#kubernetes
Tagged “kubernetes”
40 articlesKubernetes 1.37 turns native histograms on by default for its own metrics
The Prometheus native-histogram format graduates to beta in Kubernetes 1.37 and ships enabled by default, promising smaller time-series and sharper latency percentiles for the metrics the control plane already emits.
Sep 12, 2026 · Maya OkonkwoRunners & infrastructureKubernetes 1.37 promotes gang scheduling to a first-class Workload API in beta
Kubernetes v1.37 graduates the Workload and PodGroup APIs, Workload-Aware Preemption, and shared DRA ResourceClaims to beta, moving all-or-nothing scheduling out of third-party operators. A new CompositePodGroup API lands in alpha for hierarchical training topologies.
Sep 12, 2026 · Maya OkonkwoPlatform engineeringKubernetes v1.37 stops your in-place Pod resize from stalling on a full node
An alpha feature gate in Kubernetes v1.37 lets the scheduler evict lower-priority Pods on the same node to unblock a higher-priority Pod's in-place CPU or memory scale-up. In-place resize itself went GA back in v1.35, and this fills the last big gap in that workflow.
Sep 11, 2026 · Priya NairAccess & identityThe kubectl client secret CNCF wants you to stop distributing
A CNCF blog post argues that the 'confidential' OIDC client most on-prem clusters use for kubectl is a shared static credential in disguise, and that a public client with PKCE is the honest fit for a CLI that lives on every operator's laptop.
Sep 9, 2026 · Tomás VegaKubernetesKubernetes v1.37 Garhwal ships with 67 enhancements
Kubernetes v1.37, code-named Garhwal, is out with 67 enhancements: 16 GA, 23 Beta, 27 Alpha and one deprecation. The headline items land in scheduling, storage, autoscaling and cluster identity.
Sep 9, 2026 · Maya OkonkwoKubernetesKubernetes 1.37 turns Storage Version Migration on by default
Storage Version Migration graduated to GA in Kubernetes v1.37, and the built-in StorageVersionMigration API and controller are enabled on every v1.37 cluster. Rewriting stored objects to a new schema version is now a first-class control loop that ships with core.
Sep 8, 2026 · Maya OkonkwoSecurity & supply chainRootless Kubernetes finally reaches beta, eight years after the first experiment
Kubernetes v1.37 promotes the KubeletInUserNamespace feature gate to beta. Kubelet, the container runtime, CNI plugins and kube-proxy can now all run as an unprivileged user on the host.
Sep 8, 2026 · Tomás VegaIdentity and accessEKS clusters lag on an AWS auth deprecation, per The New Stack
The New Stack reports that 81% of Amazon EKS clusters still run an AWS EKS authentication method the vendor has deprecated. For platform teams whose deploy pipelines target EKS, the number reads as a migration flag against the auth path baked into kubeconfigs, CI service accounts and IaC modules.
Aug 20, 2026 · Maya OkonkwoDeveloper experienceKYAML pins down the YAML that Kubernetes actually reads
SIG CLI's new KYAML dialect is a strict subset of YAML that quotes every string, drops block-style indentation, and stays fully parseable by the existing ecosystem. For anyone who has watched a manifest silently turn NO into false, this is the guardrail the platform has been missing.
Aug 17, 2026 · Priya NairPlatform engineeringKairos pipeline runs a Kubernetes control-plane upgrade in eleven minutes, no operator
A CNCF case study documents a fully automated Kubernetes control-plane upgrade on immutable Kairos nodes that finished in about eleven minutes with zero human touch, using A/B partitions and GitOps to keep etcd quorum intact.
Aug 15, 2026 · Maya OkonkwoRunners & infrastructureMulti-gigabyte image pulls are now the EKS cold-start problem
The New Stack walks through why container image pull time has become a first-class bottleneck on Amazon EKS, driven by machine-learning workloads that ship in much larger images than a typical application. Pull latency is now something CI/CD and platform teams have to design for, not wait out.
Aug 12, 2026 · Maya OkonkwoPlatform engineeringGKE's ClusterNetworkPolicy gives platform teams a floor without stepping on namespace owners
Google Cloud is previewing ClusterNetworkPolicy in GKE, a cluster-scoped resource with an Admin, NetworkPolicy and Baseline tier stack. It lets platform teams set a non-negotiable isolation floor while namespace-scoped NetworkPolicies keep working underneath.
Aug 11, 2026 · Priya NairSecurity & supply chainCNCF's shadow-AI post makes the case for treating agents as identities
A new CNCF community post from Matteo Bisi at ReeVo argues for treating AI tools in the CI/CD pipeline as privileged identities, and maps the threat model plus available open-source controls stage by stage. The gap it names: no CNCF graduated project owns end-to-end AI governance yet.
Aug 9, 2026 · Tomás VegaPlatform engineeringWhere the controller-runtime cache bites you: stale reads, missing indexes, unbounded watches
A revised kubernetes.io deep dive walks through the local cache every kubebuilder-based controller depends on. The operational read: r.Get and r.List never touch the API server, and that is where a class of quiet controller bugs actually lives.
Aug 8, 2026 · Maya OkonkwoSecurity & supply chainGitLab Secrets Manager reaches beyond CI jobs to ESO, Terraform, and an API
GitLab has pushed its Secrets Manager into public beta with three new consumers beyond CI jobs: External Secrets Operator for Kubernetes, a Terraform/OpenTofu data source, and a Vault-compatible API. OpenBao powers it under the hood.
Aug 6, 2026 · Tomás VegaPlatform engineeringOpenCost 1.121.0 pins a dollar figure to every model and token on Kubernetes
OpenCost 1.121.0, announced on the CNCF blog on August 5, adds per-model and per-token cost attribution for AI inference workloads. The release aims at platform teams that have been reading GPU bills and token counters in separate windows with no way to connect them.
Aug 6, 2026 · Maya OkonkwoPlatform engineeringGateway API v1.6 promotes TCPRoute and UDPRoute to Standard, and puts a clock on the v1alpha2 shapes
The June 30 release of Kubernetes Gateway API v1.6 graduates raw L4 TCPRoute and UDPRoute to the Standard channel under v1, deprecates their v1alpha2 counterparts, and moves remaining experimental resources into a separate API group so the boundary between stable and unstable shapes stops being a naming convention.
Aug 5, 2026 · Maya OkonkwoPlatform engineeringThe Kubernetes v1.37 sneak peek gives you three deprecations to diary now
The release team's preview for v1.37 flags a three-release deprecation clock on kube-proxy ipvs mode, a rule that Static Pods can no longer reference Secrets or ConfigMaps, and the removal of the --filename flag on kubectl run. It also reprises the still-live cgroup v1 tripwire that stops kubelet from booting.
Aug 3, 2026 · Priya NairSupply chain securityImage verification, one layer below admission
A CNCF post outlines a Node Resource Interface plugin that verifies SLSA, VEX and VSA attestations at CreateContainer time inside the container runtime, closing gaps that admission webhooks can miss.
Jul 31, 2026 · Tomás VegaPlatform engineeringKubernetes 1.37 beta lands a StatefulSet Recreate strategy and CRI pod checkpoint RPCs
The 1.37.0-beta.0 release adds a Recreate update strategy for StatefulSets, promotes PLEGOnDemandRelist and metrics.k8s.io to v1, and pushes pod checkpoint and restore into the CRI interface. A 1.36.3 patch shipping in the same window catches a kubelet memory-leak regression that first landed in 1.36.
Jul 31, 2026 · Maya OkonkwoPlatform engineeringKyverno's CLI learns to fake production so offline policy tests stop lying
A CNCF blog post walks through how the Kyverno CLI now stands up an in-memory fake of the Kubernetes API cache, so policies that lean on GlobalContextEntry lookups can be exercised offline instead of silently skipping. The workflow that used to say 'all pass' when it really meant 'never ran' has finally closed.
Jul 29, 2026 · Priya NairRunners & infrastructureLinkerd federation keeps the app running when a whole Kubernetes cluster dies
A CNCF walk-through by Dominik Táskai wires three GKE clusters into a full-mesh Linkerd multicluster and kills one. The nine-pod frontend rebalances across the surviving six with no application changes, but the setup pays a real price at the VPC, node-count and controller layers.
Jul 28, 2026 · Maya OkonkwoPlatform engineeringGoogle's pitch: put Agent Substrate on top of GKE Agent Sandbox, and call it the AI-agent runtime
Two months after GKE Agent Sandbox went GA in May 2026, Google introduced a follow-up called Agent Substrate in the same post. The New Stack's read is that Google now wants Kubernetes to be the runtime for AI agents on the primitives GKE already uses for production services.
Jul 26, 2026 · Maya OkonkwoSecurity & supply chainConfidential Containers hits CNCF incubation, and every pipeline is on notice
The CNCF Technical Oversight Committee voted Confidential Containers into incubation on July 22, moving TEE-backed pods one step closer to being a normal part of the Kubernetes stack. If your pipeline already signs and attests images, the runtime side is about to demand the same discipline.
Jul 25, 2026 · Tomás VegaRunners & infrastructureThe 60% idle GPU that turned out to be a network policy
A CNCF write-up walks through a distributed Kubeflow training job whose GPUs sat around 60% idle while every pod reported healthy. The failure lived one layer down, in a Cilium policy enforcing zone boundaries that gradient sync had to cross.
Jul 23, 2026 · Maya OkonkwoRunners & infrastructureGPUs keep falling off the PCIe bus, and standard node health does not notice
AWS engineers write up what running Kubernetes at Amazon EKS scale taught them about GPU node failure, and why the default node health model has nothing to say when the GPU just vanishes from the bus.
Jul 20, 2026 · Maya OkonkwoKubernetesVault Kubernetes KMS enters public beta, aiming at the etcd key sprawl
HashiCorp put a Kubernetes KMS v2 plugin for Vault Enterprise into public beta, letting the API server encrypt etcd through the same Vault install that already holds pipeline secrets. It collapses one more custody trail; it does not lower the operational burden on the API server side.
Jul 16, 2026 · Maya OkonkwoSecurity & supply chaink8s-aibom writes down the AI your cluster is already running
Google Cloud open-sourced k8s-aibom, an unprivileged Kubernetes controller that watches the cluster API for inference runtimes and agent frameworks and emits OWASP CycloneDX ML-BOMs from what it finds. The bet is that shadow-AI inventory is easier to solve from outside the workload than by asking developers to fill in a form.
Jul 14, 2026 · Tomás VegaRunners & infrastructureAWS puts gray zone failures into the EKS control loop
The New Stack details how AWS treats non-obvious availability zone degradation as its own category on EKS, with zonal shift moving traffic away from an impaired zone before the traditional alarms fire. For CI/CD teams, it reframes what a regional resilience test needs to cover.
Jul 12, 2026 · Maya OkonkwoPlatform engineeringAfter the ingress-NGINX retirement, what your migration plan owes production
The Kubernetes SIG Network retired ingress-nginx in March 2026, leaving clusters still on it exposed to unpatched CVEs and stalled feature work. A CNCF post lays out the two migration paths operators are picking between and the tooling to make the move.
Jul 11, 2026 · Maya OkonkwoPlatform engineeringetcd v3.7 adds a streaming range API and drops the legacy v2 store
SIG etcd shipped v3.7.0 with a RangeStream API that chunks large read responses instead of buffering them, plus faster lease handling under load and the removal of the legacy v2 backing store. Kubernetes will expose the feature in v1.37 behind a gate.
Jul 9, 2026 · Maya OkonkwoPlatform engineeringSandboxing your agent isn't the hard part, keeping it cheap is
A CNCF post from Solo.io's Lin Sun argues Kubernetes' agent-sandbox project delivers the isolation piece of hosting AI agents, while a sibling project, agent-substrate, is aimed at the resource-efficiency gap a per-agent pod leaves behind.
Jul 7, 2026 · Tomás VegaRunners & infrastructureDynamic Resource Allocation hits GA in Kubernetes 1.35, and GPU CI jobs finally get a real API
DRA reached general availability in Kubernetes v1.35, and the NVIDIA DRA driver has dropped its Beta label. For teams running GPU workloads through Kubernetes-backed pipelines, it replaces a decade of nodeSelector gymnastics with a first-class request primitive.
Jul 2, 2026 · Priya NairPlatform engineeringAWS reworks the EKS control plane and starts selling it in sized tiers
Amazon EKS engineers detail a set of architectural changes to how the service runs the Kubernetes control plane, including a purpose-built journal that replaces etcd's Raft consensus, and a new tier-priced product, EKS Provisioned Control Plane, that lets customers reserve API and scheduling capacity ahead of bursty workloads.
Jul 1, 2026 · Maya OkonkwoImage distributionDragonfly 2.5 ships Kubernetes webhook injection, drops V1 preheat
The CNCF P2P file distribution project adds an admission webhook that wires pods into the mesh without rebuilding images, plus a download blocklist, an hf:// scheme for model repositories, and a new dfctl CLI. The V1 preheat endpoints are removed.
Jun 30, 2026 · Maya OkonkwoSecurity & supply chainKubernetes will let you write patches with AI. It will not let you hide it.
The Kubernetes project published an AI contribution policy on June 26, 2026 that bans AI co-author trailers, requires PR descriptions to disclose generative-AI assistance, and tells maintainers to close PRs whose authors cannot explain the code in person. For any project taking community patches, it is a usable template.
Jun 30, 2026 · Tomás VegaSecurity & supply chainSecurity Profiles Operator hits v1 with stable APIs and a hardening pass
The CNCF's Security Profiles Operator graduated to v1.0.0 on June 26, freezing eight CRD APIs and clearing a third-party audit. The kubelet-side follow-up, KEP 6061 for OCI artifact distribution, is the piece still in flight.
Jun 27, 2026 · Maya OkonkwoPlatform engineeringA self-hosted Kubernetes diagnostic agent shipped by GitOps: the CNCF walkthrough
A CNCF blog post lays out a read-only, in-cluster AI agent whose CI/CD chain runs entirely on GitHub Actions and Argo CD Image Updater, with no data leaving the cluster and no cloud AI provider in the loop.
Jun 25, 2026 · Maya OkonkwoPlatform engineeringFlipkart's chaos platform runs 90% of fault injection in staging, ships five fixes back to LitmusChaos
Flipkart's central reliability engineering team won the CNCF End User Case Study contest for a multi-tenant chaos engineering platform on Kubernetes that runs roughly 90% of its experiments in staging clusters and contributed five fixes upstream to LitmusChaos. The next step on the roadmap is to wire chaos testing into the CI/CD pipeline as a mandatory phase.
Jun 18, 2026 · Maya OkonkwoIncident responseAWS pushes its DevOps Agent's diagnostic reach down to the EKS node via a custom MCP server
AWS has published a pattern for extending its autonomous DevOps Agent into EKS node OS and runtime data through a custom Model Context Protocol server, addressing incidents that live outside the agent's native cluster-control-plane visibility. The post is explicit that the implementation is a proof of concept, not a production replacement for monitoring or log shipping.
Jun 17, 2026 · Maya Okonkwo