Insights for Builders

A maximum-severity GitLab RCE lands under active exploitation while CISA catches up on last week's PHP flaws, OpenAI ships GPT-6.1 Terra, and Oracle agrees to sell Google's TPUs on OCI. Our take on this week's cloud and AI news.

Teams keep framing this as a choice. It isn't. Karpenter decides what nodes exist; Kueue decides which jobs are allowed to run. On a GPU cluster you almost always need both — and the interesting failures live in the gap between them.

Hybrid isn't two clusters you SSH between. It's one platform contract — identity, networking, GitOps, and observability — that behaves the same whether a pod lands in us-east-1 or your own rack. Here's how to draw that boundary without building a snowflake.

A provider quotes you a price per million tokens. To know whether self-hosting beats it, you need the same number for your own GPUs. It's one division — but the denominator is throughput, and throughput is where every self-host business case quietly cheats.

Handing an agent a shell with the AWS CLI is the fastest way to give it power — and the fastest way to lose the ability to say what it did. The AWS MCP Server trades a little setup for a boundary you can actually scope, audit, and revoke.

From EKS 1.37, new Auto Mode NodePools default to Balanced consolidation instead of WhenEmptyOrUnderutilized. It trades a sliver of cost savings for a lot fewer pod evictions — and AWS flipped the default because that trade is usually worth it.