Week 37, Sep 7-13, 2026

This week: 49 releases, 162 news items.

👋 Welcome

This week saw a series of security and patch releases across container runtimes, including containerd and CRI-O, addressing various fixes. Kubernetes v1.37 introduced significant advancements, with Kubelet’s rootless mode and HPA scale-to-zero graduating to Beta, and Storage Version Migration reaching General Availability. The Cloud Native ecosystem also focused on AI integration, discussing infrastructure challenges for heterogeneous compute, fast model loading for inference, and the role of AI agents in development and operations. OpenTelemetry officially achieved CNCF graduated status.

🚀 Notable Releases

Container Runtimes

  • containerd v2.3.5 - Includes security updates (CVE-2026-53495, GHSA-rp3h-jf77-q9p4) and hardening for stripping sensitive authentication data during image distribution.
  • containerd v2.2.8 - Provides security updates (CVE-2026-53495, GHSA-rp3h-jf77-q9p4) and hardening for sensitive authentication data in image distribution.
  • containerd v2.0.12 - Contains security updates (CVE-2026-53495, GHSA-rp3h-jf77-q9p4) and hardening for stripping sensitive authentication data during image distribution.
  • containerd v1.7.35 - Delivers security updates (CVE-2026-53495, GHSA-rp3h-jf77-q9p4) and hardening for sensitive authentication data in image distribution.
  • cri-o v1.36.5 - A patch release addressing bug fixes and regressions.
  • cri-o v1.35.8 - A patch release containing various fixes.
  • cri-o v1.34.13 - A patch release with fixes and updates.
  • Podman v6.1.1 - Addresses CVE-2026-17106, which prevented crafted tar archives from writing outside extraction directories. Fixes rootlessport bind behavior for separate IPv4 and IPv6 bindings.

CI/CD

  • Flux2 v2.9.5 - Moves helm-controller and source-controller to upstream Helm v4.2.4. Hardens kubeconfig Secret handling in helm-controller and kustomize-controller to reject local filesystem references and require inline credentials/certificates. Stops kustomize-controller from retaining previous temporary directories.

Service Mesh

  • Istio 1.31.0 - A new minor release for the service mesh.
  • Kuma v2.14.4 - Bumps dependencies including coredns to v1.14.7, Envoy from 1.38.3 to 1.38.4, cilium/ebpf from 0.21.0 to 0.22.0, and google/cel-go from 0.29.0 to 0.30.0.

Orchestration

  • Karmada v1.19.0 - A new minor release for multi-cluster Kubernetes orchestration.
  • Karmada v1.18.3 - A patch release with various updates.
  • Karmada v1.17.6 - A patch release with various updates.
  • Karmada v1.16.9 - A patch release with various updates.
  • Capsule v0.14.4 - Addresses GHSA-2vqc-26cg-wpxg, preventing namespaced tenant reads of capsule-controller process environment/secrets due to a template sanitizer issue. Fixes validation of only changed metadata on updates.

Security

  • Open Policy Agent v1.20.2 - Fixes a parser regression from v1.20.0, resolving stale parse errors on statements starting with { when and/or keywords are imported. Includes dependency updates.
  • Kubescape v4.0.13 - Adds C-0298 for detecting subjects that can attach ephemeral containers to pods. Introduces RBAC-police rules for impersonate, token-mint, escalate, bind, node-proxy, and PV create. Adds opt-in audit for posture exceptions.
  • Python-TUF v7.0.1 - Fixes hash method on Role and DelegatedRole, corrects a dependency range for urllib3, improves ngclient connection exception handling, resolves incorrect delegation in diamond-shape cases, and avoids symlink use on Windows.

Observability

  • OpenTelemetry Collector v0.160.0 - Deprecates flat idle_conn_timeout and max_idle_conns fields in HTTP client and server configurations, favoring a new keepalive section.

Storage

  • Rook v1.20.7 - A patch release for the Ceph operator. Improvements include skipping election strategy changes when stretch mode is enabled, muting health warnings in cluster reconcile, updating CSI to v3.17.1 for AES256K compatibility, and explicitly setting the root user for the chown initContainer.
  • Rook v1.19.11 - A patch release for the Ceph operator. Improvements include updating CSI to v3.16.3 for AES256K compatibility, skipping election strategy changes when stretch mode is enabled, muting health warnings in cluster reconcile, and unsetting the Rook MGR module when disabled.

Database

  • Vitess v24.0.3 - Removes the VRLog feature, which provided a streaming log of VReplication events at VTTablet’s /debug/vrlog HTTP endpoint. The --vreplication-enable-http-log flag is now a deprecated no-op.
  • Vitess v23.0.6 - Removes the VRLog feature and deprecates the --vreplication-enable-http-log flag.
  • CrateDB 6.4.4 - A patch release for the distributed SQL database.
  • ScyllaDB Operator v1.22.0 - A new minor release for the ScyllaDB Kubernetes operator.

Configuration

  • Cloud Custodian 0.9.52.0 - Adds tagging for AWS Bedrock resources and a delete action for AWS VPC endpoints. Fixes the account service-limit filter for GovCloud support.
  • Metal3-io Baremetal Operator v0.13.4 - Bumps the grpc dependency to v1.83.1.
  • Meshery v1.0.69 - Fixes auto-registration from proceeding after machine initialization failures. Updates github.com/gorilla/websocket from 1.5.0 to 1.5.3.

Networking

  • Container Networking Interface (CNI) v1.3.1 - Clarifies language regarding DEL and prevResult in the specification. Adds error codes for the STATUS verb to types.go and SPEC.md.
  • Kube-OVN v1.16.3 - Fixes reconciliation of missing node logical switch ports and refreshes announced next hops during speaker reconcile.
  • Kubernetes Gateway API v1.6.2 - Updates HTTPRequestRedirectFilter status codes 303, 307, and 308 to Extended conformance. Fixes flaky TCPRouteWeightedRouting and UDPRouteWeightedRouting conformance tests with a data-plane readiness check. Addresses FailFast behavior and allows disabling parallel tests.

Application Frameworks

  • Fermyon Spin Canary - A canary release reflecting recent commits on the main branch, intended for developers to test features that may not be fully implemented.

Cluster Management

  • Kubernetes-sigs Cluster API v1.14.1 - Extends management cluster support to v1.33.x -> v1.37.x and workload cluster support to v1.31.x -> v1.37.x. Includes fixes for 5 bugs, such as not using cache with the CRD migrator and executing /etc/kubeadm.sh via /bin/bash for /etc noexec compatibility.

📰 This Week in Cloud Native

This week, the Cloud Native landscape saw significant developments in Kubernetes capabilities, AI infrastructure, and platform engineering practices. Kubernetes v1.37 introduced several features, including the promotion of KubeletInUserNamespace (rootless mode) to Beta, enabling kubelet and other node components to run as non-root users. The HorizontalPodAutoscaler (HPA) gained Beta support for scaling workloads down to zero replicas, allowing for cost optimization. Storage version migration reached General Availability, providing built-in tools for API object conversion. Additionally, the etcd RangeStream feature, now in Beta, reduces memory consumption in the API server and etcd during large list reads. AWS highlighted the use of Kyverno for automating proxy injection on EKS Fargate and strategies for fast model loading for AI inference on EKS. Microsoft announced Enterprise Live Migrations to GitHub Enterprise Cloud in public preview, focusing on data residency and minimizing disruption.

AI integration within Cloud Native infrastructure continued to be a prominent theme. Discussions focused on the challenges of AI platform engineering, particularly managing heterogeneous infrastructure comprising both CPUs and GPUs for model training and inference. The role of Kubernetes in orchestrating AI workloads was re-emphasized, with attention to optimizing GPU inference cold start times and token usage. The week also saw the official graduation of OpenTelemetry to CNCF status, underscoring its role in providing standardized observability for complex distributed systems. Related discussions explored moving beyond basic metrics to derive meaningful insights from Kubernetes environments and strategies for managing tracing data to avoid overload.

In platform engineering, the concept of maturity models was explored, detailing the progression from fragmented toolchains to self-service platforms. Practical guidance was provided on migrating critical Kubernetes deployments from the default namespace without downtime. The Metal3 project’s integration with KubeVirtBMC was showcased, demonstrating how virtual machines could be provisioned using bare metal-like interfaces. Security considerations for AI agents and the importance of agent observability were also discussed, alongside the need for robust retrieval engineering to scale AI agents effectively.

💬 Community Buzz

On Hacker News this week, discussions centered on Kubernetes debugging and connecting application telemetry to underlying Kubernetes dependencies. The promotion of Kyaml as a method for consistent Kubernetes manifest management was noted, alongside the beta release of HPA scale-to-zero in Kubernetes v1.37. New open-source projects for Kubernetes-native AI multi-model inference (Shaide) and real-time Docker egress inspection via eBPF (Dsnitch) were shared. The community also discussed self-hosted Docker UIs that support rootless mode and solutions for Tailscale integration with Docker services (TSDProxy). Other topics included AI-native development workflows, cost-effective AI models, and local AI desk assistants.

📊 Numbers of the Week

  • Total stable releases: 34 across 24 projects
  • Top 3 projects by commits this week:
    1. kubernetes/kubernetes — 155 commits
    2. cilium/cilium — 152 commits
    3. envoyproxy/envoy — 111 commits
  • Top 3 projects by merged pull requests this week:
    1. cilium/cilium — 138 merged PRs
    2. argoproj/argo-cd — 122 merged PRs
    3. envoyproxy/envoy — 111 merged PRs

📚 View all articles from this week →