev/staging/prod) with clear release processes.
For compliance requirements from NIS-2 , DORA , GDPR , and the Cyber Resilience Act , GitOps with ArgoCD offers a complete audit trail, reproducible deployments, and a clear separation of configuration and secrets.
Rollbacks primarily occur via Git (Revert, Rollback Commits); ArgoCD then synchronizes the cluster state, uses its internal history for inspection, and supports disaster recovery scenarios by rebuilding entire environments solely from Git.
ayedo integrates ArgoCD, GitLab, secrets management, and registry components like Harbor into a cohesive delivery platform, aiding organizations in securely establishing GitOps workflows – including multi-environment strategy and compliance architecture.

GitOps as a Foundation: What Really Changes

Git as the Single Source of Truth

At its core, GitOps means: Everything that should run in the cluster is described as a declarative state in Git – not just application manifests, but ideally also platform components, policies, and configurations.

HashiCorp Vault + External Secrets Operator: Zero-Trust Secrets Management

Sat, 01 Nov 2025 12:00:00 +0000

TL;DR

Secrets in Git, classic Kubernetes secrets, and manual processes are no longer sufficient for zero-trust requirements and modern regulations.
HashiCorp Vault provides the necessary technical foundation for robust, audit-proof secrets management with Secrets Engines, Dynamic Secrets, Encryption as a Service, and detailed audit logs.
The External Secrets Operator (ESO) connects Vault and Kubernetes: It synchronizes secrets in namespaces in a controlled manner, ensures automatic rotation, and decouples application teams from the complexity of the Vault backend.
A seamless workflow from Platform Admin → Vault → ESO → Kubernetes → App ensures that credentials for systems like PostgreSQL never end up in Git or unencrypted in clusters.
ayedo supports organizations in operating Vault and ESO productively and compliantly—from architecture and setup to integration into existing CI/CD and governance structures.

Why Modern Secrets Management is a Core Component of Zero-Trust

Secrets management is not just a security issue but a prerequisite for any serious compliance strategy. Losing access credentials, tokens, or encryption keys can mean losing control over data, systems, and reputation.

Harbor Deep Dive: Vulnerability Scanning, SBOM, Image Signing

Fri, 31 Oct 2025 12:00:00 +0000

TL;DR

A modern container registry is now a central compliance tool, especially in the context of the Cyber Resilience Act , NIS-2 , and DORA .
Harbor combines vulnerability scanning (Trivy), SBOM management (SPDX, CycloneDX), and image signing (Notary, Cosign) with enterprise features like replication, quotas, RBAC, and audit logs—ideal for structured management of supply chain risks.
For the Cyber Resilience Act (effective since May 20, 2024, with most obligations applicable from 2027), SBOMs, coordinated vulnerability disclosure processes, and signed artifacts are particularly relevant—areas where Harbor can provide substantial support.
NIS-2 (effective since January 16, 2023, to be implemented into national law by October 17, 2024) and DORA (applicable from January 17, 2025) demand more transparency and control in the ICT supply chain—Harbor provides traceable artifact histories, policies, and auditability.
ayedo plans, builds, and operates Harbor instances as part of an integrated compliance -capable platform—including policy design, vulnerability management workflows, and secure Harbor configuration.

Why the Container Registry Becomes a Key Compliance Component

Container images are now the primary delivery format for software. This means a large portion of security and compliance-relevant information moves into the registry: vulnerabilities, dependencies, licenses, provenance.

Kaniko vs. Buildah: Rootless, Daemonless Container Builds in Kubernetes

Thu, 30 Oct 2025 12:00:00 +0000

TL;DR

Traditional container builds with Docker Daemon, root privileges, and docker.sock in CI systems pose an unnecessary security risk—especially when builds run directly in a Kubernetes cluster.
Rootless, daemonless tools like Kaniko and Buildah enable secure image builds in pods without privileged rights and without a Docker Daemon—an essential component for technical guardrails and modern Compliance requirements.
Kaniko is the “Kubernetes-native” approach: declarative, heavily focused on Dockerfiles, with good layer caching via the registry; Buildah offers more flexibility, deep OCI integration, and scriptability—suitable if you need more complex build workflows or custom toolchains.
For the European context—including the Cyber Resilience Act and signed builds—rootless pipelines are a pragmatic way to embed security-by-design in the software supply chain.
ayedo consistently relies on rootless builds with Kaniko and Buildah in its platform, integrated into GitLab , Harbor , and GitOps deployment—and supports teams in adopting this architecture in a structured manner.

Why Traditional Container Builds in Kubernetes Become a Risk

Many organizations built their first CI/CD pipelines with a simple assumption: “We install Docker on the runner and call docker build.” In traditional VM setups, this was pragmatic. However, in a Kubernetes cluster, this habit becomes a structural risk.

Compliance

Thu, 30 Oct 2025 00:00:00 +0000

Introduction

ayedo specializes in tailored container solutions and operating complex applications, ensuring business-critical software runs reliably at all times. Information security and quality are firmly anchored in our corporate culture. We have established and successfully certified an integrated management system (IMS) that meets the requirements of ISO/IEC 27001:2022 (Information Security Management) and ISO 9001:2015 (Quality Management). Security is not a buzzword for us, but a core part of our DNA. This document summarizes the technical infrastructure, security measures and compliance aspects of our platform – with the goal of giving IT and compliance managers a comprehensive overview of “what they get with us.”

Open Source in Administration: The Government Site Builder 11 Sets Standards

Wed, 29 Oct 2025 12:23:41 +0000

With the award ceremony at the Smart Country Convention (SCCON) on October 2, 2025, the open-source movement in public administration celebrated a visible success. At the first nationwide Open Source Competition for Authorities and Public Institutions, organized by the Open Source Business Alliance (OSBA) and partners like govdigital, SUSE, Capgemini, and ZenDiS, projects were honored that demonstrate: Open Source is no longer an experiment – it is a viable administrative infrastructure.

GitLab CI/CD in Detail: Stages, Jobs, Pipelines for Modern Software

Wed, 29 Oct 2025 12:00:00 +0000

TL;DR

GitLab CI/CD is much more than a build tool: When used correctly, it becomes the central backbone of your delivery process – from commit to production, including documentation and audit trail.
Core components like .gitlab-ci.yml, stages, jobs, and artifacts allow you to model a clear, reproducible supply chain – including build (Kaniko, SBOM), test (pytest, integration, Trivy), package (push to Harbor , signature), deploy (GitOps with ArgoCD ).
Modern requirements from the Cyber Resilience Act , NIS‑2 , DORA , and GDPR can be directly embedded in GitLab CI/CD: SBOM generation, CVE scanning, signed images, audit trails, and clean secrets management.
A well-thought-out pipeline structure makes compliance an integrated feature of your software supply chain – rather than a downstream control mechanism.
ayedo supports you in orchestrating GitLab CI/CD, Harbor , ArgoCD , and your Kubernetes ecosystem to enhance delivery speed, security, and compliance equally.

GitLab CI/CD as the Backbone of Your Delivery Process

Today, those responsible for software manage not just source code but entire supply chains: source code management, build processes, container images, policy checks, deployments, audits. GitLab CI/CD brings these threads together in one place.

Of AI Browsers, Cybersecurity, and Compliance

Tue, 28 Oct 2025 12:33:37 +0000

The introduction of AI browsers like OpenAI’s ChatGPT Atlas and Perplexity Comet marks the beginning of a new era in human-computer interaction. These tools promise to redefine not just browsing, but the entire online task execution by understanding the web and performing autonomous actions. However, these groundbreaking capabilities pose fundamental challenges to our existing security architectures. For those of us in the IT industry, these new “agents in the browser” are not mere features but critical, novel attack vectors.

Let's Deploy with ayedo, Part 2: ArgoCD GitOps, Monitoring, Observability

Tue, 28 Oct 2025 12:00:00 +0000

TL;DR

GitOps with ArgoCD anchors the desired state of your applications and infrastructure in Git, making deployments reproducible, auditable, and automatable.
In the combined workflow of GitLab , Harbor , ArgoCD, and Kubernetes , pipelines handle building, testing, and signing, while ArgoCD manages controlled delivery to various environments.
ArgoCD ApplicationSets enable scalable multi-environment deployment according to uniform standards—with clear guardrails, selectable automation levels, and clean rollbacks.
Monitoring & Observability with VictoriaMetrics (metrics), VictoriaLogs (logs), and Grafana provide the technical foundation to reliably meet compliance requirements for availability, traceability, and incident handling.
ayedo integrates this entire GitOps and observability stack into a consistent platform that combines deployment automation with compliance guardrails—including ready-to-use ArgoCD templates and dashboards.

GitOps with ArgoCD: Control Center for Platform State

What GitOps Means in Practice

GitOps is not just another buzzword, but a structuring approach:
The desired system state—deployments, configuration, policies—is versioned in Git. Automated controllers continuously check whether the actual state in the cluster matches this target image and correct deviations.

Let's Deploy with ayedo, Part 1: GitLab CI/CD, Harbor Registry, Vault Secrets

Mon, 27 Oct 2025 12:00:00 +0000

TL;DR

GitLab CI/CD becomes the central orchestrator of your delivery workflow: clearly structured stages (build, test, package, deploy) make your artifact chain traceable and verifiable.
Rootless, daemonless container builds with Kaniko or Buildah enable secure pipelines without privileged Docker daemons – including SBOM generation as a basis for auditability and upcoming requirements from NIS2 and Cyber Resilience Act (effective from 09.01.2024).
A central registry like Harbor evolves from a simple image store to a compliance hub: automatic CVE scanning, image signing, and enforced vulnerability policies measurably increase your supply chain security.
With HashiCorp Vault and the External Secrets Operator , you automate secrets management from the pipeline to the /kubernetes/ cluster – including dynamic credentials and rotation, without “hiding” secrets in GitLab variables.
ayedo provides an integrated platform with GitLab , Harbor , HashiCorp Vault , and ESO along with proven GitLab CI/CD templates that pre-structure this workflow for you.

GitLab CI/CD as the Backbone of the Deployment Workflow

For modern, regulation-compliant software delivery, a clean CI/CD pipeline is not “nice to have” but the technical organizational chart of your organization. In many companies, GitLab assumes this role – in the ayedo platform, it is the first step in the end-to-end workflow.

Microsoft Teams: When Office Software Becomes Attendance Control

Mon, 27 Oct 2025 10:48:02 +0000

Starting December 2025, Microsoft will enhance its collaboration platform Teams with a feature that automatically detects the actual work location of employees. The software is designed to determine if a user is connected to the company’s Wi-Fi and infer whether they are physically in the office.

Officially, the feature is intended to facilitate hybrid collaboration. In large office complexes or with distributed teams, it can make it visible who is on-site and who is working from home. However, the technical basis—the collection of location data via the corporate network—raises concerns.

ohMyHelm: Helm Charts for 15-Factor Apps Without Kubernetes Complexity

Sun, 26 Oct 2025 12:00:00 +0000

TL;DR

ohMyHelm is a universal Helm chart wrapper that delivers production-ready workloads without requiring teams to maintain their own templates – the entire definition is managed through a central values.yaml.
Standard components like Deployments/StatefulSets, Ingress, RBAC, ConfigMaps, Secrets (including External Secrets Operator), and observability hooks are integrated and pre-configured according to best practices.
The 15-Factor principles (configuration, backing services, logs, telemetry, parity) can be consistently mapped into Helm models with ohMyHelm – ideal for standardized cloud-native architectures on /kubernetes/.
Guardrails such as resource limits, network policies, security contexts, and standardized service dependencies make it easier to enforce regulatory requirements and internal /compliance/ guidelines.
ayedo uses ohMyHelm itself as a building block of a sovereign, policy-compliant platform and supports teams in transitioning their applications into a secure, auditable operational environment without Kubernetes overhead.

Why Helm Charts Often Bring More Complexity Than Benefit

Helm has become the de facto standard for packaging applications on /kubernetes/. However, in practice, many teams see two opposing realities:

Delivery Operations: The Path from Code to Production

Sat, 25 Oct 2025 12:00:00 +0000

TL;DR

Delivery Operations describe the journey from code in your version control to running workloads in production – including build, test, packaging, security scans, deployment, and monitoring.
Unlike Platform Operations (cluster, network, basic services), Delivery Operations focus on reproducible, traceable, and automated processes that address both technical quality and regulatory requirements.
A well-designed end-to-end workflow – Code → CI → Package → Scan → Deploy → Monitor – is the most effective lever to pragmatically implement requirements from the Cyber Resilience Act , NIS‑2 , DORA , and Data Act .
Key compliance components include SBOMs, CVE scanning, signed artifacts, a robust audit trail, and the exit capability of your platform – all embedded in a streamlined developer experience.
ayedo provides an integrated environment with its Software Delivery Platform, where Delivery Operations, Compliance , and modern Cloud-Native technology are combined – including pre-configured workflows, guardrails, and a consistent delivery workflow demo.

Delivery Operations as a Counterpart to Platform Operations

When we talk about modern Cloud-Native environments, terms like Kubernetes, Observability, or Infrastructure as Code often come up. These are classic topics of Platform Operations: building and operating the technical foundation – i.e., clusters, network, storage, logging, identity, and the underlying platform .

Velero: Backup & Disaster Recovery for DORA and NIS-2

Fri, 24 Oct 2025 12:00:00 +0000

TL;DR

Velero is a mature open-source tool for backups, migration scenarios, and disaster recovery in Kubernetes environments – making it a central component for any robust compliance architecture.
Regulatory requirements like GDPR (applicable since 05/25/2018), NIS‑2 (implementation by 10/17/2024), and DORA (effective from 01/17/2025) explicitly demand robust business continuity and recovery concepts – not just backups “somewhere in an S3 bucket.”
A coherent backup strategy includes automated, policy-based backups, geographically separated and encrypted storage, clear RPO/RTO goals, and regularly practiced restore and disaster recovery processes.
Velero becomes the operational heart of the DR process in critical scenarios – from the loss of a namespace to a complete cluster failure – linking technical recovery with regulatory-compliant documentation.
ayedo provides an integrated solution: The ayedo Kubernetes Distribution includes Velero , offsite storage, monitoring, and standardized DR processes as building blocks – including consulting for alignment with GDPR , NIS‑2 , and DORA .

Velero Overview: Backup and Migration Engine for Kubernetes

In productive Kubernetes landscapes, a robust backup and disaster recovery concept is no longer optional but a regulatory obligation. Velero has established itself as the de facto standard here.

Kyverno: Policy as Code for Automated Compliance Checks

Thu, 23 Oct 2025 12:00:00 +0000

TL;DR

Kyverno is a Kubernetes-native policy engine that allows you to define security and operational policies directly as YAML and enforce them automatically as an admission controller within the cluster.
With clearly structured guardrails for security (e.g., container isolation, trusted registries), reliability (e.g., resource management), and operation (e.g., storage, load balancer, and backup rules), compliance becomes a repeatable, verifiable process.
Regulatory requirements from GDPR Art. 32 (applicable since 25.05.2018), the NIS-2 directive (with implementation deadline for EU member states by 17.10.2024), and the BSI IT-Grundschutz can be systematically mapped in your Kubernetes cluster using policy as code.
In practice, this means deployments are checked against policies before being applied; faulty configurations are rejected with clear technical guidance before they become a risk in production.
ayedo uses Kyverno as a central policy-as-code tool, providing predefined guardrails and reporting functions, and supports you in establishing Kyverno policies as a fixed part of your delivery and compliance strategy.

Kyverno Overview: Policy as Code, Where It Belongs

Kyverno is a policy engine specifically developed for Kubernetes . Unlike generic policy frameworks, Kyverno fully relies on Kubernetes objects and YAML. This fits well in a world where infrastructure, applications, and security configurations are already described as code.

Weekly Backlog Week 44/2025

Thu, 23 Oct 2025 11:03:00 +0000

Editorial

Germany, your servers. In the same week that a small community in Baden-Württemberg digitally collapses and the federal login system goes offline, Europe debates “digital sovereignty”—while Microsoft simultaneously learns who is actually in the office and who is just pretending to be.

One might say: Welcome to the paradoxical republic. Between security gaps and surveillance features, between fax machines and cloud monopolies. This week shows once again: Digitalization is not an IT project. It’s a question of power.

Keycloak: Identity & Access Management for GDPR and NIS-2

Wed, 22 Oct 2025 12:00:00 +0000

TL;DR

Keycloak is a mature open-source Identity & Access Management (IAM) solution that supports modern protocols like OAuth2, OpenID Connect (OIDC), and SAML 2.0, and integrates well into cloud-native architectures.
For GDPR (particularly Article 32), NIS-2 , and DORA , Keycloak provides essential components: strong authentication (MFA), granular role and permission management (RBAC), and detailed audit logs.
In practice, Keycloak serves as a central identity provider for the Kubernetes -API, for unified MFA policies, and for consistent role concepts across infrastructure and application layers.
By integrating into a central platform like the ayedo SDP, Keycloak becomes a strategic IAM component of your compliance architecture—with standardized operational processes, high availability, and well-documented access paths.
ayedo supports the architecture, introduction, and operation of Keycloak, integrates the IAM into your platform and security landscape, and helps pragmatically implement regulatory requirements—from the initial assessment to productive Keycloak integration.

Why Identity & Access Management is the Core of Modern Compliance

Anyone responsible for a digital organization today knows: The major European regulatory frameworks—GDPR , NIS-2 , DORA —do not target individual tools but structured security and risk management. Access to systems and data is at the center.

VictoriaMetrics & VictoriaLogs: Observability for NIS-2 and DORA

Tue, 21 Oct 2025 12:00:00 +0000

TL;DR

Modern compliance requirements like NIS-2 , DORA , and GDPR demand robust, verifiable observability: metrics, logs, and traces must be systematically collected, analyzed, and stored long-term.
VictoriaMetrics offers a high-performance, Prometheus-compatible metrics platform with efficient long-term retention—ideal for regulatory-compliant representation of SLOs, capacities, and incidents.
VictoriaLogs complements this with structured, high-performance, tamper-proof log management, enabling audit trails, forensic analysis, and audit-proof evidence.
Combined with Grafana and a tracing backend, a complete observability stack is created that supports proactive monitoring, rapid incident handling, and reliable reporting for NIS-2, DORA, and GDPR.
ayedo designs, implements, and operates such observability stacks based on VictoriaMetrics, VictoriaLogs, and Grafana—technically deep, regulation-aware, and with a clear focus on your compliance requirements.

Observability is more than “Monitoring 2.0.” It is the ability to understand the state of complex distributed systems from their behavior—even when specific error patterns were previously unknown. For regulated companies, this ability has become a core component of governance.

Harbor: Container Registry with Integrated CVE Scanning and SBOM

Mon, 20 Oct 2025 12:00:00 +0000

TL;DR

Harbor is an open-source container registry (CNCF Graduated Project) that combines registry functionality, security scanning, SBOM generation, and signing into one system—ideal for cloud-native platforms in regulated environments.
For the Cyber Resilience Act , the integrated CVE scanning with Trivy, SBOM generation, and image signing are crucial to demonstrably manage vulnerabilities and make software supply chains transparent.
In the context of the GDPR , features like fine-grained RBAC and audit logs are essential to control access to container images and trace security-relevant activities.
Through policy-based vulnerability checks, Harbor can be seamlessly integrated into GitLab/GitOps deployments, ensuring that only scanned, signed, and policy-compliant images reach your Kubernetes clusters.
ayedo uses Harbor as a central component of its own software delivery platform and supports you in pragmatically integrating registry, security scanning, and compliance requirements into your organization—from concept to production operation.

Harbor Overview: More Than Just a Container Registry

Harbor was originally developed as an on-premise alternative to hosted registries like Docker Hub or GitHub Container Registry. It has since become a CNCF Graduated Project and a de facto standard component for companies wanting to operate their software supply chain autonomously and auditable.

Cilium: eBPF-based Networking for Zero Trust and Compliance

Sun, 19 Oct 2025 12:00:00 +0000

TL;DR

Cilium leverages eBPF to execute network functions directly in the Linux kernel, enabling high-performance, identity-based networking for modern Kubernetes platforms.
For Zero Trust architectures, Cilium provides essential components: fine-grained Network Policies (microsegmentation), end-to-end encryption via WireGuard, deep observability with Hubble, and intrusion detection capabilities.
eBPF combines performance, flexibility, and security: it extends the kernel in a controlled manner without the need for patching, creating a solid technical foundation for regulatory transparency and control over network traffic.
Namespace isolation can be implemented with Cilium to ensure tenants are clearly separated, only explicitly allowed connections are possible, and all flows can be traced in a revision-secure manner—a direct lever for auditability and Compliance .
ayedo uses Cilium as the standard network component in its own Kubernetes distribution, integrating it into logging, monitoring, and governance processes, and supporting organizations in pragmatically implementing Zero Trust and compliance requirements.

Why Network Security Becomes the Foundation of Compliance

Network communication is no longer “just” an infrastructure topic. It has become a central component for information security and thus for regulatory compliance.

ayedo Kubernetes Distribution: CNCF-compliant, EU-sovereign, compliance-ready

Sat, 18 Oct 2025 12:00:00 +0000

TL;DR

The ayedo Kubernetes Distribution offers two distinct operational variants: Loopback for European public clouds and a k3s-based solution for on-premises and enterprise environments – both based on CNCF-certified / CNCF-compliant Kubernetes .
CNCF compliance ensures API compatibility, avoids lock-in through proprietary extensions, and lays the foundation for portability between clouds, data centers, and providers.
By operating in EU data centers (Germany, Finland) and embedding into a structured Cloud-Sovereignty-Framework , your organization can consistently address technical sovereignty, data protection requirements, and regulatory mandates.
Pre-configured platform services like Cilium, VictoriaMetrics/VictoriaLogs, Harbor , Keycloak, Kyverno, Cert-Manager, and Velero form an integrated foundation for security, observability, and resilience – a crucial component for modern compliance .
ayedo combines these components into a curated, European Kubernetes Distribution, providing a robust, compliance-ready foundation for your own platform – whether in the public cloud or on-premises.

Why a European, CNCF-compliant Kubernetes Distribution?

Today, those responsible for infrastructure and application operations face dual pressures: Teams must quickly and flexibly roll out new services, while regulatory, data protection, and internal governance requirements are increasing.

ayedo Software Delivery Platform: High-Level Overview

Fri, 17 Oct 2025 12:00:00 +0000

TL;DR

The ayedo Software Delivery Platform combines a production-ready Kubernetes distribution , the automation framework Polycrate, and the Helm wrapper ohMyHelm into an integrated solution for development, operations, and compliance.
Core platform services like Cilium, VictoriaMetrics, Harbor , Keycloak, Kyverno, Cert-Manager, and Velero are predefined, integrated, and operable – including backup, security, observability, and identity.
A catalog of over 50 managed apps enables consistent provisioning of critical components like CI/CD, databases, or observability stacks without the need for custom integration efforts.
The platform addresses typical bottlenecks: out-of-the-box compliance requirements, a consistent developer experience, clear separation of platform operations and delivery operations, as well as multi-cloud and on-premises scenarios.
With the ayedo platform , organizations receive a European-conceived, regulation-compliant software delivery foundation, supported from architecture to operations – including a personalized platform demo.

What the ayedo Software Delivery Platform Is – and What It Solves

The ayedo Software Delivery Platform (SDP) is an integrated environment for the entire lifecycle of modern applications: from the initial commit pipeline to ongoing operations in production-ready Kubernetes clusters.

Deterministically Checking Security Standards: Policy as Code, CVE Scanning, SBOM

Thu, 16 Oct 2025 12:00:00 +0000

TL;DR

Deterministic security checks in the cloud-native environment are based on three pillars: Policy as Code, automated CVE scanning, and SBOM management. Together, they enable measurable, reproducible security instead of ad-hoc checks.
Policy as Code (e.g., with Kyverno) establishes guardrails at the Kubernetes level: Only deployments that comply with clearly defined security and compliance rules are accepted.
CVE scanning with tools like Trivy and container-native registries like Harbor ensures that known vulnerabilities are detected early and automatically considered in build and deployment pipelines.
SBOMs are the foundation for transparency in the software supply chain – and with the Cyber Resilience Act from around 2027, they will be mandatory in many cases. Together with NIS-2 and DORA , a binding framework for security automation is emerging.
ayedo integrates these three pillars into an automated software delivery platform, helping organizations implement deterministic security checks concretely – technically, organizationally, and in the context of compliance requirements.

Why Deterministic Security Checking is Crucial Now

Cloud-native architectures bring enormous flexibility – and drastically increased complexity. Containers, microservices, Infrastructure as Code, and dynamic orchestration with Kubernetes make traditional, manual security checks practically impossible.

Weekly Backlog 43/2025

Thu, 16 Oct 2025 08:15:45 +0000

“When Tenders Time Out and AWS Gets the Hiccups”

Editorial

This week demonstrated how interconnected the modern world is—technically, economically, and politically. A DDoS attack on the federal procurement portal halted public tenders, an attack on F5 opened a window into the engine room of global network security, and AWS once again showed that “Multi-AZ” is not a backup plan.

Additionally: Saarland loses its digital flagship to Munich.

The Tech News of the Week

DDoS Cripples Federal Procurement Portal

For several days, the central federal procurement portal—the heart of public tenders—was inaccessible. The cause: a large-scale DDoS attack by the pro-Russian hacker group Noname057(16), which has been conducting coordinated overload attacks on European authorities, banks, and media for years.

Standardized Software Logistics: OCI, Helm, Kubernetes API

Wed, 15 Oct 2025 12:00:00 +0000

TL;DR

The Cloud-Native community has established a comprehensive “software logistics” system with OCI, Helm, and the Kubernetes API: standardized, interoperable, and largely decoupled from individual vendors.
For software vendors, this means: package once correctly, then deliver on any CNCF-compliant platform—from hyperscaler Kubernetes to sovereign private clouds.
For software buyers, tangible benefits arise: better negotiating position with providers, true portability, and standardized audit trails for security, SBOM, and regulatory compliance .
Regulations like the Data Act , Cyber Resilience Act , and the European Cloud Sovereignty Framework become not only achievable through these standards but strategically usable—as levers for governance and quality.
ayedo builds on these exact standards: standardized container registries, Helm-based platform components, and Kubernetes-native compliance automation—from chart quality to documented, audit-proof delivery.

The Evolution of Software Logistics: From Installers to Standards

Software distribution was long a patchwork: individual installers, proprietary update mechanisms, manual configurations. Every environment was different, every change in operating model a mini-migration project.

The Trojan Horse of the 'Sovereign Cloud'

Tue, 14 Oct 2025 19:13:15 +0000

The Trojan Horse of the “Sovereign Cloud”

Why Europe’s new sovereignty is often just American-painted

The meme is brilliant in its simplicity:

A Trojan horse rolls up to the gates of Europe.

On it is written: “Sovereign Cloud”.

Inside sit: AWS, Microsoft, Google – smiling happily.

And at the gates of the city stand two European men pulling the rope, saying: “Let’s bring it in - it looks safe.”

Open Source ≠ Sovereignty. On Dependency and Responsibility in a Cloud-Native World

Tue, 14 Oct 2025 19:01:55 +0000

Many confuse Open Source with sovereignty. Both are interconnected – but one does not automatically guarantee the other.

The well-known XKCD meme, depicting a vast, shaky digital infrastructure resting on a tiny software component “quietly maintained by some person in Nebraska since 2003,” is more than a humorous caricature. It is an accurate depiction of our digital present – and a warning to all who believe that Open Source automatically means security, control, or even independence.

Weekly Backlog Week 42/2025

Tue, 14 Oct 2025 14:31:04 +0000

Editorial

This week was a fever dream. From Localmind to Aleph Alpha, from SonicWall to GitHub – the same pattern everywhere: big promises, thin architecture, and a deep misunderstanding of what control really means. If we continue to believe that security is created through marketing, and if US companies continue to believe that trust is a subscription model - then 2025 will be a year of disenchantment.

The Tech News of the Week

Localmind – How to Squander Trust in European AI

Heise reports on an incident so absurd it could almost be satire: The Austrian company Localmind, which markets itself as a “secure AI platform,” exposed its entire infrastructure - not through an attack, but through incompetence.

Cloud Sovereignty + 15 Factor App: The Architectural Bridge Between Law and Technology

Tue, 14 Oct 2025 12:00:00 +0000

TL;DR

The Cloud Sovereignty Framework of the EU defines what digital sovereignty aims to achieve – the 15-Factor App principles define how a concrete application architecture implements these goals technically.
SOV‑3 (Data & AI) becomes operationally tangible when configuration (including encryption keys) is completely decoupled from the code and managed as a BYOK setup in standardized environments – in line with Factor 3 “Config”.
SOV‑4 (Operational), SOV‑6 (Technology), and SOV‑7 (Security) can be directly mapped to modern architectural principles: Backing Services, API-First, Open Source, Telemetry, and comprehensive authentication make portability, exit capability, and auditability built-in features.
A 15-Factor-compliant application can be migrated between cloud providers without changing the application code – configuration, APIs, and infrastructure abstractions bear the migration load. This precisely matches the exit capability demanded by the Cloud Sovereignty Framework.
ayedo combines sovereign infrastructure according to the Cloud Sovereignty Framework with 15-Factor-based application packaging. With our Portability Assessment, we make visible how portable your applications are today – and how you can meet regulatory requirements architecturally cleanly.

Why Cloud Sovereignty is an Architectural Issue

Regulatory requirements are no longer purely a legal issue. Since the EU Commission published version 1.2.1 of the Cloud Sovereignty Framework in October 2025, it has become clear: Anyone who wants to procure or offer sovereign cloud services needs comprehensible technical answers.

The Germany Stack

Tue, 14 Oct 2025 07:13:04 +0000

The Germany Stack and the Reality of Modern Cloud-Native Development:

Digitization is no longer a buzzword – it is a foundation, a competitive advantage, and a geopolitical factor all at once. Europe has understood this. And with the Germany Stack, a reference architecture initiated by the Federal Ministry for Digital and State Modernization, an open, validated, and interoperable technology stack for software development in administration and business is being created for the first time.

The Modern Software Development Lifecycle: From Cloud-Native to Compliance

Mon, 13 Oct 2025 12:00:00 +0000

TL;DR

The modern Software Development Lifecycle (SDLC) is based on cloud-native architectures, automated pipelines, and a clear separation of responsibilities between platform and product teams.
Multiple releases per day are only sustainable if portability, resilience, and standardized logistics are embedded in the architecture from the start—ideally following principles like the 15-Factor App.
A well-designed SDLC not only creates speed but, more importantly, predictability, measurable quality, and a deterministic foundation for security and compliance audits.
Platform Operations and Delivery Operations are two sides of the same coin: one side provides a robust, compliance-capable platform, while the other uses this platform for repeatable, auditable software delivery.
ayedo offers a platform and tailored solutions for GitOps, CI/CD, and compliance, providing a framework for organizations to establish modern SDLC practices securely, structurally, and regulatory resiliently.

From Classic Projects to Continuous Product Development

Many organizations have moved far from classic “project IT.” Instead of large, infrequent releases, we are shifting towards continuous product development: features are developed, tested, and delivered in small increments—often several times a day.

15 Factor App Deep Dive: Factors 13–15 (API First, Telemetry, Auth)

Sun, 12 Oct 2025 12:00:00 +0000

TL;DR

Extending the classic 12-Factor-App with factors 13–15 (API First, Telemetry, Auth) is not a “nice-to-have” but a prerequisite for robust, scalable, and regulation-compliant Cloud-Native applications.
API First with OpenAPI/Swagger and contract-first development enables parallel teamwork, better interoperability, and creates a solid foundation for requirements from the Data Act .
Telemetry with metrics, traces, and events elevates you from reactive troubleshooting to a proactive observability level – directly addressing the monitoring and reporting expectations from NIS-2 and DORA .
Modern authentication and authorization (OAuth2, OIDC, Zero-Trust models) are core components to technically meet security requirements from the GDPR (especially Art. 32) and NIS-2 .
ayedo anchors the 15-Factor principles – including API First, Telemetry, and Auth – in a sovereign, European delivery platform , allowing engineering teams to jointly think and implement Cloud-Native architectures and compliance requirements.

From 12 to 15 Factors: Why the Extension is Crucial

The classic 12-Factor methodology set a standard for modern web applications. However, many of these principles were developed at a time when APIs, observability, and Zero-Trust did not have the significance they do today.

15 Factor App Deep Dive: Factors 7–12 (Networking, Scaling, Operations)

Sat, 11 Oct 2025 12:00:00 +0000

TL;DR

Factors 7–12 of the 15-Factor-App primarily address operations, scaling, and maintainability—exactly where modern container platforms like Kubernetes excel.
Port Binding, Concurrency, and Disposability ensure applications are cleanly encapsulated, horizontally scalable, and replaceable at any time—the foundation for stable deployments and robust business continuity concepts.
Dev/Prod Parity, Logs as Event Streams, and Admin Processes as One-Off Processes make operations predictable, auditable, and automatable—a significant contribution to structured Compliance programs.
Kubernetes mechanisms like Deployments, Horizontal Pod Autoscaling, Liveness/Readiness Probes, and central log pipelines (e.g., with Loki ) are direct technical levers for implementing these factors.
ayedo translates the 15-Factor principles into applicable best practices for your team with ohMyHelm, Polycrate, and the ayedo Platform—from standardized deployments to Kubernetes governance and compliance-by-design.

Why Factors 7–12 Are Crucial for Operations Teams

Factors 1–6 of the 15-Factor-App lay the foundation: codebase, configuration, dependencies, and statelessness. From Factor 7 onwards, the focus shifts clearly towards operations: How is an application exposed, scaled, monitored, and operated in the cluster?

15 Factor App Deep Dive: Factors 1–6 (Basics & Lifecycle)

Fri, 10 Oct 2025 12:00:00 +0000

TL;DR

Factors 1–6 of the 15-Factor App define the internal lifecycle of an application: from the codebase through dependencies and configuration to processes and runtime behavior.
A single codebase with clearly declared dependencies and external configuration reduces operational risks, facilitates audits, and lays the foundation for robust, portable deployments.
Backing services as interchangeable resources and strictly separated build/release/run phases are key levers for resilience, portability, and regulatory traceability.
Stateless processes support high availability and disaster recovery – an important component for organization-wide compliance and resilience requirements.
With ohMyHelm as the packaging tool of the ayedo platform, these factors can be systematically translated into Helm charts and values.yaml files – including a clean separation of code, configuration, and environment (without proprietary dependencies).

Why the First Six Factors Make the Difference

The 15-Factor App extends the well-known 12-Factor principles with modern requirements such as telemetry and security. In practice, however, it is primarily factors 1–6 that determine whether an application can be reliably operated on a modern platform – and whether it keeps pace with your compliance and sovereignty goals in the medium and long term.

GitHub Fully Migrates to Azure Cloud – Infrastructure Over Innovation

Fri, 10 Oct 2025 09:45:37 +0000

GitHub will migrate its entire infrastructure to Microsoft Azure within the next 24 months. This information comes from internal documents reported by The New Stack. With this decision, GitHub ends the operation of its own data centers in favor of the Microsoft Cloud – despite technical risks and at the expense of new product features.

Migration Over Development

According to GitHub CTO Vladimir Fedorov, this step is necessary to meet the increasing demand from AI features like Copilot. The existing infrastructure, particularly the central data center in Virginia, has reached its capacity limit. The complete migration is expected to be finished in 12 months, with a six-month buffer for parallel operation.

SonicWall Data Breach: A Systemic Flaw in Security Architecture

Fri, 10 Oct 2025 08:45:08 +0000

What initially seemed like a manageable incident has now officially turned into a complete loss of control: The firewall manufacturer SonicWall has confirmed that all cloud backups of all firewalls have been compromised—contrary to the initial statement that only about five percent were affected. This incident impacts all customers who had activated the optional cloud backup feature for their firewall configurations.

The urgency lies not only in the scope of the leak but in the nature of the affected data: The stolen backups consist of complete configuration files of productive network security solutions—including routing information, VPN tunnels, port forwarding, authentication mechanisms, rules, and potentially stored access information.

15 Factor App: The Evolution of Cloud-Native Best Practices

Thu, 09 Oct 2025 12:00:00 +0000

TL;DR

Heroku’s 12-Factor App set a clear standard for cloud-compatible applications in 2011 – the 15-Factor App extends this foundation with three factors that have become indispensable in a world of microservices, zero-trust, and observability.
API First, Telemetry, and Authentication & Authorization seamlessly complement the existing twelve factors: they address not new “trends,” but consistently thought-out requirements for interface design, operational observability, and security.
For distributed systems and microservice architectures, all 15 factors together form a practical reference framework: from clean config handling to horizontal scaling to comprehensive security and observability concepts.
With ohMyHelm , applications can be packaged so that these 15 principles are truly lived in everyday life: one chart, multiple environments, integrated telemetry, and security-by-design – embedded in the ayedo platform on Kubernetes .
ayedo sees the 15-Factor App as a blueprint for sovereign, compliant-operated cloud-native applications in Europe and supports you in anchoring these principles with realistic processes and tools in your organization.

From 12 to 15 Factors: Evolution, Not Disruption

The 12-Factor App, formulated by Heroku in 2011, has shaped an entire generation of cloud and SaaS applications. It clearly articulated many practices that seem self-evident today – such as the separation of configuration and code or the avoidance of local state.

The Localmind Case: What Happens When Security Promises Are Not Kept

Thu, 09 Oct 2025 08:43:04 +0000

The Localmind Case: What Happens When Security Promises Are Not Kept

The self-description was promising: “Local & secure AI platform for enterprises”, “full control”, “independence from the Cloud ”. The reality: Admin access with a trivial password, unsecured test systems, plaintext credentials in the internal knowledge database, and potential access to systems of over 150 companies – including banks, authorities, energy providers, and public organizations in Germany and Austria.

What the Austrian provider Localmind referred to as a “beta test instance” turned out in practice to be a gateway with almost unrestricted access to infrastructure and customer data. According to Heise, an anonymous security researcher managed to penetrate internal structures via an openly accessible test system with immediate admin rights – without an exploit, without an attack, but with simple means. Access to the internal knowledge database opened the door to further systems, including root credentials in plaintext. Some passwords were reportedly as simple as “whatTheHell123$$$”.

How EU Regulations Interconnect: An Integrated Compliance Approach

Wed, 08 Oct 2025 12:00:00 +0000

TL;DR

The European regulatory landscape is intentionally interconnected: The GDPR forms the foundation, upon which NIS-2, DORA , Cyber Resilience Act , and Data Act build—supplemented by the Cloud Sovereignty Framework as a procurement guideline.
An integrated approach significantly reduces effort: A solid ISMS based on ISO 27001, active GDPR compliance, and cloud-native principles cover large parts of the requirements of all mentioned regulations simultaneously.
NIS-2 (from October 2024) and DORA (from January 2025) focus on cyber resilience and operational risk management; CRA (from 2027) and Data Act (from September 2025) shift the focus to secure products, interoperability, and vendor neutrality.
The Cloud Sovereignty Framework makes these requirements measurable for procurement and architecture, linking data protection, security, exit capability, and sovereignty to concrete selection criteria for Cloud and SaaS services.
ayedo pursues an integrated compliance approach: We combine ISO-27001-oriented processes, cloud-native architecture patterns, and EU regulatory knowledge to guide organizations structurally towards a sustainable, auditable compliance strategy.

The GDPR has been directly applicable law in the EU since May 25, 2018—and it is more than “just” data protection. It defines principles that run through the entire regulatory landscape:

Expanding Our Multi-Cloud Offering: IONOS Cloud Now Available

Wed, 08 Oct 2025 10:03:54 +0000

New Standards for Compliance and European Cloud Sovereignty

Effective immediately, ayedo customers have access to another powerful cloud provider: IONOS Cloud. This addition enhances our existing infrastructure portfolio—which includes our own infrastructure as well as connections to providers like Hetzner—with another European alternative boasting the highest security standards.

Whether it’s Managed Kubernetes or operating our Managed Apps, customers can now run their software on IONOS infrastructure via ayedo—including all the benefits of our certified platform services.

The End of num=100 - Small Change, Big Impact

Wed, 08 Oct 2025 09:40:39 +0000

When Google quietly removed the “num=100” parameter from its search engine logic, hardly anyone outside the SEO bubble noticed at first. Yet, this inconspicuous variable had been a central tool for years for those seeking deeper insights into Google search results. With “num=100,” Google could be instructed to deliver up to a hundred results per query—a convenient backdoor that allowed developers of SEO tools, data service providers, and even AI systems to capture large amounts of search data in a single fetch. Now, this door is closed, and the consequences extend far beyond a few additional lines of code.

OpenAI, AMD, and the Quiet Power Shift in the Global AI Infrastructure

Tue, 07 Oct 2025 13:25:51 +0000

The announcement initially sounded like just another technical partnership in the era of generative AI: OpenAI and AMD have agreed on six gigawatts of GPU capacity to support future AI infrastructures. But a closer look reveals that this partnership is more than just a deal between supplier and buyer. It marks the next level of escalation in a rapidly evolving power structure—not only in high-performance computing but also in the architecture of a digital global economy increasingly built around proprietary models, closed supply chains, and strategic investments.

Cloud Sovereignty Framework: Making Digital Sovereignty Measurable

Tue, 07 Oct 2025 12:00:00 +0000

TL;DR

The EU’s Cloud Sovereignty Framework makes digital sovereignty precisely measurable for the first time – through eight sovereignty objectives (SOV-1 to SOV-8) and five assurance levels (SEAL-1 to SEAL-5).
The SEAL levels allow procurement agencies to set clear minimum requirements for cloud services and objectively compare offers – especially in the regulated and public sector.
SEAL-4 represents practically complete digital sovereignty: EU jurisdiction, technical and operational control by European actors, exit capability, and verifiable evidence across all eight sovereignty objectives.
For organizations, the framework offers a pragmatic roadmap: define target levels per SOV objective, identify gaps, prioritize measures, and align procurement processes and contracts with the model.
ayedo supports you in building SEAL-4 capable platforms – with EU-only infrastructure, BYOK, open standards, exit scenarios, ISO-certified processes, and a structured Cloud Sovereignty Assessment.

What the Cloud Sovereignty Framework Achieves

Digital sovereignty has long been an abstract concept. This changes with the European Commission’s Cloud Sovereignty Framework. It translates the political demand for European control over digital infrastructures into an operational model that can be measured, audited, and embedded in tenders.

Backup Failure in South Korea

Tue, 07 Oct 2025 10:04:18 +0000

The reason given: The storage structure was too large, the transfer rates too slow. A declaration of bankruptcy. Anyone who decides not to maintain external backups under such conditions is recklessly accepting the irreversible destruction of knowledge.

What is overlooked: Not only bits and bytes were deleted – decisions, contexts, traceability, and control were lost. The Ministry of Personnel Management was particularly hard hit, as it stored all documents exclusively in the Cloud .

Weekly Backlog 41/2025

Mon, 06 Oct 2025 13:59:28 +0000

Weekly Backlog Week 41/2025

Digital Identity, Sovereign Administrations, and the Unbreakable Inertia of German Digitalization

Editorial

This week acts as a magnifying glass on everything going wrong in German digital policy—and in a few places, offers some hope.

While Bonify (a Schufa subsidiary!) demonstrates with a data breach that even identity services struggle to protect their own data, others are eager to launch a digital wallet for all of Germany. Meanwhile, Discord grapples with a breach via external service providers—and Saarland shows that administration with open-source AI and European data management can indeed work.

Data Act: Portability and Exit Capability Become Mandatory from September 2025

Mon, 06 Oct 2025 12:00:00 +0000

TL;DR

The Data Act comes into effect on September 12, 2025, making data portability, cloud switching, and interoperability mandatory requirements – with clear rights for users and obligations for providers.
The six core objectives range from IoT data access rights to B2B/B2G data access, cloud switching, interoperability, and protection against third-country access – aiming for fair competition instead of vendor lock-in.
For cloud switching, open APIs, transparent egress rules, and functional equivalence are mandatory. Organizations need exit strategies with clear runbooks, responsibilities, and tested processes.
Interoperability standards like ISO/IEC 19941 and the EU Cloud Rulebook offer a technical compass for multi-cloud architectures and prevent isolated solutions.
ayedo supports you with API-first platform design, standardized exit runbooks, and multi-cloud architectures to pragmatically implement Data Act requirements and leverage portability as a competitive advantage.

Data Act: Portability and Exit Capability Become Plannable

The Data Act (Regulation (EU) 2023/2854) is more than just another compliance project. It is an infrastructure law for the European data and cloud market.

Data Breach at Discord: Attack on Support Provider Compromises User Data

Mon, 06 Oct 2025 10:12:09 +0000

On October 5, 2025, it was revealed that an external support provider for the platform Discord was the target of a cyberattack. Personal data of users who had contacted Discord support in recent weeks was stolen. According to Discord, the core platform was not affected. The attack focused exclusively on the systems of the contracted service provider.

Type of Data Compromised

According to the company, the attackers were able to access the following data sets:

F13 in Saarland: Open-Source AI for a Modern, Sovereign Administration

Mon, 06 Oct 2025 09:54:01 +0000

With the pilot project to introduce the AI assistant F13, Saarland is taking a remarkably clear path towards a digitally sovereign administration. Originally developed in Baden-Württemberg, the solution was specifically designed for the public sector, focusing on data protection, transparency, and control by governmental bodies.

Digital Administration Under Government Control

The goal: to make daily work in authorities more efficient without relying on proprietary platforms. The F13 AI solution processes information locally, does not leave the European legal space, and has been available as Open-Source Software for reuse since July 2025—a rarity in the field of AI-based administrative software.

Cyber Resilience Act: Security by Design for Products with Digital Elements

Sun, 05 Oct 2025 12:00:00 +0000

TL;DR

The Cyber Resilience Act (CRA) mandates manufacturers of “Products with Digital Elements” (PDE) to demonstrate cybersecurity throughout the entire product lifecycle—from design through operation to end-of-support—starting from its enforcement on August 20, 2024.
Products are classified based on risk into non-classified, “Important” (Class I/II), and “Critical”; the class determines whether a self-assessment is sufficient or if a third-party assessment or EU certification is required.
Core requirements include Security by Design, comprehensive and maintained SBOMs, systematic CVE management, structured update strategies with clearly defined support periods, and coordinated vulnerability disclosure processes including reporting deadlines.
The CRA creates transparency in the supply chain—including non-technical risks like jurisdictional dependencies—and offers European providers the opportunity to leverage security and sovereignty as competitive advantages.
ayedo supports you practically in achieving CRA readiness: automated SBOM generation, signed build pipelines, continuous vulnerability management, and a coordinated incident and support model—up to a structured CRA readiness check.

Cyber Resilience Act: Context and Timeline

With the Cyber Resilience Act , the EU is establishing a horizontal legal framework for the cybersecurity of products with digital elements for the first time. The CRA comes into force on August 20, 2024, with most obligations applying after a transition period of 36 months—likely from late summer 2027. Certain parts, particularly those related to vulnerability disclosure and reporting, will take effect earlier.

DORA: ICT Resilience for the Financial Sector Starting January 2025

Sat, 04 Oct 2025 12:00:00 +0000

TL;DR

On January 17, 2025, the Digital Operational Resilience Act (DORA ) will come into effect for financial institutions and key ICT service providers in the EU, establishing a mandatory framework for ICT risk management, incident handling, testing, and third-party risk.
DORA complements the horizontal security framework of NIS2 as a specialized, sector-specific regulation for the financial sector—with stricter, more detailed requirements for governance, testing (including TLPT), and ICT third-party control.
Threat-Led Penetration Testing (TLPT) according to TIBER-EU will become mandatory for large and systemically important financial actors, requiring structured, intelligence-led red teaming against real threat scenarios.
ICT third-party risk takes center stage: A complete register, systematic due diligence, clear exit strategies, and contractually secured audit and control rights become core requirements of digital resilience.
ayedo supports financial institutions with a DORA compliance workshop, ISO-27001-oriented operational models, Cloud-Native platform expertise, and concrete preparation for TLPT to pragmatically implement technical and organizational requirements.

DORA from January 2025: What Financial Institutions Can Expect

With Regulation (EU) 2022/2554, the EU is establishing a unified, binding framework for the digital operational resilience of financial institutions for the first time. DORA targets nearly all actors in the financial sector: credit institutions, payment service providers, insurers, investment firms, market infrastructures, and—most importantly—critical ICT third-party providers.

NIS-2: Cyber Resilience Becomes Mandatory for 18 Sectors

Fri, 03 Oct 2025 12:00:00 +0000

TL;DR

NIS-2 expands the scope of EU cybersecurity regulation to 18 sectors, primarily involving medium and large companies in critical and important areas. The directive has been in effect since January 16, 2023, and must be transposed into national law by October 17, 2024.
The core element of NIS-2 consists of ten minimum requirements for cyber risk management, including incident handling, business continuity/disaster recovery, supply chain security, access control, and multi-factor authentication.
Management bears explicit responsibility: leadership teams must understand cybersecurity risks, make strategic decisions, and are personally liable in cases of gross negligence.
Reporting obligations are strictly regulated: early warning within 24 hours, detailed report after 72 hours, and a final report within a month – requiring clear processes, roles, and appropriate technical telemetry.
ayedo supports you with an integrated, NIS-2-focused platform: from intrusion detection with Falco, to network visibility with Cilium , backups with Velero , to supply chain security with Harbor as well as a structured compliance architecture and a NIS-2 readiness assessment.

NIS-2 as the New Standard for Cyber Resilience in Europe

With the NIS-2 Directive (EU) 2022/2555, the EU establishes a unified, demanding standard for cybersecurity. The directive came into force on January 16, 2023; member states must transpose it into national law by October 17, 2024. From this point, national NIS-2 laws apply – along with concrete obligations and sanction mechanisms.

GDPR: Privacy by Design as the Foundation of Modern Software

Thu, 02 Oct 2025 12:00:00 +0000

TL;DR

The GDPR has required since May 25, 2018, that personal data be protected according to the “Privacy by Design” principle – technically, this means risk-based security architecture, end-to-end encryption, and well-implemented processes for data subject rights.
Article 32 demands “state of the art” in security and availability: Pseudonymization, encryption, access control, auditability, and robust backup/recovery processes are now minimum standards in cloud-native environments.
Article 28 shifts responsibility into the supply chain: Cloud providers must provide clear guarantees as processors – from adherence to instructions, transparency of subprocessors, to technical support for deletion requests (Article 17).
EU data localization is not a political luxury but a technical and legal anchor of stability: Data residency in EU data centers reduces regulatory risks and simplifies architectural decisions.
ayedo practically implements Privacy by Design: EU-based data centers, BYOK key management, end-to-end encryption, detailed audit logs based on systems like Loki , and documented Compliance components in the ayedo Kubernetes distribution.

Privacy by Design as an Architectural Principle – Not an Add-on

“Privacy by Design” in the GDPR is not a marketing slogan but an architectural principle. The regulation is deliberately technology-neutral. It does not prescribe which software you must use but defines protection goals and leaves you the freedom to implement them technically in a meaningful way.

When the Score Provider Becomes a Risk Itself

Thu, 02 Oct 2025 10:17:45 +0000

Bonify and the Loss of Digital Identity

On October 1, 2025, a data protection incident came to light that further shook trust in the digital credit industry: Schufa subsidiary Forteil, operator of the Bonify service, confirmed that unauthorized access to user identification data had occurred. This was not about abstract metadata or technical logs, but real personal data: identity documents, addresses, photos, and video recordings, captured during the video identification process.

Compliance Compass: EU Regulations for Software, SaaS, and Cloud Hosting

Wed, 01 Oct 2025 12:00:00 +0000

TL;DR

The EU has established a coherent framework with GDPR , NIS‑2 , DORA , CRA , Data Act , and the Cloud Sovereignty Framework, systematically enhancing data protection, cyber resilience, digital sovereignty, and interoperability.
For operators of software, SaaS, and cloud hosting, this means clear requirements for security-by-design, data processing, exit capability, third-party risks, and governance – but also reusable components that address many obligations simultaneously.
The common goals of these regulations are: protection of personal and business-critical data, resilience against cyber incidents, reduction of vendor lock-in, and a sovereign European technology landscape.
A strategically sensible approach is an integrated one: a clean ISMS, cloud-native architecture, documented processes, and transparent supply chains can cover large parts of the requirements of all six regulations in parallel.
ayedo supports organizations in translating these regulations into sustainable architecture, platform, and process decisions, thus using compliance as a structured competitive advantage – from analysis to the operated platform.

Why a Compliance Compass is Necessary

The European regulatory landscape has become significantly denser in recent years. This is no coincidence but an expression of a clear political goal: Europe wants to be not just a consumer but an independent player in the digital space. This includes reliable data protection, robust infrastructures, fair competition conditions, and a minimum level of technological independence.

Smart Load Balancing with Cloudflare Healthchecks: Efficient, Robust, and Cost-Effective

Tue, 30 Sep 2025 09:03:28 +0000

Cloudflare is far more than just a CDN provider. In addition to performance optimization and security features, the platform offers numerous tools that can be creatively used to address individual requirements in modern infrastructure setups—without necessarily relying on the paid Enterprise features.

At ayedo, we have done just that: We use Cloudflare not only for DNS management and traffic proxies but also for our own load balancing concept—without using Cloudflare’s official load balancer features, and with impressive cost efficiency.

The Digital Networks Act (DNA): Europe's Explosive Connectivity Reform

Mon, 29 Sep 2025 08:32:34 +0000

Why the DNA Redefines Europe’s Digital Foundation

With the Digital Networks Act (DNA), the EU is preparing one of the most profound reforms of its telecommunications sector. The aim is to overcome regulatory fragmentation, accelerate investments in future-proof network infrastructures, and strengthen Europe’s digital competitiveness on a global scale.

However, the DNA is more than a technocratic piece of legislation: it represents a paradigm shift towards a unified, resilient, and sovereign digital infrastructure—while also being at the heart of a highly emotional controversy over the introduction of a so-called Fair-Share Model. This model aims to obligate large content providers to co-finance the networks, with potential implications for net neutrality and the openness of the internet.

OpenAI for Germany – Digital Sovereignty with Azure as the Foundation?

Thu, 25 Sep 2025 07:28:07 +0000

Title: OpenAI for Germany – Digital Sovereignty with Azure as the Foundation?

Markdown-Content:

On September 24, 2025, SAP and OpenAI announced a new partnership: OpenAI for Germany. The goal is to bring artificial intelligence “made for Germany” to the public sector – responsibly, legally compliant, and sovereign. The project is supported by SAP and operated through their subsidiary Delos Cloud – based on Microsoft Azure .

At first glance: a step forward. On second glance: a contradiction.

Weekly Backlog Week 40/2025

Thu, 25 Sep 2025 07:16:31 +0000

Sovereignty vs. Market Logic

🧠 Editorial

This week, a common theme is hard to miss: “Sovereignty” is being invoked everywhere. In the cloud, in AI, in networks. But as soon as you look closer, everything crumbles. Sometimes the German “state AI” is dependent on Azure. Sometimes Nvidia pumps 100 billion into OpenAI to secure its monopoly position. And sometimes Brussels is drafting a Digital Networks Act that aims to reorder the basic rules of the net. Uncertainties between fair-share demands and net neutrality dangers.

OpenAI and Nvidia: $100 Billion for the AI Arms Race

Wed, 24 Sep 2025 11:41:40 +0000

Title: OpenAI and Nvidia: $100 Billion for the AI Arms Race

Markdown-Content:

The Reuters report is making waves: Nvidia plans to invest up to $100 billion in OpenAI. A move that impresses not only by its sheer scale but also by the structure of the deal. Nvidia aims not only to provide capital but also to supply the necessary hardware—thus securing the foundation for OpenAI’s future data centers.

The Scale of the Deal

Specifically, the agreement stipulates that OpenAI will deploy at least 10 gigawatts of Nvidia systems. This equates to the energy needs of over eight million US households. It is already clear: The construction and operation of these data centers will set new standards—both technically and economically.

Weekly Backlog Week 39/2025

Wed, 24 Sep 2025 10:41:40 +0000

Linux Vs Windows

🧠 Editorial

Astronauts use Linux because you can’t open Windows in space – and honestly, sometimes I wish our interior ministries would take the same logic to heart. But we’ll get to that in a moment.

🚨 The Tech News of the Week

Lower Saxony Stops Palantir – Finally Someone with Backbone

Lower Saxony’s Interior Minister Daniela Behrens did the only right thing: she gave Palantir a clear rejection. Her statement “The system is, of course, a good system, but it is not manageable” hits the nail on the head.

The Big Difference: Why MSPs Have a Future

Sun, 21 Sep 2025 20:09:56 +0000

Why Hyperscalers Only Sell Hardware – and MSPs Are the Future

Hyperscalers have shaped the digital world like few other models. With the promise of unlimited scaling, global availability, and seemingly endless innovation, they have dominated an entire generation of IT strategies. However, upon closer inspection, little remains of this narrative: The business model of hyperscalers is still almost exclusively based on the sale of hardware—compute, storage, network traffic. Nicely packaged, globally distributed, encapsulated in APIs, but at its core, it’s still the same logic: You rent machines.

Kubernetes as the Operating System of the Cloud

Sun, 21 Sep 2025 20:07:30 +0000

When discussing digital sovereignty and modern IT infrastructures today, Kubernetes is unavoidable. In just a few years, this open-source project has evolved from a container orchestrator to a de facto standard, comparable in significance to the Linux kernel. To understand why, one must examine its architecture and take the parallels seriously.

From Linux to Cluster

Linux abstracts the hardware of a server. It manages CPU cores, memory, and storage media, ensures process isolation, and provides interfaces upon which applications can build.

Cloud-Native Software Development

Sun, 21 Sep 2025 20:04:43 +0000

Sovereignty Through Architecture

Cloud-native software development is more than just a set of methods. It describes a paradigm that designs applications to function reliably in highly dynamic infrastructures—environments where servers, databases, and networks no longer exist statically but can be provisioned and removed via API.

This shifts the perspective: it’s no longer just about writing code or operating infrastructure, but about the integration of both disciplines into a continuous, verifiable process.

Microsoft Entra ID - The Most Dangerous Security Vulnerability

Fri, 19 Sep 2025 11:21:58 +0000

A critical look at CVE-2025-55241

On September 18, golem.de reported a security vulnerability in Microsoft Entra ID, discovered by security researcher Dirk-Jan Mollema, who described it as “probably the most significant Entra ID security vulnerability” of his career. Registered as CVE-2025-55241 and rated as critical with a CVSS score of 9.0, the case exemplifies how vulnerable central identity and access platforms can be.

What was the issue?

At its core, the vulnerability is based on the misuse of so-called Actor-Tokens—internal tokens that Microsoft uses for service-to-service communication. Combined with a bug in the Graph API for Azure Active Directory, Mollema demonstrated that these tokens could be repurposed to gain access to foreign tenants.

Switching Register – Procedures, Formats & Interfaces

Fri, 19 Sep 2025 00:00:00 +0000

Version: 2025-09-19

Contact: security@ayedo.de · billing@ayedo.de
Legal nature: This register specifies Art. 26 EU Data Act. The contract including the General Terms and Conditions remains decisive. For each contract, the version handed over at the time of the conclusion of the contract is decisive (export/PDF as an attachment). Subsequent updates do not affect current contracts to their detriment.

1) Purpose and Scope

This register describes procedures, data structures/formats, standards, and interfaces for provider switching. It applies to the following ayedo service areas:

EU Data Act – Switching & Interoperability Center

Thu, 18 Sep 2025 00:00:00 +0000

As of: 18.09.2025

This page consolidates ayedo-wide information on switching, interoperability and transparency according to Regulation (EU) 2023/2854 (EU Data Act). It specifies our contracts/terms but is not itself part of the contract. The applicable contract including annexes (definitive lists) remains authoritative. Versions of this page are relevant for the time of contract conclusion.

Applicability & Key Dates

12.09.2025: Applicability of switching obligations (Chapter VI; esp. Art. 23–27, 30).
12.01.2027: Prohibition of switching charges; until then only cost-based, reduced fees are permitted (directly attributable costs).
Chapter IV (unfair contract terms in B2B towards SMEs) applies to newly concluded contracts from 12.09.2025; transition periods apply to certain existing contracts.
Note: Standard service fees continue regularly during Notice/Transit. Egress/parallel operation: at cost.

Further information can be found in our Terms and Conditions (Chapter 7).

CrowdStrike Under Fire: Supply Chain Attack on npm Packages Unveils New Dimension of Threat

Tue, 16 Sep 2025 13:15:26 +0000

The news is making waves: Several npm packages from CrowdStrike – a company known for security and protection – have been compromised. What might seem like a footnote is actually a massive wake-up call for the entire software industry. This is a continuation of the “Shai-Halud” campaign, which had already been noted during the Tinycolor attack.

What Happened?

Unknown attackers gained access to the npm account crowdstrike-publisher and published tampered versions of popular CrowdStrike libraries. These include:

Hosting Reloaded: Why the Future Doesn't Belong to the Hyperscalers

Mon, 15 Sep 2025 07:09:24 +0000

In recent years, Cloud First has been considered an almost unshakeable maxim. Companies of all sizes were encouraged to move their infrastructure to the public cloud as quickly as possible to ensure scalability, innovation, and competitiveness. For many, this sounded like a simple formula: the more cloud, the better. However, it has become apparent that this approach does not always deliver the promised solution—in fact, it raises new questions that are increasingly being critically discussed.

Chat Control: From GDPR to Mass Surveillance – Europe's Dangerous Shift

Fri, 12 Sep 2025 08:08:10 +0000

The European Union is on the verge of enacting one of the most profound intrusions into digital privacy since the inception of the internet. The draft law for the so-called “Chat Control,” officially the “Regulation to Prevent and Combat Child Sexual Abuse,” initially appears to be a necessary protective measure. However, in reality, it is a proposal that not only undermines encrypted communication but also questions the fundamental rights of hundreds of millions of EU citizens.

NPM Under Siege: Supply Chain Attack on the Foundation of Software Development

Mon, 08 Sep 2025 19:26:12 +0000

Since September 8th, concrete evidence has emerged that a number of extremely widespread NPM packages — including debug, chalk, ansi-styles, supports-color, and other core components of the Node.js ecosystem — have been compromised. According to public accounts, the maintainer was tricked via phishing into a fake NPM support domain, leading to the release of new, tampered versions that, in total, are downloaded billions of times weekly across the entire set, potentially infiltrating virtually every modern frontend, backend, and CI/CD pipeline.

Meta, Microsoft, and the Illusion of "Superintelligence for All"

Fri, 05 Sep 2025 10:20:14 +0000

Starting Point: Quarterly Figures and Big Promises

At the end of July 2025, Meta released its latest quarterly figures – alongside strong revenues (22% growth to $47.52 billion, profit increase of 36% to $18.34 billion), Mark Zuckerberg primarily delivered one message: “Superintelligence” is within reach. Meta aims to “create a personal superintelligence for all people in the world.”

In parallel, Microsoft also presented impressive figures: a revenue jump of 18% to $76.4 billion, a profit increase of 22% to $27.2 billion, and cloud growth of 25%. With these figures, Microsoft joins the four-trillion-dollar club, alongside Nvidia, while Meta moves towards a market capitalization of two trillion dollars. The AI boom is driving the stock market – and is being sold as a historical turning point.

SBOM and CVE Scanning – Why Secure Artifacts Are Essential for the Software Supply Chain

Tue, 02 Sep 2025 15:45:28 +0000

The security of software supply chains is one of the central topics in IT security today. Companies are under increasing pressure to ensure transparency, traceability, and reliability of the software they use. A key tool in this regard is the Software Bill of Materials (SBOM), complemented by automated scanning for known vulnerabilities – Common Vulnerabilities and Exposures (CVE).

In this post, we will:

Explain the term SBOM and make it tangible using real-world concepts.
Describe the concept of CVEs and introduce the main sources of vulnerability information.
Show how tools like GitLab and Harbor help generate SBOMs and conduct CVE scans.
Highlight the particular benefits of these processes for compliance-heavy industries such as pharma, industry, and GovTech.

What is a Software Bill of Materials (SBOM)?

A Software Bill of Materials is essentially a bill of materials for software. It describes the components that make up software – similar to the bills of materials used in industrial manufacturing.

Storage in Kubernetes

Tue, 02 Sep 2025 15:45:25 +0000

Storage in Kubernetes is by no means trivial. Stateful workloads impose the highest demands on stability, performance, and availability—handling persistent data is thus one of the most complex tasks in the Cloud-Native environment. This article provides a comprehensive overview: from CSI, Cloud vs. On-Premise CSI, Longhorn, Ceph, and another solution, to Cloud-Controller-Manager, costs, scaling, redundancy, security, and the challenges of local storage landscapes.

What is CSI (Container Storage Interface)?

CSI, the Container Storage Interface, is a standard interface (API specification) that allows Kubernetes or other container orchestrations to work with any storage solutions (block or file) without changes to the Kubernetes core code. This enables external storage providers to develop CSI drivers and deploy them independently of the Kubernetes release cycle. The architecture typically includes two components: a Controller Plugin (for provisioning, attachment, etc.) and a Node Plugin (for mounting).

Immutable Releases on GitHub – A Significant Milestone for a Secure Software Supply Chain

Tue, 02 Sep 2025 15:37:32 +0000

The security of the software supply chain is one of the central topics in modern software development. With every new dependency, external artifact, and library used, the attack surface grows – and so does the responsibility of developers to secure this chain against manipulations and accidental errors. GitHub has now introduced a feature called Immutable Releases, which marks a significant step in this direction: once published, releases can no longer be altered.

Kyverno vs. OPA – Policy Control for Kubernetes in Regulated Environments

Sun, 31 Aug 2025 21:39:41 +0000

Kubernetes has become the de facto standard for operating cloud-native applications. However, with its flexibility comes immense complexity. In highly regulated environments—such as finance, healthcare, or public administration—secure use of Kubernetes is only possible when policies strictly control the behavior of clusters, workloads, and users. Without such mechanisms, there is a risk of compliance violations, security gaps, and uncontrolled deviations from internal standards.

Two of the most well-known policy engines are Kyverno and Open Policy Agent (OPA) . Both offer mechanisms to enforce policies in Kubernetes environments, yet they differ significantly in philosophy, usability, and integration. This article highlights the differences, shows the pros and cons in regulated environments, and compares suitability for small teams and large organizations.

Spotify Backstage – Potentials and Challenges of Internal Developer Platforms

Sun, 31 Aug 2025 21:16:46 +0000

Internal Developer Platforms (IDPs) have been a hot topic in software development for several years. Companies face the challenge of managing complex cloud-native landscapes with microservices , APIs, Kubernetes clusters, and a multitude of tools. Developer teams lose time due to context switching, incomplete documentation, and fragmented toolchains. This is where Spotify Backstage comes in – an open-source platform for developer portals, released by Spotify in 2020 and now part of the Cloud Native Computing Foundation (CNCF) .

Sovereign Alternatives to Hyperscalers – Does It Always Have to Be Another "Cloud"?

Sun, 31 Aug 2025 17:30:34 +0000

The debate about sovereignty in the cloud in Europe often revolves around the question: Do we need our own hyperscalers to be independent? Many see the solution in a “European cloud” that should replace AWS, Azure, or Google Cloud. But the reality is much more complex—and in many ways, more pragmatic. Most services offered by hyperscalers are based on well-known open-source projects. The difference lies in branding, integration, and pricing. Those truly seeking sovereignty don’t necessarily need to build a new hyperscaler. The real alternative is closer: Kubernetes as a foundation and open tools instead of proprietary “cloud services.”

Sovereign AI for Europe – The Supply Chain Problem

Sun, 31 Aug 2025 17:24:07 +0000

The European debate on “sovereign AI” is often reduced to regulation, data protection, and societal acceptance. What is often overlooked: Sovereignty in Artificial Intelligence is not only determined by algorithms or models but crucially by the supply chain of the underlying hardware. Without chips, without GPUs, without the necessary infrastructure, any vision of European AI sovereignty is nothing more than an academic exercise. In this post, I aim to highlight the real bottlenecks blocking Europe on this path and simultaneously identify the remaining opportunities for action. This will not be a romantic plea for autarky, but a sober analysis of dependencies, market mechanisms, and industrial policy options.

Kubernetes v1.34: Precision, Security, and Maturity

Fri, 29 Aug 2025 08:22:17 +0000

Kubernetes v1.34: Precision, Security, and Maturity

Kubernetes continues to grow – with version 1.34, the next major release is here. The cycle includes 58 new features: 23 are stable, 22 are Beta, and 13 are newly Alpha. Numbers alone don’t say much. What’s interesting is how Kubernetes is developing technically – and where it’s headed.

Dynamic Resource Allocation Becomes Stable

A key advancement is the now stable Dynamic Resource Allocation (DRA). It allows GPUs, TPUs, network cards, and other specialized resources to be flexibly claimed within the cluster. This makes managing parallel workloads, AI training, and HPC scenarios significantly easier.

Databases in Kubernetes – Alternatives to Cloud-Hosted DB

Thu, 28 Aug 2025 12:25:21 +0000

Operating databases in Kubernetes was long considered risky: Stateful workloads, persistent data, and container orchestration seemed incompatible. Today, the situation is different. Specialized operators, optimized storage solutions, and proven practices have made relational and document-based databases stable building blocks for cloud-native architectures.

While hyperscalers like AWS, Google, or Azure simplify operations with cloud-hosted DBaaS offerings (e.g., RDS, CloudSQL, CosmosDB), questions remain: Vendor lock-in, sovereignty, compliance. Companies seeking full control and flexibility therefore opt for self-hosted databases in Kubernetes.

Observability in Kubernetes – A Comprehensive Comparison

Wed, 27 Aug 2025 08:37:19 +0000

Kubernetes has become the standard for running containerized applications in recent years. As its adoption grows, so does the need to monitor clusters and applications transparently, traceably, and efficiently. Observability – the ability to reconstruct the state of a system from external signals such as logs, metrics, and traces – is a central concept for this purpose.

This article provides a well-founded overview of open-source solutions in the field of metrics and log monitoring , comparing their strengths and weaknesses in terms of scalability, performance, and maintainability, and exploring various data ingestion methods. The goal is to provide clear guidance for architects and operations teams looking to build a future-proof observability strategy in Kubernetes .

Egress Traffic Management in Kubernetes

Wed, 27 Aug 2025 08:16:48 +0000

Kubernetes has provided proven mechanisms for years to manage incoming traffic into a cluster. Ingress controllers serve as a defined “bottleneck” through which external requests enter and are handled with clear rules – such as for routing, TLS, or authentication. However, the situation for outgoing traffic, known as egress traffic, is less clear. By default, egress traffic leaves the cluster via the node where the pod initiating the connection is running. There is no central control instance comparable to the ingress controller.

.NET in Kubernetes – Is It Possible?

Wed, 27 Aug 2025 07:00:43 +0000

Spoiler Alert: Yes, it is – and it’s not only possible but already a standard in many enterprise environments.

Does .NET Fit with Kubernetes?

At first glance, it may seem unusual to run a technology originally heavily influenced by Windows in the Linux-dominated Kubernetes environment. However, in practice, Microsoft has strategically worked over the past few years to make .NET cross-platform. Since the introduction of .NET Core , the runtime environment has been fully available on Linux and macOS and is continuously optimized for container operations. With .NET 7 and .NET 8 , Microsoft places special emphasis on performance, resource efficiency, and cloud-native use cases.

From OTRS to Zammad – 50,000 Tickets Find a New Home

Tue, 26 Aug 2025 11:41:51 +0000

The transition from OTRS to Zammad is more than just a technical upgrade for many organizations – it’s a step towards a sovereign, modern, and highly available ticketing infrastructure. In this blog post, we describe in detail how we successfully migrated 50,000 tickets from a non-highly available OTRS 6 instance to a self-hosted Zammad instance running on Kubernetes.

We cover both the technical preparations and the challenges, best practices, and specific recommendations for anyone planning a similar journey.

Digital Powerlessness – Germany Ensnared by Big Tech - A Film by ARD

Thu, 21 Aug 2025 08:14:12 +0000

The fact that the Bundeswehr will store its data in the Google Cloud is not an IT project. It is a security policy capitulation. Just like the decision to give Peter Thiel’s Palantir direct access to German police data. These two examples are not isolated missteps – they are expressions of systemic failure. Germany has relinquished its digital sovereignty.

Lack of Strategy as a Principle

Instead of developing a coherent digital strategy, the German government has settled for elevating American hyperscalers to the standard. Cloud infrastructure, identity management, communication networks, cybersecurity – almost all critical systems are structurally supported by US corporations. The illusion that one has acquired “the best technologies” replaces any geopolitical analysis. Those who place data in the Google Cloud, who integrate Palantir into police systems, are not choosing efficiency but dependency.

Microsoft Eliminates Traditional Volume Licenses

Wed, 20 Aug 2025 07:50:27 +0000

Starting November 1, 2025, Microsoft will eliminate traditional volume licenses. Specifically affected are the major licensing models Enterprise Agreement (EA) and Microsoft Products and Services Agreement (MPSA). Previously, companies could receive discounts between 6 and 12 percent off the list price depending on the volume purchased. This will soon end. From November, all customers will fall into price level A – and will pay the full list price as it appears on the Microsoft website.

K3s on Flatcar via Ansible & vSphere: Automated K8s for Regulated Environments

Sun, 17 Aug 2025 19:17:38 +0000

In industries like manufacturing, finance, or critical infrastructures, automation is not a “nice-to-have” but a mandatory necessity. Kubernetes is well-established – yet the provisioning of control planes in regulated on-premises environments remains complex.

Virtual machines must be auditable, reproducible, and secure. Standard templates with Ubuntu or CentOS are often challenging to keep up-to-date. At the same time, compliance requires full control over supply chain, secrets, and network access.

An approach particularly suitable for edge, test, dev, and even prod clusters in sensitive environments: Flatcar Linux + k3s, fully automated provisioning via Ansible on vSphere.

k3k: agent-less k3s in Kubernetes

Sun, 17 Aug 2025 18:44:33 +0000

Summary in Three Points

Controlplane on demand: With k3k, you can run a fully-fledged k3s control plane as a Kubernetes workload – without agent nodes. This enables lightning-fast spin-up/down of complete, valid k3s clusters for testing, tenants, or edge scenarios. (Background: agent-less servers are a feature of k3s where the control plane is not a normal node in the cluster, as is usually the case)
On-Prem turbo: Where provisioning full VMs for each control plane can take hours/days, k3k creates reproducible environments in minutes – ideal for end-to-end tests in CI, multi-tenant K3s setups, dev clusters, and resource-limited edge.
Compatible & open: k3s is a lightweight, CNCF-compliant Kubernetes with ARM support; Helm remains the familiar package manager. k3k leverages this – with Helm install, declarative, GitOps-friendly.

k3k on GitHub

Zero Trust Network Access (ZTNA) with NetBird – The Open-Source Alternative

Sun, 17 Aug 2025 18:28:18 +0000

In a world where cloud-native architectures, remote development, and complex multi-cluster infrastructures have become the norm, traditional VPN-based access is simply outdated. Zero Trust Network Access (ZTNA) is not just a trend but a necessity: a modern paradigm where trust is never blind and every access is explicitly verified—regardless of location, device, or network.

In this article, we explain:

What ZTNA is and how it differs from traditional VPN/network access
Why ZTNA is indispensable for secure, cloud-native software delivery pipelines
Comparison between established industry-standard ZTNA providers and the open-source solution NetBird
Why we at ayedo rely on NetBird – benefits of the OSS strategy
Technical integration of ZTNA with OIDC, Kubernetes & cross-network scenarios

What is ZTNA – and what makes it different?

ZTNA is based on the core principle of “Never trust, always verify.” Unlike VPNs that trust traditional network zones, ZTNA individually verifies each connection—even within the internal network. Authentication (often OIDC-based), device status, context, and identity determine whether access is granted—and only to the permissible target resources, following the Least Privilege principle. This is often combined with terms like “Software-Defined Perimeter (SDP)” or “Secure Access Service Edge (SASE).” Here are some key advantages:

Artifact Management – Why Blind Trust in Public Artifacts is Dangerous

Sun, 17 Aug 2025 17:52:25 +0000

The Invisible Foundation of Modern Software

Cloud-native software development is built on a foundation that usually remains invisible: artifacts. These include Docker images, Helm charts, operator packages, and other components essential in modern Kubernetes workflows. Almost every project—from small APIs to complex AI platforms—relies on these packages. But how stable is this foundation really when sourced from the community or third parties without safeguards, mirroring, or governance?

The short answer: not stable enough.

Developer Platforms by ayedo: Tailored, Flexible, and Future-Oriented

Sun, 17 Aug 2025 17:07:27 +0000

Developer Platforms by ayedo: Tailored, Flexible, and Future-Oriented

At its core, Developer Platforms enable teams to guide software securely, efficiently, and automatically through the entire Software Development & Delivery Lifecycle. As a Managed Service Provider for cloud-native platforms, ayedo designs these platforms not as a rigid product but as a dynamic infrastructure that responds to customer needs just like a sophisticated GitOps pipeline.

Why Have Your Own Developer Platform?

The Problem: Fragmented Tool Landscapes and Unclear Processes

In many companies, development and operations teams work with a multitude of standalone solutions:

Governance & Security for AI Development Teams: Cluster Access & Secret Management in Kubernetes

Sun, 17 Aug 2025 16:59:23 +0000

How companies can make their GPU-Kubernetes environments secure, compliant, and efficient for AI development using tools like Kyverno, Vault, and Infisical.

Introduction

AI workloads are not only computationally intensive but also sensitive in terms of security and compliance. While GPUs, MIG, and time-slicing ensure resources are used efficiently, new questions arise at the governance level:

Who is allowed to deploy where?
How are access rights for clusters and GPU resources assigned?
How are secrets (API keys, tokens, database passwords, model registry credentials) managed?
How is it prevented that sensitive data is used uncontrollably in dev or staging environments?

In our last post, we showed how MIG and time-slicing make GPU resources available for AI teams in Kubernetes. Now it’s about the governance layer above: Cluster Access and Secret Management – the two central levers for security and compliance.

GPUs in Kubernetes: Practical Guide for H100, MIG & Time-Slicing

Sun, 17 Aug 2025 14:34:08 +0000

GPUs in Kubernetes: Practical Guide for H100, MIG & Time-Slicing

How to securely, efficiently, and cloud-natively provision GPU resources for development, inference, and training - including H100-MIG and Time-Slicing, YAML examples, and operational policies.

TL;DR

Yes, a single GPU can be used by multiple Pods – either hardware-isolated via MIG (Multi-Instance GPU) or cooperatively via Time-Slicing.
Developers request exactly the GPU size they need (e.g., nvidia.com/mig-3g.40gb: 1), receive predictable performance, and only pay/consume what they use.
Cloud-native patterns (GitOps, CI/CD, IaC, Rolling/Blue-Green, Canary, Autoscaling, Multi-Tenancy) work even for GPU workloads – if the infrastructure is cleanly modeled.

This post shows end-to-end how to operate bare-metal Kubernetes (e.g., with NVIDIA H100) in a production-ready manner, how to effectively combine MIG and Time-Slicing, and which operational and governance aspects (quotas, labeling, monitoring, cost control) are crucial.

324 Million MagentaTV Logs Exposed Online – What This Case Reveals About Data Security

Wed, 13 Aug 2025 08:29:04 +0000

The numbers are impressive – and alarming: Over an unsecured Elasticsearch database, 324 million log entries from the streaming platform MagentaTV were publicly accessible. Affected: Data from an estimated 4.4 million customers.

The security gap was not discovered internally but by the security experts at Cybernews. The database did not belong directly to Deutsche Telekom but to the French AdTech company Equativ and its subsidiary Serverside.ai, which handles server-side ad insertion (SSAI) for MagentaTV.

Kira: Why We Are the First to Use an AI Influencer – and What It Means for ayedo

Mon, 11 Aug 2025 09:40:48 +0000

An AI influencer is not a human who spontaneously decides whether to post a video or a post today. An AI influencer is a digital persona, fully constructed, always available, never in need of a vacation, and capable of producing high-quality content in seconds. That’s exactly what Kira is. She will speak for us – about Cloud-Native technologies, AI and hosting news, in videos, podcasts, and on LinkedIn.

We are consciously taking a step with Kira that no other company in our industry has dared to take. We don’t just want to join the conversation; we want to shape how this topic is discussed.

Why Helm is the Standard for Kubernetes Apps

Wed, 06 Aug 2025 10:25:18 +0000

Kubernetes has evolved from an experimental playground to the de facto standard for cloud-native applications in recent years. Its flexibility and scalability are impressive, but they come at a cost: significantly increased complexity in managing deployments, configurations, and releases. Anyone seriously operating or delivering software on Kubernetes will sooner or later face the question: How do I package my application so that it is reproducible, maintainable, and easily integrable?

Tariff Deal with Trump: Saarland Pays the Price

Mon, 04 Aug 2025 06:46:22 +0000

Sometimes a single sentence is enough to reveal the political reality in all its bitterness. In this case, it is: “The tariff deal with the USA is damage control – at a very high price.” This was recently commented on by Frank Thomé, CEO of the IHK Saarland. And this price? It could cost up to 17,000 jobs in Saarland.

What Was Actually Decided?

US President Donald Trump and EU Commission President Ursula von der Leyen reached an agreement at the end of July that, at first glance, seems like a breakthrough. Instead of 30% import tariffs on European products, there are now “only” 15% across the board. This sounds like relief – until you read the fine print.

Transatlantic Illusion – How Europe Becomes a Supplier of Data and Investment

Wed, 30 Jul 2025 08:15:04 +0000

The celebration over the recent “deal” between the EU and Donald Trump seems like a macabre staging. While Brussels publicly celebrates “planning security in uncertain times,” the real power dynamics continue to shift westward – economically, technologically, politically. They speak of partnership, but what they mean is submission.

1. Economically: Tariffs on Steel, Billions Flowing

A quick glance at the numbers is enough to recognize the imbalance: Europeans commit to investing 750 billion euros in US energy – LNG, oil, and uranium. An additional 600 billion euros are set to flow into the US economy, rather than into our crumbling infrastructure or digital sovereignty. Meanwhile, European exports to the US will be subject to a 15 percent tariff – with few exceptions. German steel will continue to face 50 percent punitive tariffs. The “success” of this deal is that Trump reduced his initial threat of a 30 percent blanket tariff on everything to 15 percent. A bad deal that costs jobs and endangers production sites.

Palantir and the Police: How Surveillance Software Becomes a Threat to Civil Rights

Mon, 28 Jul 2025 11:37:41 +0000

Palantir in Germany is more than just a software provider. It symbolizes a quiet shift in the state: away from democratic control, towards data-driven surveillance by external tech corporations. And right in the middle of it all—German interior ministries spending millions on a system they neither understand nor control.

400,000 Euros Monthly for an Unused System

In Hesse, a contract with Palantir Technologies was signed, costing the state government around 400,000 euros per month—over five years. Without public tender. Without parliamentary oversight. And without productive use. The deployment of the surveillance software Gotham was halted after the Federal Constitutional Court in 2023 declared key regulations unconstitutional.

Tariffs, Steel Crisis, US Dependency: What the Trump-EU Deal Means for Germany

Mon, 28 Jul 2025 11:16:25 +0000

It was a long tug-of-war – now there’s a deal. The EU and the USA have reached a last-minute compromise in the tariff conflict. What initially appears to be a geopolitical breakthrough reveals, upon closer inspection, primarily one thing: Europe pays. A lot. And not just with money.

A “Deal” That Comes at a High Price

The new deal stipulates that the initially threatened 30% US tariffs on European products are averted. But this is not a victory – rather the price for something else. The EU now accepts a flat import tariff of 15% on the majority of its exports to the USA. For many goods – especially cars – this means a sixfold increase in the previous tariff rates. Meanwhile, access for US products to the European market remains largely tariff-free.

Cloud First is Yesterday – Why Europe Must Finally Digitally Sovereignize

Wed, 23 Jul 2025 11:43:48 +0000

For a long time, digital transformation was considered a technical project: faster, more scalable, more efficient. Those who ventured into the cloud early were seen as bold, modern, progressive. Today, over a decade later, we must acknowledge: The cloud is no longer just a technology topic – it is also a political question.

From Progress to Risk

What was once celebrated as an engine of innovation has now become critical infrastructure. And critical infrastructure demands control. Knowing where our data resides. Ensuring who has access to it. Being certain that it cannot be used against us in a critical situation.

ToolShell, SharePoint – and the Convenience of Losing Control

Mon, 21 Jul 2025 11:50:46 +0000

Why security vulnerabilities are not just technical risks but should provoke political decisions

The newly discovered security vulnerability CVE-2025-53770, known in expert circles as “ToolShell”, once again reveals a fundamental dilemma of modern IT: the growing discrepancy between technical feasibility and strategic dependency. This time, Microsoft’s SharePoint is affected – specifically the On-Premise versions Enterprise Server 2016 and Server 2019. The cloud variants? Of course not.

And here begins the real problem.

Sovereign Washing, Now Also Confirmed Under Oath.

Mon, 21 Jul 2025 08:54:45 +0000

An Oath of Disclosure – in the Truest Sense of the Word

We’ve suspected it for a long time, it was downplayed, relativized, dissected in whitepapers, and wrapped in PR language. Now the truth is on the table – legally unassailable, crystal clear, irrefutable.

In a hearing before the French Senate in June 2025, Anton Carniaux, Head of Corporate, External & Legal Affairs at Microsoft France, was questioned under oath. The central question:

One Year of OZG 2.0: The Digital Administration Still Awaits Its Breakthrough

Fri, 18 Jul 2025 07:59:04 +0000

One year after the enactment of the Online Access Act 2.0, the results are sobering. The big promises remain, but noticeable progress for citizens and administrations is scarce. A central solution has long been on the table: Cloud-native technologies. The BSI itself recommends containerization, Kubernetes, and modular architectures—not as a fad, but as a solid foundation for a secure, scalable, and modern administrative infrastructure.

We have been working with these technologies for years, in complex IT environments, under the highest security requirements. And we see: It works—if the political framework is created to actually implement it.

The Digital Sellout of Europe – And We're Paying for It!

Fri, 11 Jul 2025 08:44:16 +0000

70% of European companies consider their dependency on non-European technology too high. This is not a gut feeling, but the result of the current “State of Cybersecurity Report 2025” by HarfangLab. A wake-up call. Yet, the majority of our data traffic continues to flow to where our laws end: American data centers, operated by platforms that have more in common with stock prices and geopolitical interests than with European IT reality.

End of Support for Windows 10: Why Now is the Right Time to Break Away from Hyperscalers

Thu, 10 Jul 2025 11:49:59 +0000

On October 14, 2025, regular support for Windows 10 will end. What initially appears to many IT departments as a manageable maintenance date reveals itself upon closer inspection as a strategic turning point. Although Microsoft offers a one-year “Extended Security Updates” phase (ESU), the conditions reveal much about the underlying dynamics and prompt a fundamental question for companies: How dependent do we really want to be?

The Grace Period – More Symbolism than Service

With the ESU model, Microsoft promises to provide security-critical updates for Windows 10 even after support ends. Private users have three options to participate:

Hyperscaler Madness in Germany: Expensive, Binding, and Legally Negligent

Wed, 09 Jul 2025 11:28:06 +0000

A sober look at the average IT infrastructure in German companies reveals that the technological needs are mostly manageable. Active Directory, SQL databases, an ERP system, a few virtual machines, and an email infrastructure that has been reliably serving for over a decade—this is the reality in the industrial mid-sized sector, healthcare, energy suppliers, and government agencies.

What these landscapes do not need, however, are hyperscaling platforms with global CDN, dozens of regions, serverless functions, BigQuery engines, and GPU farms on demand. Yet, these scenarios are precisely what is happening: companies are booking infrastructure with AWS, Microsoft Azure, or Google Cloud—and paying as if they were scaling the next streaming platform with 100 million users.

US Pressure on the EU: Is Brussels Diluting the Digital Markets Act?

Tue, 08 Jul 2025 10:49:52 +0000

The European Union celebrated itself as a pioneer in regulating digital platforms. With the Digital Markets Act (DMA), it aimed to make a statement: against dominant tech corporations, for more competition, data control, and transparency. The DMA came into force in March 2024 – but barely a year later, this very European regulation is apparently up for debate. And not from Brussels itself, but from Washington.

What Happened?

As reported by Süddeutsche Zeitung and Handelsblatt, the EU Commission is negotiating a new transatlantic trade agreement with the USA, discussing not only tariffs but also the implementation of the DMA. According to consistent sources, there are considerations to apply the rules more “flexibly” – even a joint committee is being discussed, where the USA could influence the application of European laws.

Catch Me If You Can: What the Soham Parekh Case Reveals About Modern Tech Startups

Mon, 07 Jul 2025 11:26:43 +0000

A software developer, 22 simultaneous jobs, a scandal: The Soham Parekh case reads like a script for a sequel to “Catch Me If You Can.” But this time, it’s not about forged checks and pilot uniforms, but GitHub profiles, remote jobs, and a remarkable lack of control.

Parekh, a talented developer from India, managed to work for more than twenty AI startups simultaneously over several months. Most of them: young Y-Combinator startups with significant funding and even greater pressure to deliver quickly. His strategy: ace the interviews, impress with surface-level skills, then disappear. Few commits, many excuses, even more payouts.

Challenges and Solutions: Mastering Device Failures in Kubernetes Pods

Sun, 06 Jul 2025 02:00:00 +0000

Kubernetes is the de facto standard for container orchestration, but when it comes to handling specialized hardware like GPUs and other accelerators, things get complicated. In this blog post, we take a look at the challenges of managing failures when running Pods with devices in Kubernetes. These insights are based on the presentation by Sergey Kanzhelev and Mrunal Patel at KubeCon NA 2024. You can view the presentation and the recording .

The AI/ML Boom and Its Impact on Kubernetes

The rise of AI/ML workloads brings new challenges for Kubernetes. These workloads often heavily rely on specialized hardware, and any device failure can significantly impact performance and lead to frustrating disruptions. As highlighted in the Llama paper in 2024, hardware issues, particularly GPU failures, are one of the main causes of disruptions in AI/ML training. You can also learn about the efforts NVIDIA puts into handling device failures and maintenance by watching the talk by Ryan Hallisey and Piotr Prokop “All Your GPUs Are Belong to Us: An Inside Look at NVIDIA’s Self-Healing GeForce NOW Infrastructure” (recording ), where they discuss 19 remediation requests per 1000 nodes per day!

Product Update at Loopback:

Thu, 03 Jul 2025 11:13:40 +0000

New Features for More Control, Security, and Flexibility

On July 1st, our sister company Loopback released a comprehensive update to their cloud platform—a significant step towards more powerful, secure, and user-friendly Kubernetes infrastructures. Whether it’s new storage options, enhanced management features, or targeted UI optimizations, the release addresses key requirements of modern IT teams.

Object Storage: Rethinking Data Retention

With the introduction of Object Storage, Loopback expands its platform with an essential feature for cloud-native applications:

Progress Through Clarity:

Thu, 03 Jul 2025 10:04:37 +0000

How the AI Service Desk of the Federal Network Agency Guides Companies into the Future

The European AI Regulation (AI Act) is a milestone: It creates a unified legal framework for the development and use of Artificial Intelligence in the EU for the first time. The goal is to enable innovation while minimizing risks to society, the economy, and fundamental rights. However, implementing this complex regulation poses significant challenges for companies. This is where the new AI Service Desk of the Federal Network Agency comes into play.

Kubernetes as a Key Technology for Implementing the OZG in Saarland

Thu, 03 Jul 2025 07:37:24 +0000

Digital administration in Saarland is at a standstill. Only 29% of administrative services have been digitized under the Online Access Act (OZG) according to the Bitkom Länderindex, placing it last in the national comparison. Yet, there is no shortage of skilled professionals: the proportion of computer science trainees and students is above average. So, what is the issue?

One reason is technical: the administrative IT in Saarland is often based on outdated monolithic architectures. New services are difficult to integrate, scaling is complex, and reusability of existing components is lacking. This is where Kubernetes comes into play—as a foundation for modern, containerized administrative platforms.

Only 29% OZG Implementation in Saarland: How Did It Come to This?

Wed, 02 Jul 2025 08:53:43 +0000

Saarland ranks last in the current Bitkom Länderindex 2024 in the “digital administration” category. Only 29% of the digital administrative services required by the Online Access Act (OZG) have been implemented. In comparison, the leader Hamburg achieves 63%, while the national average is about 50%. The results for Saarland are sobering and raise fundamental questions about the state’s digital strategy.

What Do the Numbers Say?

Here are Saarland’s rankings compared to other federal states according to the Bitkom Index 2024:

Compatibility of Container Images: A Key to Reliability in Cloud Environments

Sat, 28 Jun 2025 02:00:00 +0000

In industries where systems must operate with utmost reliability and stringent performance requirements, such as telecommunications, high-performance, or AI computing, containerized applications often require specific operating system configurations or hardware. It is common practice to demand certain versions of the kernel, its configuration, device drivers, or system components.

Despite the existence of the Open Container Initiative (OCI) , a community that defines standards and specifications for container images, there was a gap in expressing such compatibility requirements. The need to address this issue led to various proposals and ultimately to an implementation in the Kubernetes project Node Feature Discovery (NFD) .

Nextcloud & IONOS Challenge Microsoft

Wed, 25 Jun 2025 11:43:10 +0000

Why this alliance is a turning point for Europe’s digital self-determination

The headline may seem unremarkable, but its content is not: Two German tech companies are joining forces to develop a European alternative to Microsoft 365. What sounds straightforward is, in fact, a clear political, economic, and technological signal.

Nextcloud and IONOS are taking the next step together—sending a strong message for digital sovereignty in Europe. No empty phrases, no marketing labels, no pseudo-guarantees, but: control. Commitment. Responsibility.

Sovereign Washing 2.0

Wed, 25 Jun 2025 11:36:58 +0000

What Microsoft’s new Sovereign Cloud really means – and what it doesn’t

Microsoft has delivered. At least at first glance.

With the updated Sovereign Cloud roadmap from June 2025, the corporation responds to geopolitical tensions, European data protection requirements, and increasing regulatory pressure. New products like “Data Guardian,” “EU Data Boundary,” or “Microsoft 365 Local” aim to provide control and transparency for European customers.

The message is clear: You can trust us again.

Three Weeks at ayedo – My Internship in the Brand Team

Wed, 25 Jun 2025 09:32:04 +0000

by Leon, 8th Grade

I spent three weeks at ayedo – and honestly: The internship was much better than I had imagined. I didn’t just watch; I actively participated. From day one, I was part of the Brand Team, the area at ayedo responsible for all things creative – from social media posts to video productions.

What surprised me: I was taken seriously. I was allowed to contribute my own ideas, help shape content, and was directly involved in the action.

Gigafactory Without Gigavision?

Wed, 25 Jun 2025 09:20:19 +0000

How SAP Evades Responsibility – and What It Reveals About the State of the German Tech Industry

On June 21, 2025, the Tagesspiegel published an article titled “German Corporations Divided – No Joint Bid for AI Gigafactory”. It describes an initiative by the EU Commission that could actually be a cause for optimism: Up to six so-called “AI Gigafactories” are to be established – powerful data centers where European models for Artificial Intelligence can be trained in the future. One of these factories is to be located in Germany. And the EU is being generous: Up to 35 percent of the billion-euro costs are to be publicly funded.

Public Relations

Mon, 23 Jun 2025 21:57:06 +0000

System Error Identity: Why 16 Billion Leaked Logins Are a Wake-Up Call

Fri, 20 Jun 2025 09:06:51 +0000

A security incident is systemic when it repeats, scales, and becomes normalized.

The current data breach with over 16 billion compromised credentials meets all three criteria – and unmistakably shows: We have a structural problem in handling digital identity. And it affects us all.

What Happened – and What Didn’t

Security researchers at Cybernews have uncovered what is likely the largest credential leak of all time. Not recycled old data, but new login information intercepted by malware: Usernames, passwords, target URLs – ready-to-use and automatically analyzable.

Kubernetes Can Offer Freedom - If Done Right.

Tue, 17 Jun 2025 09:09:46 +0000

Why Managed Kubernetes with Hyperscalers Doesn’t Lead to Digital Sovereignty

Kubernetes has established itself as the de facto standard for orchestrating containerized applications. It promises portability, scalability, and unified control of complex IT environments. However, many companies use Kubernetes in a way that undermines its core promise: independence.

Managed Kubernetes offerings like Amazon EKS or Azure AKS seem convenient at first glance. They take over operations, provide integrations into the respective platform, and promise an all-inclusive package. In reality, however, they shift central control functions out of the company’s influence. The supposed convenience comes at the cost of massive dependency.

Sovereign Washing - A Microsoft Marketing Fairy Tale from Redmond

Mon, 16 Jun 2025 17:28:16 +0000

Satya Nadella introduced a new “Sovereignty Program” for European Microsoft customers in Amsterdam. Three cloud models, Hardware Security Modules (HSMs), European support, and partners like Utimaco are intended to build trust. What sounds like a European security initiative is, upon closer inspection, a sophisticated PR strategy to calm an increasingly skeptical market—and a distraction from the real threat: the American CLOUD Act .

CLOUD Act: The Elephant in the Server Room

Since 2018, the CLOUD Act requires all US companies—including Microsoft—to hand over data to US authorities, even if stored in data centers outside the USA. The legal logic: the company’s headquarters matter, not the storage location. And: this handover can occur without a court order. Even more problematic: companies are prohibited from informing their customers about these accesses—a so-called “Gag Order.”

Vibecoding Kills Software. AI Amplifies What You Can – or Can't Do.

Fri, 13 Jun 2025 08:25:01 +0000

Everyone is writing software with AI now. Prompt in, code out. A few lines of Typescript here, a Dockerfile there, and somehow everything flies. People feel productive. Because they have output.

What no one asks: Do you actually understand what’s happening?

Because that’s the difference:

Experienced developers use AI like a precision tool.

Everyone else builds software with it that relies only on stack traces and hope.

Prompt != Architecture

AI can generate code. But it doesn’t know your system.

Structure Over Chaos - Our Path to an IMS

Fri, 13 Jun 2025 08:17:35 +0000

Cyber risks are increasing. Requirements are rising. And to be taken seriously as an IT service provider, you need more than just good technology. At ayedo, we realized early on that growth without structure doesn’t work. Security, quality, and efficiency don’t happen by themselves – they need a solid foundation.

For us, this means an integrated management system (IMS) that not only meets ISO standards but also withstands everyday challenges.

Containers Natively on Mac: Apple Gets Serious

Fri, 13 Jun 2025 07:26:43 +0000

With the announcement of macOS 26 (“Tahoe”), Apple quietly but fundamentally reshuffles the cards in the DevOps landscape. For the first time, the operating system offers native support for Linux containers —without Docker, without Orbstack, without additional dependencies. A move that not only reduces technical friction but also has the potential to reposition the Mac: as a fully-fledged, system-level development environment for cloud-native workflows.

What’s New?

Apple integrates its own containerization framework directly into macOS 26. It is based on an open-source foundation, specifically optimized for Apple Silicon, and allows the execution of OCI-compliant Linux containers —directly via the terminal. The solution uses a lightweight VM in the background, is securely isolated, and operates without the Docker Engine or comparable layers.

Vendor Lock-in – When Architecture Becomes Dependency

Wed, 11 Jun 2025 10:17:40 +0000

Vendor lock-in refers to the technically, economically, or legally restricted ability to switch an IT service provider or platform vendor without significant effort.

In other words: In theory, you could leave – but practically, it’s no longer an option.

This dependency doesn’t happen overnight. It grows gradually.

A Managed Service here, an auth system there, some monitoring, a bit of IAM. Everything interlocks, everything works seamlessly. Until you eventually realize: Your entire stack is inextricably linked to just one provider.

Net Neutrality – The Invisible Backbone of Digital Fairness

Wed, 11 Jun 2025 09:59:50 +0000

Net neutrality means: All data on the internet is treated equally. Period.

It doesn’t matter whether they come from a corporation, a research lab, a non-profit project, or a startup. The transport path must be blind. No packet prioritization, no artificial slowing, no selective routing.

This principle sounds self-evident, but it is far from it.

Infrastructure providers recognize how much power lies in the data line itself. Whoever controls the line can determine which service “works” when and how. Technically, this power can be finely tuned – through bandwidth allocation, routing preferences, packet filtering, protocol prioritization.

What Does "Digital Sovereignty" Actually Mean – In Concrete Terms?

Wed, 11 Jun 2025 09:47:17 +0000

Digital sovereignty refers to an organization’s ability to manage its digital systems, data flows, and technical dependencies in a way that remains independent, capable, and secure against market forces, infrastructure operators, and foreign legal jurisdictions.

This involves more than just data protection or hosting locations. Digital sovereignty is a combination of technical architecture, legal control, and operational self-determination.

It answers questions such as:

Who controls my system access?
Who operates the Control Plane of my cloud environment?
Who can access my logs, traces, and configuration data?
Who decides when APIs become obsolete?
Who is capable of acting in a crisis – me, or my provider?

Digital sovereignty does not mean building everything yourself. It means being able to consciously decide at any time what you control yourself – and where you delegate responsibility.

Hyperscaler or Hylascaler? How Simple Services Turn into Expensive Platform Dependencies.

Sun, 08 Jun 2025 10:10:34 +0000

Cloud infrastructure has its justification. Scalability, automation, and globalization of IT resources are now standard. Technically, the major platform providers — AWS, Google Cloud, Azure — undoubtedly deliver stable base technology.

But the problem begins when customers believe they are only purchasing infrastructure. In reality, they are buying business models. With our Enterprise Cloud and Private Cloud , we offer alternatives that give you full control over your infrastructure.

The Comparison: Cloud Sold Like a Hyla Vacuum Cleaner

The hyperscaler doesn’t sell what the customer actually needs. The customer wants a vacuum cleaner. The hyperscaler sells the entire ecosystem around it: water filtration system, humidifier, allergy certificates, lifetime service contract, training programs, service inspections.

New Approaches in AI Management: The Gateway API Inference Extension

Sun, 08 Jun 2025 02:00:00 +0000

Modern generative AI and large language models (LLMs) present unique traffic management challenges for Kubernetes. Unlike typical ephemeral, stateless web requests, LLM inference sessions are often lengthy, resource-intensive, and sometimes stateful. For instance, a single GPU-backed model server can maintain multiple inference sessions and manage stored tokens in memory.

Traditional load balancers that focus on HTTP paths or round-robin lack the specialized capabilities required for these workloads. They also do not consider model identity or the criticality of requests (e.g., interactive chat vs. batch jobs). Organizations often cobble together ad-hoc solutions, yet a standardized approach is missing.

How to Ensure Your Sidecar Container Starts First

Fri, 06 Jun 2025 02:00:00 +0000

Introduction to Managing Sidecar Containers in Kubernetes

In the world of Kubernetes, Sidecar containers are useful helpers that extend functionalities or take on additional tasks for the main application. In this article, we will look at how you can ensure that your Sidecar containers start before the main application. This can be crucial to avoid issues during startup and ensure the stability of your applications.

What Specifically Changes for Developers/DevOps Teams?

With the introduction of Kubernetes v1.29.0, native support for Sidecar containers has been improved. These can now be defined in the .spec.initContainers field, which means they will always start before the main application. This sounds simple but presents some challenges.

AI in the Classroom: Opportunities and Challenges for the Future of Education

Thu, 05 Jun 2025 18:59:14 +0000

AI in the Classroom: Opportunities and Challenges for the Future of Education

The debate around the use of Artificial Intelligence (AI) in education is polarizing. While some see great opportunities for personalized learning, others fear a dehumanization of teaching and new dependencies. However, if we take an objective look at it, it becomes clear: AI can be a valuable tool — provided we use it responsibly.

The Great Opportunities: How AI Can Improve Teaching

1. Individualized Learning at a New Level Everyone learns at different speeds, in their own way, with their own strengths and weaknesses. AI-powered learning systems can address this precisely: They analyze students’ learning progress in real-time, identify comprehension issues early, and automatically adjust the learning content. This makes teaching more individualized and effective.

Modern Ticket Systems: Why Zammad is the Better Choice for IT Support and Customer Service

Thu, 05 Jun 2025 18:55:10 +0000

Today, every support request influences customer satisfaction, loyalty, and long-term business success. Unstructured processes, lost tickets, and long response times erode trust and efficiency. Many companies struggle with complex, inflexible helpdesk solutions or become entangled in costly dependencies on SaaS providers. This is where Zammad makes a clear difference.

Zammad: The Powerful Open-Source Ticket System

Zammad is more than just another ticket system. As a modern, open-source-based solution, it combines efficiency, transparency, and full control over your support processes. Companies of all sizes gain a scalable platform that operates without licensing costs and adapts flexibly to individual requirements.

Gateway API v1.3.0: New Features for Flexible Request Mirroring and More!

Thu, 05 Jun 2025 02:00:00 +0000

We are excited to announce the general availability of Gateway API v1.3.0! Released on April 24, 2025, this version brings exciting new features.

What specifically changes for developers/DevOps teams?

Version 1.3.0 of the Gateway API introduces percentage-based request mirroring as a new feature in the Standard channel. Additionally, there are three experimental features: CORS filters, a standardized mechanism for merging listeners and gateways, and retry budgets.

Inclusion in the Standard channel indicates a high level of confidence in the API surface and guarantees backward compatibility. Developers can thus rely on the new features being stable and future-proof.

The Forgotten Vulnerability in Your CI/CD Pipelines: The Registry

Tue, 03 Jun 2025 10:26:37 +0000

The Forgotten Vulnerability in Your CI/CD Pipelines: The Registry

Everyone talks about build pipelines, deployment automation, GitOps, blue/green rollouts, canary releases. Everything is orchestrated, automated, versioned. Sounds stable. But the entire stack relies on a simple point that many teams have ignored for too long: the container and artifact registry.

This is where everything is stored that makes your software runnable: container images, Helm charts, packages, libraries, dependencies. Without these artifacts, every build is worthless. Without them, not a single pipeline can be deployed.

Application Performance Should Be Measurable — Anytime, in Real-Time

Tue, 03 Jun 2025 10:24:49 +0000

When running applications in production, you don’t need pretty dashboards, but hard data. Performance issues never arise when there’s time for debugging. They occur precisely when systems are under load, services are running at peak load, external dependencies start to falter, or network latencies gradually build up.

The question isn’t whether you’ll eventually find out why the stack is underperforming. The question is whether you can see it early enough to intervene before the customer notices.

Why Are You Still Managing Your App Yourself?

Tue, 03 Jun 2025 10:24:14 +0000

The question keeps coming up. Development teams deliver features, optimize releases, build clean architectures — yet they still get stuck in infrastructure. Managing Kubernetes clusters, renewing certificates, expanding storage, configuring load balancers, checking backups, monitoring oversight, applying security patches.

All of this is daily operational work. But none of these tasks bring a new feature to the customer. Not a single one of these tasks increases the value of your application. Operations merely secure the state that the customer already expects: that it works.

AI Without Losing Control: Machines Run Better on Your Own Infrastructure

Tue, 03 Jun 2025 10:21:56 +0000

Everyone is talking about AI, Large Language Models, inference pipelines, custom LLMs, and co-pilots for all conceivable business processes. What is often forgotten: The real value creation does not occur at the prompt, but in the infrastructure on which the models run.

And this is where it quickly becomes uncomfortable.

Anyone seriously wanting to operate AI models for enterprise processes quickly faces two questions: Where does the model run? And who controls who accesses it?

IIoT Data Is Useless If It Rots Inside the Machine

Tue, 03 Jun 2025 10:18:57 +0000

Most IIoT projects don’t fail because of the machines. The sensors work. The controllers provide data. The networks transmit packets. The problem starts one level higher: The data ends up somewhere in the production network, is briefly logged, maybe aggregated, and then? Nothing.

Because no one has effectively solved how to turn high-frequency real-time data from OT into actionable information for analytics, planning, supply chain, and management. And that’s absurd. The production line already knows its status — but the organization often finds out days later when reports are consolidated.

App Hosting on Kubernetes — Fully Managed

Tue, 03 Jun 2025 10:10:24 +0000

Software Development Doesn’t End with Code

When developing applications for clients today, the next topic quickly arises: How is the software operated in production? Where do staging and production systems run? Who takes over 24/7 operations? What does security look like? Who handles availability, patching, backup, scaling, monitoring?

Most clients today expect more than just software development; they want a complete package: development, deployment, operations, support.

This is where the operational gap emerges.

Secure Infrastructure for Health Data — ISO27001 Compliant

Tue, 03 Jun 2025 10:02:56 +0000

Health Data is a Special Case — Both Technically and Regulatorily

Processing health data fundamentally differs from traditional corporate IT. It involves not just personal data, but highly sensitive information as defined by Article 9 of the GDPR. Diagnoses, lab results, therapy progress, medication plans, imaging data, and treatment documentation are extremely sensitive. A technical error, security incident, or inadequately secured operational process not only jeopardizes business processes but also the integrity of individuals.

Host Your Banking APIs DORA-Compliant on European Infrastructure with ayedo

Tue, 03 Jun 2025 09:57:07 +0000

DORA is coming. And this time, it’s not just about a few pretty compliance PDFs.

What many banks, payment service providers, and FinTechs are just beginning to realize:

DORA (Digital Operational Resilience Act) is not just another documentation and audit procedure that can be elegantly addressed with a few policies and certificates. DORA delves much deeper into operational operations.

It’s about technical resilience. Not at the PowerPoint level, but directly in the infrastructure.

Building OZG Software is One Thing. Building OZG Software is One Thing.

Tue, 03 Jun 2025 09:50:41 +0000

OZG Implementation: Software Alone is Not Enough

The Online Access Act (OZG) obliges the federal government, states, and municipalities to make administrative services digitally available. On paper, this sounds like software projects. In practice, it’s no longer just about the application.

The key to feasibility is how the underlying infrastructure is operated. Authorities no longer expect mere development partners but operational concepts that secure the entire service chain: processing of personal data, processing of registration data, register access, identities, interfaces, compliance, and auditability.

Cloud Act: The Real Issue Isn't Data Location, It's the Control Plane

Tue, 03 Jun 2025 07:11:02 +0000

In most discussions about the Cloud Act, the focus is solely on data location. Data center in Frankfurt? ISO-certified? Encrypted? Sounds good.

From a technical standpoint, however, this discussion falls short.

The real point of attack lies elsewhere: the Control Plane.

Whoever Controls the Control Plane Controls Everything

In every cloud infrastructure, there are two levels:

Data Plane: This is where the actual user data resides and moves.
Control Plane: This is where it is determined who processes what, how, and where. Scheduling, orchestration, APIs, IAM, access rights, encryption management, network control, policy engines.

Control over the Control Plane effectively determines who has access to which data streams, metadata, keys, and control commands.

IT/OT Integration with Kubernetes: Architecture for Industrial Real-Time Data Processing

Sun, 01 Jun 2025 13:30:25 +0000

Why IT and OT Must Converge

In modern industrial environments, increasingly complex data streams are emerging at the interface between production and enterprise IT. Production facilities, sensors, and machine controls continuously provide real-time data, which is becoming increasingly important for process optimization, predictive maintenance, quality assurance, and business decisions.

The problem: OT systems (Operational Technology) and traditional IT speak different languages. While OT is optimized for stability, low latency, and deterministic behavior, IT operates in a service-oriented, dynamically scalable manner with entirely different requirements for networks, security, and manageability.

Kubernetes as a Bridge Between IT and OT: Intelligently Processing Real-Time Data from Machines

Sun, 01 Jun 2025 13:25:22 +0000

The Gap Between Shopfloor and Enterprise IT

In more and more companies, IT and OT (Operational Technology) are converging. Production facilities, machines, control systems, and sensors deliver massive amounts of real-time data. This information is valuable—but only if it can be quickly, reliably, and securely integrated into the IT infrastructure and further processed. This is where the typical challenges have been arising for years:

High latency and inconsistent protocols
Fragmented networks between shopfloor and enterprise IT
Security requirements and segmentation
Proprietary interfaces and legacy systems

The traditional separation between OT and IT is becoming increasingly impractical. What is needed is a clean, standardized integration layer that connects both worlds—and this is precisely where Kubernetes offers decisive advantages.

Redundancy, Automation, Independence – Three Dimensions of an Infrastructure Decision

Thu, 29 May 2025 10:06:09 +0000

Technological Independence Begins in the Data Center: Why We Rely on European Network Technology

Digital sovereignty doesn’t start with legal texts or strategy papers – it begins where infrastructure is planned, implemented, and operated. At ayedo, this means: every component, every layer, every interface is scrutinized. Not out of distrust, but out of responsibility.

In our current data center expansion project, we have deliberately invested in more redundancy and performance – while also taking another step towards technological independence. The focus was on network infrastructure. Specifically: the use of European routing technology, which not only provides us with technical advantages but also sets new standards in terms of control, maintainability, and legal clarity.

Bundeswehr & Google Cloud: Why This Is a Security Policy Risk

Wed, 28 May 2025 08:29:29 +0000

A Technical Project That Raises Political Questions

The announcement initially sounded straightforward: The Bundeswehr will build its private cloud infrastructure with the support of Google. Specifically, BWI GmbH – the IT service provider of the Bundeswehr – has signed a framework agreement with “Google Cloud Public Sector – Germany GmbH” to set up two isolated cloud instances. The term Google itself uses: Air-Gapped Cloud.

At first glance, this seems like a pragmatic solution: data centers operated in-house, physical separation from the public internet, and supposedly complete data control by the Bundeswehr.

Why Germany Needs More Data Centers

Tue, 20 May 2025 19:12:51 +0000

Digital Sovereignty Begins with Infrastructure

Digitalization in Germany is advancing, but it requires a solid foundation. This foundation is the IT infrastructure. Data centers form the backbone of our digital economy. Yet, despite growing digital dependencies, Germany lags behind in expanding its data center infrastructure. This is not only an economic risk but also a sovereignty issue.

The Growing Demand: Data Explodes, Infrastructure Stagnates

Cloud applications, AI models, connected production facilities, and data-driven business processes generate immense amounts of data daily. According to Bitkom, the data volume in Germany grows by more than 30% annually. At the same time, the requirements for availability, security, and latency are increasing.

Farewell Cold Calling

Tue, 20 May 2025 18:38:23 +0000

How Modern IT Sales Build Trust Instead of Disrupting!

In the IT industry, traditional sales were long dominated by persistent calls, generic emails, and uninspired PowerPoint slides. But the rules have changed: decision-makers, developers, and tech startups today expect solutions, not products—partnerships, not promises. Welcome to the era of building digital trust.

Why Cold Calling is Outdated

Cold calling, as the name suggests, feels cold. It interrupts rather than inspires. Especially in technology-driven markets, where informed customers operate on an equal footing, aggressive sales are increasingly perceived as friction.

Cloud Exit Becomes Reality: Why Companies Are Seriously Considering Repatriation

Tue, 20 May 2025 18:16:59 +0000

The Cloud Loses Its Innocence

The cloud was once the epitome of efficiency, scalability, and digital transformation. However, the reality has caught up with many companies: vendor lock-ins, uncontrolled cost increases, compliance risks, and a growing loss of control over sensitive data have led more organizations to consider the option of a cloud exit—and in some cases, to implement it decisively.

Cloud exit does not mean the end of cloud usage per se, but rather a targeted retreat from certain public cloud scenarios towards more sovereign, cost-transparent, and controllable IT infrastructures—whether on-premises, in the private cloud, or on European open-source platforms.

Europe and the Cloud

Mon, 19 May 2025 17:11:55 +0000

Hey,

I’m Fabian – engineer, entrepreneur, and European citizen residing in Germany.

For over 10 years, I’ve been part of the international tech scene with a clear focus: think globally, act locally. I hold a formal degree in computer science and technology, but I’ve always been self-taught, curious, open to new things, and pragmatic in dealing with the real world.

In 2017, I quit my job and founded a consulting company for Cloud-native technologies – mainly DevOps, but also custom software development, team building, venture building, and product development.

Microsoft Blocks the Email Account of a Chief Prosecutor. Europe Watches.

Mon, 19 May 2025 14:57:22 +0000

A senior investigator of the International Criminal Court loses access to his emails – because a US President imposes sanctions. Microsoft complies. Without trial, without justification, without consequences.

A case that reveals everything many in Europe continue to ignore: Our digital infrastructure is beyond our control. Anyone using services like Microsoft 365 or Azure today is not acting neutrally. They are relinquishing control.

What Happened Is Not an Exception – It’s Systemic

A UN investigator is technically incapacitated.
NGOs end cooperation with the ICC out of fear of sanctions.
Investigations into war crimes come to a halt – not due to lack of evidence, but because access was blocked.

Anyone reading this and thinking: “This doesn’t affect us” – is mistaken.

etcd v3.6.0: A Milestone for Security and Performance

Sun, 18 May 2025 02:00:00 +0000

Today, we are excited to announce the release of etcd v3.6.0, the first minor release since etcd v3.5.0. This update brings numerous new features, enhances support for downgrades and migrations to the v3store, and addresses many critical and important issues. Additionally, significant optimizations in memory usage have been made, improving both efficiency and performance.

Another key point: etcd is now part of Kubernetes as a SIG (sig-etcd). This will help us improve the sustainability of the project. We have introduced systematic robustness testing to ensure correctness and reliability. Through the etcd-Operator Working Group, we also plan to enhance user-friendliness.

Kubernetes v1.33: Finally, Secure Access to Private Container Images!

Thu, 15 May 2025 02:00:00 +0000

Finally, Secure Access to Private Container Images!

In the world of Kubernetes, surprises are not uncommon, and the functionality of imagePullPolicy is no exception. It might seem strange that for over 10 years, there has been an issue where Pods could access authenticated images without the necessary permissions. With the new version v1.33, the Kubernetes community has finally resolved a decade-old problem.

What Specifically Changes for Developers/DevOps Teams?

The imagePullPolicy: IfNotPresent has so far done exactly what it promises: it pulls an image only if it is not present locally. However, this also resulted in security gaps. Consider the following scenario: Pod A in Namespace X is scheduled on Node 1 and requires Image Foo from a private repository. For authentication, the Pod uses Secret 1, which contains the necessary credentials.

Data Sovereignty vs. Digital Hesitation: Why Germany Must Catch Up on Cloud

Tue, 13 May 2025 10:31:36 +0000

Germany discusses data sovereignty but remains technologically dependent. How this relates to our culture and what needs to change to achieve digital independence.

Between Fear, Ambition, and Ambivalence

Germany—the land of poets and thinkers. The place where the foundations for modern technology, computer science, and automation were once laid. And yet, when it comes to digital infrastructures, especially cloud services, we almost exclusively look towards the USA. Amazon, Microsoft, Google—the heavyweights are all elsewhere. And what do we have? A few local data centers, niche IT service providers, and a massive dose of technological dependency.

Sovereign Cloud: Ambitions, Reality, and Technical Solutions

Mon, 12 May 2025 09:13:41 +0000

A sovereign cloud requires more than just a data center in Europe. How the CLOUD Act collides with the GDPR—and which technologies enable true data sovereignty.

Between Legal Deadlock and Technological Feasibility

The idea of a Sovereign Cloud has become a guiding principle in the European IT landscape—especially in the context of data protection, digital independence, and regulatory compliance. However, there is a significant gap between aspiration and reality: While technological concepts for sovereignty are increasingly available, the legal side remains complex and contradictory.

US Cloud Act vs. GDPR: Who Really Controls Your Data?

Mon, 12 May 2025 09:03:32 +0000

The CLOUD Act allows US authorities to access European data, conflicting with the GDPR. Learn how companies can protect themselves technically and legally.

A Law with Explosive Potential for European Companies

In March 2018, the US government passed the CLOUD Act (Clarifying Lawful Overseas Use of Data Act). What initially seems like technocratic legislation is, in reality, a geopolitical reach into your corporate data—even if stored on European servers. The key factor is not the location of the servers but who controls them.

US Cloud Act vs. GDPR: When Data Protection Meets Geopolitical Reality

Mon, 12 May 2025 08:57:39 +0000

The US Cloud Act allows US authorities to access European servers—a clear conflict with the GDPR. Discover how companies can protect themselves and reclaim digital sovereignty.

What Drives US Authorities to European Servers—and What It Means for Your Business

Transatlantic data relations have never been simple, but with the US Cloud Act, it’s clear: companies working with US-based cloud providers must be aware that it’s not European law but American interests that may have the final say. This affects not only US servers but also data centers right in Germany if they are controlled by a US corporation.

Kubernetes v1.33: Efficient Data Transfer with Streaming List Responses

Mon, 12 May 2025 02:00:00 +0000

Managing Kubernetes cluster stability becomes increasingly critical as your infrastructure grows. One of the most challenging aspects of operating large clusters has been handling list requests that retrieve extensive datasets—a common operation that can unexpectedly impact your cluster’s stability.

Today, the Kubernetes community is excited to announce a significant architectural improvement: streaming encoding for list responses.

The Problem: Unnecessary Memory Consumption with Large Resources

Current API response encoders serialize an entire response into a single contiguous memory area and perform a single ResponseWriter.Write call to transmit the data to the client. Despite HTTP/2’s ability to split responses into smaller frames for transmission, the underlying HTTP server still holds the complete response data as a single buffer. Even when individual frames are transmitted to the client, the memory associated with these frames cannot be incrementally released.

Kubernetes 1.33: Volume Populator Now Generally Available – What This Means for You!

Sun, 11 May 2025 02:00:00 +0000

Kubernetes Volume Populators are now generally available (GA)! With the AnyVolumeDataSource feature, users can now specify any suitable custom resource as a data source for a PersistentVolumeClaim (PVC).

An example of how to use dataSourceRef in PVC:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc1
spec:
  ...
  dataSourceRef:
    apiGroup: provider.example.com
    kind: Provider
    name: provider1

What’s New

This release includes four significant improvements compared to the Beta.

Populator Pod is Optional

During the Beta phase, Kubernetes contributors identified potential resource leaks when deleting PersistentVolumeClaims (PVC) while volume population was still in progress. These leaks occurred due to limitations in handling finalizers. Before graduating to general availability, the Kubernetes project added support for deleting temporary resources (PVC prime, etc.) when the original PVC is deleted.

Why We Must Say Goodbye to AWS, Azure & Google Cloud Now

Fri, 09 May 2025 09:33:09 +0000

Digital transformation is no longer a thing of the future – it is a reality. It affects not only e-commerce or digital tools in the office but has deeply penetrated the foundation of our society: connected production processes, automated supply chains, digital healthcare, smart energy grids, and the management of critical infrastructures. In short: the backbone of our economy and administration.

Yet this very backbone is currently reliant on foreign legislation – and that’s dangerous.

Kubernetes v1.33: Precise Control Over Groups for Enhanced Security

Fri, 09 May 2025 02:00:00 +0000

The new supplementalGroupsPolicy feature was introduced as an optional alpha feature in Kubernetes v1.31 and has now moved to beta in v1.33. The associated feature gate (SupplementalGroupsPolicy) is now enabled by default. This feature allows for more precise control over Supplemental Groups in containers, strengthening the security posture, particularly when accessing volumes. Additionally, it improves the transparency of UID/GID details in containers, offering enhanced security monitoring.

Please note that this beta version includes some behavioral changes. For more information, refer to the sections The Introduced Behavioral Changes in Beta and Upgrade Considerations .

With Kubernetes v1.33: Image Volumes Now in Beta!

Fri, 02 May 2025 02:00:00 +0000

Image Volumes were introduced as an alpha feature in Kubernetes version v1.31 and have now been promoted to beta status in version v1.33. This is part of KEP-4639 .

It is important to note that the feature is disabled by default, as not all container runtimes offer full support yet. CRI-O has supported the initial feature since version v1.31 and will add support for Image Volumes as a beta in v1.33. containerd has integrated support for the alpha feature, which will be part of version v2.1.0, and is working on beta support as part of PR #11578 .

Kubernetes v1.33: User Namespaces Now Enabled by Default!

Mon, 28 Apr 2025 02:00:00 +0000

In Kubernetes v1.33, support for user namespaces is enabled by default. This means that Pods, when system requirements are met, have the ability to use user namespaces. There’s no longer a need to activate a Kubernetes feature flag!

What are User Namespaces?

Note: Linux user namespaces are a different concept from Kubernetes namespaces . The former is a feature of the Linux kernel; the latter is a feature of Kubernetes.

Linux offers various namespaces to isolate processes from each other. A typical Kubernetes Pod, for example, runs within a network namespace to isolate network identity and a PID namespace to isolate processes.

Kubernetes v1.33: Magical Innovations for Developers and DevOps Teams

Sat, 26 Apr 2025 02:00:00 +0000

Kubernetes v1.33 introduces exciting innovations that are highly beneficial for both developers and DevOps teams. This version includes 64 enhancements, featuring 18 stabilized features, 20 transitioning to beta, and 24 new alpha features.

What Specifically Changes for Developers/DevOps Teams?

A particularly noteworthy feature in this version is the Sidecar Containers, which have now reached “stable” status. This pattern allows for the implementation of additional container services responsible for tasks such as networking, logging, and metrics collection.

Challenges and Solutions in Database Scaling: Nextdoor's Optimization Journey

Fri, 25 Apr 2025 07:00:46 +0000

In a detailed blog series, Nextdoor’s Core Services team provides valuable insights into their strategies for optimizing database and cache infrastructure. This series is aimed at development teams dealing with the scaling challenges of PostgreSQL and Redis.

The Initial Situation and Key Challenges Nextdoor Faced Two Major Issues:

Excessive load on the primary database, despite the use of read replicas. Issues with inconsistencies in the cache system. The backend architecture design, heavily reliant on the Django ORM, caused requests to often go to the primary database for security reasons. This triggered further issues, such as data inconsistencies due to concurrent writes and unsuccessful cache updates.

The Burnout Machine: The Dark Side of the Tech Industry

Fri, 25 Apr 2025 06:59:56 +0000

Beneath the glittering facade of the tech industry, where bean bags, free kombucha, and flexible working hours are touted as perks, lies a deeper, darker reality. The article “The Burnout Machine” published in “2600 Hacker Quarterly” takes an unflinching look at the troubling work practices of an industry once hailed as the modern worker’s paradise.

The Dark Depths of the Tech Industry

Supposed dream jobs often turn out to be grindstones that relentlessly drain the energy reserves of their talents. Agile methods, originally developed to enhance flexibility and efficiency, have morphed into endless sprints that demand constant availability. In this culture, burnout is not only normalized but even seen as a benchmark for commitment. Night shifts have become badges of dedication.

Remote Work: Ensuring Flexibility Without Overwhelm

Fri, 25 Apr 2025 06:51:56 +0000

In today’s work landscape, the concept of remote work has brought about a remarkable change by offering flexibility while simultaneously introducing new challenges regarding work-life balance. In her latest article, Marissa Goldberg illustrates how to achieve flexibility in work life without compromising health.

Flexibility in Reality

Goldberg describes a common misconception: While she advocates for flexible working, she has been criticized for handling emails at unusual times. What is often overlooked is that Goldberg, as a mother, also has family commitments during the day. She argues that flexibility is not achieved through fixed working hours but through individually tailored structures.

Sidecars in Kubernetes: The Key to Extending Your Applications

Fri, 25 Apr 2025 02:00:00 +0000

Kubernetes has established itself as the preferred platform for deploying complex, distributed systems. One of the most powerful yet subtle design patterns in this ecosystem is the sidecar pattern. It allows developers to extend the functionality of applications without delving deeply into the source code.

The Origins of the Sidecar Pattern

Imagine a sidecar as a loyal companion on a motorcycle. Historically, IT infrastructures have always used auxiliary services to perform critical tasks. Before containers, we worked with background processes and auxiliary services to manage logging, monitoring, and network administration. The microservices revolution transformed this approach, making the sidecar pattern a structured and purposeful architectural choice. With the rise of microservices, the sidecar pattern became more clearly defined. Developers can offload specific responsibilities from the main service without altering its code. Service meshes like Istio and Linkerd have popularized sidecar proxies, demonstrating how these companion containers elegantly handle observability, security, and traffic management in distributed systems.

EU Strengthens Digital Sovereignty: New Vulnerability Database as a Response to CVE Uncertainties

Thu, 17 Apr 2025 12:44:14 +0000

CVE shutdown averted – but Europe is charting its own course. With the new vulnerability database from ENISA, the EU is strengthening its digital sovereignty. ayedo demonstrates how modern vulnerability management works.

At the Last Minute: CVE Remains – For Now

On April 16, 2025, a decisive shift occurred in the global IT security world: the impending shutdown of the CVE system (Common Vulnerabilities and Exposures) was apparently averted. According to reports, the contract between the U.S. cybersecurity agency CISA and the operator MITRE was extended at the last minute—a measure taken literally in the nick of time.

ZenDiS in Crisis: Why the Dismissal of Jutta Horstmann is a Warning Signal for Open Source

Thu, 17 Apr 2025 09:41:10 +0000

The sudden dismissal of Jutta Horstmann as the managing director of the Center for Digital Sovereignty (ZenDiS) raises fundamental questions about the strategic direction of public IT in Germany. Where does digital sovereignty stand when visionaries leave?

A Setback at the Wrong Time

Amidst a phase where Open Source initiatives in public administration are finally gaining momentum, the Federal Ministry of the Interior (BMI) surprises with a decision that not only confuses but also raises serious doubts about the federal government’s digital agenda. Jutta Horstmann, a recognized OSS expert and long-time advocate of free software, was dismissed from her role at ZenDiS without specific justification.

US Cuts to CVE: When Digital Security Becomes a Bargaining Chip

Wed, 16 Apr 2025 11:04:16 +0000

The US funding for the CVE list has been stopped with immediate effect—potentially dramatic consequences for global IT security. Why Europe must now prove its digital sovereignty.

A Wake-Up Call for IT Security Leaders in Europe

The Common Vulnerabilities and Exposures (CVE) list forms the backbone of coordinated IT security measures worldwide. It is not just a technical standard but a strategic tool for collective cyber defense. Now it faces an end—at least in its current form. The US government has halted funding for the project. And this with immediate effect.

Polycrate: Automated Infrastructure in Modular Packages

Wed, 16 Apr 2025 09:25:22 +0000

Automation must become manageable again. At ayedo, we are building a framework with Polycrate that brings order to the chaos of complex IT infrastructures—modular, reusable, and fully automatable.

In this post, we demonstrate how Polycrate works, how to use it productively, and why we believe: “Modular Infrastructure as Code” is the next level of GitOps.

What is Polycrate?

Polycrate is a lightweight framework for packaging, integrating, and automating IT and cloud infrastructure. It combines:

Infrastructure That Thinks: How We Rethought Operations and Automation

Tue, 15 Apr 2025 15:36:09 +0000

Digital sovereignty doesn’t end with tool selection or architecture. It only reaches its full potential when operations are efficient, secure, and scalable. In this final part of our blog series, we show how we at ayedo have made our infrastructure automated and self-serviceable—without vendor overhead.

Why Automation is Essential

Many IT teams still work as they did ten years ago:

Manual configuration,
Maintenance through tickets,
Changes without versioning.

In complex, dynamic infrastructures, this is not only inefficient but also risky. Our approach: Automation as default—not as an afterthought.

Architecture Over Dependency: This Is What Our Infrastructure Looks Like Today

Tue, 15 Apr 2025 15:22:48 +0000

Digital sovereignty is not a feature – it is an architectural principle. After transitioning our toolchain to open source, the next step was to strategically rethink the infrastructure behind the tools.

In this post, we showcase how our modern IT architecture looks – container-based, automated, scalable, and fully under our control.

Why Infrastructure Is the Key to Freedom

Many companies replace individual tools but remain structurally dependent:

on hyperscaling cloud providers,
on opaque black-box services,
on rigid hosting models.

Our goal was clear: To create a foundation that offers us maximum control, flexibility, and future-proofing.

Out of the SaaS Maze: Our Everyday Open-Source Alternatives

Tue, 15 Apr 2025 15:07:17 +0000

Digital sovereignty begins with concrete decisions. In this post, we show how we at ayedo have replaced key SaaS tools with powerful open-source solutions—and what we learned in the process.

Why the Toolbox Matters

In discussions about digital independence, the focus is often on grand strategies—but change starts with the tools we use daily:

Where do we plan our projects?
How do we organize internal communication?
Where are our documents stored—and who has access?

We demonstrate: There is another way. And it works.

End SaaS Servitude: Why We Are Committed to Digital Independence

Tue, 15 Apr 2025 10:19:14 +0000

The dependency on US SaaS providers is increasingly costing German companies control, money, and innovation power. ayedo demonstrates how Open Source becomes a strategic alternative – for more digital sovereignty, flexibility, and efficiency.

Introduction: Growing Dependency Becomes a Risk

In many companies, a strong dependency on US SaaS providers has developed over the years. What began as a convenient licensing model is increasingly turning into a digital dead end:

Microsoft Bids Farewell to Traditional Server Models – What's Next?

Fri, 11 Apr 2025 07:17:21 +0000

Microsoft Bids Farewell to Traditional Server Models – What’s Next?

Starting July 2025, the licensing model for Microsoft’s on-premise products will undergo a fundamental change: Prices for local server solutions like Exchange, SharePoint, or Skype for Business will increase by up to 20%, and perpetual licenses will be discontinued. The direction is clear: The path leads to the cloud.

A Strategic Shift – with Consequences

Microsoft’s argument: On-premise products incur high development and maintenance costs. The result is a clear focus on cloud services. However, for companies with sensitive or business-critical systems, the question arises: Is the public cloud really the right place for my data and workloads?

Kube-Scheduler-Simulator: The Key to Better Scheduling in Kubernetes

Thu, 10 Apr 2025 02:00:00 +0000

The Kubernetes Scheduler is a crucial component of the Control Plane that determines which node a Pod will run on. Anyone using Kubernetes relies on a scheduler.

The kube-scheduler-simulator is a simulator for the Kubernetes Scheduler, initiated as a project in the Google Summer of Code 2021 and developed by me (Kensei Nakada). This application allows users to closely examine the behavior and decisions of the scheduler.

It is useful for casual users employing scheduling conditions (for example, Inter-Pod Affinities ) as well as for experts extending the scheduler with custom plugins.

Docker vs Kubernetes

Fri, 28 Mar 2025 11:44:36 +0000

Kubernetes vs. Docker – Why You Need Both and Shouldn’t Pit Them Against Each Other

The question of whether to use Kubernetes or Docker is completely misguided. The two technologies do not compete with each other; rather, they complement each other perfectly. Both have their place and specific role in modern infrastructure and DevOps environments. Anyone viewing them as alternatives likely hasn’t worked much with containers or is searching for a quick answer without the necessary context.

IngressNightmare: Critical RCE Vulnerabilities in Ingress NGINX Threaten Kubernetes Clusters

Wed, 26 Mar 2025 17:07:13 +0000

Introduction

In the world of Kubernetes orchestration, the Ingress NGINX Controller plays a central role as it serves as the gateway for traffic to applications within the cluster. However, recent discoveries by security researchers reveal that this essential component of Kubernetes poses significant security risks.

Researchers from Wiz Research have uncovered a series of Remote Code Execution (RCE) vulnerabilities known as IngressNightmare. The affected CVEs (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974) have a CVSS score of 9.8, making them critical threats.

JobSet: The New Solution for Distributed ML and HPC Workloads in Kubernetes

Wed, 26 Mar 2025 01:00:00 +0000

In the world of Kubernetes development, there’s exciting news: JobSet has been introduced, an open-source API specifically designed for managing distributed jobs. The goal of JobSet is to provide a unified API for distributed training of Machine Learning (ML) and High-Performance Computing (HPC) workloads on Kubernetes.

Why JobSet?

Recent improvements in the Kubernetes batch ecosystem have caught the attention of ML engineers who have found Kubernetes to be excellent for the demands of distributed training workloads.

The Secrets of SIG etcd: Insights into the Kubernetes World

Fri, 07 Mar 2025 01:00:00 +0000

A Look at SIG etcd

In this article, we take a look at the Kubernetes Special Interest Group (SIG) etcd. We spoke with some of the key players to learn more about their roles and their motivation for working on etcd.

Who are the Members of SIG etcd?

Benjamin: Hello, I’m Benjamin. I’m the technical lead of SIG etcd and one of the maintainers of etcd. I work at VMware, which is part of the Broadcom group. My interest in Kubernetes, etcd, and CSI (Container Storage Interface ) began in 2020, both from a professional interest and my passion for open source.

Enhancing Performance with nftables: Rethinking kube-proxy

Mon, 03 Mar 2025 01:00:00 +0000

Introduction

In the world of Kubernetes, there are constant developments aimed at improving the performance and efficiency of applications. One of the most exciting innovations is the introduction of the nftables mode for kube-proxy in Kubernetes 1.29, which is now in beta and is expected to become a stable feature in version 1.33. This new feature aims to address the longstanding performance issues of the previous iptables mode.

What specifically changes for developers/DevOps teams?

The use of nftables brings significant improvements, particularly regarding latency in data traffic. The iptables mode was originally designed for simple firewall applications and struggles to handle the multitude of services in large Kubernetes clusters. The more services there are, the more rules need to be processed in iptables mode, negatively impacting latency on the first request.

The Chicken-and-Egg Problem of the Cloud Controller Manager in Kubernetes

Mon, 17 Feb 2025 01:00:00 +0000

Kubernetes 1.31 has completed the largest migration in Kubernetes history by removing the in-tree cloud provider. Although the migration of components is now complete, it introduces additional complexity for users and installation projects like kOps or Cluster API. In this article, we explore the additional steps and potential pitfalls, providing recommendations for cluster owners. This migration was complex and required extracting some logic from core components, leading to the formation of four new subsystems.

Transatlantic Data Transfer in Crisis: What Does It Mean for Businesses?

Sun, 09 Feb 2025 17:07:13 +0000

The Uncertain Future of EU-US Data Transfer

Regulatory uncertainty surrounding data exchange between the EU and the US is increasing once again. After US President Donald Trump dismissed three members of the data protection oversight board PCLOB, the Transatlantic Data Privacy Framework (TADPF) is on shaky ground. If the EU’s adequacy decision for data transfers to the US is overturned, European companies face significant legal and organizational challenges.

Pod Failures in Kubernetes: Mastering Challenges with Specialized Devices

Fri, 17 Jan 2025 01:00:00 +0000

Impact on Developers and DevOps Teams

The boom of AI/ML applications brings new challenges for Kubernetes. These workloads often heavily rely on specialized hardware, and a device failure can significantly impact performance and lead to frustrating disruptions. According to the Llama-Paper published in 2024, hardware issues, particularly GPU failures, are one of the main causes of disruptions in AI/ML training.

Optimizing Kubernetes: How API Streaming Enhances Efficiency

Fri, 20 Dec 2024 01:00:00 +0000

Efficient management of Kubernetes clusters is becoming increasingly important, especially as cluster size grows. One of the biggest challenges with large clusters is the memory overhead caused by list requests.

In the current implementation, the kube-apiserver handles list requests by assembling the entire response in memory before transmitting data to the client. But what happens when the response content is extensive, say several hundred megabytes? And imagine multiple list requests arriving simultaneously, perhaps after a brief network outage. While API Priority and Fairness has proven effective in protecting the kube-apiserver from CPU overload, its impact on memory protection is visibly less. This can be explained by the different nature of resource consumption of a single API request - CPU usage at any given time is limited by a constant value, whereas memory, which is not compressible, can grow proportionally with the number of objects processed and is unlimited.

Kubernetes 1.32: Enhanced Storage Management Features for Container Applications

Mon, 16 Dec 2024 01:00:00 +0000

With Kubernetes 1.32, the storage manager has officially reached General Availability (GA) status. This marks a significant step towards more efficient and predictable storage allocation for containerized applications. Since version 1.22, when it moved to beta status, the storage manager has proven to be reliable and stable, establishing itself as a useful complementary feature to the CPU Manager .

What Changes Specifically for Developers/DevOps Teams?

The storage manager contributes to optimizing storage allocation and alignment during the workload admission process by the Kubelet. This allows users to allocate exclusive memory for Pods in the Guaranteed QoS class. Changes introduced during the beta phase focused primarily on bug fixes, internal restructuring, and observability improvements, such as new metrics and enhanced logging.

Optimizing Pod Assignment: QueueingHint in Kubernetes v1.32

Sun, 15 Dec 2024 01:00:00 +0000

The Kubernetes Scheduler is the core component that determines which nodes will run new pods. It processes these new pods one at a time. Therefore, the scheduler’s efficiency becomes increasingly important as your clusters grow.

Over the years, the Kubernetes SIG Scheduling has optimized the scheduler’s throughput with various improvements. In this article, we introduce a significant enhancement to the scheduler in Kubernetes v1.32: a scheduling context element called QueueingHint. Here, you’ll learn how QueueingHint improves the efficiency of pod assignment.

Kubernetes v1.32: Making the Cloud Even Smarter!

Sat, 14 Dec 2024 01:00:00 +0000

The latest version of Kubernetes, v1.32, brings exciting innovations and improvements! This version, named “Penelope,” marks the tenth anniversary of Kubernetes and showcases how far the community has come. With a total of 44 enhancements, including 13 new stable, 12 in Beta, and 19 in Alpha, this release is a true milestone.

What Changes Specifically for Developers/DevOps Teams?

The new features in Kubernetes v1.32 aim to simplify the daily work of developers and DevOps teams. Notably, the improvements in dynamic resource allocation (DRA) are designed specifically for workloads that rely on specialized hardware such as GPUs and FPGAs. These adjustments offer more efficient resource management and are particularly valuable for applications in machine learning and high-performance computing.

Changelog: Kubernetes v1.32

Wed, 11 Dec 2024 18:00:00 +0000

Kubernetes v1.32: Optimizing Your Container Infrastructure with ayedo

In the dynamic world of container orchestration, Kubernetes plays a central role. At ayedo, the experts in Docker and Kubernetes, we are always committed to integrating the latest technologies to provide our customers with top-notch service. Kubernetes v1.32 introduces significant innovations that enhance our ability to manage your container-based workloads efficiently and securely.

API Deprecation: Secure and Future-Proof

Kubernetes v1.32 implements stricter measures for API deprecation, ensuring that your infrastructure remains up-to-date. This policy guarantees continuous functionality with more advanced and stable API versions. With ayedo by your side, you are prepared for API changes, continuing your operations seamlessly through clear transition strategies and migrations.

The Future of Kubernetes under NIS2: Ayedo's Path to Enhanced Cybersecurity

Thu, 28 Nov 2024 09:38:36 +0000

NIS2 Directive: Why Now is the Perfect Time for Enhanced Security – Ayedo Shows the Way

The introduction of the NIS2 Directive has made waves in the world of container technologies. For companies relying on Kubernetes, this directive brings new challenges. However, at Ayedo, we see less of a storm and more of an opportunity to elevate security standards and strengthen digital resilience.

What Does NIS2 Mean for Kubernetes Users?

The new directive demands more cybersecurity and precise incident reporting processes. Kubernetes users face the task of expanding and securing their systems accordingly. This is where Ayedo steps in: We provide not only support in implementation but also ongoing management of your container infrastructures. Whether on-premise or in the cloud, we are certified according to ISO/IEC 27001:2022 and offer solutions that meet these new requirements.

Gateway API v1.2: New Features for Developers and DevOps Teams

Sun, 24 Nov 2024 01:00:00 +0000

Kubernetes SIG Network is excited to announce the general availability of Gateway API v1.2! This version of the API was released on October 3rd, and we are thrilled that there are now several conformant implementations you can try out.

Gateway API v1.2 brings numerous new features to the standard channel (the GA release channel of the Gateway API), introduces some new experimental features, and celebrates our new release process—though there are also two breaking changes to be aware of.

Kubernetes Training in Japan: Become a Contributor!

Thu, 31 Oct 2024 01:00:00 +0000

We are the organizers of the Kubernetes Upstream Training in Japan . Our team consists of members who actively contribute to Kubernetes, including roles such as Member, Reviewer, Approver, and Chair.

Our goal is to increase the number of Kubernetes contributors and foster community growth. Although the Kubernetes community is friendly and collaborative, newcomers might find the first step towards contributing somewhat challenging. Our training program aims to lower this barrier and create an environment where even beginners can participate smoothly.

Ollama on Your Own Servers in the Data Center with Continue in VSCode as a Copilot Alternative

Wed, 09 Oct 2024 13:07:13 +0000

Introduction

In today’s software development landscape, where AI-powered tools like GitHub Copilot and similar assistants provide support, many developers are seeking more flexible and privacy-friendly alternatives. An exciting option is the combination of Ollama and Continue. This solution allows developers to run their AI-powered coding assistants completely independently of external cloud services.

Visual Studio Code (VSCode)

VSCode is a free, open-source text editor from Microsoft, highly popular among developers due to its extensibility and wide range of plugins (Extensions). It offers support for various programming languages and features like debugging, Git integration, and intelligent code completion. With its extensibility, AI-based tools like Continue can be seamlessly integrated to accelerate the coding process.

Maximize Data Sovereignty with Our Internal RAG Solution and the ayedo Cloud

Mon, 07 Oct 2024 10:35:36 +0000

Maximize Data Sovereignty with Our Internal RAG Solution and the ayedo Cloud

Introduction

In today’s digital era, efficiently managing large volumes of data is crucial for business success. Retrieval-Augmented Generation (RAG) has emerged as a revolutionary method to provide AI-driven systems with current and specific information. But what exactly is RAG, and what benefits does it offer your business?

What is RAG?

RAG combines the strengths of information retrieval systems with generative AI models. It retrieves relevant information from a knowledge database and integrates it into the creation of responses. The result is precise and contextually relevant answers that are always based on the latest data.

Inclusion in Tech: The DHHWG and Its Importance for Kubernetes

Tue, 24 Sep 2024 02:00:00 +0000

Introduction

In the context of Deaf Awareness Month, the CNCF Deaf and Hard-of-Hearing Working Group (DHHWG) takes center stage. We take a look at the inspiring work of Catherine Paganini, one of the founders of this group, and Sandeep Kanabar, a deaf member who highlights the importance of inclusion in the tech community.

What Specifically Changes for Developers/DevOps Teams?

The DHHWG is committed to making Cloud-Native projects like Kubernetes more accessible to everyone. This is achieved by creating pathways that allow underrepresented groups, including people with disabilities, to contribute their unique perspectives and skills. The initiative not only raises awareness about accessibility but also fosters an environment where empathy and support are prioritized.

Kubernetes 1.31: Precise Control Over Group Memberships in Pods

Sun, 25 Aug 2024 02:00:00 +0000

Kubernetes 1.31 introduces an exciting new feature that enhances the handling of group memberships in containers within Pods. This change aims to refine control over group memberships and minimize potential security risks.

What Specifically Changes for Developers/DevOps Teams?

With the introduction of the new supplementalGroupsPolicy field in a Pod’s .spec.securityContext, the way group memberships for container processes are calculated is optimized. Developers and DevOps teams now have the option to choose between two policies:

Kubernetes v1.31: Optimized CPU Distribution for Enhanced Performance on Multi-Core Processors

Sun, 25 Aug 2024 02:00:00 +0000

In Kubernetes v1.31, we are excited to introduce a significant improvement in CPU management: the distribute-cpus-across-cores option for the CPUManager static policy . This feature is currently in the Alpha phase and is hidden by default. It marks a strategic shift aimed at optimizing CPU utilization and enhancing system performance on multi-core processors.

Understanding the Feature

Traditionally, Kubernetes’ CPUManager tends to allocate CPUs as compactly as possible, typically packing them onto the smallest number of physical cores. This allocation strategy is critical because CPUs on the same physical host continue to share some resources of the physical core, such as cache and execution units.

ESCRA and ayedo Revolutionize ZTNA with Kubernetes and Cloud Hosting

Thu, 04 Jul 2024 11:45:36 +0000

Successful Partnership: ESCRA and ayedo Revolutionize ZTNA with Kubernetes and Cloud Hosting

Strategic partnerships are crucial for combining strengths and growing together. An outstanding example of this is the collaboration between ESCRA, an emerging startup offering ZTNA (Zero Trust Network Access) remote access solutions, and us, ayedo, an innovative provider of cloud hosting and Kubernetes management services. This partnership has not only strengthened the individual offerings of both companies but also set new standards in the industry.

How to Handle 160 Million Users a Month? With K8s and Docker!

Mon, 01 Jul 2024 17:07:13 +0000

Highly Available SaaS Infrastructure for Over 2 Billion Requests Per Month

In today’s digital world, resilience and scalability are indispensable features of any successful Software-as-a-Service (SaaS) platform. Prime Insights, a leading provider of data analytics solutions, recognized this need early on and sought an advanced infrastructure to efficiently manage its rapidly growing number of user requests. This is where ayedo comes into play – our experts developed and operate a highly available, geo-redundant SaaS infrastructure that meets the demands of Prime Insights.

Protection Against Cyber Threats: A Comprehensive Guide to Cyber Risk Assessment

Thu, 13 Jun 2024 11:45:36 +0000

An effective way to minimize these risks is through Cyber Risk Assessment. In this blog post, you will learn what Cyber Risk Assessment is, why it is important, and how ayedo can help you optimize your security measures.

What is Cyber Risk Assessment?

Cyber Risk Assessment is a systematic process for evaluating a company’s security posture. It identifies potential security gaps and suggests measures to mitigate risks. The assessment includes analyzing technologies, processes, and employee behavior to develop a comprehensive security strategy.

Compliance Made Easy: ISO27001 as the Key to Regulatory Compliance

Mon, 10 Jun 2024 11:45:36 +0000

Compliance Made Easy: ISO27001 as the Key to Regulatory Compliance

Meeting legal requirements and data protection regulations is a constant challenge for companies. ISO 27001, the international standard for Information Security Management Systems (ISMS), offers a comprehensive solution to this challenge. But how exactly can ISO 27001 help your company comply with legal regulations more easily?

What is ISO27001?

ISO 27001 is an internationally recognized standard that defines the requirements for establishing, implementing, maintaining, and continuously improving an ISMS. The goal is to ensure the confidentiality, integrity, and availability of information through a risk-based approach.

Deploy getHomepage with Traefik Labels and Use Under a DNS Entry

Sun, 09 Jun 2024 17:07:13 +0000

In this post, we will show you how to deploy the dashboard app getHomepage using Docker Compose and Traefik, and access it through a DNS entry like https://my.your-domain.org. This configuration allows for easy and centralized management of your SaaS tools.

Introduction to Traefik

Traefik is a dynamic reverse proxy and load balancer designed specifically for modern applications. It enables automatic service discovery and easy management of SSL/TLS certificates. You can find more details in our Traefik Tutorial .

Deploying Baserow with Traefik Labels and Using It Under a DNS Entry

Sun, 09 Jun 2024 17:07:13 +0000

Introduction

In this post, we will show you how to deploy Baserow using Docker Compose and Traefik and make it accessible via a DNS entry like https://data.your-domain.org. This configuration allows for a simple and secure deployment of your low-code database platform.

Introduction to Traefik

Traefik is a powerful reverse proxy and load balancer that simplifies the management and deployment of microservices. It enables automatic service discovery and SSL/TLS certificate management. For more details and a comprehensive tutorial, check out our Traefik Tutorial .

Deploying Mattermost with Traefik Labels and Using It Under a DNS Entry

Sun, 09 Jun 2024 17:07:13 +0000

Introduction

In this post, we will show you how to deploy Mattermost using Docker Compose and Traefik, and access it via a DNS entry like https://chat.your-domain.org. This configuration allows for a simple and secure deployment of your communication platform.

Introducing Traefik

Traefik is a dynamic reverse proxy and load balancer specifically designed for microservices and modern cloud-native applications. It enables automatic service discovery and management of SSL/TLS certificates. For more details and a comprehensive tutorial, visit our Traefik tutorial .

Deploying Paperless-ngx with Traefik Labels and Accessing via DNS Entry

Sun, 09 Jun 2024 17:07:13 +0000

Introduction

In this post, we will show you how to deploy Paperless-ngx using Docker Compose and Traefik, and access it via a DNS entry like https://docs.your-domain.org. This configuration allows for a simple and secure deployment of your digital document management platform.

Introducing Traefik

Deploying Portainer with Traefik Labels and Accessing via DNS Entry

Sun, 09 Jun 2024 17:07:13 +0000

Introduction: Deploying Portainer with Traefik Labels and Accessing via DNS Entry

In this post, we’ll show you how to deploy Portainer using Docker Compose and Traefik, and access it via a DNS entry like https://portainer.your-domain.org. This configuration allows for easy and secure management of your Docker environment through a user-friendly interface.

Introducing Traefik

Deploying StirlingPDF with Traefik Labels and Accessing via DNS Entry

Sun, 09 Jun 2024 17:07:13 +0000

Introduction

In this post, we demonstrate how to deploy Stirling PDF using Docker Compose and Traefik, and access it via a DNS entry like https://pdf.your-domain.org. This configuration enables a straightforward and secure deployment of your PDF processing application.

Introducing Traefik

Traefik is a powerful reverse proxy and load balancer that simplifies the management and deployment of microservices. With Traefik, you can automatically generate certificates for HTTPS and distribute the load across various backend services. For more details and a comprehensive tutorial, visit our Traefik tutorial .

Deploying Vikunja with Traefik Labels and Using It Under a DNS Entry

Sun, 09 Jun 2024 17:07:13 +0000

Introduction

In this post, we will show you how to deploy the to-do app Vikunja with Docker Compose and Traefik and access it via a DNS entry like https://do.your-domain.org. This configuration allows for easy and secure management of your task lists.

Introduction to Traefik

Traefik Tutorial: Setup and Configuration

Sun, 09 Jun 2024 17:07:13 +0000

In this tutorial, you will learn how to set up and configure Traefik as a reverse proxy using Docker Compose. Traefik offers a modern and flexible solution to manage traffic for your applications, ensuring they are securely accessible over the internet. We will cover the configuration of docker-compose.yml, traefik.toml, traefik_dynamic.toml, and acme.json. Additionally, we will explain what a reverse proxy is and why certificates are important for securing your applications.

Kubernetes: A Decade of Innovation and Growth

Sun, 09 Jun 2024 02:00:00 +0000

Ten years ago, on June 6, 2014, the first commit of Kubernetes was published on GitHub. This initial commit, comprising 250 files and 47,501 lines of Go, Bash, and Markdown, marked the beginning of the project we know today. Who would have thought back then that Kubernetes would grow into one of the largest open-source projects with over 88,000 contributors from more than 8,000 companies across 44 countries a decade later?

Secure Your Data with the Cyber Risk Check: How to Effectively Protect Your Business

Mon, 03 Jun 2024 11:45:36 +0000

Protecting sensitive data is of utmost importance. A Cyber Risk Check is an effective tool to assess and improve your company’s security posture. In this blog post, you’ll learn how the Cyber Risk Check from ayedo can help keep your data secure.

What is a Cyber Risk Check?

A Cyber Risk Check is a systematic process for evaluating a company’s cybersecurity. It involves identifying potential vulnerabilities, assessing risks, and proposing risk mitigation measures. The goal is to develop a robust security strategy that protects your sensitive data.

ayedo Cloud: Performance Optimization for Cloud-Native Applications

Tue, 28 May 2024 11:45:36 +0000

ayedo Cloud: Performance Optimization for Cloud-Native Applications

The performance of cloud-native applications is a critical factor for business success. ayedo Cloud offers specialized solutions for performance optimization, ensuring that your applications always run efficiently and reliably. In this article, we explore the various features and strategies of ayedo Cloud that contribute to performance enhancement.

1. High-Performance Infrastructure

Modern Hardware and Network Technologies

State-of-the-Art Hardware: ayedo Cloud relies on modern hardware components to ensure maximum performance and reliability. This includes powerful processors, fast SSDs, and highly available network technologies.
Optimized Network Connectivity: By utilizing advanced network technologies and redundant connections, ayedo Cloud offers low latency and high bandwidth, accelerating data transmission.

2. Automatic Scaling

Dynamic Resource Adjustment

The Driving Force Behind Kubernetes: A Look at SIG Node

Fri, 24 May 2024 02:00:00 +0000

In the world of container orchestration, Kubernetes is the undisputed leader, powering some of the most complex and dynamic applications globally. Behind the scenes, a network of Special Interest Groups (SIGs) ensures the innovation and stability of Kubernetes.

Today, we have the pleasure of speaking with Matthias Bertschy , Gunju Kim , and Sergey Kanzhelev , members of SIG Node , who will provide insights into their roles, challenges, and exciting developments within SIG Node.

Cyber Risk Assessment: Key Steps to Enhance Your Cybersecurity

Mon, 20 May 2024 10:38:36 +0000

Cybersecurity threats are constantly increasing, and companies face the challenge of protecting their sensitive data. A Cyber Risk Assessment is an essential process to evaluate and improve your company’s security posture. In this blog post, we present the key steps of a Cyber Risk Assessment and demonstrate how ayedo can assist you in optimizing your cybersecurity.

What is a Cyber Risk Assessment?

A Cyber Risk Assessment is a systematic review of a company’s IT security. It involves identifying potential vulnerabilities, assessing risks, and proposing risk mitigation measures. The goal is to strengthen your IT infrastructure’s security and minimize the risk of cyberattacks.

Gateway API v1.1: New Features for Developers and DevOps Teams!

Sun, 12 May 2024 02:00:00 +0000

Following the general release of the Gateway API last October, the Kubernetes SIG Network is excited to announce the release of v1.1 of the Gateway API . In this version, several features are now available in the Standard Channel (GA), including support for Service Mesh and GRPCRoute. Additionally, we are introducing some new experimental features, such as session persistence and client certificate validation.

What’s New?

Graduation to Standard

In this version, four eagerly anticipated features have graduated to standard. This means they are no longer experimental concepts; their inclusion in the standard release channel indicates a high level of confidence in the API surface and provides guarantees for backward compatibility. Of course, features in the Standard Channel can continue to evolve, with backward-compatible additions expected over time. For more information, see the Gateway API Versioning Policy .

The Impact of ISO 27001 Certification on Data Protection and Data Integrity

Fri, 10 May 2024 11:45:36 +0000

The Impact of ISO 27001 Certification on Data Protection and Data Integrity

Data breaches and cyber-attacks are ubiquitous threats that can affect companies of any size today. In this context, ISO 27001, the international standard for Information Security Management Systems (ISMS), gains enormous importance. This certification is not only a quality seal for information security but also plays a crucial role in protecting data protection and data integrity. But what does this mean specifically for your company?

The Secrets of the Container Runtime Interface: Streaming Made Easy!

Sat, 04 May 2024 02:00:00 +0000

The Kubernetes Container Runtime Interface (CRI) is the central link between the kubelet and the Container Runtime . These runtimes must provide a gRPC -server that fulfills a Protocol Buffer interface defined by Kubernetes. This API definition evolves over time as new features are added or fields are deprecated.

In this blog post, I want to highlight the functionality and history of three exceptional Remote Procedure Calls (RPCs) that stand out in their operation: Exec, Attach, and PortForward.

Kubernetes 1.30: Enhanced Security with User Namespace for Pods

Thu, 25 Apr 2024 02:00:00 +0000

Linux offers various namespaces to isolate processes from each other. A typical Kubernetes Pod runs in a network namespace to isolate network identity and in a PID namespace to isolate processes.

One Linux namespace that has been overlooked until now is the User Namespace . This namespace allows us to isolate the user and group IDs (UIDs and GIDs) we use inside the container from those of the host.

This powerful abstraction allows us to run containers as “root”: we are root inside the container and can do everything a root within the Pod can do. However, our interactions with the host are limited to what an unprivileged user can do. This is great for limiting the impact of a container breakout.

Build Your Own Cloud: Achieving Success with Kubernetes

Mon, 08 Apr 2024 02:00:00 +0000

Introduction

Have you ever thought about creating your own cloud? Maybe you’ve even tried it! With Kubernetes, it’s certainly possible, and in this series of articles, I’ll show you how to tackle it. At Ænix, we’ve gained a lot of experience developing Cozystack and want to share our insights with you.

What Specifically Changes for Developers/DevOps Teams?

It’s often argued that Kubernetes isn’t meant for creating your own cloud and that OpenStack should be used instead. However, adding a complex system like OpenStack isn’t necessary. Kubernetes already has everything you need to operate tenant Kubernetes clusters. In this series, I’ll show you how to use Kubernetes on bare metal for your cloud.

Build Your Own Cloud: Virtualization Made Easy with Kubernetes

Mon, 08 Apr 2024 02:00:00 +0000

In our series on building your own cloud with the Kubernetes ecosystem, we continue our journey today. In the previous article , we explained how to prepare a basic Kubernetes distribution based on Talos Linux and Flux CD. In this article, we will show you various virtualization technologies in Kubernetes and prepare everything you need to run virtual machines in Kubernetes—particularly in the areas of storage and networking.

But why are virtual machines necessary, and why can’t we just use Docker containers to build a cloud? The reason is simple: containers do not offer the necessary level of isolation. Even though the situation improves year by year, we often encounter vulnerabilities that allow escaping the container sandbox and escalating privileges within the system.

Kubernetes in Kubernetes: How to Build Your Own Cloud!

Mon, 08 Apr 2024 02:00:00 +0000

In this exciting continuation of our series on Kubernetes, we explore how you can run Kubernetes in Kubernetes (K8s in K8s). Technologies like Kamaji and Cluster API take center stage, along with their integration with KubeVirt. After covering how to prepare Kubernetes on bare metal and transform it into a management system for virtual machines in previous articles, here’s the final touch: With these technologies, you can build a fully managed Kubernetes environment and operate virtual Kubernetes clusters with just one click.

Kubernetes for IoT and IIoT

Wed, 27 Mar 2024 11:52:36 +0000

Kubernetes has established itself as a key technology for managing and operating containerized applications, including those used in the Internet of Things (IoT) and Industry 4.0 (IIoT) sectors. By providing a flexible, scalable, and highly available infrastructure, Kubernetes significantly eases the deployment and management of IoT and IIoT applications and services. Especially in real-time communication between devices and their control plane, message queues and brokers like Apache Kafka and NATS play a crucial role. Here, we describe in detail how Kubernetes supports these processes:

Kubernetes for App Developers

Wed, 27 Mar 2024 11:51:36 +0000

Kubernetes can help a software or digitalization agency generate additional revenue through the highly available operation of software in various ways:

High Availability: By ensuring nearly 100% availability of applications, agencies can negotiate higher Service-Level Agreements (SLAs) with their clients, justifying higher prices.
Scalability: Kubernetes allows applications to dynamically scale to handle peak loads without the need to constantly reserve resources. This can help agencies offer more efficient and cost-effective solutions to their clients.
Automated Rollouts and Rollbacks: The ability to execute updates and changes quickly and reliably without risking downtime means agencies can bring new features to market faster and respond to customer demands, increasing customer satisfaction and loyalty.
Self-Healing: Kubernetes can automatically replace faulty instances, ensuring continuous service availability. This reduces the need for manual interventions, allowing the agency to focus on developing and improving applications rather than maintaining them.
Portability and Flexibility: Independence from cloud providers and infrastructures allows agencies to run their applications in any environment, optimizing hosting costs and offering software to different customers on their preferred platform.
Security: Kubernetes offers robust security features that can help protect customer applications. Agencies can use this as a selling point, especially in industries where data protection and security are crucial.
Managed Services: Many cloud providers offer Kubernetes as a managed service. Agencies can leverage their expertise in these services to assist clients with the migration, management, and optimization of their Kubernetes clusters, providing an additional revenue stream.

Software Development with a Built-in Distribution Channel

Seven reasons to develop software to run on Kubernetes:

Kubernetes for AI

Wed, 27 Mar 2024 11:50:36 +0000

Kubernetes plays a crucial role in supporting open source AI applications by providing a robust, scalable, and flexible platform for deploying, managing, and scaling such applications. This container orchestration tool simplifies the management of containerized applications across multiple hosts, making it ideal for AI projects that often require large amounts of computing resources and a reliable infrastructure.

Automation and Scalability

With Kubernetes, developers can automatically scale AI applications to meet changing demands. This is particularly important for AI models that require significant resources during the training process or when processing large datasets. Kubernetes enables efficient resource allocation and automatic scaling as needed, improving both performance and cost efficiency.

Laravel for SaaS Apps

Wed, 27 Mar 2024 11:49:36 +0000

Laravel is one of the most popular PHP frameworks, offering a range of features that make it an excellent choice for developing Software-as-a-Service (SaaS) products. Here are seven reasons to use Laravel:

Simplicity and Elegance: Laravel offers an elegant syntax that speeds up development and makes the code more readable. It allows developers to achieve more with less effort.
Modularity: With built-in modularity, developers can easily integrate reusable components into their applications. This promotes code reusability and simplifies maintenance.

PHP in Kubernetes

Wed, 27 Mar 2024 11:48:36 +0000

By leveraging Kubernetes , developers and operations teams can overcome the challenges of traditional hosting environments, making their PHP applications more efficient, reliable, and scalable. Here are some key aspects of how Kubernetes can simplify and enhance the operation of PHP applications:

Automated Deployment and Scaling

Fast and Consistent Deployments: Kubernetes allows PHP applications to be packaged in containers, facilitating fast, consistent, and reproducible deployments across different environments. This significantly simplifies the software delivery process.
Automatic Scaling: Kubernetes can automatically adjust the number of pods (containers) based on the load. For PHP applications, this means they can automatically scale up with increasing traffic to maintain performance and scale down during low traffic to save costs.

Enhanced Resilience and Availability

Self-Healing: Kubernetes constantly monitors the state of the pods and can automatically replace faulty instances. This increases the reliability of PHP applications by minimizing downtime and quickly addressing potential disruptions.
Load Balancing: Kubernetes distributes incoming network traffic across multiple instances of the application, improving load distribution and enhancing the overall availability of the PHP application.

Efficient Resource Management

Resource Quotas: Kubernetes allows setting resource limits and requests (such as CPU and memory) for each container. This helps optimize the use of system resources and ensures that a PHP application does not consume more resources than allocated.
Persistent Storage: Kubernetes supports persistent volumes that remain independent of the container lifecycle. This is crucial for PHP applications that rely on databases or file storage to ensure consistent data retention.

Improved Development and Collaboration

Declarative Configuration: Kubernetes uses YAML or JSON configuration files to describe the desired state of an application. This promotes best practices like infrastructure as code and facilitates collaboration in development teams.
Comprehensive Ecosystem: Thanks to Kubernetes’ broad ecosystem, teams can choose from a variety of tools and services specifically designed for monitoring, logging, and CI/CD, further simplifying the operation and maintenance of PHP applications.

Overall, Kubernetes can significantly simplify and enhance the operation of PHP-based applications through automation, improved resilience, efficient resource management, and support for modern development practices. These advantages make Kubernetes an attractive platform for companies looking to run their PHP applications in a dynamic, scalable, and reliable environment.

What is the ayedo Cloud?

Wed, 27 Mar 2024 11:47:36 +0000

Welcome to the ayedo Cloud – your ultimate platform for zero-downtime SaaS app hosting. Designed for the creative minds who want to enrich the world with their software. Whether you’re a Software-as-a-Service provider, a Docker enthusiast, or simply someone who wants to enjoy the peace of night without worrying about running your applications – the ayedo Cloud is for you.

Cloud Services for App Developers: The Ultimate Toolkit

Kubernetes - Managed or Manual?

Wed, 27 Mar 2024 11:46:36 +0000

Kubernetes - Managed or Manual?

Should you manage Kubernetes yourself or entrust the responsibility to Managed Service Providers? With Kubernetes emerging as the de facto standard for container orchestration, many face this decision.

Managed Kubernetes Clusters from the ayedo Cloud

At ayedo, we understand the challenges and opportunities that Kubernetes presents. Our Managed Kubernetes services in the ayedo Cloud are designed not only to offer you a robust and scalable orchestration solution but also significant cost advantages, time savings, access to expertise, and a highly available infrastructure.

Docker Swarm vs Kubernetes

Wed, 27 Mar 2024 11:45:36 +0000

In the world of container orchestration, two technologies are at the center of the discussion: Docker Swarm and Kubernetes . Both offer powerful platforms for managing containers, yet they fundamentally differ in their approach, complexity, and functionality.

Feature	Docker Swarm	Kubernetes
Setup and Ease of Use	Simple and quick, intuitive commands for Docker users	More complex, offers more comprehensive configuration options
Scalability	Optimal for small to medium-sized clusters	Designed for high scalability, even in very large environments
Orchestration Features	Basic functions for container management	Extensive orchestration features and capabilities
Future-Proofing	Limited by simpler functionality	High, due to active development and broad acceptance
Technology State	Good for simple applications and deployments	Advanced, supports latest technologies and standards
Developer Community	Part of the Docker community, smaller compared to Kubernetes	Large, active community; broad support and engagement
CNCF Membership	Not directly listed as a CNCF project	Core project of the CNCF, central to the cloud-native ecosystem
Familiarity Among Developers	High, especially among developers working with Docker	Very high, recognized as the de facto standard for container orchestration
Flexibility and Adaptability	Less customizable, focused on simplicity	Highly customizable, supports a wide range of workloads

Docker Swarm: Simplicity and Speed

Docker vs Docker Swarm

Wed, 27 Mar 2024 11:44:36 +0000

Docker and Docker Swarm are closely related technologies in the realm of containerization and orchestration, each covering different aspects of container management. Here are the fundamental differences between the two:

Property	Docker	Docker Swarm
Focus	Containerization of applications	Orchestration of containers at the cluster level
Use Case	Development, shipping, and operation of containers	Management of highly available and scalable applications
Architecture	Single host	Cluster of hosts
Scaling	Manual on a single host	Automatic scaling across multiple hosts
Availability	Limited to the availability of a single host	Highly available through multi-host deployment
Networking	Simple network management for containers	Advanced network management for clusters
Data Persistence	Volumes and bind mounts for persistence	Volumes combined with external storage solutions for cluster-wide persistence
Discovery & Orchestration	Not natively supported	Native support for service discovery and orchestration
Tools/Platform	Docker CLI, Docker Compose	Docker CLI, Docker Compose (extended for Swarm)
Security	Basic security features	Additional security features for cluster communication

Docker

Docker is a platform for developing, shipping, and running applications in containers. It allows developers to package applications and their dependencies into lightweight, portable containers that can run on nearly any Linux or Windows base. Docker simplifies the development workflow and facilitates Continuous Integration and Continuous Deployment (CI/CD) processes.

What is Netbird?

Wed, 27 Mar 2024 11:43:36 +0000

Netbird is a modern peer-to-peer (P2P) networking solution that enables the creation of a secure, scalable, and easy-to-manage network. It is an advanced alternative to traditional VPN solutions, specifically designed to meet the needs of businesses. With Netbird, teams can securely and efficiently access system resources, regardless of their location.

Benefits of Netbird

Easy Setup and Management: Netbird eliminates the complexity often associated with setting up and managing VPNs, allowing for quick and straightforward network configuration.
Secure, Encrypted Access: It offers end-to-end encryption, ensuring secure access to network resources and the protection of sensitive data.
Scalability: Netbird seamlessly adapts to your company’s growth, enabling easy network scaling without additional hardware or complex configurations.
High Availability: Through its P2P architecture and automatic connection recovery, Netbird ensures constant availability and reliability of the network.

Why Netbird Outperforms Other VPN Solutions

Unlike traditional VPN technologies that use centralized servers and can often lead to bottlenecks, Netbird is based on a decentralized P2P architecture. This configuration enhances performance, reduces latency, and increases fault tolerance. Furthermore, Netbird simplifies network operations through automation and offers an intuitive user interface that allows even non-experts to configure complex network settings.

Postgresql vs MongoDB

Wed, 27 Mar 2024 11:42:36 +0000

PostgreSQL and MongoDB are two of the most popular database management systems (DBMS) that fundamentally differ in their approach and use cases. PostgreSQL is a relational DBMS based on Structured Query Language (SQL), while MongoDB is a NoSQL DBMS designed for storing document-oriented or semi-structured data. Both systems can be configured in Kubernetes for high availability and automated operations, albeit with different approaches and considerations.

Property	PostgreSQL	MongoDB
Data Model	Relational, table-based, with strict data schemas	Document-oriented, schema-free, JSON-like documents
Query Language	SQL (Structured Query Language), supports complex queries and joins	MQL (MongoDB Query Language), flexible for document-oriented queries
High Availability in Kubernetes	Requires tools like Patroni for HA and scaling; more complex setup	Native support through MongoDB Atlas and MongoDB Kubernetes Operator; easier setup
Scalability	Vertical and horizontal (with additional tools for cluster management)	Native support for horizontal scaling through sharding
Performance	High performance for complex transactions and queries	Optimized for fast read and write operations of large volumes of variable data
Automated Operations in Kubernetes	Management via operators possible, but generally more complex	Simpler and more automated through MongoDB Kubernetes Operator
Use Cases	Suitable for applications requiring relational data integrity and complex transactions	Suitable for applications with large data volumes and flexible schemas

Data Model and Query Language

PostgreSQL: Utilizes a table-based model with strict data schemas. It supports complex queries and transactions that ensure ACID properties (Atomicity, Consistency, Isolation, Durability). PostgreSQL is ideal for applications requiring complex joins, transactions, and analytical operations.
MongoDB: Uses a flexible, document-oriented model that allows developers to store semi-structured data in a JSON-like format. MongoDB is particularly well-suited for applications that require rapid iterations, handling large volumes of variable data structures, and easy scalability.

High Availability and Scalability in Kubernetes

PostgreSQL: Implementing high availability (HA) and scalability in Kubernetes requires additional tools and operators, such as Patroni, to manage a PostgreSQL cluster. These tools enable the automation of failover processes, backups, and scaling. PostgreSQL can be scaled vertically (by adding resources to existing nodes) and horizontally (by adding multiple nodes), with the latter being more complex to manage.
MongoDB: MongoDB offers native support for cloud operations, including Kubernetes, with features for automatic scaling, backups, and HA through MongoDB Atlas. The MongoDB Kubernetes Operator automates the deployment, failover, and scaling of MongoDB instances. MongoDB also supports horizontal scaling through sharding directly, making it potentially easier to scale in Kubernetes environments.

Performance

PostgreSQL: Provides high performance for complex queries and is optimal for scenarios requiring relational data integrity and complex transactions. However, performance may suffer under extremely high read and write demands, especially when horizontal scaling is used.
MongoDB: Designed for fast data access and high performance, particularly in read and write operations of large volumes of non-relational data. Through sharding and replication, MongoDB can achieve high throughput and low latency even with very large datasets.

Automated Operations in Kubernetes

PostgreSQL and MongoDB: Both database systems can benefit from the orchestration and self-healing capabilities of Kubernetes. The use of operators in Kubernetes facilitates the automation of deployment, scaling, and management, including monitoring the health of the databases and automatically handling failover scenarios.

Conclusion

The choice between PostgreSQL and MongoDB depends on the specific requirements of the application, the preferred data model, and scalability needs. While PostgreSQL excels with its robust, relational model for complex data processing needs, MongoDB offers flexibility and performance for handling large volumes of variable data. In Kubernetes environments, both systems can be configured for high availability and automated operations, with their respective operators and management tools being crucial for the efficiency and simplicity of management.

What is Cilium?

Wed, 27 Mar 2024 11:41:36 +0000

Cilium is an open-source project that provides network security and monitoring for container orchestration systems like Kubernetes . It uses a modern technology called eBPF (extended Berkeley Packet Filter), which allows for efficient control and monitoring of network traffic at a very low level.

For someone without extensive experience with Kubernetes, it’s helpful to understand that Kubernetes manages containers in an isolated and automated environment. Network security and communication between these containers and the outside world are crucial for the operation of any application. This is where Cilium comes into play:

Kafka vs NATS

Wed, 27 Mar 2024 11:40:36 +0000

Apache Kafka and NATS are high-performance messaging systems used in modern distributed architectures to connect components through message exchange. Despite some overlap in functionality, both systems fundamentally differ in design, use cases, and technical specifications.

Property	Apache Kafka	NATS
Scalability	High, supports petabytes of data across clusters of servers.	Good, optimized for lightness and scalability in large systems.
Runtime Requirements	Higher, requires a JVM environment.	Lower, written in Go and optimized for container and microservice landscapes.
Performance	High throughput and low latency, optimized for millions of messages per second.	Extremely low latencies and high throughput rates, optimized for fast message delivery.
Complexity	Higher, complex architecture requires specialized knowledge for setup and management.	Lower, simpler to set up and manage. Simplified API and client libraries.
Persistence	Provides durable message storage.	Focuses on message deliverability without persistent data storage.
Use Cases	Ideal for reliable, durable, and scalable processing of message streams.	Suitable for projects seeking a fast, efficient, and lightweight messaging solution.
Clustering Capability	Supports partitioning and replication for scaling and availability.	Supports clustering for scaling and increased throughput, though with a different focus than Kafka.
Language/Platform	Written in Scala and Java.	Written in Go.

Apache Kafka

Apache Kafka is a distributed streaming platform used for publishing, subscribing, storing, and processing streams of events (messages) in real-time. Originally developed by LinkedIn, it is now an open-source project of the Apache Software Foundation.

Postgresql vs MariaDB

Wed, 27 Mar 2024 11:39:36 +0000

PostgreSQL and MariaDB are both popular open-source relational database management systems (RDBMS) used for storing and managing data. Although both systems offer many similar features, there are significant differences between them in terms of functionalities, performance characteristics, and support.

Aspect	PostgreSQL	MariaDB
Foundation	Advanced features and data structures	Derivative of MySQL
Licensing	PostgreSQL license (similar to MIT license)	GPL v2 license
Extensibility	High, with support for custom data types and functions	Also offers extensions, but focuses on MySQL compatibility
Clustering Capability	Supported through native features and third-party extensions	Built-in clustering solution with MariaDB Galera Cluster
PITR Backups	Extensive support for PITR	Supports PITR, implementation varies by storage engine
High Availability	Achievable through streaming replication and logical replication	Highly available through MariaDB Galera Cluster without additional software
Scalability	Supports both vertical and horizontal scaling	Horizontal scaling through Galera Cluster, different storage engines support different loads
Performance	High for complex queries and large datasets	Optimized for high performance and scalability
Data Types and Functions	Supports advanced data types like arrays, JSON/JSONB, and geometric types	Focuses on compatibility with MySQL, extends its features
Storage Engines	Unified approach with MVCC	Supports multiple storage engines, including Aria and InnoDB
Performance Features	Robust indexing options and MVCC	Pool-of-Threads for improved scalability

PostgreSQL

Advanced Features: PostgreSQL is known for its advanced features such as support for complex queries, foreign keys, triggers, views, transactions with ACID properties, and more. It also supports advanced data types like arrays, hstore (a key-value store), JSON/JSONB, and geometric data types.
Performance: PostgreSQL is often praised for its performance in complex queries and its ability to handle large datasets. It offers robust indexing mechanisms like B-trees, Multiversion Concurrency Control (MVCC), and GIN indexes for complex search queries.
Extensibility: A key feature of PostgreSQL is its extensibility. Developers can add new functionalities, such as data types, functions, operators, and index methods, without modifying the core code.
Licensing: PostgreSQL is released under the PostgreSQL license, a liberal open-source license similar to the MIT license.
Clustering Capability: PostgreSQL supports native partitioning and sharding through its architecture, allowing efficient data distribution across multiple servers. Additionally, there are third-party extensions like Postgres-XL for horizontal scaling and Citus, which adds distributed database functionalities to enhance clustering capability.
Point-in-Time Recovery (PITR) Backups: PostgreSQL offers extensive backup and recovery options, including PITR. PITR allows databases to be restored to a specific point in the past, which is very useful for minimizing data loss after an error.
High Availability and Scalability: PostgreSQL can be made highly available through replication solutions like streaming replication and logical replication. For scalability, PostgreSQL offers native partitioning and the aforementioned third-party extensions, as well as load balancing and failover mechanisms.

MariaDB

Derivative of MySQL: MariaDB was created as a fork of MySQL after MySQL was acquired by Oracle. It aims for full binary compatibility with MySQL, meaning it can function as a drop-in replacement.
Performance and Storage Engines: MariaDB is known for its high performance and scalability, supporting a wide range of storage engines, including Aria, InnoDB, and MyISAM. It also offers features like Pool-of-Threads to improve scalability and performance.
Extensions over MySQL: MariaDB adds numerous enhancements and new features not present in MySQL, including advanced query optimizations, new storage engines, and extensions for geo-spatial support.
Licensing: MariaDB is released under the GPL v2 license, which requires that all changes and extensions are also released under the same license.
Clustering Capability: MariaDB provides a built-in solution for synchronous replication across multiple nodes with MariaDB Galera Cluster. This facilitates the setup of highly available systems with automatic failover and recovery without the need for additional software.
Point-in-Time Recovery (PITR) Backups: Similar to PostgreSQL, MariaDB supports PITR backups, with implementation varying by the storage engine used. In addition to traditional backup solutions, MariaDB also offers snapshot backups and incremental backups.
High Availability and Scalability: MariaDB achieves high availability through the use of MariaDB Galera Cluster and other replication methods. For scalability, MariaDB offers support for master-slave and master-master replication configurations. Performance can be further enhanced through features like Pool-of-Threads and query optimization.

Conclusion

While PostgreSQL excels with its extensibility, advanced data processing capabilities, and robust support for complex data structures, as well as clustering capabilities via third-party extensions, MariaDB offers an attractive alternative with a strong emphasis on easy cluster setup, PITR backups, and scalability through MariaDB Galera Cluster and a variety of storage engines. Both database systems offer excellent options for high availability and scalability, with the choice depending on specific requirements, the experience of the development team, and the existing infrastructure.

GitHub vs GitLab

Wed, 27 Mar 2024 11:38:36 +0000

GitLab and GitHub are both very popular platforms for version control and collaboration on software development projects based on Git. Although they offer similar features like issue tracking, pull requests, and CI/CD pipelines , there are some significant differences between the two.

Feature	GitHub	GitLab
Foundation	Cloud Service	Open Source
Hosting	Primarily cloud-based; Enterprise version for self-hosting	Both cloud-based and open source for self-hosting
Open Source	No (GitHub itself is not open source)	Yes (Community Edition available)
Self-Hosting	Only in the Enterprise version	Possible in all versions, including the free Community Edition
CI/CD Integration	Available, with GitHub Actions	Integrated CI/CD in all versions
Cost	Free and paid plans; self-hosting in Enterprise version	Free Community Edition; paid Enterprise Edition
Target Audience	Individuals and businesses	Individuals, open-source projects, and businesses

GitHub:

Cloud Service: GitHub is primarily used as a cloud-based service. This means users host their projects on GitHub’s servers. This solution offers quick setup and easy accessibility from anywhere, as long as there is an internet connection.
Enterprise Hosting: While GitHub offers an Enterprise version that allows companies to host GitHub on their own servers, this option is paid. This version is aimed at organizations that require greater control over their data and deep integration into their internal systems.
Open Source: While many open-source projects are hosted on GitHub, the platform itself is not open source. However, GitHub provides numerous tools and APIs available to developers to facilitate integrations and automations.

GitLab:

Open Source: A key difference from GitHub is that GitLab is available as an open-source platform. This means anyone can view, modify, and self-host GitLab’s source code. GitLab offers a Community Edition that is free and community-supported, as well as an Enterprise Edition with advanced features for larger organizations.
Self-Hosting: GitLab allows users from the start to run their own instance of the platform on private servers. This offers companies and organizations the flexibility to design their own version control and CI/CD infrastructure according to their security and compliance requirements.
Integrated CI/CD: Both GitLab and GitHub offer integrated solutions for Continuous Integration and Continuous Deployment. However, GitLab is particularly known for providing a comprehensive, out-of-the-box CI/CD solution within its platform, tightly integrated with other features.

Conclusion:

While GitHub is considered the leading platform for open-source projects and developer collaboration worldwide, GitLab offers a flexible and fully open-source alternative that allows users to host the platform on their own servers. The decision between GitLab and GitHub ultimately depends on the specific requirements of a project or company, including factors like cost, hosting preferences, privacy and security requirements, and the need for integrated CI/CD pipelines.

Prometheus vs VictoriaMetrics

Wed, 27 Mar 2024 11:37:36 +0000

Prometheus and VictoriaMetrics are both powerful time-series databases suitable for monitoring and alerting tasks in complex IT environments. Although they pursue similar goals, there are some significant differences in their architecture, operation, and offered features.

Feature	Prometheus	VictoriaMetrics
Architecture	Pull-based model for metric retrieval	Supports both pull and push models for data collection
Scalability	Vertical by increasing resources or through federation	Both vertically and horizontally scalable
Query Language	PromQL (Prometheus Query Language)	Backward compatible with PromQL and introduces MetricsQL, an extension of PromQL
High Availability	No built-in clustering, manual coordination needed for high availability	Designed with high availability in mind, uses replication and clustering
Performance and Efficiency	Optimized for real-time monitoring, not specifically for long-term storage	Higher resource efficiency and better support for long-term storage with more efficient data collection
Integration with Grafana	Easy, thanks to Grafana’s flexible data source support	Also easy, additionally supports enhancements through MetricsQL
API	HTTP-based, PromQL for queries and management	Comprehensive HTTP API, compatible with Prometheus, additionally supports InfluxDB and Graphite API

Architecture and Data Collection

Prometheus uses a pull-based model, where it retrieves metrics from configured targets at specified intervals. It stores time-series data in its own efficient local storage format and supports multidimensional data collection, querying, and alerting. Prometheus can be deployed as a single binary on a server or on a container platform like Kubernetes.

Redis vs KeyDB

Wed, 27 Mar 2024 11:35:36 +0000

Redis and KeyDB are both powerful in-memory database systems known for their speed and efficiency in data processing. Despite their similarities, there are significant differences between the two technologies.

Feature	Redis	KeyDB
Origin	Originally developed by Salvatore Sanfilippo	A fork of Redis
Licensing	BSD license; dual licensing model for advanced modules and enterprise features	Open-source license, details vary by version and components
Architecture	Single-threaded	Capable of multithreading
Performance	High, limited by single-threaded architecture on multi-core CPUs	Enhanced performance through multithreading, efficient use of multi-core CPUs
Extensibility	Module system for extensions	Compatible with Redis protocols and data structures, own extensions
Community and Support	Large and active community; extensive documentation and tutorials	Strives for compatibility with Redis, own community for specific KeyDB extensions
Compatibility with Redis	-	Yes, supports Redis protocols and data structures
Additional Features	-	Improved replication, additional commands
Active-Active Cluster	Only available in the enterprise version	Included in the standard version

Redis

Origin and Distribution: Redis (Remote Dictionary Server) was originally developed by Salvatore Sanfilippo and is widely used in the industry as a powerful and flexible in-memory database for caching, session management, pub/sub, and more scenarios.
Licensing: Redis is released under the BSD license, which is very permissive and imposes few restrictions on use and distribution. Over time, Redis has introduced a dual licensing model, especially for its advanced modules and enterprise features.
Architecture and Performance: Redis uses a single-threaded architecture known for its simplicity and high performance. It supports various data structures like strings, hashes, lists, sets, sorted sets with range queries, bitmaps, hyperloglogs, and geospatial indexes with radius queries.
Extensibility and Modules: Redis offers a module system that allows the functionality of the database to be extended through third-party or custom modules.
Community and Support: As one of the most popular open-source projects, Redis has a large and active community. There is extensive documentation, tutorials, and third-party tools available.

KeyDB

Origin and Distribution: KeyDB is a fork of Redis, distinguished by its multithreading capability. The main goal of KeyDB is to enhance Redis’s performance through multithreading to achieve higher throughput and better utilization of modern multi-core CPUs.
Licensing: KeyDB is also released under an open-source license, with the specific licensing model depending on the version and specific components.
Architecture and Performance: Unlike Redis, KeyDB uses a multithreading architecture that allows efficient use of multiple processor cores to achieve higher throughput rates and better scalability, especially for workloads involving many connections and commands.
Compatibility with Redis: KeyDB strives to remain compatible with Redis, meaning applications written for Redis can often work with KeyDB without changes. KeyDB supports the same protocols and data structures as Redis.
Extensions and Differences: In addition to multithreading, KeyDB adds its own extensions and improvements that go beyond the core functions of Redis, such as improved replication and additional commands.

Conclusion

Although Redis and KeyDB are similar in many aspects, they mainly differ in their internal architecture and performance optimization. Redis is known for its stability and large user community, while KeyDB is positioned as a more powerful alternative through the use of multithreading and additional optimizations. The choice between Redis and KeyDB ultimately depends on the specific requirements of the project, the preferred architecture, and performance expectations.

Authentik vs Keycloak

Wed, 27 Mar 2024 11:30:36 +0000

In today’s digital world, managing user identities and access permissions is a central challenge for companies of all sizes. Single-Sign-On (SSO) solutions offer an efficient way to enhance user experience while simultaneously increasing security. They allow users to log in once and gain access to multiple applications without needing to authenticate for each one separately. In this context, two leading tools have emerged: Authentik and Keycloak . Both provide robust solutions for identity management, offering open alternatives to services like Auth0 or Okta. In this article, we take a detailed look at Authentik and Keycloak, comparing their core features, use cases, and how they perform in real-world scenarios. The goal is to give you a clear understanding of which tool best suits your company’s specific needs.

Cyber Risk Check: How to Identify and Mitigate Security Vulnerabilities in Your Company

Wed, 27 Mar 2024 10:38:36 +0000

An effective way to minimize these risks is the Cyber Risk Check. In this blog post, you will learn how to identify and mitigate security vulnerabilities in your company with the help of ayedo.

What is a Cyber Risk Check?

A Cyber Risk Check is a comprehensive approach to evaluating and improving a company’s cybersecurity. It includes identifying potential vulnerabilities in the IT infrastructure, assessing the associated risks, and implementing measures to mitigate those risks.

Why ISO 27001 is Important for Businesses of All Sizes

Sun, 24 Mar 2024 11:45:36 +0000

Why ISO 27001 is Important for Businesses of All Sizes

Information security is a central concern for businesses. From small start-ups to large multinational corporations, every company must protect sensitive data from cyber threats while also meeting legal requirements. This is where ISO 27001 comes into play, the internationally recognized standard for Information Security Management Systems (ISMS). But why is this certification so important for companies of all sizes?

ArgoCD vs Flux

Sat, 23 Mar 2024 11:30:36 +0000

ArgoCD and Flux are both tools used for Continuous Deployment (CD) and GitOps workflows in Kubernetes clusters. They automate the deployment of applications and configurations in Kubernetes clusters by monitoring declarative configurations in Git repositories and applying changes to the clusters in real-time. Here are the main differences between ArgoCD and Flux:

Criterion	ArgoCD	Flux
Development	Developed by Intuit and hosted in CNCF	Developed by Weaveworks, now supported by CNCF
Architecture	Central control and monitoring module	Modular architecture with various controllers
Supported Features	Automatic synchronization, rollback, monitoring, integration with CI/CD	Synchronization, automatic updates, rollback, integration with CI/CD
User Interface	Built-in web-based user interface	No built-in user interface, CLI-based
Ease of Use	Easier to use with built-in user interface	CLI-based, but can be integrated with external tools
Community and Ecosystem	Active community and growing ecosystem	Active community and growing ecosystem

Origin and Development:

Kubernetes vs VMWare

Fri, 22 Mar 2024 11:30:36 +0000

Criterion	Kubernetes	VMware
Technology	Container orchestration platform	Virtualization platform
Level of Abstraction	Virtualizes applications at the container level	Virtualizes hardware at the server level
Use Case	Deployment and management of container applications in cloud environments	Server consolidation, desktop virtualization, cloud infrastructures
Architecture	Master-slave architecture with Kubernetes nodes	Hypervisor (e.g., VMware ESXi) and management software (e.g., vSphere)
Deployment Location	Cloud and hybrid cloud environments	Data centers and cloud infrastructures
Features	Automated deployment, scaling, and management of containers	Server consolidation, load balancing, resource optimization
Portability	Portability of container applications across different cloud platforms	Portability of VMs across various VMware products
Example Products	Google Kubernetes Engine (GKE), Amazon Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS)	VMware vSphere, VMware ESXi, VMware vCenter Server

This table provides a clear overview of the differences between Kubernetes and VMware in terms of technology, level of abstraction, use case, architecture, deployment location, features, portability, and example products.

Managed Kubernetes Comparison

Wed, 20 Mar 2024 11:30:36 +0000

TL;DR

Criterion	AWS EKS	Azure AKS	Google GKE
Pricing	Complex, based on instances, services, and data transfer	Varies depending on node type and number of nodes	Depends on node configuration, storage, and services
Management Features	Auto-scaling, monitoring, logging, integration with other AWS services	Auto-scaling, monitoring, integration with Azure services	Auto-scaling, monitoring, integration with Google Cloud services
Performance and Scalability	High performance, supported by AWS infrastructure	High availability and performance, supported by Azure infrastructure	Highly scalable Kubernetes clusters, supported by Google Cloud infrastructure
Security	VPC isolation, IAM roles, integration with AWS security services	Azure Active Directory integration, network security groups, Security Center integration	Automatic patches, network security, IAM integration
Support and Community	Large AWS community, extensive Amazon support	Azure community, Azure support team	Large Kubernetes community, Google Cloud support

What is Kubernetes?

Kubernetes is an open-source platform for automating the deployment, scaling, and management of containerized applications. Containers package applications and their dependencies to enable fast deployment and consistent execution. Kubernetes manages these containers across clusters of hosts and provides tools for scaling, managing, and monitoring containerized applications. In this post, we compare the most popular European Managed Kubernetes providers.

Enhanced Security for Your Business: The Benefits of a Cyber Risk Check

Wed, 13 Mar 2024 10:38:36 +0000

The digital transformation not only brings advantages but also new challenges in the field of cybersecurity. To address these challenges and ensure the security of your business, a Cyber Risk Check is essential. In this blog post, we explain the numerous benefits of a Cyber Risk Check and how ayedo can help you enhance your security standards.

What is a Cyber Risk Check?

A Cyber Risk Check is a comprehensive process for assessing a company’s IT security posture. It identifies vulnerabilities, assesses risks, and suggests measures for risk mitigation. The goal is to make the IT infrastructure more secure and resilient against cyber threats.

ISO 27001: The Gold Standard for Information Security – What Does It Mean for Your Business?

Sun, 10 Mar 2024 11:45:36 +0000

ISO 27001: The Gold Standard for Information Security – What Does It Mean for Your Business?

Today, more than ever, companies must protect their sensitive data from cyber threats while also meeting legal requirements. Information security plays a central role in this. This is where ISO 27001 comes in, the internationally recognized standard for Information Security Management Systems (ISMS). But what does this certification mean for your company?

Learning Together: The Kubernetes Book Club and Its Benefits

Sun, 25 Feb 2024 01:00:00 +0000

Learning about Kubernetes and the entire ecosystem of technologies surrounding it is not without challenges. In this article, we take a look at the Kubernetes Book Club, initiated by Carlos Santana. Here, we learn how it works and how anyone can participate to benefit from a community-driven learning experience.

The Path to the Kubernetes Book Club

Carlos Santana is an experienced Senior Specialist Solutions Architect at AWS with six years of production experience with Kubernetes. His journey led him through Knative to contributions to the Kubernetes Release Team. The Kubernetes Book Club originated from a casual idea during a TGIK livestream. It wasn’t just about reading a book, but about creating a learning community. This platform has established itself not only as a source of knowledge but also as a support system, especially during the challenging times of the pandemic.

Kubernetes vs OpenShift

Thu, 22 Feb 2024 11:30:36 +0000

Criterion	Kubernetes	OpenShift
Developer	Open-source project by Google, managed by the CNCF	Container platform developed by Red Hat, based on Kubernetes
Functionality	Basic container orchestration features like auto-scaling, load balancing, and service discovery	Advanced features and services like build and image management, application scaling, and security
Extensibility	Modular and extensible, supports a variety of add-ons and plugins	Extends Kubernetes with additional features and services, offers extra integrations and support
Community Support	Large and active community of developers and companies	Supported by Red Hat and the open-source community, offers additional enterprise support and integrations
Development and Operations Environment	Primarily focuses on container orchestration and management	Integrated development and operations environment, supports CI/CD pipelines and DevOps practices
Companies and Organizations	Commonly used by companies and organizations of all sizes and industries	Often used by companies and organizations with complex application environments and specific requirements
Support and SLAs	Support and services offered by various providers, no specific SLAs	Provides enterprise support and service-level agreements (SLAs) through Red Hat and partner companies

Kubernetes and OpenShift are two related but distinct technologies in the realm of container orchestration and container application management. Here are the main differences between Kubernetes and OpenShift:

Why Kubernetes?

Sat, 10 Feb 2024 11:30:36 +0000

Welcome to ayedo: Your Solution for Cost-Efficient Operation of SaaS Products with Kubernetes

As a software company, you know that operating Software-as-a-Service (SaaS) products can be a complex and demanding task. Deploying, scaling, and managing applications requires a professional infrastructure and an experienced team. This is where Kubernetes comes into play – the leading platform for container orchestration that helps you run your SaaS products efficiently and cost-effectively.

Kubernetes On-Premise

Sat, 27 Jan 2024 11:30:36 +0000

Deploying Kubernetes on-premise, in a private, self-managed infrastructure, can present several challenges that need to be addressed. Here are some of the key challenges and potential difficulties:

Infrastructure Complexity: Setting up and managing a Kubernetes infrastructure on-premise requires a certain level of technical expertise and an understanding of networks, storage, and compute resources. This can be particularly challenging for smaller companies or organizations that may not have the necessary expertise or resources.

Kubernetes vs Docker

Fri, 26 Jan 2024 11:30:36 +0000

Criterion	Kubernetes	Docker
Functionality and Purpose	Container orchestration platform for deploying, scaling, and managing container applications	Containerization platform for packaging, deploying, and running applications in containers
Level of Abstraction	Higher level of abstraction, focuses on managing containers and applications in a distributed environment	Lower level of abstraction, focuses on packaging applications in containers and running them
Management of Containers and Applications	Comprehensive platform for cluster management, service discovery, load balancing, auto-scaling, and rolling updates of applications	Tools for creating, managing, and running containers, but lacks advanced features for cluster management and distributed application management
Scope of Use	Often used in production environments for running container applications in cloud and hybrid cloud environments	Frequently used by developers and DevOps teams for local development and packaging applications in containers, also used in production environments
Example Products	Google Kubernetes Engine (GKE), Amazon Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS)	Docker Engine, Docker Desktop, Docker Hub

Kubernetes and Docker are two different technologies that are often used together because they both deal with container management. Here are the main differences between Kubernetes and Docker:

What is Docker

Sat, 20 Jan 2024 11:30:36 +0000

Docker is an open-source platform for containerizing applications. It allows developers to package applications and their dependencies into containers to ensure consistent deployment and execution across different environments. Docker has fundamentally changed the way applications are developed, deployed, and operated.

Here are the main components and concepts of Docker:

Container: A container is a standardized, isolated, and portable environment that includes an application and its dependencies. Docker uses containers to run applications in a consistent environment, regardless of the underlying infrastructure.

What is Kubernetes?

Fri, 19 Jan 2024 11:30:36 +0000

Kubernetes is a powerful open-source platform designed to simplify the management of container applications. To understand what Kubernetes is and what it is used for, it is helpful to first explain what containers are.

Containers are a type of software packaging that allows developers to bundle applications and all their dependencies into a single, isolated package. These containers are lightweight, portable, and consistent, meaning they can run consistently across different environments, regardless of the underlying operating systems or infrastructures.

The Art of Kubernetes Versions: A Behind-the-Scenes Look at the Release Group

Thu, 18 Jan 2024 01:00:00 +0000

Introduction

The Release Special Interest Group (SIG Release) is the heart of Kubernetes when it comes to releasing new features and bug fixes every four months. Have you ever wondered how such a large project like Kubernetes manages its schedule so efficiently? In this article, we take a look at the processes within the release team and how you can participate.

What Specifically Changes for Developers/DevOps Teams?

SIG Release plays a crucial role in the development and evolution of Kubernetes. The main goal of this group is to manage the release process of new Kubernetes versions. This occurs in a regular cycle, typically every three to four months. During this cycle, the Kubernetes release team works closely with other SIGs and contributors to ensure a smooth and well-coordinated release. This includes planning the release schedule, setting deadlines for code freezes and testing phases, and creating release artifacts such as binaries, documentation, and release notes.

Cal.com with Docker in the Hetzner Cloud

Fri, 12 Jan 2024 11:30:36 +0000

In this article, we demonstrate the fastest and most convenient way to self-host Cal.com with Docker in the Hetzner Cloud. With the help of Polycrate , you can access your own Cal.com instance on Hetzner in less than 5 minutes.

Your Cal.com instance allows numerous integrations with calendar and meeting tools, such as:

Zoom
Jitsi
MiroTalk
and more.

In this article, your Cal.com instance will be integrated with Microsoft 365 so you can immediately access your MS365 calendars and meetings.

Container Network Interface (CNI) in Kubernetes: Cilium's Role and Cisco's Acquisition of Isovalent

Mon, 01 Jan 2024 09:30:36 +0000

Welcome to a topic that is crucial for every Kubernetes user: the Container Network Interface (CNI). In this discussion, we not only explore the basics of CNIs but also delve into the specific role of Cilium, a leading CNI known for its advanced features and significance in modern Kubernetes implementations. Particularly interesting is the recent development in the CNI landscape – the acquisition of Isovalent, the Swiss company behind Cilium, by the American networking giant Cisco.

Contact

Mon, 01 Jan 2024 00:00:00 +0000

What Exactly Does OPNsense Do?

Thu, 28 Dec 2023 11:30:36 +0000

Network security is often neglected, even though it is of high importance! Both in the private and business sectors, often only one tool is used, and even then, it is often unknowingly:

The Firewall

A firewall is a fundamental security feature to protect your network from unauthorized access. It acts as a security barrier between a local and an external network, such as the Internet. Incoming and outgoing traffic is monitored, and based on predefined rules, the firewall decides which data packets need to be blocked. This packet inspection happens in real-time, checking parameters like source and destination IP addresses, ports, protocols, and other header information. If these parameters are on a blacklist (known as black-listing), such as access to an unwanted port, the rule-based filtering kicks in and blocks the packet. Additionally, the firewall logs accesses, providing the administrator with control over potential security incidents. A firewall is integrated into most modern routers, configured by default, and thus protects the user’s network.

What's the matter with matter?

Thu, 28 Dec 2023 11:30:36 +0000

In today’s world, where technology plays a central role in our daily lives, the idea of a connected home - a Smart Home - has gained significance. Smart Home devices, or IoT devices, allow us to control and automate lighting, heating, security systems, and much more over the internet. These are far from being just small quality of life changes - like starting the washing machine via smartphone - the Smart Home can do much more. For instance, it helps save energy by automatically lowering the blinds when a certain outside temperature is reached or regulates the heating more precisely than we could. Every time you hit the highway on your way to vacation, the same questions arise: Did we lock the front door? Is the small bathroom window still open? Do I need to ask the neighbor to check? Such questions can become a thing of the past thanks to smart door locks or window sensors.

Terms and Conditions

Tue, 26 Dec 2023 00:00:00 +0000

Note: Our Terms and Conditions are only available in German for legal reasons.

The German version is the legally binding document. Please find it at /agb/ or use the language switcher to access the German version.

Hinweis: Unsere Allgemeinen Geschäftsbedingungen sind aus rechtlichen Gründen nur auf Deutsch verfügbar.

Die deutsche Fassung ist das rechtlich verbindliche Dokument. Sie finden es unter /agb/ .

Kubernetes 1.29: Easily Modify Volume Attributes – A Developer's Advantage!

Mon, 18 Dec 2023 01:00:00 +0000

The release of Kubernetes 1.29 introduces an exciting new feature: an alpha capability that allows volumes to be modified by changing the volumeAttributesClassName set for a PersistentVolumeClaim (PVC). This feature significantly simplifies the management of volume attributes, as changes can now be made directly through Kubernetes rather than having to manage them through various vendor APIs.

VolumeAttributesClass

The new API group storage.k8s.io/v1alpha1 offers two new types:

VolumeAttributesClass
Represents a specification of mutable volume attributes defined by the CSI driver. This class can be specified during the dynamic provisioning of PersistentVolumeClaims and altered in the PVC specification after provisioning.

The ABCs of OpenTelemetry: From Basics to Integration

Sat, 25 Nov 2023 11:30:36 +0000

In a complex IT landscape, monitoring and understanding application performance can become a real challenge. The open-source framework OpenTelemetry offers a unified solution for monitoring and observability, enabling developers and DevOps to gain comprehensive insights into their applications. This article guides you through the basics, shows you why OpenTelemetry is important, and helps you take the first steps towards implementing this versatile framework into your technology stack.

What is OpenTelemetry?

OpenTelemetry is an open standard framework specializing in the observability of software applications. It serves as an abstraction layer for your applications and tools that you use for monitoring, tracing, and logging. By utilizing standardized APIs and SDKs, OpenTelemetry enables the generation, collection, transformation, and export of data, simplifying the analysis of software performance. Essentially, OpenTelemetry allows developers and DevOps teams to gain a comprehensive overview of their application landscape without being tied to a specific observability tool.

Kubernetes Resource Limits: The Balancing Act Between Predictability and Efficiency

Sun, 19 Nov 2023 01:00:00 +0000

There is a lot of discussion about whether not using Kubernetes resource limits could actually be beneficial (for example, in articles like For the Love of God, Stop Using CPU Limits on Kubernetes or Kubernetes: Make your services faster by removing CPU limits ). The arguments are certainly valid—it makes little sense to pay for computing power that goes unused due to restrictions or to artificially increase latency. However, this article aims to demonstrate that limits have their legitimate advantages.

Zero-Downtime Deployments with Docker Swarm and Portainer - Part 2/2

Sun, 05 Nov 2023 10:37:00 +0000

What have we achieved so far?

In Part 1 , we explored the differences between rolling updates and zero-downtime deployments. We then prepared our stack to perform a zero-downtime deployment.

In this part, we will look at how we can update our application via Portainer . We will trigger an update automatically via GitHub, so we don’t have to do anything in Portainer .

Behind the Scenes: A Look at the Kubernetes Contributor Summit 2023

Sun, 05 Nov 2023 01:00:00 +0000

Every year, just before the official opening of KubeCon+CloudNativeCon, a very special event takes place that holds a special place in the hearts of organizers and participants: the Kubernetes Contributor Summit. To find out why this is the case and to get a behind-the-scenes look, we interviewed Noah Abrahams, who served as a co-chair of the Kubernetes Contributor Summit 2023.

Frederico Muñoz (FSM): Hello Noah and welcome. Could you please introduce yourself and tell us how you got involved with Kubernetes?

Gateway API v1.0: A Milestone for Kubernetes Routing

Fri, 03 Nov 2023 01:00:00 +0000

We are excited to announce the release of Gateway API v1.0 on behalf of the Kubernetes SIG Network! This release marks a significant milestone for the project. Several core APIs have reached “generally available” (GA) status, while other major features have been included in the experimental channel.

What’s New?

Graduation to v1

This release includes the graduation of Gateway , GatewayClass , and HTTPRoute to v1. This means they are now generally available (GA). This API version indicates a high level of confidence in the API surface and offers guarantees for backward compatibility. Note that the version of these APIs included in the standard channel is now considered stable, but this does not mean they are complete. These APIs will continue to receive new features through the experimental channel as they meet the criteria for graduation. For more information, see the Gateway API Versioning Policy .

Successful Transition: ingress2gateway for an Easy Migration to the Gateway API

Sat, 28 Oct 2023 02:00:00 +0000

Today, we introduce ingress2gateway , a tool that assists you in migrating from Ingress to the Gateway API . The Gateway API is on the verge of its GA release—so if you haven’t made the switch yet, now is the perfect time!

Background

In the ever-evolving world of Kubernetes, networking technology plays a crucial role. With the increasing number of applications in Kubernetes clusters, effectively delivering these services to clients becomes a critical challenge. If you are already working with Kubernetes, you are likely familiar with the Ingress API , which serves as the standard solution for external access to services.

What Exactly is an Internal Developer Platform?

Wed, 25 Oct 2023 11:30:36 +0000

Efficiency and scalability are often critical factors for the success of a project in the fast-paced world of software development. A technology that is gaining increasing importance in this context is the Internal Developer Platform (IDP). But what exactly is it, and why should you and your company be interested? In this post, we delve into the basics and benefits of Internal Developer Platforms and provide guidance for selecting the right solution.

Kubernetes Contributor Summit 2023: A Reunion in Shanghai

Mon, 23 Oct 2023 02:00:00 +0000

On September 26, 2023, nearly 50 contributors gathered for the Kubernetes Contributor Summit in Shanghai, as part of the KubeCon + CloudNativeCon + Open Source Summit China 2023 .

This was the first in-person meeting in China after three years of the pandemic.

A Joyful Gathering

The event kicked off with welcome speeches from Kevin Wang of Huawei Cloud, one of the co-chairs of KubeCon, and Puja from Giant Swarm.

Kubernetes in the Air Gap: How to Start a Cluster Without Internet

Sun, 15 Oct 2023 02:00:00 +0000

Ever wonder how software gets deployed onto a system that is deliberately disconnected from the Internet and other networks? These systems are often isolated from the Internet due to their sensitive nature. This includes utilities (electricity/water), banks, healthcare, weapon systems, and other government applications. Sometimes it’s even a moat, like when running Kubernetes on an underwater vehicle. Yet, these environments still need to be operated with software. This concept of deployment in an isolated state describes what it means to deploy to the other side of an air gap .

Single Sign-On (SSO): What Exactly Are OAuth, OpenID, SAML, and SCIM?

Tue, 10 Oct 2023 11:30:36 +0000

In the digitally connected world, constantly logging into various services is more than just a nuisance—it’s a challenge for data security and user experience. An advanced solution to this dilemma is Single Sign-On technology (SSO). It allows users to log in once and gain access to multiple services without needing to enter separate credentials for each service.

However, behind SSO are various protocols and technologies responsible for its seamless operation. In this post, we will take a closer look at these technologies, particularly OAuth, OpenID, SAML, and SCIM. These concepts play a central role in the implementation and management of Single Sign-On solutions.

Container Orchestration: What's the Difference Between Docker Swarm and Kubernetes?

Mon, 09 Oct 2023 09:30:36 +0000

In modern software development, container orchestration is no longer an unfamiliar term but an essential tool for DevOps teams. It enables efficient management, distribution, and scaling of container instances. However, when it comes to choosing the right orchestration platform, many face a decision: Docker Swarm or Kubernetes ?

Both technologies have their own advantages, weaknesses, and use cases. But which one is right for your project? In this post, we delve into both orchestration tools in detail, compare their features, and provide you with solid criteria to help you make the best decision for your requirements.

User Namespaces: Stateful Pods Now Available in Kubernetes 1.28!

Sat, 16 Sep 2023 02:00:00 +0000

Kubernetes v1.25 introduced support for user namespaces only for stateless Pods. With Kubernetes 1.28, this limitation has been lifted following some design changes made in version 1.27.

The beauty of this feature lies in the fact that:

it can be adopted effortlessly (just set a boolean field in the Pod specification)
no changes are required for most applications
security is drastically improved by enhancing container isolation and mitigating CVEs rated HIGH and CRITICAL.

This post explains the basics of user namespaces and demonstrates:

Zero-Downtime Deployments with Docker Swarm and Portainer - Part 1/2

Sun, 10 Sep 2023 13:37:00 +0000

Zero-downtime deployments with Docker Swarm and Portainer Part 1/2

What are Zero-downtime deployments?

Before we dive into the details, let’s clarify what Zero-downtime deployments are. Zero-downtime deployments are deployments that have no downtime. This means that the application being deployed is not offline during the deployment. This is especially important for applications that need to run 24/7. The high availability of applications is becoming increasingly important. Let’s be honest, who wants to wait when Netflix and others update their applications?

Attention: Legacy Kubernetes Package Repositories Are Being Frozen!

Sun, 03 Sep 2023 02:00:00 +0000

On August 15, 2023, the Kubernetes project announced the general availability of the community-managed package repositories for Debian and RPM packages under pkgs.k8s.io. These new repositories replace the outdated, Google-hosted package repositories: apt.kubernetes.io and yum.kubernetes.io. The announcement post for pkgs.k8s.io highlighted that we will no longer publish packages to the old repositories in the future.

Today, we officially announce the deprecation of the old package repositories (apt.kubernetes.io and yum.kubernetes.io) and inform you about our plans to freeze the content of these repositories on September 13, 2023.

Kubernetes Garbage Collection: Cleaning Up Terminating Pods

Thu, 17 Aug 2023 10:38:36 +0000

Operating your apps in Kubernetes is a breeze with ayedo. However, sometimes the built-in tools aren’t enough to ensure the smooth operation of your applications. In this article, we introduce a handy little life hack related to terminating pods. Don’t have a Kubernetes cluster yet?

With ayedo Fleet , you can test Kubernetes for 30 days free of operational headaches. Give it a try.

The CronJob:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: garbage-collector-cronjob
  namespace: kube-system
spec:
  schedule: '*/1 * * * *'
  concurrencyPolicy: Forbid
  suspend: false
  jobTemplate:
    metadata:
      creationTimestamp: null
    spec:
      parallelism: 1
      completions: 1
      backoffLimit: 0
      template:
        metadata:
          creationTimestamp: null
        spec:
          volumes:
            - name: scripts
              configMap:
                name: garbage-collector-cm
                defaultMode: 320
          containers:
            - name: garbage-collector
              image: alpine/k8s:1.25.12
              command:
                - /scripts/remove-evicted-pods-all-ns.sh
              resources: {}
              volumeMounts:
                - name: scripts
                  mountPath: /scripts
              terminationMessagePath: /dev/termination-log
              terminationMessagePolicy: File
              imagePullPolicy: IfNotPresent
          restartPolicy: Never
          terminationGracePeriodSeconds: 30
          dnsPolicy: ClusterFirst
          securityContext: {}
          schedulerName: default-scheduler

And the corresponding ConfigMap:

Docker Swarm on Hetzner Cloud in 3 Steps

Tue, 11 Jul 2023 10:38:36 +0000

With ayedo, running your apps in Kubernetes is a breeze. With Docker Swarm, we offer a production-ready alternative to Kubernetes for those who are comfortable with Docker’s abstractions but need more availability and scalability. With the ayedo Fleet Custom Edition , you can enjoy Docker Swarm without the operational headaches. Try it out .

We love Kubernetes. It’s just our thing. Nevertheless, many companies still rely on Docker Swarm for orchestrating their container workloads, and rightly so. Docker Swarm is less flexible than Kubernetes in many ways, but definitely less complex—making it the ideal candidate for beginners in the world of distributed container workloads. Docker Swarm extends the syntax and semantics of the already familiar Docker commands with a concept of Services and Stacks to make replicated workloads jointly manageable.

Mattermost Self-Hosted: SSO with Authentik as IDP in the Free Version

Tue, 04 Jul 2023 12:40:00 +0000

Mattermost is used in many companies as a central communication platform. It is comparable to Microsoft Teams or Slack. So, what sets Mattermost apart from other communication platforms? Mattermost is fundamentally free. Additionally, you can run the open-source software on your own servers, which is a crucial criterion for some companies, keyword: Compliance.

A major drawback of the free version of Mattermost is the limitation to authenticate only via GitLab SSO if you want more than users in the Mattermost internal DB. If your company uses GitLab as the central user management, this poses no problem. However, most companies use dedicated IDPs (Identity Providers) like Keycloak, Authentik , or Auth0.

Secure Container Images: How to Verify Digital Signatures in Kubernetes

Sun, 02 Jul 2023 02:00:00 +0000

Introduction

The Kubernetes community took a significant step with version v1.24 by digitally signing their container image-based artifacts. With the transition of the corresponding enhancement from alpha to beta in v1.26, signatures for binary artifacts were also introduced. This has inspired other projects to implement image signatures for their releases as well. But how can these signatures be effectively verified?

Changes for Developers and DevOps Teams

For developers and DevOps teams, this means they now have the ability to automatically sign container images and verify these signatures. This can be done either within their own CI/CD pipelines, for example, through GitHub Actions, or via the Kubernetes image promotion process, which automatically handles the signing. The prerequisite is that the project is part of the kubernetes or kubernetes-sigs GitHub organization.

Kubernetes: Understanding Liveness and Readiness Probes

Sat, 01 Jul 2023 10:38:36 +0000

Probes are checks that the Kubelet of a node performs on or against a Pod to verify its status.

Using probes, you can check, for example, whether the container is listening on a specific port or whether programs running in the container return a specific exit code.

The result of a probe is interpreted by the Kubelet and triggers certain lifecycle events of a Pod. For instance, if a probe fails, it can signal the Kubelet to restart the Pod.

Kubernetes 1.27: Adjust Resources Dynamically – Without Restarting Pods!

Mon, 15 May 2023 02:00:00 +0000

In the latest version of Kubernetes, v1.27, there’s an exciting new feature: the ability to adjust CPU and memory resources for running pods without needing to restart them. This is a significant relief for developers and DevOps teams who often face the challenge of dynamically managing their application’s resources.

What Specifically Changes for Developers/DevOps Teams?

Previously, adjusting resources for pods was a disruptive action requiring a restart. With the introduction of the new alpha feature in Kubernetes v1.27, you can now simply change the resources fields in a pod’s containers by patching the specification of the running pod. This reduces downtime and increases the efficiency of your applications.

Kubernetes 1.27: Enhanced Memory Management Features for Your Containers

Mon, 08 May 2023 02:00:00 +0000

Kubernetes v1.27, released in April 2023, introduces improvements in Memory QoS (alpha), enabling more efficient memory management on Linux nodes.

Support for Memory QoS was initially introduced in Kubernetes v1.22, with some limitations identified later regarding the calculation of memory.high. These limitations have now been addressed in Kubernetes v1.27.

Background

Kubernetes allows you to optionally specify how much of each resource a container requires in the Pod specification. The most common resources are CPU and memory.

Five Key Features of Portainer

Sun, 07 May 2023 11:30:36 +0000

Five Key Features of Portainer

As mentioned in the previous blog post , Portainer is a powerful tool that graphically represents and simplifies all Docker functions. Beyond the features known from Docker, Portainer offers several additional features that make managing Docker containers even easier.

In this blog post, I would like to introduce five of these features.

Kubernetes Enhances the Official CVE Feed: What Developers Should Know

Fri, 28 Apr 2023 02:00:00 +0000

Since the introduction of the auto-refreshing official CVE feed as an alpha feature in version 1.25, we have made significant improvements and updates. We are pleased to announce the release of the beta version of the feed. In this blog post, we will discuss the feedback received, the changes made, and the ways to support this as we prepare to make it a stable feature in a future Kubernetes release.

Feedback from End Users

The SIG Security team received some feedback from end users:

Why You Should Use Portainer Instead of the Console: Introduction and Quick Start

Mon, 10 Apr 2023 11:30:36 +0000

For those who want to get started right away, here’s the link to the practical section

Why This Post?

I’ve often noticed that many people shy away from the command line. This is not particularly surprising, as the command line requires a certain level of technical understanding and can be intimidating, especially for newcomers and inexperienced users. After all, many technologies offer a graphical user interface (GUI) in addition to the command line, which is often perceived as more intuitive.

The Art of Forensic Analysis of Kubernetes Containers

Mon, 13 Mar 2023 01:00:00 +0000

In my previous article, I introduced the topic of Checkpointing in Kubernetes and explained how it can be set up. This time, I want to show you how to analyze the created checkpoints. Checkpointing is currently still an alpha feature in Kubernetes, and this article provides a preview of what this feature might look like in the future.

Preparation

Details on configuring Kubernetes and the underlying CRI implementation to enable support for Checkpointing can be found in my previous article.

KWOK: Revolutionize Your Kubernetes Testing in Seconds!

Sat, 04 Mar 2023 01:00:00 +0000

Have you ever wondered how to set up a cluster of thousands of nodes in seconds, simulate real nodes with low resource requirements, and test your Kubernetes controllers at scale without spending much on infrastructure?

If you answered “Yes” to any of these questions, KWOK might be just what you need. It’s a toolkit that allows you to create a cluster of thousands of nodes in seconds.

The Security of Microservices: Identifying and Protecting Against Vulnerabilities

Mon, 23 Jan 2023 01:00:00 +0000

In today’s digital world, cyber-attacks are more complex than ever. Companies providing cloud services continuously invest in security measures, yet the number of cyber incidents continues to rise. It is becoming increasingly clear that the idea of developing completely secure and vulnerability-free microservices is naive. The first step to improving your security strategy is to accept: Your services are vulnerable!

What Specifically Changes for Developers/DevOps Teams?

Recognizing that all microservices are vulnerable is crucial. It is important for developers and DevOps teams not only to follow security best practices but also to understand that vulnerabilities can always be present. This means that a reactive approach to security monitoring and analysis is essential.

Protect Your Most Important Pods from Eviction with PriorityClass!

Sun, 15 Jan 2023 01:00:00 +0000

Kubernetes has established itself as a leading orchestration engine used by many organizations to efficiently manage workloads. Proper pod scheduling is crucial to ensure that application pods run smoothly within the Kubernetes cluster. In this article, we explore how the PriorityClass object is used to protect mission-critical or high-priority pods from eviction, ensuring they remain available and continue to serve traffic.

Resource Management in Kubernetes

The Kubernetes Control Plane consists of several components, with the scheduler (typically the built-in kube-scheduler ) being one of the most important. It is responsible for assigning a node to a pod.

Kubernetes v1.26: Revolutionary Improvements in Traffic Management

Mon, 02 Jan 2023 01:00:00 +0000

Kubernetes v1.26 brings significant advancements in network traffic management. Two features, support for internal traffic policy for Services and endpoint slice termination conditions, have been promoted to General Availability (GA). A third feature, proxy for terminating endpoints, has reached Beta status. These improvements aim to address challenges in traffic management and open new possibilities for the future.

Traffic Loss through Load Balancers during Rolling Updates

Before Kubernetes v1.26, clusters could experience traffic loss through Service Load Balancers during rolling updates when the externalTrafficPolicy field was set to Local. To understand this, a brief overview of how Kubernetes manages Load Balancers is helpful!

Kubernetes 1.26: Efficient Job Tracking for Massive Batch Workloads!

Sun, 01 Jan 2023 01:00:00 +0000

The release of Kubernetes 1.26 introduces a stable implementation of the Job controller, which reliably tracks a large number of highly parallel jobs. The teams from SIG Apps and WG Batch have been working on this fundamental improvement since Kubernetes 1.22. After several iterations and scalability reviews, this is now the default implementation of the Job controller.

In combination with the indexed completion mode , the Job controller can manage massively parallel batch jobs and supports up to 100,000 concurrent Pods.

Kubernetes v1.26: More Flexible Authentication for Container Registries

Sun, 25 Dec 2022 01:00:00 +0000

Kubernetes v1.26 introduces an exciting new feature: the general availability (GA) of Kubelet Credential Provider Plugins . This extensible plugin framework allows developers to dynamically retrieve credentials for any container image registry.

What Specifically Changes for Developers/DevOps Teams?

Before Kubernetes v1.20, developers relied on Kubelet authentication being available only for certain specific container registries like Amazon Elastic Container Registry (ECR), Azure Container Registry (ACR), and Google Cloud Container Registry (GCR). Starting with v1.20, alpha support for Kubelet Credential Provider Plugins was introduced, enabling the dynamic retrieval of credentials for any container registry.

Kubernetes 1.26: Revolutionary Validation Policies for Admissions

Fri, 23 Dec 2022 01:00:00 +0000

In Kubernetes 1.26, the first alpha version of Validating Admission Policies is available! These new policies utilize the Common Expression Language (CEL) and offer a declarative, in-process alternative to the existing validating admission webhooks .

CEL was originally introduced for validation rules for CustomResourceDefinitions in Kubernetes. This extension significantly broadens the use of CEL and supports a much wider range of use cases for admission.

What specifically changes for developers/DevOps teams?

Admission webhooks can pose a significant challenge for developers and DevOps teams. They not only have to implement and maintain a webhook binary but also ensure it is always available. If a webhook times out or is unreachable, it can lead to a failure of the Kubernetes control plane. With the new Validating Admission Policies, this complex process is greatly simplified by embedding CEL expressions directly into Kubernetes resources.

Kubernetes 1.26: The Device Manager is Now Ready for Everyone!

Thu, 22 Dec 2022 01:00:00 +0000

Introduction

With the release of Kubernetes 1.26, the Device Manager is now generally available! This feature, originally introduced in Kubernetes v1.8, allows developers to efficiently discover, offer, and assign external devices without altering the core Kubernetes system. This is a significant step that opens up new possibilities for both developers and DevOps teams.

What Specifically Changes for Developers/DevOps Teams?

The Device Manager enables seamless communication with so-called Device Plugins via gRPC. These plugins act as servers, allowing the kubelet to connect with them to discover devices and offer them as extended resources. By registering with the kubelet, the Device Manager becomes part of the Kubernetes ecosystem, enabling the management of external devices such as GPUs, FPGAs, and more.

Dynamic Resource Allocation in Kubernetes 1.26: Flexibility for Developers

Sun, 18 Dec 2022 01:00:00 +0000

Introduction

In the latest version of Kubernetes 1.26, there is an exciting new feature: the Alpha API for dynamic resource allocation. This feature allows developers to request resources more flexibly and specifically. The extension is a generalization of the API for persistent storage and opens up new possibilities in handling resources in containers.

What specifically changes for Developers/DevOps Teams?

Dynamic resource allocation allows the same resource instance to be used across different Pods and containers. Additionally, specific constraints can be attached to resource requests to obtain exactly the resources needed. This significantly improves resource efficiency and utilization.

Now Available: HostProcess Containers for Windows in Kubernetes 1.26

Fri, 16 Dec 2022 01:00:00 +0000

The long-awaited day has arrived: HostProcess containers, the Windows counterpart to Linux privileged containers, are finally generally available in Kubernetes 1.26!

What are HostProcess Containers and Why are They Useful?

Cluster operators often face the challenge of configuring their nodes during deployment, such as installing Windows services, configuring registry keys, managing TLS certificates, making network configuration changes, or even deploying monitoring tools like the Prometheus Node-Exporter. Until now, these tasks on Windows nodes were typically performed by running PowerShell scripts via SSH or WinRM sessions and/or using the cloud provider’s management tools.

Secure Container Analysis: Forensic Checkpointing in Kubernetes

Thu, 08 Dec 2022 01:00:00 +0000

Forensic container checkpointing is based on Checkpoint/Restore In Userspace (CRIU) and allows for the creation of stateful copies of a running container without the container being aware of it. This copy can be analyzed and restored multiple times in a sandbox environment without the original container knowing. Forensic container checkpointing was introduced as an alpha feature in Kubernetes v1.25.

How does it work?

With the help of CRIU, it is possible to checkpoint and restore containers. CRIU is integrated into runc, crun, CRI-O, and containerd, and the forensic container checkpointing as implemented in Kubernetes leverages these existing CRIU integrations.

Kubernetes and OpenTelemetry: The Secret Weapon for Better Container Monitoring

Sun, 04 Dec 2022 01:00:00 +0000

Introduction

In the world of cloud-native technologies, OpenTelemetry (OTEL) is often cited as the key to enhancing application monitoring. This innovative solution allows logs, metrics, and traces to be combined into a comprehensive picture. But how can Kubernetes leverage this technology to improve visibility in container runtime environments?

What specifically changes for developers/DevOps teams?

Kubernetes is a complex system composed of various components that are either independent or interconnected. To simplify monitoring, OpenTelemetry is now also integrated into Kubernetes. This integration means that developers and DevOps teams gain better insight into the state of their clusters. Instead of relying on sifting through logs and metrics, they can now use consolidated information to identify and resolve issues more quickly.

Infrastructure as Code: The DevOps Standard

Mon, 28 Nov 2022 16:38:36 +0000

Infrastructure as Code (IaC) supports DevOps best practices by facilitating the creation of repeatable infrastructure environments using a declarative language. This article explores what IaC is, the benefits it offers from a DevOps perspective, and some of the most popular IaC tools available today.

If you’re a DevOps engineer looking to advance your career, you’ve probably heard of Infrastructure as Code (IaC). Infrastructure as Code has emerged as a key component of the DevOps movement, which aims to improve communication and collaboration between development and operations teams.

German Administrative Cloud Strategy: Focus on Kubernetes, Containers, and DevOps

Thu, 17 Nov 2022 10:38:36 +0000

The IT Planning Council adopts the document “German Administrative Cloud Strategy: Framework for Target Architecture 2.0”.

Download PDF

TL;DR

The German Administrative Cloud should primarily consist of Open Source components
All participants must implement and adhere to the defined standards
Providers of solutions for the German Administrative Cloud must
- deliver their services within German jurisdiction
- provide Container-as-a-Service platforms based on Kubernetes
- implement DevOps approaches like Continuous Integration and Continuous Deployment
- ensure the portability of services between different providers
Central service components developed by participants of the German Administrative Cloud should be made available to all participants via OpenCoDE

Overview

The IT Planning Council acts as the central political steering committee between the federal and state governments on issues of information technology and the digitalization of administrative services. It promotes and develops joint user-oriented IT solutions, paving the way for efficient, secure, and well-networked digital administration in Germany.

Kubernetes v1.25: Security with User Namespaces for Pods

Thu, 06 Oct 2022 02:00:00 +0000

Kubernetes v1.25 introduces a significant new feature: support for user namespaces. This functionality allows for secure workloads in Kubernetes by restricting each pod to a limited set of available UIDs and GIDs on the system. This adds an additional layer of security to protect pods running on the same system.

What Changes for Developers/DevOps Teams?

With the new support for user namespaces, developers and DevOps teams can deploy more secure applications. Each pod runs in its own environment with unique IDs, reducing the risk of security incidents. In particular, it becomes possible to run workloads as root without compromising the host. This isolation is especially valuable in multi-tenant environments where different teams or applications operate on the same cluster.

Kubernetes 1.25: Stability for StatefulSets and DaemonSets in Rollout

Sun, 18 Sep 2022 02:00:00 +0000

Introduction

With the release of Kubernetes 1.25, there are exciting updates for developers and DevOps teams: Two important features, minReadySeconds for StatefulSets and maxSurge for DaemonSets, have reached “stable” status. These changes improve the handling of rollouts and increase application availability.

What specifically changes for developers/DevOps teams?

The new stable features offer developers enhanced control over the rollout process of StatefulSets and DaemonSets. minReadySeconds allows teams to ensure that a Pod is ready for a specified time before it is considered available. At the same time, maxSurge enables multiple instances of a Pod to run on a node during a rollout, minimizing downtime.

Stay Secure: Keep an Eye on the New Automatic CVE Feed for Kubernetes

Thu, 15 Sep 2022 02:00:00 +0000

A long-standing wish of the Kubernetes community has been to create a programmatic way to track security issues in Kubernetes (also known as “CVEs”). With the release of Kubernetes v1.25, we are pleased to announce the availability of such a feed as an alpha feature. In this blog post, we will explore the background and scope of this new service.

Motivation

With the increasing focus on Kubernetes, the number of CVEs associated with Kubernetes has also risen. Although most CVEs that directly, indirectly, or transitively affect Kubernetes are regularly addressed, there is no single place where Kubernetes end users can programmatically subscribe to or retrieve data on resolved CVEs. The current options are either flawed or incomplete.

Build your own developer platform on Kubernetes with Otomi

Sun, 28 Aug 2022 10:38:36 +0000

Building cloud native software and running it in production is quite a challenge these days. Besides getting the architecture of your software right, you have to deal with things like cloud infrastructure, CI/CD and a whole lot of security concerns – especially if you build your software in teams. Our work at ayedo is focused on helping you get the latter part right with our managed Kubernetes and Applications offerings. One of these applications is Otomi – a self-hosted PaaS that enables organizations to build their own developer platform on top of Kubernetes.

Kubernetes v1.25: Pod Security Becomes the New Norm

Sun, 28 Aug 2022 02:00:00 +0000

The release of Kubernetes v1.25 marks a significant milestone for pod security controls: the Pod Security Admission Controller (PSA) has reached “stable” status, while the Pod Security Policy (PSP) has been removed. PSP was deprecated in Kubernetes v1.21 and no longer functions in Kubernetes v1.25 and beyond.

The Pod Security Admission Controller replaces the Pod Security Policy and simplifies the enforcement of predefined Pod Security Standards by simply adding a label to a namespace. The Pod Security Standards are maintained by the K8s community, meaning you automatically receive updated security policies when new security-related features are introduced in Kubernetes.

PodSecurityPolicy: From Inception to Deprecation – A Retrospective

Fri, 19 Aug 2022 02:00:00 +0000

The PodSecurityPolicy (PSP) was removed with Kubernetes v1.25. This decision was previously announced in the blog post PodSecurityPolicy Deprecation: Past, Present, and Future . In this article, we take a look at the inception and evolution of the PSP, explain why it never became stable, and show why it was replaced by the Pod Security Admission Control.

The Inception of PodSecurityPolicy

The PodSecurityPolicy has its roots in the SecurityContextConstraints (SCC) of OpenShift, which were implemented in the first version of the Red Hat OpenShift Container Platform, even before the release of Kubernetes 1.0. The PSP was a simplified version of the SCC.

Kubernetes Updates: How the Enhancement Team Shapes the Future

Sun, 14 Aug 2022 02:00:00 +0000

Did you know that Kubernetes v1.24 includes a total of 46 enhancements ? In just four months, the team has integrated an impressive number of new features into the system. The Kubernetes Release Team handles the logistical tasks of such a release, from fixing test issues to publishing updated documentation. It’s a lot of work, but it is always successfully managed.

The Release Team consists of about 30 people divided into six sub-teams: Bug Triage, CI Signal, Enhancements, Release Notes, Communications, and Docs. Each of these teams manages a part of the release. In this article, we want to focus particularly on the role of the Enhancements Team and show you how you can get involved.

Documentation in the Spotlight: How SIG Docs Drives Kubernetes Forward

Fri, 05 Aug 2022 02:00:00 +0000

Introduction

The official documentation is the central resource for any open-source project. For Kubernetes, this is a continuously growing Special Interest Group (SIG) where dedicated members work to make information easily accessible for new contributors and users. SIG Docs publishes the official documentation on kubernetes.io , which includes, among other things, documentation of core APIs, architectural details, and CLI tools that are released with Kubernetes versions.

To learn more about the work of SIG Docs and their future plans to shape the community, I summarized my conversations with the co-chairs Divya Mohan (DM), Rey Lejano (RL), and Natali Vlatko (NV). They explained the goals of the SIG and how other contributors can help.

Kubernetes 1.24: Structured Logs for Enhanced Clarity

Sat, 28 May 2022 02:00:00 +0000

The Working Group for Structured Logging has introduced new features to the logging infrastructure in Kubernetes 1.24. In this article, you’ll learn how developers can leverage these to make log outputs more useful and how they can actively participate in improving Kubernetes.

Structured Logging

The goal of structured logging is to replace C-style formatting and the resulting opaque log strings with log entries that have a clearly defined syntax for separately storing messages and parameters, for instance, as a JSON structure.

Kubernetes 1.24: The Revolution in Storage Management is Here!

Mon, 09 May 2022 02:00:00 +0000

The release of Kubernetes 1.24 introduces Storage Capacity Tracking as a generally available feature. This innovation enables developers and DevOps teams to better manage and monitor the capacity of their storage resources.

What specifically changes for developers/DevOps teams?

With the new Storage Capacity Tracking, CSI drivers (Container Storage Interface) can provide information about the remaining storage capacity. The kube-scheduler uses this information to select appropriate nodes for Pods that still require volumes.

Security Boost for Ingress-NGINX: How the New Version Protects Your Kubernetes Applications

Sun, 01 May 2022 02:00:00 +0000

The Ingress is one of the most frequently targeted components in Kubernetes. An Ingress typically defines an HTTP reverse proxy exposed to the internet and contains multiple websites. Additionally, it has privileged access to the Kubernetes API, for example, to read Secrets for TLS certificates and their private keys.

Although this is a risky component in your architecture, it remains the most popular way to properly expose your services.

Ingress-NGINX was part of security assessments that pointed to a major issue: we do not perform all necessary sanitation measures before converting the configuration into an nginx.conf file, which can lead to information leaks.

Two Years of SIG Node CI: On the Path to More Stable Kubernetes Tests

Sat, 19 Feb 2022 01:00:00 +0000

Ensuring the reliability of SIG Node upstream code is a continuous effort that takes a lot of behind-the-scenes effort from many contributors. There are frequent releases of Kubernetes , base operating systems, Container runtimes, and test infrastructures, leading to a complex matrix that requires attention and continuous investment to “keep the lights on.”

In May 2020, the Kubernetes Node Special Interest Group (“SIG Node”) organized a new subproject for continuous integration (CI) for node-related code and tests. Since its inception, the SIG Node CI subproject has held weekly meetings, and even a full hour often isn’t enough to address all the bugs, test-related PRs, and issues, and to discuss all ongoing work within the group.

Multicluster: The Future of Kubernetes Beyond Cluster Boundaries

Thu, 10 Feb 2022 01:00:00 +0000

Introduction

The SIG Multicluster is the Special Interest Group focused on applying Kubernetes concepts beyond the confines of a single cluster. Traditionally, Kubernetes resources interact only within these boundaries. With the growing prevalence of multicloud and multicluster deployments, the work of SIG Multicluster is becoming increasingly significant. In this blog, Jeremy Olmsted-Thompson from Google and Chris Short from AWS discuss the exciting challenges SIG Multicluster addresses and how you can get involved.

What Specifically Changes for Developers/DevOps Teams?

Over the past few years, SIG Multicluster has evolved to tackle specific issues arising from managing multiple Kubernetes clusters. A central concern is the communication between workloads distributed across multiple clusters. Previously, the focus was more on anticipating potential problems, whereas now, concrete solutions are being developed.

Keeping an Eye on Secure Containers: Detecting Container Drift with Admission Controllers

Fri, 24 Dec 2021 01:00:00 +0000

At Box, we use Kubernetes (K8s) to manage hundreds of microservices that enable us to stream data at petabyte scale. As part of our deployment process, we employ kube-applier as part of our GitOps workflows with declarative configuration and automated deployments. Developers declare their K8s applications in a Git repository, which requires code review and automated checks before changes can be merged and applied to our K8s clusters. However, with kubectl exec and similar commands, developers can directly interact with running containers and alter them from their deployed state. This interaction could undermine the change and code review processes enforced in our CI/CD pipelines. Moreover, it allows such affected containers to continue receiving traffic in the production environment over the long term.

Rethinking Security: The Latest Features of Security Profiles Operator v0.4.0

Mon, 20 Dec 2021 01:00:00 +0000

The Security Profiles Operator (SPO) is a pivotal extension for Kubernetes, significantly simplifying the management of seccomp , SELinux , and AppArmor profiles. We are excited to announce the release of v0.4.0, which brings numerous new features, improvements, and bug fixes.

What’s New?

It’s been a while since the last release v0.3.0. Over the past six months, we’ve made over 290 commits to add new features, optimize existing ones, and overhaul our documentation.

A highlight is the ability to record seccomp and SELinux profiles using the log enricher. This reduces the dependencies required for profile recording to the presence of auditd or syslog (as a fallback) on the nodes. All profile recordings in the operator function uniformly via the ProfileRecording CRD and the corresponding label selector . The log enricher can also be used to gain valuable insights into seccomp and SELinux messages from a node. For more information, see the official documentation .

Storage Quality in Kubernetes: How to Optimize Your Resources

Mon, 29 Nov 2021 01:00:00 +0000

Kubernetes v1.22, released in August 2021, introduces a new alpha feature that enhances how Linux nodes manage memory resources. This advancement marks a significant step forward for developers and DevOps teams in resource management.

What Specifically Changes for Developers/DevOps Teams?

In previous versions, Kubernetes did not support quality guarantees for memory. This meant there could be issues when allocating memory resources, especially if containers exceeded their limits. With the introduction of Memory QoS (Quality of Service), you can now ensure that critical processes are always allocated sufficient memory.

Docker Integration in Kubernetes: What Does the Removal of Dockershim Mean for You?

Mon, 15 Nov 2021 01:00:00 +0000

Introduction

The Kubernetes community is facing a significant change: the removal of the Dockershim component is imminent. This part of Kubernetes, which allows integrated use of the Docker Engine, will soon no longer be supported. But don’t worry, we’ll clarify what this means for you and your team!

What Specifically Changes for Developers/DevOps Teams?

The deprecation of Dockershim means that Kubernetes users who have been using Docker as their container runtime should switch to alternative runtimes. Kubernetes has already developed the Container Runtime Interface (CRI), which enables seamless integration with other container runtimes. Many developers and companies have already made this transition without encountering major issues. Nevertheless, Dockershim remains popular among many users, highlighting the need for careful planning and preparation.

The Role of SIG Node: How Kubernetes Optimizes Interaction Between Pods and Resources

Thu, 30 Sep 2021 02:00:00 +0000

Introduction

In Kubernetes, a Node represents a single machine in your cluster. SIG Node is responsible for these crucial Node components and supports various subprojects like Kubelet and Container Runtime Interface (CRI). In this blog, we’ve summarized our conversations with Elana Hashman (EH) and Sergey Kanzhelev (SK) , who guide us through the various aspects of SIG membership and provide insights on how others can get involved.

Summary of Our Conversation

Could you tell us a bit about what SIG Node does?

SK: SIG Node is a vertical SIG responsible for the components that support controlled interactions between Pods and host resources. We manage the lifecycle of Pods scheduled on a Node. The focus of this SIG is to enable a broad range of workload types, including those with hardware-specific or performance-dependent requirements. We maintain the isolation boundaries between Pods on a Node as well as between Pod and host. This SIG manages a variety of components and has many external dependencies (like container runtimes or operating system features), which significantly increases the complexity we deal with. We tame this complexity and continuously strive to improve Node reliability.

Windows HostProcess Container: A New Era for Kubernetes Management

Thu, 19 Aug 2021 02:00:00 +0000

Kubernetes v1.22 introduced an exciting new alpha feature for clusters with Windows nodes: HostProcess Containers.

HostProcess Containers extend the Windows container model and enable a variety of scenarios for managing Kubernetes clusters. These containers run directly on the host and behave similarly to regular processes. With HostProcess Containers, users can package and distribute management operations and functions that require host access while maintaining the version control and deployment methods of containers. This allows Windows containers to be used for various scenarios related to device plugins, storage, and network management in Kubernetes.

Kubernetes Release Cycle: What the New Three-Month Rule Means for You

Fri, 23 Jul 2021 02:00:00 +0000

On April 23, 2021, the release team adopted a Kubernetes Enhancement Proposal (KEP) that changes the release cycle from four releases per year to three releases per year. This decision brings some significant changes for the Kubernetes community.

What Exactly is Changing?

Starting with the Kubernetes 1.22 version , a lightweight framework will be used to create the release schedule. The key points are:

The first Kubernetes version of a calendar year should begin in the second or third week of January to give contributors more time after the holidays.
The last Kubernetes version of a calendar year should be completed by mid-December.
A Kubernetes release cycle lasts approximately 15 weeks.
The week of KubeCon + CloudNativeCon is not considered a “working week” for SIG Release. The release team does not hold meetings or make decisions during this time.
There is an explicit SIG Release pause of at least two weeks between each release cycle.

As a result, Kubernetes will now release three times a year. Version 1.23 will be the last release of the calendar year 2021. This new regulation ensures a very predictable release schedule, making it easier to plan upcoming release dates:

Important API Changes in Kubernetes 1.22: What You Need to Know!

Sat, 17 Jul 2021 02:00:00 +0000

The Kubernetes API is constantly evolving, which means that older APIs are regularly reorganized or updated. With the release of Kubernetes 1.22, scheduled for August 2021, several important changes are on the horizon. In this version, several deprecated beta APIs will be removed and replaced by more stable versions. Here’s what this means specifically for developers and DevOps teams.

What Specifically Changes for Developers/DevOps Teams?

The upcoming API removals affect all beta APIs that have already been marked as deprecated. These changes could impact the workflow and compatibility in your projects. It’s important to review the new stable API versions and adjust your implementations accordingly to ensure a smooth migration.

Annual Reports of the Kubernetes Community: A Behind-the-Scenes Look

Thu, 01 Jul 2021 02:00:00 +0000

The Kubernetes community has taken a crucial step towards improving transparency and traceability of its activities. With the introduction of the Annual Reports of the Kubernetes Community for Special Interest Groups (SIGs) and Working Groups (WGs), it becomes easier to assess the vitality and progress of the various groups within the project. This is particularly important as the Kubernetes project has grown enormously with over 100,000 commits and thousands of contributors.

Kubernetes 1.21: Finally, Stable Metrics for Reliable Monitoring!

Mon, 26 Apr 2021 02:00:00 +0000

Kubernetes 1.21 introduces the first officially supported stable metrics with the completion of the Metrics Stability Framework. These new stable metrics not only offer support guarantees but also provide safeguards when encountering problematic metrics.

You can view the list of stable Kubernetes metrics here .

What are stable metrics and why do we need them?

A stable metric is one that can be reliably consumed across multiple Kubernetes versions without the risk of ingestion errors. Metric stability is an ongoing concern for the community. The monitoring infrastructure of clusters often assumes the stability of certain control plane metrics. Therefore, we have introduced a mechanism for versioning metrics as a proper API, with stability guarantees around a formal process for deprecating metrics.

The Future of Kubernetes Networking Technology: Spotlight on Gateway API

Sun, 25 Apr 2021 02:00:00 +0000

The Ingress resource is one of Kubernetes’ many success stories. It has spawned a diverse ecosystem of Ingress controllers that are deployed in hundreds of thousands of clusters in a standardized and consistent manner. This standardization made it easier for users to adopt Kubernetes. However, five years after the introduction of Ingress, signs of fragmentation into various but strikingly similar CRDs and overloaded annotations have emerged. The same portability that made Ingress so widespread also limited its future.

CronJobs in Kubernetes 1.21: Now in Full Bloom!

Sun, 11 Apr 2021 02:00:00 +0000

In Kubernetes v1.21, the CronJob resource has reached General Availability (GA). This not only means that CronJobs are now stable and ready for production use, but also that we have significantly improved performance since Kubernetes v1.19 by implementing a new controller.

Already in Kubernetes v1.20, we introduced a revised v2 controller for CronJobs, initially available as an Alpha feature. In v1.21, we now use this newer controller by default, and the CronJob resource itself is now GA (GroupVersion: batch/v1).

Five Years of Kubernetes Dashboard: A Retrospective on Its Evolution

Fri, 12 Mar 2021 01:00:00 +0000

In October 2020, the Kubernetes Dashboard officially celebrated its fifth anniversary. As the main project maintainers, we can hardly believe that so much time has passed since our first commit. However, when we look back with a bit of nostalgia, we realize that a lot has happened during this time. It’s time to celebrate “our baby” with a brief retrospective.

How It All Began

The original idea behind the Kubernetes Dashboard was to provide a web interface for Kubernetes. We wanted to reflect the functionalities of kubectl in an intuitive web UI. The main advantage of using the UI is that you can quickly identify things that aren’t working as expected (monitoring and troubleshooting). Additionally, the Kubernetes Dashboard is a great starting point for users new to the Kubernetes ecosystem.

Legal Notice

Fri, 06 Apr 2012 00:00:00 +0000

Note: Our Legal Notice (Impressum) is only available in German for legal reasons.

The German version is the legally binding document. Please find it at /impressum/ or use the language switcher to access the German version.

Hinweis: Unser Impressum ist aus rechtlichen Gründen nur auf Deutsch verfügbar.

Die deutsche Fassung ist das rechtlich verbindliche Dokument. Sie finden es unter /impressum/ .

Privacy Policy

Fri, 06 Apr 2012 00:00:00 +0000

Note: Our Privacy Policy is only available in German for legal reasons.

The German version is the legally binding document. Please find it at /datenschutz/ or use the language switcher to access the German version.

Hinweis: Unsere Datenschutzerklärung ist aus rechtlichen Gründen nur auf Deutsch verfügbar.

Die deutsche Fassung ist das rechtlich verbindliche Dokument. Sie finden es unter /datenschutz/ .

15-Factor App