Field notes from
the sovereign stack
Page 13

Production PostgreSQL on Kubernetes with CloudNativePG: streaming-replication HA, WAL archiving and PITR to your own object store, and a clean exit from RDS.

MinIO archived its open-source edition. Choosing its replacement — Rook/Ceph, SeaweedFS or Garage — by tenancy, throughput and jurisdiction, not by benchmark.

SPIFFE/SPIRE issues cryptographic, attested workload identity — X.509 and JWT SVIDs — so Kubernetes services get mutual TLS and zero long-lived static secrets.

The EU AI Act, NIS2, and DORA are one architecture constraint, not three checklists — the technical evidence for why hyperscaler SaaS cannot satisfy them.

Progressive delivery on Kubernetes with Argo Rollouts: metric-driven AnalysisRuns, automatic rollback, Gateway API traffic shaping, audit-grade promotion.

The Grafana stack — OpenTelemetry, Prometheus, Loki, Tempo — against Datadog and Elasticsearch: sovereign telemetry on Kubernetes with no per-GB ingestion bill.

Talos Linux vs Ubuntu for Kubernetes security: an immutable, API-only node ships almost no userspace to carry CVEs, and hardening Ubuntu cannot close that gap.

A no-hype cloud repatriation playbook for Kubernetes: dependency audit, stateful workload triage, a real TCO model, and why most attempts fail inside 18 months.

How to run self-hosted LLM inference on Kubernetes with vLLM at production grade: GPU sizing, cost crossover analysis, audit logging for EU AI Act compliance.