Blog: Kubernetes on Scaleway in practice
Practical know-how for teams on Scaleway Kubernetes: costs, migration, security, backups and customer onboarding – from running real clusters.
OperationsZero-downtime deployments on Kubernetes: readiness, rolling updates and rollback
The rollout was green, yet users saw 502 errors for 20 seconds. What a rolling update alone does not give you: readiness, a clean shutdown, disruption budgets, migrations in two steps and a rollback to a pinned version.
- Kubernetes
- CI/CD
Operationscert-manager with Scaleway DNS: wildcard certificates via DNS-01
Your domain lives at Scaleway, you need *.example.com – and cert-manager knows Cloudflare and Route 53, but not Scaleway. How wildcard certificates via DNS-01 reach the cluster with Scaleway’s own webhook, pitfalls included.
- TLS
- Scaleway
- Kapsule
SecurityCLOUD Act and GDPR: what your choice of cloud provider means for SaaS
“But the data is in Germany” does not answer the CLOUD Act question. What the US law allows, where the Data Privacy Framework stands, and what SaaS companies should check when choosing a cloud provider.
- Compliance
- Scaleway
SecurityISO 27001 A.8.13: proving backups and restore tests to your auditor
The auditor wants to see the backup of 12 March and the last restore test – the team has backups but no record. What ISO 27001 asks for under A.8.13, which evidence counts and what a restore test record looks like.
- Compliance
- Backups
OperationsRestoring a PostgreSQL backup without overwriting the live database
A migration has damaged 2,300 invoices, and the 3 a.m. backup is there. Restoring it over production wipes out everything since 3 a.m. Why a restore belongs in a new database – step by step with pg_restore.
- Databases
- Backups
- Scaleway
ArchitectureGitOps with Argo CD or a control plane? What teams without a platform team actually need
GitOps with Argo CD brings review, history and drift correction – plus a second repository, a secrets strategy and a tool that needs looking after. What small teams actually need, and when GitOps is still the better choice.
- Kubernetes
- CI/CD
OperationsS3 versioning is not a backup: protecting buckets with Object Lock
A clean-up job deletes 180,000 product images and versioning saves the day – this time. Why versions are not a backup, what replication does not do, and what a bucket backup with Object Lock looks like.
- Backups
- Scaleway
- Compliance
SecurityNetwork policies on Kubernetes: truly separating environments and customers
A pod belonging to customer A calls customer B’s internal API – and Kubernetes lets it. Namespaces separate names, not network traffic. How two network policies change that without cutting off running apps.
- Kubernetes
- Multi-tenant
- Ingress
ArchitectureScaleway Kapsule vs. AWS EKS: managed Kubernetes in Europe compared
A free control plane against $73 a month, Cilium on a private network against the VPC CNI, API keys against Pod Identity: a fair comparison of Kapsule and EKS – including where EKS comes out ahead.
- Kapsule
- Scaleway
- Migration
ArchitectureA Heroku alternative in Europe: from PaaS to your own cloud without a platform team
Since February 2026 Heroku has stopped building new features. What you have to replace when you move – from the build to the Postgres add-on –, which options exist in Europe and how the migration works, step by step.
- Migration
- Scaleway
- CI/CD
OperationsKubernetes in production: the checklist most architecture diagrams leave out
Popular Kubernetes production architecture diagrams usually stop at the registry. This checklist starts there: rollback, secrets, TLS, resources, backups with tested restores, security, alerts, upgrades and the question of who owns the cluster.
- Kubernetes
- Backups
- CI/CD
ArchitectureKubernetes hosting or bring your own cloud? Who owns your infrastructure
Hosting, managed Kubernetes or bring your own cloud: the three models sound alike, yet they split ownership, billing and operations in completely different ways. A comparison in four questions – and when each one fits.
- Kubernetes
- Scaleway
- Costs
SecurityLooking at production data without sharing the password
Support wants to know whether the order really arrived. The quickest way – the app’s password and a port-forward – is almost always the wrong one. Four layers for read access that only reads and stays traceable.
- Databases
- Compliance
- Kubernetes
OperationsWordPress on Kubernetes: seven traps between the chart and the first page
WordPress runs well on Kubernetes if a few things are right from the start. Seven traps almost everyone hits once during their first setup, and how to avoid them.
- Kubernetes
- Volumes
- Databases
ArchitectureHelm charts and their disks: what is left after helm uninstall
A Helm chart often brings its own disks, for example for the database bundled in the chart. Some disappear on uninstall, data and all, others stay around forever. You want to know which before you start.
- Volumes
- Backups
- Kubernetes
OperationsLogs, usage and uptime without your own monitoring stack
During an incident, three questions matter: What is the application writing, how heavily was it used, and can it be reached from outside? Not every team needs its own monitoring stack for that.
- Monitoring
- Kubernetes
- Kapsule
SecurityKubernetes Secrets: why Base64 is not encryption
A Kubernetes Secret is Base64, readable by anyone with the right permissions. Where secrets leak, and what a secret manager, rotation and clean permissions change.
- Secrets
- Kubernetes
- Scaleway
OperationsRollbacks on Kubernetes: why a tag is not a version
A rollback that pulls the same tag again brings back the broken version. If you want to roll back reliably, you need the digest of every deployment, and a plan for the database.
- CI/CD
- Kubernetes
- Backups
OperationsBus factor 1: when the cluster belongs to a single colleague
In many small teams, the cluster belongs to one colleague. That works fine until they go on vacation. Six steps to make sure operations no longer hinge on one person.
- Kubernetes
- SaaS
- Costs
SecurityNIS2 in Kubernetes operations: the evidence an auditor wants to see
NIS2 doesn’t require any particular technology, but measures and proof. For Kubernetes operations, that means personal access, a complete log and tested backups.
- Compliance
- Kubernetes
- SaaS
OperationsFrom AWS to Scaleway: what becomes of RDS, S3 and Route 53
Almost every AWS service has a counterpart at Scaleway. The move rarely fails because of Kubernetes – it fails on the database cutover, egress costs and DNS.
- Migration
- Scaleway
- Kubernetes
ArchitectureFrom ingress-nginx to Envoy Gateway: switching controllers without a dark window
Change the ingress class and deploy: the new controller serves, the old one no longer does, and DNS still points at the old one. The host answers 404 until the TTL expires. Here’s a better way.
- Ingress
- Kubernetes
- TLS
ArchitecturePersistent volumes on Kubernetes: ReadWriteOnce, Recreate and the snapshot before deletion
A rolling update with a volume is a deadlock waiting to happen. And deleting a volume from the manifest is data loss waiting to happen. Five rules that prevent both.
- Volumes
- Kubernetes
- Backups
OperationsKubernetes upgrades on Kapsule without the fear
Kubernetes ships three minor versions a year, and Kapsule supports only a limited number of them. Wait two years and you have four upgrades ahead of you. Better: one per quarter, boring.
- Kapsule
- Kubernetes
- Scaleway
OperationsOne database per service: roles, privileges and the read-only user who sees nothing
The BI user has read access and still can’t see the new table. That’s not a bug, that’s PostgreSQL. And it’s the reason privileges have to be granted in a fixed order.
- Databases
- Scaleway
- SaaS
OperationsIn the cluster or on GitHub Actions: where should the image be built?
A build in the cluster runs where the application runs. GitHub Actions builds where the code lives. Neither needs a Docker daemon, and both have a catch you only notice in production.
- CI/CD
- Kubernetes
- Costs
SecurityCustomer offboarding: why every drop needs a dump first
Deleting is easy, restoring is impossible. Offboarding needs a fixed order: back up, verify, then tear down. And a retention rule that someone has written down.
- Backups
- SaaS
- Databases
OperationsWhy your app sees the wrong IP behind the load balancer
Every visitor comes from the same IP, the login limit locks out all customers at once, and the allowlist lets nobody in. That’s not an attack, that’s the load balancer.
- Ingress
- Scaleway
- Kubernetes
SecurityLet’s Encrypt rate limits: why SaaS subdomains need a wildcard certificate
Fifty certificates per domain per week sounds like a lot. Until the fiftieth customer gets stuck in onboarding and the certificate won’t arrive until next week.
- TLS
- SaaS
- Ingress
ArchitectureMulti-tenant SaaS: a namespace per customer or a row per customer?
Multi-tenancy is not a yes-or-no question. Most SaaS vendors need both: rows for the many small customers and namespaces for the few large ones.
- SaaS
- Multi-tenant
- Kubernetes
OperationsWhat does Kubernetes on Scaleway really cost?
Node prices are the smallest part. Budgeting Kubernetes on Scaleway takes five line items, and the most expensive one is on no price list.
- Costs
- Scaleway
- Kapsule