Week 36, Aug 31 - Sep 6, 2026

This week: 57 releases, 168 news items.

👋 Welcome

This week in Cloud Native saw the release of Kubernetes v1.37.0, introducing new features and API stability advancements. OpenTelemetry officially achieved CNCF graduated status, marking a milestone in the observability space. Additionally, multiple projects released security updates and bug fixes, while discussions continued around integrating AI into Kubernetes environments and developer workflows.

🚀 Notable Releases

CI/CD

Container Runtime

Networking

  • Envoy v1.39.1 - Addresses security vulnerabilities CVE-2026-73511 (URL normalization) and CVE-2026-73512 (HTTP/3 UAF).
  • Envoy v1.38.4 - Addresses security vulnerabilities CVE-2026-73511 (URL normalization) and CVE-2026-73512 (HTTP/3 UAF).
  • Envoy v1.37.6 - Addresses security vulnerabilities CVE-2026-73511 (URL normalization) and CVE-2026-73512 (HTTP/3 UAF).
  • Envoy v1.36.10 - Addresses security vulnerabilities CVE-2026-73511 (URL normalization) and CVE-2026-73512 (HTTP/3 UAF).
  • Istio 1.30.4 - Refers to external release notes for details.
  • Istio 1.29.7 - Refers to external release notes for details.
  • Submariner v0.24.1 - A maintenance release.

Orchestration

  • Kubernetes v1.37.0 - Introduces Pod Certificates, Cluster Trust Bundles, and graduates the Metrics API to stable (v1).
  • Volcano v1.15.2 - Addresses a security vulnerability (GHSA-j38h-7pfq-cxmw) related to excessive iteration in DRA capacity accounting, which could allow authenticated tenants to exhaust scheduling resources, and includes multiple bug fixes.
  • Volcano v1.14.5 - Includes bug fixes for nil-pointer panics, node allocation errors, and device feasibility rechecks after tentative reclaim evictions.
  • Volcano v1.13.4 - Includes bug fixes for victim reprieve order in preemption, HAMi vGPU scheduling failures, unbounded job.Status.Conditions growth, and treating succeeded pods as ready for job dependencies.
  • Capsule v0.14.3 - Fixes an issue allowing replications to own replications without blocking controller updates.
  • Capsule v0.14.2 - Removes resource rejection checks.
  • Capsule v0.14.1 - Adds external IP support to the rules API and migrates to a dedicated resource quota controller.
  • K3s v1.36.4+k3s1 - Updates Kubernetes to v1.36.4 and includes a breaking change from the Traefik chart v40.x upgrade, which renames the ingress-nginx provider from kubernetesIngressNginx to kubernetesIngressNGINX.
  • K3s v1.35.8+k3s1 - Updates Kubernetes to v1.35.8 and includes a breaking change from the Traefik chart v40.x upgrade, which renames the ingress-nginx provider from kubernetesIngressNginx to kubernetesIngressNGINX.
  • K3s v1.34.11+k3s1 - Updates Kubernetes to v1.34.11 and includes a breaking change from the Traefik chart v40.x upgrade, which renames the ingress-nginx provider from kubernetesIngressNginx to kubernetesIngressNGINX.
  • Kind v0.33.0 - Contains dependency updates and bug fixes, with the default node image now kindest/node:v1.37.0.

Security

  • Open Policy Agent (OPA) v1.20.1 - Fixes a regression introduced in v1.20.0 concerning number comparison with float values.
  • Open Policy Agent (OPA) v1.20.0 - Introduces new Rego keywords and and or, restricts remote JSON Schema $ref fetching with allow_net, provides coverage reports that explain why a range is not covered, and improves partial evaluation performance.
  • Keycloak 26.7.3 - Addresses security fixes, including CVE-2026-35563, where the LDAP client implementation did not verify server certificates against the intended LDAP hostname.
  • OpenFGA v1.19.0 - Adds configurable pipeline optimization for specific graph edges (internal only) and fixes a validation-ordering defect that could cause WriteAuthorizationModel to panic.
  • External Secrets v2.10.0 - General release notes for the External Secrets project.
  • External Secrets helm-chart-2.10.0 - Helm chart release for external secrets management in Kubernetes.

Database

  • TiKV v8.5.8 - Includes new features, improvements, and bug fixes, with details available in the TiDB v8.5.8 release notes.

Build

  • Backstage v1.51.3 - Includes a robustness improvement in the Catalog, specifically improved validation of catalog entity placeholder paths.
  • Backstage v1.50.5 - Contains security fixes.
  • Backstage v1.49.6 - Contains security fixes.
  • Backstage v1.54.6 - Includes validation, permission handling, and robustness improvements across Backstage, with specific updates to Scaffolder task visibility, ordering, retry behavior, and the addition of an opt-in scaffolder.requireScmUserCredentials setting.
  • Backstage v1.53.2 - Includes robustness improvements across the Scaffolder and Catalog, with updates to task response serialization and permission evaluation in the Scaffolder, and improved validation of catalog entity placeholder paths.
  • Backstage v1.54.5 - Fixes issues related to catalog import owner autocomplete writing canonical group entity references, normalization of legacy owner filters, and ownership card links filtering by canonical owner entity references.
  • Backstage v1.54.4 - Fixes software template inline conditionals without an else branch to render an empty string when the condition is false.

Configuration

  • Baremetal Operator v0.13.3 - Adds delete permission to hostupdatepolicies.metal3.io and bumps dependencies including k8s.io/api and Go version to 1.25.13.
  • Baremetal Operator v0.12.7 - Adds delete permission to hostupdatepolicies.metal3.io and bumps dependencies including CAPI and Go version to 1.25.13.

Messaging

  • NATS Server v2.14.6 - Improves constant-time removal from service import response maps, reduces client buffer deadline resets, and ensures correct freeing of client write buffers. Requires Go 1.26.7.

Storage

  • OpenEBS v4.6.0 - Bundles updated engine versions including Replicated PV Mayastor v2.12.0, Local PV ZFS v2.11.0, and Local PV LVM v1.10.0.

Application Frameworks

  • Spin v4.1.0 - A stable release that includes instructions for verifying release signatures using cosign.

📰 This Week in Cloud Native

The Cloud Native landscape saw significant activity this week, particularly with the release of Kubernetes v1.37.0. This new version stabilizes the metrics.k8s.io API to v1 and introduces Pod Certificates and Cluster Trust Bundles, enhancing security and operational capabilities. Concurrently, Kubernetes is undergoing internal cleanup, deprecating legacy components like kube-DNS, IPVS, and cgroup v1 as it evolves. The broader Kubernetes ecosystem continued to address operational challenges, with discussions on running SQLite applications using Litestream, sanitizing manifests, and simplifying infrastructure-as-code with tools like Infra Lang. AWS also released guidance on establishing break-glass access for Amazon EKS to mitigate federated identity provider outages.

A major theme this week was the increasing integration of AI within Cloud Native environments. The CNCF published several articles discussing how Kubernetes platforms are adapting to support AI workloads, including predictive autoscaling for GPUs and building “AI factories” on Kubernetes. This highlights the technical requirements for managing large-scale AI infrastructure, such as pooled GPU resources for diverse tasks like fine-tuning, inference, and evaluation. The intersection of AI and developer workflows also gained traction, with Microsoft announcing public previews of GitHub Copilot Code Reviews for Azure Repos and Azure DevOps integration with the GitHub Copilot app, aiming to streamline development processes.

Observability and security remained critical areas of focus. OpenTelemetry achieved CNCF graduated status, signifying its maturity and widespread adoption as a standard for collecting telemetry data. However, discussions also acknowledged the growing data challenges for observability, particularly with the influx of AI-generated telemetry. In security, several projects, including Envoy, Volcano, and Keycloak, released updates addressing specific vulnerabilities, such as URL normalization issues, denial-of-service risks in resource allocation, and LDAP client certificate verification flaws. Beyond project releases, general security advice emphasized the need to address long-standing vulnerabilities and manage credentials effectively, as seen in guidance for eliminating long-lived GCP service account keys with Workload Identity Federation.

💬 Community Buzz

Discussions on Hacker News centered on the Kubernetes v1.37 release, alongside broader topics such as Docker security, including rootless containers and microVM daemons. The impact of AI on coding and developer productivity was a recurring subject, alongside debates about AI agent design, memory management, and novel LLM interfaces. Several new open-source projects were showcased, ranging from infrastructure-as-code DSLs to agent orchestrators and specialized developer tools.

📊 Numbers of the Week

  • Total stable releases: 43 across 20 projects
  • Top 3 projects by commits this week:
    1. cilium/cilium — 175 commits
    2. kubernetes/kubernetes — 142 commits
    3. meshery/meshery — 139 commits
  • Top 3 projects by merged pull requests this week:
    1. cilium/cilium — 132 merged PRs
    2. envoyproxy/envoy — 130 merged PRs
    3. kubernetes/kubernetes — 110 merged PRs

📚 View all articles from this week →