How Apache DataFusion Runs SQL In-Process
Apache DataFusion is an embeddable query engine: SQL goes in, runs as columnar Arrow batches inside your own process, and results come out without a separate service.
Loading visual explainer…
How MaaS Governance Wraps a Model Endpoint on AKS
A model deployed on AKS is open by default. See how MaaS policies insert Authorino authentication and Limitador rate limits in front of vLLM, so bad keys and over-quota requests stop at the gate.
Explanation
Dropping an LLMInferenceService onto an AKS cluster gives you a running vLLM server and a router-scheduler, but the endpoint is open. Governance is a separate layer: applying a MaaSSubscription and a MaaSAuthPolicy activates Authorino, which validates API keys or JWTs, and Limitador, which enforces token rate limits. Requests that fail either check are answered with 401 or 429 before they ever reach vLLM, so rejected traffic never touches the GPU.
FAQ
Why is an AKS model endpoint reachable before any MaaS policy is applied?
An LLMInferenceService deploys a vLLM server and a router-scheduler, but it does not add enforcement on its own. The endpoint stays open until a MaaSSubscription and a MaaSAuthPolicy are applied, which is what activates Authorino and Limitador in front of the model.
Do rejected requests ever reach the model server?
No. Authorino answers missing or invalid keys with 401, and Limitador returns 429 when token rate limits are exceeded, both before the request reaches vLLM. That keeps unauthorized and over-quota traffic off the GPU.
Should governance live in the model server or in a separate layer?
On AKS the MaaS governance layer sits on top of the inference platform and extends to non-OpenShift Kubernetes distributions, so the vLLM deployment itself does not change. Keeping identity and quota checks in a separate gate lets you add or remove governance without rebuilding the serving stack.
The posts behind it
Related reading
AWS · · TutorialScope workloads and share resilience policies with AWS Resilience Hub
AWS Resilience Hub’s Next generation, announced September 18, 2026, adds three capabilities to align workload scope and resilience requirements with running environments. Amazon EKS label support selects Kubernetes resources using existing labels with AND logic, establishing precise resource boundaries without reorganizing namespaces. Generative AI-powered Dependency Insights summarizes discovered dependencies and highlights patterns warranting resilience review, such as cross-Region dependencies questioning recovery design. Resilience policy sharing through AWS Organizations lets a central team define requirements once and make them available to member accounts, with policy events tracking adoption. The post walks through scoping a checkout service on EKS using labels, examining dependencies via synthetic traffic, and applying a shared tier-1-critical policy with a 99.9% availability SLO, 5-minute multi-AZ RTO, 1-minute RPO, 15-minute multi-Region RTO, and 60-minute backup intervals.
Stack Overflow · · ExplainerWhy Your Sandbox Never Quite Matches Production (And Why That's Fine)
The gap between sandbox and production environments is structural and inevitable because they change on different schedules with different triggers. Infrastructure divergence rarely affects what integration tests catch, but behavioral contract drift—when simulated upstream responses no longer match real ones—causes tests to pass while production fails. The most effective teams connect simulation updates to upstream deployment events rather than to test failures, using observation-based tools like Keploy that capture real HTTP traffic to keep simulations current. Full production parity is not the goal; targeted accuracy for the specific behavioral contracts that integration tests validate is sufficient to catch the failures that matter most in distributed systems. The sandbox covers what it can, production reveals what it cannot, and the maintenance work is keeping the sandbox’s coverage accurate within its boundary, not expanding it to match production exactly.
Cloudflare · · ExplainerUnder the hood, off the hot path: How D1 scales to millions of databases
D1, Cloudflare’s serverless SQLite database, has seen 15x growth in live databases over the past year and scales by keeping query execution on the edge in Durable Objects, separate from the control plane’s metadata operations. The control plane uses an Edge API Worker with Hyperdrive to access Postgres clusters for transactional metadata, while Workers KV caches database-to-Durable-Object mappings for fast edge lookups. Database creation completes in about 1.6 seconds by generating a Durable Object ID, persisting metadata to Postgres, and storing the mapping in Workers KV, with the Durable Object lazily initialized on first query. Storage usage enforcement uses atomic counters in Workers KV that are checked locally on each query and updated asynchronously after execution, avoiding any central database round trip during the query. Precomputed aggregations for billing are stored in ClickHouse, and guiding principles such as eventual consistency and idempotency further reduce reliance on centralized components.
Red Hat · · TutorialRed Hat AI Inference 3.5 MaaS governance on AKS
Red Hat AI Inference 3.5 extends its Model-as-a-Service (MaaS) governance layer to non-OpenShift Kubernetes distributions, including Azure Kubernetes Service (AKS). MaaS adds multi-tenant API governance on top of the inference platform, controlling authentication, rate limiting, and model access via Authorino and Limitador from Red Hat Connectivity Link (Kuadrant). A model is first deployed with a single LLMInferenceService YAML, creating a vLLM server and router-scheduler, but the endpoint is open. Applying a MaaSSubscription and MaaSAuthPolicy activates governance: Authorino validates API keys or JWTs, and Limitador enforces token rate limits. The post demonstrates three enforcement scenarios on an AKS cluster with a T4 GPU running Qwen3-0.6B: 401 for missing or invalid keys, 200 for authenticated requests, and 429 when rate limits are exceeded, blocking requests before they reach vLLM.
More like this
More how it works explainers
How Caddy Serves a Static Site: The Request Flow
See how Caddy handles a request for a static site, from DNS resolution through container routing to file_server, and how TLS and redirects fit into the flow.
How BYOK Works: Your Key and Knowledge at Request Time
BYOK lets a system run on assets you supply — your model credential or your private knowledge — instead of the vendor's defaults. This walkthrough traces six steps from registration to an audited response.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.