Optionality

Namespace-level Kubernetes cost allocation with OpenCost: run showback and graduate to chargeback on bare-metal clusters where no cloud billing API exists.

Run a self-hosted certificate authority for internal Kubernetes names: step-ca as a private ACME server, cert-manager as the client, no CT-log leakage.

A production ops playbook for a self-owned event backbone: Strimzi's Kafka lifecycle on Kubernetes, Redpanda's single binary, and NATS — off Confluent Cloud.

MIG gives hard, isolated GPU partitions; time-slicing shares one context with none; DRA makes fractional GPU scheduling a first-class Kubernetes primitive.

Model residency is not agent residency. A self-hosted MCP gateway and LiteLLM proxy keep tool-calls, keys, and PII inside your own network boundary.

Schrems II turns six today. The EU-US Data Privacy Framework is under fresh challenge, and CLOUD Act reach means US-parent clouds remain a live transfer risk.

European sovereign cloud is three options, not one: hyperscaler region, EU-incorporated provider, or self-host — scored on control, jurisdiction, lock-in, cost.

Gaia-X gives European cloud services a machine-verifiable trust layer — but not control-plane custody, key ownership, or immunity from foreign jurisdiction.

Operationalizing the DPDPA: a consent flow, data-principal access and verifiable erasure across your stores, and a breach workflow on the DPB's clock.

The engineering read of India's DPDP Act 2023: data fiduciary duties, cross-border transfer, and the Significant Data Fiduciary tier as infrastructure.

The EU AI Act's high-risk AI system obligations — Article 12 logging, conformity assessment, post-market monitoring — mapped to on-prem inference infrastructure.

Bare metal Kubernetes provisioning compared: Tinkerbell's workflow engine, Metal3's Cluster API/Ironic path, and Sidero Omni's post-CAPI machine model.

Kubernetes hard multi-tenancy without cluster sprawl: when namespaces suffice, where Capsule and vCluster fit, and how node isolation makes tenancy real.

Self-hosted ClickHouse vs Snowflake: build a sovereign lakehouse with ClickHouse, Apache Iceberg, and DuckLake for teams past the warehouse cost ceiling.

Self-hosted LLM hardware sizing: the VRAM math per model size and quantization, consumer vs datacenter GPU economics, and throughput-vs-latency capacity planning.

Run GitHub self-hosted runners on Kubernetes with actions-runner-controller (ARC): ephemeral, autoscaling, network-isolated CI compute you own — without leaving GitHub.

Run a self-hosted LLM for coding: Continue and Tabby wired to an open-weight code model served on vLLM, so your proprietary source code never reaches a vendor.

How a covered entity runs a HIPAA-compliant LLM on-premises: PHI never leaves your perimeter, no third-party BAA to manage, every inference logged for audit.

Own your identity plane: a trust-model decision matrix comparing Keycloak, Authentik, and Zitadel as self-hosted SSO — the engineering exit from Okta.

A self-hosted CI/CD GitHub Actions alternative: Forgejo for git, Woodpecker for pipelines, Zot for OCI artifacts — the whole delivery chain as owned infrastructure.

SPIFFE/SPIRE issues cryptographic, attested workload identity — X.509 and JWT SVIDs — so Kubernetes services get mutual TLS and zero long-lived static secrets.

An engineering guide to running production PostgreSQL on Kubernetes with CloudNativePG: HA streaming replication, WAL archiving and PITR to your own object store, automated failover, and exit from managed-DB lock-in.

After MinIO archived its open-source edition: a framework for choosing self-hosted S3-compatible object storage by tenancy, throughput, and jurisdiction.

The EU AI Act, NIS2, and DORA are one architecture constraint, not three checklists — the technical evidence for why hyperscaler SaaS cannot satisfy them.

Canary and blue-green on Kubernetes with Argo Rollouts: metric-driven AnalysisRuns, automated rollback, Gateway API traffic shaping, and audit-grade promotion gates.

How to replace Datadog and New Relic with a self-hosted OpenTelemetry + Prometheus + Loki + Tempo + Grafana stack on Kubernetes — retaining data sovereignty, audit-grade retention, and eliminating per-GB ingestion costs.

A no-hype engineering playbook for cloud repatriation: dependency audit, stateful workload classification, TCO model, and why ~70% of attempts fail within 18 months.

How to run self-hosted LLM inference on Kubernetes with vLLM at production grade: GPU sizing, cost crossover analysis, audit logging for EU AI Act compliance.

Hub-and-spoke vs distributed pull: scaling multi-cluster GitOps past 20 clusters, Argo CD control-plane bottlenecks, Flux air-gap patterns, and migration paths.