Kueue Pending Jobs: A Headlamp Checklist for Admission Failures
Kueue pending jobs often aren't a scheduler problem. A Headlamp-first checklist from the Kubernetes blog for tracing admission, quota and queues, and limits.
GPU Cost Attribution on Kubernetes: Bill on Memory, Not Compute
GPU cost attribution on Kubernetes breaks once pods share a GPU: DCGM can report 300% use. Why platform teams should split the bill on memory, not compute.
kagent Agent Builder: Three Guardrails a Prompt Can't Replace
A kagent agent builder on Kubernetes turns one sentence into a running AI agent. A CNCF lab shows why allowlists, approval and RBAC, not prompts, keep it safe.
Guardrails, Not Gates: A Better Framework for Platform Team Policy
CNCF argues platform policies fail as gates. Its framework of validation, mutation, generation, and verification makes developer experience the primary metric.
Why Coding Agents Need a Cloud-Native Harness — and What Mecatl Does About It
Desktop coding agent harnesses bundle UI, loop, sandbox, and tools in one process. How Stacklok's Mecatl splits them with cloud-native architecture.
Equinix Cut Kubernetes Operational Overhead by 40% With a Shared Services Architecture on EKS
Equinix replaced self-managed, team-owned Kubernetes clusters with a three-account shared services architecture on Amazon EKS: a workloads account (EKS + Cilium), a platform account (centralized CI/CD, managed data services), and a network account (Transit Gateway, Direct Connect). Results: 40% less operational overhead, 4× deployment frequency, 100% business unit adoption.
ReadyOn's Four Walls: The EKS Tenant Isolation Architecture That Blocks All 6 Attack Paths
ReadyOn built a defense-in-depth tenant isolation model on Amazon EKS using four independent security layers: namespace isolation with RBAC, compute isolation with Karpenter dual-taint node pools, network isolation with per-tenant VPC security groups, and data isolation with dedicated Aurora clusters and unique KMS keys. All six cross-tenant attack paths blocked in adversarial exercises.
Cilium 1.20: Gateway API Gets Authentication, TCP Gets a Route, and the Node Agent Shrinks 79%
Cilium 1.20 extends the Kubernetes Gateway API to handle external authorization flows, introduces TCPRoute and UDPRoute for L4 service management, closes a four-year ENI IPv6 gap on AWS EKS, and ships the cilium-cni binary at 16MB — down from 76MB. The release continues Cilium's expansion from CNI to full networking control plane.
Kubernetes v1.37 Native Histograms Graduate to Beta — and They're Now On by Default
Kubernetes v1.37 enables Native Histograms by default, graduating from alpha in v1.36. The change replaces classic Prometheus histograms' static buckets with adaptive, lower-cardinality metrics that provide more accurate latency percentiles without manual configuration.
Kubernetes v1.37 Adds Five Standardized Node Conditions for Drain and Maintenance Workflows
Kubernetes v1.37 introduces five new well-known Node conditions — DrainInProgress, Drained, MaintenancePlanned, MaintenanceInProgress, and GracefulNodeShutdownInProgress — replacing the scattered taint/label signals that platform teams currently use to communicate node state during operational events.
Kubernetes v1.37 Gang Scheduling Hits Beta — and Brings a New API for AI/ML Workloads
Kubernetes v1.37 graduates gang scheduling to beta with a new CompositePodGroup API, Workload-Aware Preemption, and standardized building blocks for third-party controller integration. The AI/ML workload angle is the reason this cycle matters.
Datadog Workload Protection Can Now Kill Processes and Isolate Workloads Mid-Attack
Datadog's Workload Protection has added automated and manual response actions — kill offending processes and isolate compromised containers — closing the gap between detection and remediation without a human handoff.
Kubernetes v1.37: Dynamic Resource Allocation Graduates to GA — What Changes for GPU Workloads
Kubernetes v1.37 promotes DRA Extended Resource Support to GA, enabling existing GPU workloads to migrate to Dynamic Resource Allocation without code changes. Device taints and NUMA standardization also reach GA.
Kubernetes v1.37: HPA Scale-to-Zero Is Now Beta and On by Default
The HorizontalPodAutoscaler can now scale workloads to zero replicas in Kubernetes v1.37 — what changed from alpha, how to configure it, and when not to use it.
How to Orchestrate On-Premises Infrastructure at Scale with EKS Anywhere and AWS Serverless
AWS Architecture Blog's three-layer reference architecture for hybrid cloud orchestration: EKS Anywhere clusters at the edge, Step Functions and EventBridge at center, and a DynamoDB-backed Order Management System tying them together.
Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles Are Now GA
Kubernetes v1.37 graduates Pod Certificates and Cluster Trust Bundles to stable. They replace bearer token JWTs with proof-of-possession mTLS credentials — closing a workload identity gap that has existed since the beginning.
The Definitive Guide to Building an AI Factory on Kubernetes for Platform Teams
One GPU fleet, many teams, strict isolation: how to architect multi-tenant AI infrastructure on Kubernetes without hiding the data path behind a leaky abstraction.
How to Implement Predictive Autoscaling for GPU Workloads on Kubernetes
Reactive autoscaling can't keep up with GPU provisioning delays. This framework uses a Bi-LSTM predictor, burst detection, and a graduated scaler to close the gap.
Kubernetes v1.37 Pod Certificates: Why Bearer Tokens Were Never Enough
Pod Certificates and Cluster Trust Bundles hit GA in Kubernetes v1.37, replacing bearer token identity with proof-of-possession X.509 credentials.
Kubernetes at the Edge Has Hit a Wall: Why Fleet Management Is the Answer
Edge Kubernetes deployments face a ceiling that more cluster optimization can't clear — disconnected operation, configuration drift, and scale management require a fleet-first architecture that most organizations haven't adopted yet.
AWS Retired This EKS Auth Method — and 81% of Clusters Haven't Noticed
AWS deprecated ConfigMap-based EKS cluster authentication, but 81% of clusters still run the legacy method. Here's what the migration window looks like and what's at stake.
CNCF Publishes Governance Framework Guidance: Three Models, One Critical Mechanism
CNCF's analysis of 72 projects reveals that organizational-balanced voting — not contributor volume — is the strongest predictor of sustained contributor diversity. The guidance recommends three governance structures based on project size and complexity.
Eleven Minutes, Zero Humans: How This Kubernetes Upgrade Pipeline Works
A production Kubernetes control plane upgraded across three nodes in 11 minutes without manual intervention. Here's the six-tool pipeline behind it, the critical concurrency mistake to avoid, and what self-healing actually requires.
Adobe Firefly Cut GPU Metric Query Times 28x by Moving to Amazon Managed Prometheus
Adobe moved 2 million GPU time-series metrics from self-hosted Prometheus to Amazon's managed service. 24-hour queries that took 2 minutes now complete in 10 seconds — and the team got there without replacing their existing stack.
JFrog Artifactory and GCP Artifact Registry: Native Pull, No Sync Required
JFrog's Artifact Registry Connector routes Cloud Run and GKE pulls directly to Artifactory in real time — eliminating sync lag, parallel registries, and policy enforcement gaps.
Pulling Multi-Gigabyte Container Images in Seconds on Amazon EKS
SOCI lazy loading cuts a 1.3 GB container image pull from 20 seconds to 2.8 seconds on EKS — with no image format changes required. Here's the mechanism and how to enable it.
Unfixed Kubernetes CVEs: What You Can and Can't Actually Detect
Four Kubernetes CVEs have been unfixed since 2020–2021 — not because they were overlooked, but because patching would break the platform. Here's how to know if your cluster is actually exposed.
How to Pull Multi-Gigabyte Container Images in Seconds on Amazon EKS
SOCI (Seekable OCI) lazy loading lets EKS pods start before the full image is pulled — cutting a 10 GB image from minutes to seconds. Here's how the technique works and how to deploy it.
When Zero Plus Zero Equals Two: Fixing Trace Fragmentation in Istio and Kiali
Combining Istio sidecar tracing with OpenTelemetry instrumentation produces duplicate, disconnected trace records — not unified observability. The fix is two configuration changes, and it closes the gap permanently.
Understanding Unfixed Kubernetes CVEs: What You Can — and Can't — Detect
Four Kubernetes CVEs remain unfixed because patching would break the platform. Datadog's guide to audit-log-based detection shows what each one exposes — and the honest limits of what audit logs can confirm.
Shadow AI in CI/CD: The Six-Stage Threat Model from Laptop to Kubernetes
CNCF maps six attack surfaces where unapproved AI agents gain privileged access in the software pipeline — every enterprise has at least one gap, and CI credentials are the target.
OpenCost 1.121.0: Now You Can See What Your Self-Hosted AI Models Actually Cost Per Token
OpenCost's new inference cost tracking shows the real per-token cost of running models on Kubernetes — including the KV cache effect and why low utilization makes self-hosting more expensive than it looks.
Gateway API v1.6: TCP and UDP Routing Are Finally Production-Ready
Kubernetes Gateway API v1.6 graduates TCPRoute and UDPRoute from experimental to Standard, letting platform teams route databases, DNS, and gaming traffic without vendor lock-in.
Kubernetes v1.37: The Deprecations Platform Teams Need Now
cgroup v1 nodes now fail kubelet initialization by default, kube-proxy IPVS mode is deprecated, and Static Pods lose Secret/ConfigMap references in v1.37.
Why Queue Depth Beats CPU as a Kubernetes Autoscaling Signal
KEDA's SQS-based autoscaling replaces CPU and memory metrics with queue backlog — the metric that actually reflects whether an event-driven workload is under load.
Admission Webhooks Have a Bypass Problem — Runtime Verification Fixes It
A new NRI plugin moves supply chain verification below the Kubernetes API server, closing the static-pod and kubelet-bypass gaps that admission webhooks like Kyverno and OPA Gatekeeper can't cover.
Why the controller-runtime Cache Keeps Kubernetes Stable
Every Kubernetes controller reads through a local cache, not the API server directly — the list-watch mechanism that makes that possible, and where it breaks.
The Framework for Zero-Downtime Kubernetes When a Whole Cluster Dies
Linkerd's multicluster extension turns cluster failure from a runbook into an automatic rebalance — three federation modes, chaos-tested, for $10-15/day.
Kubeflow + Cilium: Why Your GPUs Sit 60% Idle
GPUs sat at 40% utilization while fully scheduled: a hidden Cilium network policy was silently blocking Kubernetes gradient sync.
Kubernetes Didn't Fix Databases. It Just Hid the Problem
Kubernetes makes deploying Postgres trivial, but a failed failover can corrupt data in minutes. See why platform teams, not app teams, must own database ops.
The Quorum Math Behind Multi-Cluster Kubernetes Databases
CNCF's architecture guide shows multi-cluster Kubernetes databases survive regional failure on vote count, not node count: an odd, cross-cluster quorum design.
Is a Kubernetes Pod the Right Deployment Unit for an AI Agent?
CNCF's kagent team asks whether Pods — ideal for long-lived microservices — are the right abstraction for AI agents that wake briefly, execute, and go idle. Their answer: probably not.
What Running Kubernetes at Million-Cluster Scale Taught AWS About Zonal Failures
AWS operates hundreds of thousands of EKS clusters across 30+ regions. The core lesson from that scale: most availability problems don't come from components failing — they come from components reacting in ways that make failures worse. Here's what static stability means in practice.
Sandboxing Your AI Agents Is Necessary. It's Not Enough.
CNCF's July 2026 analysis of production agent fleets identifies the gap that sandboxing alone leaves open: resource efficiency at scale. Isolation solves security. Serverless-style runtimes solve the fleet management problem. You need both.
Platform Engineering 2.0: Five Pillars for AI-Native Workloads
Platform Engineering 1.0 solved developer delivery. Platform Engineering 2.0 must solve GPU allocation, model serving, agentic governance, and FinOps for AI consumption. Here's the framework.
Data Sovereignty Is No Longer a Geography Problem — It's an Architecture Problem
The EU's Cloud and AI Development Act reframes data sovereignty as jurisdictional control, not physical location. Here's how platform engineers are enforcing it through Kubernetes admission controllers, OpenStack, and policy-as-code.
kpt Joins CNCF: The Kubernetes Config Toolchain That Shows You What You're Deploying Before You Deploy It
kpt's CNCF sandbox debut reintroduces a Kubernetes configuration toolchain built around WYSIWYG deployment — you inspect the final manifest before it hits the cluster, not a template that generates it.
AWS EKS Kubernetes Version Rollbacks: Upgrading Is No Longer a One-Way Door
Amazon EKS now lets teams reverse a Kubernetes version upgrade within 7 days. Here's how rollback works, what the limits are, and what it changes for platform engineers.
AWS Certificate Manager Adds ACME Support for Automated TLS
AWS Certificate Manager now runs a fully managed ACME server endpoint — automating TLS certificate issuance and renewal via Certbot, cert-manager, or any ACMEv2 client.
AWS, Google, and Microsoft All Agree the Session Is the New Unit of Compute. They Can't Agree on How to Isolate It.
All three major clouds have independently arrived at the same architectural conclusion: the AI agent session, not the container or the function invocation, is the fundamental unit of compute. Their isolation approaches couldn't be more different.
Building a Cluster-Aware AI Agent with Kubernetes, Argo CD, and GitOps
A CNCF reference architecture shows how to run an AI agent inside a Kubernetes cluster that observes live state, diagnoses pods via RAG, and delivers updates through a full GitOps pipeline — without write access to the cluster.
Why Verifying AI Agents Is a Runtime Problem, Not a Build-Time One
Static testing and pre-deployment checks were built for synchronous, deterministic software. Async AI agents in cloud-native environments require a fundamentally different verification model — one that operates at runtime.
AWS Extends Its DevOps Agent to Diagnose EKS Node Issues via Custom MCP
A custom MCP server bridges AWS DevOps Agent to SSM Automation runbooks, giving the agent structured access to 20+ OS-level log sources — and it completed an autonomous DNS root-cause analysis in 14 minutes.
How to Secure Kubernetes in the Age of AI Workloads: A Four-Layer Approach
AI agents on shared Kubernetes clusters are dynamic, bursty, and frequently egress-heavy — a threat surface that traditional NetworkPolicy wasn't designed for. Here's the four-layer approach that addresses it.
Cloud Native Is Now AI-Native: Three Kubernetes Primitives That Don't Work for AI
A KubeCon roundtable with AWS, Google, and Microsoft engineers identified the specific Kubernetes gaps holding back production-ready AI — and the primitives being built to close them.
Kubernetes Dashboard Is Archived — Headlamp Is the Official Successor
The Kubernetes Dashboard project has been formally archived. Headlamp, its successor, adds multi-cluster support, application-centric views, and a plugin system while preserving the familiar single-cluster workflows.
The Three-Layer IDP That Cut Deployment Failures from 30% to 5%
Separating infrastructure, platform, and application layers in a Kubernetes IDP cut deployment failures from 30% to 5% and provisioning time from hours to 15 minutes. Here's the full architecture.
Kubernetes Autoscaling at Scale: The Datadog Approach
From bulk UI activation to GitOps cluster profiles: how Datadog deploys Kubernetes autoscaling across an entire fleet without per-service configuration handoffs or manual YAML.
Inference-Aware Routing for LLMs: What Datadog Now Monitors
Kubernetes Inference Extension routes LLM traffic by KV cache state and LoRA adapter availability. Datadog surfaces the metrics that reveal whether that routing is actually working.
Helm's Former APT Mirror Was Taken Over. Here's What to Check.
The baltocdn.com domain that hosted Helm packages changed ownership May 19, 2026 and may be serving malicious content. Audit your CI pipelines, Dockerfiles, and scripts now.
The Kubernetes Integration Tax: What Tutorials Never Show You
Platform teams spend 80% of their time wiring CNCF tools together, not installing them. Here's where Prometheus, Cilium, and cert-manager actually fail in production.
Kubernetes v1.36: The Route Sync Metric That Quantifies CCM Waste
A new alpha counter in Kubernetes v1.36 makes the efficiency gap between default and watch-based route reconciliation observable — and reveals that a stable cluster generates 120 unnecessary syncs for every 1 actually needed.
Kubernetes Cloud Waste: The 65% Problem Nobody Wants to Fix
Kubernetes clusters run at 20-35% utilization. The tools to fix it deliver 50-70% savings. The blocker isn't tool maturity — it's operational trust, and the market is now building around that insight.
GPU Autoscaling on Kubernetes with KEDA: Why CPU Metrics Fail AI Inference Workloads
KEDA's GPU external scaler reads VRAM and compute utilization via NVML, enabling scale-to-zero for AI inference pods — a different model than CPU-based Kubernetes HPA.
Migrating From ingress-nginx to Envoy Gateway Without Dropping a Single Request
How weighted Route 53 DNS records enable zero-downtime Kubernetes ingress migration from ingress-nginx to Envoy Gateway — and where the naive approach fails.
Kubernetes Policy Enforcement Is Happening at the Wrong Stage of Development
Review-time Kubernetes policy enforcement fills the gap between IDE linters and admission controllers. Here's how the four-layer model and GuardOn address it.
Azure Kubernetes Fleet Manager Gets Cilium Cross-Cluster Networking
Azure Kubernetes Fleet Manager now spans clusters with Cilium-based cross-cluster networking. What changes for multi-cluster workload architecture.
End-to-End Ingress Tracing for Multi-Tenant SaaS: Why Adoption Is the Hard Part
Trace ID + Span ID propagation for multi-tenant SaaS on Kubernetes. Why the organizational adoption challenge beats the technical implementation every time.
Azure Fleet Manager: How Microsoft Governs Thousands of K8s Clusters
Azure Kubernetes Fleet Manager governs thousands of K8s clusters via hub-spoke declarative policies — where GitOps' single-cluster model breaks down.
CNCF Fluid: Cutting LLM Cold Start on Kubernetes from 42 Minutes to 30 Seconds
CNCF Fluid reduces LLM cold start on Kubernetes from 42 minutes to 30 seconds via prefetching and elastic cache, with no code changes required.
Kubernetes v1.36 Declarative Validation: Retiring 18,000 Lines of Code
Kubernetes API validation graduated to GA — a code generator now replaces 18K lines of handwritten Go. What platform teams gain from the shift to marker-based validation.
Deloitte Cut Kubernetes Test Environment Provisioning From 45 Minutes to Under 5
Deloitte replaced dedicated EKS clusters per test environment with vCluster virtual clusters on a shared host — cutting provisioning from 45 minutes to under 5, and saving 500 QA hours annually.
k0s and k0rdent: Kubernetes Multi-Cluster Management Without the Control Plane Tax
k0rdent and k0s: how Hosted Control Planes remove the per-cluster overhead that makes Kubernetes fleet management expensive for platform teams.
KubeStellar: 81% PR Acceptance in 82 Days Using AI Coding Agents
KubeStellar's AI Codebase Maturity Model achieved 81% PR acceptance in 82 days — not by using better models, but by building better infrastructure around them.
Groundcover: Observability Built for Agentic AI Workloads, Not Just Microservices
Groundcover's eBPF-based observability platform is rebuilding its architecture for agentic AI — token cost tracking at span level, multi-step agent tracing, and 95% network cost reduction via BYOC.
EKS Auto Mode: AWS Takes Over Kubernetes Node Management
Amazon EKS Auto Mode handles node provisioning, patching, scaling, and lifecycle automatically — built on Karpenter but fully managed. Here's what changes for platform teams and what doesn't.
Ingress NGINX Is EOL: What the K8s Gateway API Migration Actually Requires
Ingress NGINX reached end-of-life in March 2026 with unpatched critical CVEs. Kubernetes Gateway API is the designated successor — here's what the migration breaks and what Datadog maps out.
Velero Joins CNCF Sandbox: What the Broadcom Donation Means
Broadcom donated Velero to the CNCF Sandbox at KubeCon Europe. For platform teams running Kubernetes, here's what the governance change means.
KubeCon 2026: Kelsey Hightower on AI and the Expertise Reset
Kelsey Hightower at KubeCon: when AI moves this fast, expertise resets. What 'everyone is junior on AI' means for platform engineering teams building on open source.
LLMs on Kubernetes: The Four Threats That Actually Matter
Kubernetes has no visibility into what LLM workloads do. CNCF maps OWASP's Top 10 LLM risks to the infrastructure patterns platform teams already know.
The $43,800 Hidden Tax on Kubernetes: How Virtual Clusters Fix Platform Team Sprawl
Cluster sprawl consumes 25–30% of platform engineering time. Virtual clusters eliminate the hidden tax — without sacrificing the isolation teams actually need.
The Platform Under the Model: Why Cloud Native Infrastructure Determines AI Production Success
82% of container users run Kubernetes in production. Only 41% of AI developers identify as cloud native. That gap is where most AI production failures happen.