Understanding Kubernetes, not just using it: ayedo now offers hands-on IT workshops
Technological independence starts with your own expertise. ayedo offers hands-on workshops on Kubernetes, Docker, GitOps and Polycrate for IT teams.
Operations
Betrieb, Beobachtbarkeit und Stoerungsbeherrschung produktiver Systeme.
48 of 690 items
Kubernetes is moving from cgroup v1 to v2
What the move to cgroup v2 means for cluster management, resource isolation, and operations — and why Europe needs consistent infrastructure standards.
Authentik Federation in Practice: Undocumented Behavior in Sources, Groups, and Enrollment
A field report on federating two Authentik instances via OIDC: undocumented behavior in group sync, source enrollment, expression policies and login flows – with concrete patterns that work instead.
Proxmox VE Fundamentals Workshop
Hands-on Proxmox VE training for administrators: validate VMs, LXC, storage, networking, permissions, firewall, backup, and restore in 3 days.
Introduction to Linux Workshop
Linux for Windows switchers: learn terminal, Bash, permissions and shell scripting live online in 3 days. Your own cloud environment, 8 participants maximum.
Building the Edge — Part 8
The beginning of a platform – why every architecture eventually reaches the point where it must rethink the network.
Building the Edge — Part 7
Good platforms are not built by adding more infrastructure – they are built through clearly defined responsibilities.
Building the Edge — Part 6
A connection is not yet an HTTP request – why modern edge platforms begin much earlier than many architecture diagrams suggest.
Building the Edge — Part 5
Compute is not the platform – why modern applications today consist of two platforms.
Building the Edge — Part 4
Why high availability starts in the network today – failures are not an exceptional state, but an architectural principle.
Building the Edge — Part 3
One IP address can exist in three places at once – why Anycast is not a feature, but a property of the internet.
Building the Edge — Part 2
The internet does not know applications – why BGP does not try to find the fastest path.
Kubernetes 1.38: What we know so far
Kubernetes 1.38 is targeted for December 2026. Here is what is emerging for the release and which milestones matter.
Polycrate Platform Operations Workshop
Hands-on Polycrate Workshop for platform operators: Actions, backups, monitoring, support workflows and app deployments. One day of intensive training. Made in Germany.
Digital Sovereignty Does Not End at the Data Center
An application can be fully operated in Germany and still rely on US infrastructure for every single access.
Building the Edge — Part 1
The underestimated architecture of modern applications – why modern applications no longer begin in the data center.
TLS Certificates for Public Kubernetes Endpoints
TLS for Kubernetes does not necessarily end at the Ingress. Central TLS termination at the ayedo Edge Cloud simplifies certificate management, WAF integration, and traffic control. However, additional encryption up to the cluster protects further network segments. The right decision depends on trust boundaries, operating model, compliance, and desired fault isolation.
Operating Load Balancers for Kubernetes Independently of Providers
A Kubernetes Service of type `LoadBalancer` often ties public access to the respective cloud or infrastructure provider. An independent edge layer separates this responsibility from the cluster: routing, protection, TLS, and accessibility are centrally organized, while Kubernetes can be operated at ayedo or another provider. This reduces provider dependencies and simplifies multi-cloud architectures.
Securely Accessing the Kubernetes API Server Over the Edge
A publicly accessible Kubernetes API server doesn't need to allow direct internet access to its backend address. A preceding edge layer can handle routing, TLS, DDoS protection, and backend cloaking. The key remains the separation between public accessibility, cryptographic authentication, and actual authorization within the cluster.
Making Security Decisions at the Edge Transparent
Edge Security Monitoring reveals how protective measures impact public traffic. Traffic and usage statistics help operationally assess WAF rules, DDoS protection, and exposed endpoints. However, they do not fully explain individual attacks nor replace logs, traces, and application-centric security telemetry.
Multi-Cloud Security with Centralized Edge Architecture
Multi-Cloud Security often fails not due to a lack of protective features, but because of its distributed implementation. A centralized edge architecture consolidates public access, WAF, DDoS protection, TLS termination, and routing in front of heterogeneous backends. Provider independence, an autonomous system, and active-active operation reduce control and dependency points.
Integrating DDoS Protection with Application Logic at the Edge
DDoS protection and application security address different levels of attacks. The edge can assess volume, protocols, connection rates, and request patterns to discard malicious traffic early. However, whether a valid request is being misused can often only be determined in the application context. Effective protection combines both levels with clear responsibilities.
TLS, WAF, and Backend: A Layered Architecture
A robust **security layered architecture** distributes protection tasks across different levels: TLS secures the transport connection, the WAF evaluates HTTP requests, and the backend remains responsible for authorization, validation, and data protection. The critical points are the handover points between these layers. Each decryption, forwarding, and protocol conversion creates its own trust and operational requirements.
Distributing Security Functions Between Edge and Application
Security functions should not be confined to a single location. The edge is suitable for protective measures with high visibility, significant scaling needs, and standardizable rules. The application remains responsible for identity, authorization, and business access controls. Key factors include context requirements, misconfiguration risks, and how early an attack can be detected and mitigated.
Systematically Reducing Public Attack Surfaces
A public attack surface is not just created by individual vulnerabilities, but by the entire internet-exposed architecture. Anycast Loadbalancing, WAF, DDoS Protection, TLS Termination, and Backend Cloaking must therefore be considered as an interconnected security zone in front of the backends. The key is which traffic actually reaches the backends and under what conditions.
Architectural Planning for TLS Termination at the Edge
TLS termination at the edge shortens the path from client to protected entry point but shifts responsibilities. Certificates, trust boundaries, and backend connections must therefore be planned separately. The central question is not whether TLS ends at the public entrance, but which connections remain encrypted afterwards and how their identities are verified.
DDoS Protection at the Edge and Its Limitations in the Backend
DDoS protection at the edge reduces volumetric and network-based attack pressure before it reaches a company's public infrastructure. Scrubbing thus protects the entry to applications and APIs. However, it does not replace backend security, authentication, resource limits, or domain-specific checks against misuse.
Anycast and Backend Failover in Active-Active Operations
Active-active failover is not achieved through a single mechanism but through the interplay of Anycast, distributed edge PoPs, robust health checks, and dynamic backend selection. When a backend fails, the edge must detect the state and distribute new connections to available backends without relying on a central primary path.
Separating Network Routing and Application Routing
Network routing and application routing solve different problems. Anycast and Layer 4 determine how traffic reaches an edge entry and to which transport destination it proceeds. In contrast, Layer 7 decides based on hostnames, paths, or HTTP properties which service processes the request. These layers must be modeled separately to keep architecture, operations, and troubleshooting manageable.
Correctly Implementing Proxy Protocol in the Backend Pool
Proxy Protocol transmits connection information from a proxy or load balancing layer to the backend. This allows applications to evaluate the original client IP and other transport data. Prerequisites include a coordinated protocol, compatible listeners, and consistent configuration across the entire backend pool.
TLS Termination at the Edge: Designing Secure Routing
TLS Termination ends the external HTTPS connection at the edge, creating the technical handover point for application-specific routing. This enables host, path, and header rules. However, the architecture must clearly define which security and routing tasks the edge handles and what control remains with the backend.
Failover Across Multiple Providers with the Edge Cloud
Provider-independent failover separates public traffic entry from the compute infrastructure. The edge handles Anycast, DNS, protection, TLS, and health checks, while backends or Kubernetes clusters are operated with different providers. Backend cloaking prevents failover architectures from being unnecessarily exposed by publicly accessible origin services.
Failure Domains in Edge Design for Public Services
Failover is only resilient if backup paths do not depend on the same failure domain as the primary path. Therefore, backend, cluster, provider, network, and edge must be evaluated separately. A multi-PoP architecture with its own Autonomous System and active-active operation expands the design space for high availability but does not replace a thorough dependency analysis.
Active/Passive or Active-Active: Choosing the Right Failover
Active-passive failover is not inherently simpler, nor is active-active automatically superior. Key factors include switch-over time, data consistency, maintenance requirements, and the application's ability to support parallel processing. The Edge Cloud distributes public traffic regardless of the backend model used and must reliably handle health checks, routing, and failover.
Active-Active Failover: Load Distribution and Consistency
Active-active failover distributes production traffic simultaneously across multiple backends, making individual failures often transparent to users and clients. The trade-off is additional effort: sessions, data changes, and side effects must be designed to be consistent or deliberately fault-tolerant across the involved instances.
Backend Pools in Failover: States, Routing, and Recovery
Backend pools are not a static directory of target systems but an operational model for load distribution, state assessment, and controlled recovery. Failover starts with health checks but only ends when fallback, consistency, and renewed resilience of the primary pool are verified. Without defined state transitions, returning to regular operations can create new failures.
Routing-Based Failover for APIs and Web Applications
Routing-based failover decides at the edge which accessible backend pool receives a request or connection. Unlike DNS failover, the client does not need to resolve a new target name first. This shortens the response path, makes health statuses immediately usable, and separates public access from the actual compute infrastructure.
Active-Active Architecture for Highly Available Platforms
An active-active architecture distributes edge functions across multiple PoPs, instead of maintaining a site as a passive backup. This makes failover and maintenance part of ongoing operational processes. For internal platform services, this means the public access, protection functions, and routing must be resilient themselves—regardless of where the backends are operated.
Backend Cloaking as a Platform Standard for Services
Backend Cloaking separates the public service endpoint from the actual backend addresses. As a platform standard, it reduces the visible attack surface, facilitates network segmentation, and decouples service publication from internal infrastructure details. The ayedo Edge Cloud implements this separation at the edge—even for Kubernetes clusters outside of ayedo Managed Kubernetes.
Provider-Independent Edge Architecture in Platform Operations
A provider-independent edge is not achieved merely by using multiple cloud providers. The key is who controls public accessibility, routing, protection, and failover. An independent network, autonomous system, and a centrally operated edge platform decouple these functions from individual compute or Kubernetes providers. This makes migration capability and operational responsibility architecturally manageable.
An Edge Layer for Heterogeneous Kubernetes Clusters
Heterogeneous Kubernetes clusters increase flexibility but also distribute routing, TLS, security, and failover across multiple implementations. A unified edge layer decouples the public ingress from cluster technologies and compute providers. The ayedo Edge Cloud performs these functions provider-independently, enabling consistent backend cloaking across multi-cluster architectures.
Boundaries of Responsibility Between Platform and Application
A resilient operational model for the edge separates core protection and network functions from application-specific configuration. The platform team is responsible for DNS, TLS, DDoS Protection, and technical accessibility. The application team provides business requirements, WAF rules, and robust health check endpoints. Shared responsibility prevents blind spots in accountability.
Self-Service for DNS and Traffic at the Application Entry Point
Self-service DNS should not mean that application teams manage DNS zones, routing, and security decisions entirely on their own. An internal platform should offer standardized building blocks, fixed policies, and traceable approvals. This way, services are published faster while operations, security, and network responsibilities remain centrally manageable.
Runbooks for Failover and Recovery at the Edge
Runbooks for edge failover must include more than just a list of technical commands. Clear symptoms, responsibilities, verification sequences, and abort criteria are crucial. Only when health checks, failover status, backend condition, and return to normal operations are evaluated together can incident response remain manageable under time pressure.
Operational Assessment of DDoS Events in SRE Operations at the Edge
DDoS Protection does not automatically resolve an incident. For SRE teams, the real operational task begins with classification: Is traffic being dropped at the edge, are requests still reaching the backends, and what risks remain for availability, costs, and downstream dependencies? Clear signals, escalation paths, and a reliable assessment of backend impacts are crucial.