Engineering

Back up a Kubernetes 1.37 cluster by hand with etcd snapshots, then delete the control plane and restore it. Includes the encryption key trap, all tested.

Read every Kubernetes certificate, watch one expire, and renew them all by hand. Most components reload a renewed certificate with no restart at all. Tested.

Build a Kubernetes 1.37 control plane that survives losing a server. Three control planes, etcd with TLS, a load balancer, and failure drills, all tested.

Build Kubernetes pod networking by hand with network namespaces, veth pairs, a bridge, routes and NAT, then call a CNI plugin yourself and trace a Service. Tested.

Kubernetes the Hard Way, updated for Kubernetes 1.37 and Debian 13. Every command tested end to end, on local machines and on Hetzner Cloud.

Ankra's own platform now runs in Helsinki. The timeline, the bill, the benchmark numbers, and the places UpCloud let us down, from the team that did the move.

We ran the same k6, iperf3 and fio suite on EKS, GKE and Hetzner and lined the results up against UpCloud, OVH and DigitalOcean. The cheapest node in the test won more than it had any right to.

Two identical cloud VMs measured 2.8x apart on CPU; one failed etcd's fsync bar. A 15-minute in-cluster benchmark suite catches this before production does.

UpCloud vs DigitalOcean vs OVH on identical Kubernetes clusters. UpCloud led on storage and network, OVH on latency, DigitalOcean had the slowest tails.

The 'never run a database on Kubernetes' rule predates CSI and operators. What production Postgres takes in 2026, and when managed still wins.

A new name, a new engine, and the biggest release we have ever shipped: the Go rewrite, an AI that owns the incident loop, passkey security, European multi-cloud, and Ankra on your phone.

New Ankra clusters no longer run ArgoCD. Here is the engineering story of the native deployment engine: why we built it, how the reconcile loop works, what the migration does to your live resources (nothing), and what we have not finished yet.