#kubernetes
Tagged “kubernetes”
22 articlesImage verification, one layer below admission
A CNCF post outlines a Node Resource Interface plugin that verifies SLSA, VEX and VSA attestations at CreateContainer time inside the container runtime, closing gaps that admission webhooks can miss.
Jul 31, 2026 · Tomás VegaPlatform engineeringKubernetes 1.37 beta lands a StatefulSet Recreate strategy and CRI pod checkpoint RPCs
The 1.37.0-beta.0 release adds a Recreate update strategy for StatefulSets, promotes PLEGOnDemandRelist and metrics.k8s.io to v1, and pushes pod checkpoint and restore into the CRI interface. A 1.36.3 patch shipping in the same window catches a kubelet memory-leak regression that first landed in 1.36.
Jul 31, 2026 · Maya OkonkwoPlatform engineeringKyverno's CLI learns to fake production so offline policy tests stop lying
A CNCF blog post walks through how the Kyverno CLI now stands up an in-memory fake of the Kubernetes API cache, so policies that lean on GlobalContextEntry lookups can be exercised offline instead of silently skipping. The workflow that used to say 'all pass' when it really meant 'never ran' has finally closed.
Jul 29, 2026 · Priya NairRunners & infrastructureLinkerd federation keeps the app running when a whole Kubernetes cluster dies
A CNCF walk-through by Dominik Táskai wires three GKE clusters into a full-mesh Linkerd multicluster and kills one. The nine-pod frontend rebalances across the surviving six with no application changes, but the setup pays a real price at the VPC, node-count and controller layers.
Jul 28, 2026 · Maya OkonkwoPlatform engineeringGoogle's pitch: put Agent Substrate on top of GKE Agent Sandbox, and call it the AI-agent runtime
Two months after GKE Agent Sandbox went GA in May 2026, Google introduced a follow-up called Agent Substrate in the same post. The New Stack's read is that Google now wants Kubernetes to be the runtime for AI agents on the primitives GKE already uses for production services.
Jul 26, 2026 · Maya OkonkwoSecurity & supply chainConfidential Containers hits CNCF incubation, and every pipeline is on notice
The CNCF Technical Oversight Committee voted Confidential Containers into incubation on July 22, moving TEE-backed pods one step closer to being a normal part of the Kubernetes stack. If your pipeline already signs and attests images, the runtime side is about to demand the same discipline.
Jul 25, 2026 · Tomás VegaRunners & infrastructureThe 60% idle GPU that turned out to be a network policy
A CNCF write-up walks through a distributed Kubeflow training job whose GPUs sat around 60% idle while every pod reported healthy. The failure lived one layer down, in a Cilium policy enforcing zone boundaries that gradient sync had to cross.
Jul 23, 2026 · Maya OkonkwoRunners & infrastructureGPUs keep falling off the PCIe bus, and standard node health does not notice
AWS engineers write up what running Kubernetes at Amazon EKS scale taught them about GPU node failure, and why the default node health model has nothing to say when the GPU just vanishes from the bus.
Jul 20, 2026 · Maya OkonkwoKubernetesVault Kubernetes KMS enters public beta, aiming at the etcd key sprawl
HashiCorp put a Kubernetes KMS v2 plugin for Vault Enterprise into public beta, letting the API server encrypt etcd through the same Vault install that already holds pipeline secrets. It collapses one more custody trail; it does not lower the operational burden on the API server side.
Jul 16, 2026 · Maya OkonkwoSecurity & supply chaink8s-aibom writes down the AI your cluster is already running
Google Cloud open-sourced k8s-aibom, an unprivileged Kubernetes controller that watches the cluster API for inference runtimes and agent frameworks and emits OWASP CycloneDX ML-BOMs from what it finds. The bet is that shadow-AI inventory is easier to solve from outside the workload than by asking developers to fill in a form.
Jul 14, 2026 · Tomás VegaRunners & infrastructureAWS puts gray zone failures into the EKS control loop
The New Stack details how AWS treats non-obvious availability zone degradation as its own category on EKS, with zonal shift moving traffic away from an impaired zone before the traditional alarms fire. For CI/CD teams, it reframes what a regional resilience test needs to cover.
Jul 12, 2026 · Maya OkonkwoPlatform engineeringAfter the ingress-NGINX retirement, what your migration plan owes production
The Kubernetes SIG Network retired ingress-nginx in March 2026, leaving clusters still on it exposed to unpatched CVEs and stalled feature work. A CNCF post lays out the two migration paths operators are picking between and the tooling to make the move.
Jul 11, 2026 · Maya OkonkwoPlatform engineeringetcd v3.7 adds a streaming range API and drops the legacy v2 store
SIG etcd shipped v3.7.0 with a RangeStream API that chunks large read responses instead of buffering them, plus faster lease handling under load and the removal of the legacy v2 backing store. Kubernetes will expose the feature in v1.37 behind a gate.
Jul 9, 2026 · Maya OkonkwoPlatform engineeringSandboxing your agent isn't the hard part, keeping it cheap is
A CNCF post from Solo.io's Lin Sun argues Kubernetes' agent-sandbox project delivers the isolation piece of hosting AI agents, while a sibling project, agent-substrate, is aimed at the resource-efficiency gap a per-agent pod leaves behind.
Jul 7, 2026 · Tomás VegaRunners & infrastructureDynamic Resource Allocation hits GA in Kubernetes 1.35, and GPU CI jobs finally get a real API
DRA reached general availability in Kubernetes v1.35, and the NVIDIA DRA driver has dropped its Beta label. For teams running GPU workloads through Kubernetes-backed pipelines, it replaces a decade of nodeSelector gymnastics with a first-class request primitive.
Jul 2, 2026 · Priya NairPlatform engineeringAWS reworks the EKS control plane and starts selling it in sized tiers
Amazon EKS engineers detail a set of architectural changes to how the service runs the Kubernetes control plane, including a purpose-built journal that replaces etcd's Raft consensus, and a new tier-priced product, EKS Provisioned Control Plane, that lets customers reserve API and scheduling capacity ahead of bursty workloads.
Jul 1, 2026 · Maya OkonkwoImage distributionDragonfly 2.5 ships Kubernetes webhook injection, drops V1 preheat
The CNCF P2P file distribution project adds an admission webhook that wires pods into the mesh without rebuilding images, plus a download blocklist, an hf:// scheme for model repositories, and a new dfctl CLI. The V1 preheat endpoints are removed.
Jun 30, 2026 · Maya OkonkwoSecurity & supply chainKubernetes will let you write patches with AI. It will not let you hide it.
The Kubernetes project published an AI contribution policy on June 26, 2026 that bans AI co-author trailers, requires PR descriptions to disclose generative-AI assistance, and tells maintainers to close PRs whose authors cannot explain the code in person. For any project taking community patches, it is a usable template.
Jun 30, 2026 · Tomás VegaSecurity & supply chainSecurity Profiles Operator hits v1 with stable APIs and a hardening pass
The CNCF's Security Profiles Operator graduated to v1.0.0 on June 26, freezing eight CRD APIs and clearing a third-party audit. The kubelet-side follow-up, KEP 6061 for OCI artifact distribution, is the piece still in flight.
Jun 27, 2026 · Maya OkonkwoPlatform engineeringA self-hosted Kubernetes diagnostic agent shipped by GitOps: the CNCF walkthrough
A CNCF blog post lays out a read-only, in-cluster AI agent whose CI/CD chain runs entirely on GitHub Actions and Argo CD Image Updater, with no data leaving the cluster and no cloud AI provider in the loop.
Jun 25, 2026 · Maya OkonkwoPlatform engineeringFlipkart's chaos platform runs 90% of fault injection in staging, ships five fixes back to LitmusChaos
Flipkart's central reliability engineering team won the CNCF End User Case Study contest for a multi-tenant chaos engineering platform on Kubernetes that runs roughly 90% of its experiments in staging clusters and contributed five fixes upstream to LitmusChaos. The next step on the roadmap is to wire chaos testing into the CI/CD pipeline as a mandatory phase.
Jun 18, 2026 · Maya OkonkwoIncident responseAWS pushes its DevOps Agent's diagnostic reach down to the EKS node via a custom MCP server
AWS has published a pattern for extending its autonomous DevOps Agent into EKS node OS and runtime data through a custom Model Context Protocol server, addressing incidents that live outside the agent's native cluster-control-plane visibility. The post is explicit that the implementation is a proof of concept, not a production replacement for monitoring or log shipping.
Jun 17, 2026 · Maya Okonkwo