48 of 690 items
A field report on federating two Authentik instances via OIDC: undocumented behavior in group sync, source enrollment, expression policies and login flows – with concrete patterns that work instead.
Hands-on Proxmox VE training for administrators: validate VMs, LXC, storage, networking, permissions, firewall, backup, and restore in 3 days.
Linux for Windows switchers: learn terminal, Bash, permissions and shell scripting live online in 3 days. Your own cloud environment, 8 participants maximum.
The beginning of a platform – why every architecture eventually reaches the point where it must rethink the network.
Good platforms are not built by adding more infrastructure – they are built through clearly defined responsibilities.
A connection is not yet an HTTP request – why modern edge platforms begin much earlier than many architecture diagrams suggest.
Compute is not the platform – why modern applications today consist of two platforms.
Why high availability starts in the network today – failures are not an exceptional state, but an architectural principle.
One IP address can exist in three places at once – why Anycast is not a feature, but a property of the internet.
The internet does not know applications – why BGP does not try to find the fastest path.
Kubernetes 1.38 is targeted for December 2026. Here is what is emerging for the release and which milestones matter.
Hands-on Polycrate Workshop for platform operators: Actions, backups, monitoring, support workflows and app deployments. One day of intensive training. Made in Germany.
An application can be fully operated in Germany and still rely on US infrastructure for every single access.
The underestimated architecture of modern applications – why modern applications no longer begin in the data center.
TLS for Kubernetes does not necessarily end at the Ingress. Central TLS termination at the ayedo Edge Cloud simplifies certificate management, WAF integration, and traffic control. However, additional encryption up to the cluster protects further network segments. The right decision depends on trust boundaries, operating model, compliance, and desired fault isolation.
A Kubernetes Service of type `LoadBalancer` often ties public access to the respective cloud or infrastructure provider. An independent edge layer separates this responsibility from the cluster: routing, protection, TLS, and accessibility are centrally organized, while Kubernetes can be operated at ayedo or another provider. This reduces provider dependencies and simplifies multi-cloud architectures.
A publicly accessible Kubernetes API server doesn't need to allow direct internet access to its backend address. A preceding edge layer can handle routing, TLS, DDoS protection, and backend cloaking. The key remains the separation between public accessibility, cryptographic authentication, and actual authorization within the cluster.
Edge Security Monitoring reveals how protective measures impact public traffic. Traffic and usage statistics help operationally assess WAF rules, DDoS protection, and exposed endpoints. However, they do not fully explain individual attacks nor replace logs, traces, and application-centric security telemetry.
Multi-Cloud Security often fails not due to a lack of protective features, but because of its distributed implementation. A centralized edge architecture consolidates public access, WAF, DDoS protection, TLS termination, and routing in front of heterogeneous backends. Provider independence, an autonomous system, and active-active operation reduce control and dependency points.
DDoS protection and application security address different levels of attacks. The edge can assess volume, protocols, connection rates, and request patterns to discard malicious traffic early. However, whether a valid request is being misused can often only be determined in the application context. Effective protection combines both levels with clear responsibilities.
A robust **security layered architecture** distributes protection tasks across different levels: TLS secures the transport connection, the WAF evaluates HTTP requests, and the backend remains responsible for authorization, validation, and data protection. The critical points are the handover points between these layers. Each decryption, forwarding, and protocol conversion creates its own trust and operational requirements.
Security functions should not be confined to a single location. The edge is suitable for protective measures with high visibility, significant scaling needs, and standardizable rules. The application remains responsible for identity, authorization, and business access controls. Key factors include context requirements, misconfiguration risks, and how early an attack can be detected and mitigated.
A public attack surface is not just created by individual vulnerabilities, but by the entire internet-exposed architecture. Anycast Loadbalancing, WAF, DDoS Protection, TLS Termination, and Backend Cloaking must therefore be considered as an interconnected security zone in front of the backends. The key is which traffic actually reaches the backends and under what conditions.
TLS termination at the edge shortens the path from client to protected entry point but shifts responsibilities. Certificates, trust boundaries, and backend connections must therefore be planned separately. The central question is not whether TLS ends at the public entrance, but which connections remain encrypted afterwards and how their identities are verified.
DDoS protection at the edge reduces volumetric and network-based attack pressure before it reaches a company's public infrastructure. Scrubbing thus protects the entry to applications and APIs. However, it does not replace backend security, authentication, resource limits, or domain-specific checks against misuse.
Active-active failover is not achieved through a single mechanism but through the interplay of Anycast, distributed edge PoPs, robust health checks, and dynamic backend selection. When a backend fails, the edge must detect the state and distribute new connections to available backends without relying on a central primary path.
Network routing and application routing solve different problems. Anycast and Layer 4 determine how traffic reaches an edge entry and to which transport destination it proceeds. In contrast, Layer 7 decides based on hostnames, paths, or HTTP properties which service processes the request. These layers must be modeled separately to keep architecture, operations, and troubleshooting manageable.
Proxy Protocol transmits connection information from a proxy or load balancing layer to the backend. This allows applications to evaluate the original client IP and other transport data. Prerequisites include a coordinated protocol, compatible listeners, and consistent configuration across the entire backend pool.
TLS Termination ends the external HTTPS connection at the edge, creating the technical handover point for application-specific routing. This enables host, path, and header rules. However, the architecture must clearly define which security and routing tasks the edge handles and what control remains with the backend.
Provider-independent failover separates public traffic entry from the compute infrastructure. The edge handles Anycast, DNS, protection, TLS, and health checks, while backends or Kubernetes clusters are operated with different providers. Backend cloaking prevents failover architectures from being unnecessarily exposed by publicly accessible origin services.
Failover is only resilient if backup paths do not depend on the same failure domain as the primary path. Therefore, backend, cluster, provider, network, and edge must be evaluated separately. A multi-PoP architecture with its own Autonomous System and active-active operation expands the design space for high availability but does not replace a thorough dependency analysis.
Active-passive failover is not inherently simpler, nor is active-active automatically superior. Key factors include switch-over time, data consistency, maintenance requirements, and the application's ability to support parallel processing. The Edge Cloud distributes public traffic regardless of the backend model used and must reliably handle health checks, routing, and failover.
Active-active failover distributes production traffic simultaneously across multiple backends, making individual failures often transparent to users and clients. The trade-off is additional effort: sessions, data changes, and side effects must be designed to be consistent or deliberately fault-tolerant across the involved instances.
Backend pools are not a static directory of target systems but an operational model for load distribution, state assessment, and controlled recovery. Failover starts with health checks but only ends when fallback, consistency, and renewed resilience of the primary pool are verified. Without defined state transitions, returning to regular operations can create new failures.
Routing-based failover decides at the edge which accessible backend pool receives a request or connection. Unlike DNS failover, the client does not need to resolve a new target name first. This shortens the response path, makes health statuses immediately usable, and separates public access from the actual compute infrastructure.
An active-active architecture distributes edge functions across multiple PoPs, instead of maintaining a site as a passive backup. This makes failover and maintenance part of ongoing operational processes. For internal platform services, this means the public access, protection functions, and routing must be resilient themselves—regardless of where the backends are operated.
Backend Cloaking separates the public service endpoint from the actual backend addresses. As a platform standard, it reduces the visible attack surface, facilitates network segmentation, and decouples service publication from internal infrastructure details. The ayedo Edge Cloud implements this separation at the edge—even for Kubernetes clusters outside of ayedo Managed Kubernetes.
A provider-independent edge is not achieved merely by using multiple cloud providers. The key is who controls public accessibility, routing, protection, and failover. An independent network, autonomous system, and a centrally operated edge platform decouple these functions from individual compute or Kubernetes providers. This makes migration capability and operational responsibility architecturally manageable.
Heterogeneous Kubernetes clusters increase flexibility but also distribute routing, TLS, security, and failover across multiple implementations. A unified edge layer decouples the public ingress from cluster technologies and compute providers. The ayedo Edge Cloud performs these functions provider-independently, enabling consistent backend cloaking across multi-cluster architectures.
A resilient operational model for the edge separates core protection and network functions from application-specific configuration. The platform team is responsible for DNS, TLS, DDoS Protection, and technical accessibility. The application team provides business requirements, WAF rules, and robust health check endpoints. Shared responsibility prevents blind spots in accountability.
Self-service DNS should not mean that application teams manage DNS zones, routing, and security decisions entirely on their own. An internal platform should offer standardized building blocks, fixed policies, and traceable approvals. This way, services are published faster while operations, security, and network responsibilities remain centrally manageable.
Runbooks for edge failover must include more than just a list of technical commands. Clear symptoms, responsibilities, verification sequences, and abort criteria are crucial. Only when health checks, failover status, backend condition, and return to normal operations are evaluated together can incident response remain manageable under time pressure.
DDoS Protection does not automatically resolve an incident. For SRE teams, the real operational task begins with classification: Is traffic being dropped at the edge, are requests still reaching the backends, and what risks remain for availability, costs, and downstream dependencies? Clear signals, escalation paths, and a reliable assessment of backend impacts are crucial.
In distributed edge traffic, the root cause of an error is often not where the symptom becomes visible. A robust analysis reconstructs the actual request path: from Anycast DNS through network and Edge-PoP, TLS termination, and protection functions to the backend. Only by separating these layers can misassignments be prevented and incident response times shortened.
Kubernetes orchestrates workloads. An Edge Cloud controls how traffic reaches these workloads.