Why Kuben ships as one binary
A PaaS is usually a fleet of services. Kuben is one process with roles. This post explains the architecture behind that choice, and what happens when you want three replicas.
engineering
3 posts with the tag “engineering”
Leader election without trusting clocks
Running several Kuben replicas meant deciding which one reconciles. We built the election on a Kubernetes Lease and compare-and-swap, and made sure clock skew can never produce two leaders.
How we release Kuben: attested, scanned, and built from the bytes we checked
Kuben's release pipeline builds five binaries without a cache, checksums and attests them, builds the image from those exact bytes, scans it before pushing, and embeds a dependency list in every binary. Here is why each step is there.