Week 39, Sep 21-27, 2026

This week: 65 releases, 169 news items.

👋 Welcome

This week in Cloud Native saw significant updates across core projects, with Kubernetes v1.37 features graduating to Beta, including Memory QoS and Pod-Level Resource Managers. Security remained a focus, with several projects releasing patches for vulnerabilities and hardening container environments. The ecosystem also saw continued discussion around AI agent integration and infrastructure.

🚀 Notable Releases

Security

Networking

  • cilium/cilium v1.20.2 - Adds a Gateway API node label selector for hostNetwork and fixes IPAM bugs in AWS ENI mode where the operator attempted to release prefix IPs as individual IPs when in use.
  • cilium/cilium v1.19.8 - Fixes AWS IPAM issues where the operator failed to allocate new IPs to nodes with prefix delegation on subnets that ran out of prefixes, and addresses an agent crash when dumping map events.
  • cilium/cilium v1.18.14 - Fixes AWS IPAM issues where the operator failed to allocate new IPs to nodes with prefix delegation on subnets that ran out of prefixes, and addresses an agent crash when dumping map events.
  • kubeovn/kube-ovn v1.15.27 - Updates OpenTelemetry dependencies to patched versions and hardens the initial OVN monitor setup against startup stalls.
  • kubeovn/kube-ovn v1.16.6 - Prevents the initial OVN monitor setup from blocking indefinitely when a connection or server startup stalls.
  • kubeovn/kube-ovn v1.14.44 - Updates OpenTelemetry dependencies to patched versions and hardens the initial OVN monitor setup against startup stalls.
  • kubeovn/kube-ovn kube-ovn-v2-v1.14.44 - Helm chart for Kube-OVN.
  • kubeovn/kube-ovn kube-ovn-v1.14.44 - Helm chart for Kube-OVN.
  • kubeovn/kube-ovn v1.16.5 - Replaces the historical underlay ARP flood option with the upstream OVN northd behavior that forwards broadcast ARP/ND requests to MC_UNKNOWN.
  • kubeovn/kube-ovn v1.15.26 - Replaces the historical underlay ARP flood option with the upstream OVN northd behavior that forwards broadcast ARP/ND requests to MC_UNKNOWN.
  • kubeovn/kube-ovn v1.14.43 - Backports the upstream northd change that forwards broadcast ARP/ND requests to MC_UNKNOWN and adds OCI labels to container images.
  • kubeovn/kube-ovn kube-ovn-v2-v1.14.43 - Helm chart for Kube-OVN.
  • kubeovn/kube-ovn kube-ovn-v1.14.43 - Helm chart for Kube-OVN.
  • kube-vip/kube-vip v1.2.4 - Fixes DNS lookup issues, specifically comparing IP families case-insensitively, and adds a fallback to regular BGP if MP-BGP cannot be configured.

Container Runtime

  • containerd/containerd v2.4.0 - A non-LTS release that may include breaking changes due to the removal of previously deprecated features. Users should review deprecation warnings before upgrading.
  • containerd/containerd api/v1.12.0 - Aligns with containerd 2.4 release, includes media type in content create events, adds UpdateSandbox RPC, and allows specifying parent checkpoint directory during checkpointing.
  • cri-o/cri-o v1.37.0 - General updates for the container runtime.

Orchestration

  • projectcapsule/capsule v0.14.6 - Improves admission messages for rules, fixes metadata audience inheritance for managed metadata, allows updates to namespace node-selector annotation, and reduces tenant rule reconciliation.

Observability

Database

Build

  • backstage/backstage v1.55.0 - Removes several deprecated features from @backstage/plugin-catalog-backend, including the catalog.enableRelationsCompatibility config option.
  • backstage/backstage v1.54.8 - Improves validation of Sentry API settings and handling of TechDocs MkDocs plugin configuration.
  • backstage/backstage v1.50.6 - Improves how TechDocs handles MkDocs plugin configuration.
  • containers/buildah v1.45.1 - Bumps golang.org/x/crypto to v0.56.0 to address CVE-2026-78662 and CVE-2026-56855, and incorporates fixes from GHSA-3528-5p26-cf44.
  • containers/buildah v1.43.4 - Bumps golang.org/x/crypto to v0.56.0 to address CVE-2026-78662 and CVE-2026-56855, and incorporates fixes from GHSA-3528-5p26-cf44.
  • containers/buildah v1.43.3 - Fixes packit, updates rpm/buildah.spec tests to require xz and /usr/bin/selinuxenabled, and adds new CI GitHub actions.

Chaos Engineering

  • litmuschaos/litmus 3.32.0 - Generalizes OIDC/Dex naming, adds unit tests for StatusBadgeV2 component, and adds required permissions to top-level and jobs in the workflow.

Configuration

Messaging

  • nats-io/nats-server v2.15.0 - Updates Go version to 1.27.1 and introduces a new desired state reconciliation engine for JetStream.
  • nats-io/nats-server v2.14.7 - Updates Go version to 1.26.8 and includes dependency updates for github.com/antithesishq/antithesis-sdk-go, github.com/klauspost/compress, golang.org/x/crypto, golang.org/x/sys, and golang.org/x/time.

CI/CD

  • opencost/opencost v1.121.3 - Adds support for label aliases in allocation autocomplete, changes local disk pricing in Kubemodel, reads GCP cloud configuration field ExcludePartitionTime, and includes marketplace fees for AWS.

Service Mesh

  • kumahq/kuma v2.14.5 - Bumps golang.org/x/crypto and google.golang.org/grpc, includes security updates, and fixes an issue where zone was not always rendered in a zone overview.

Edge

Container Tools

Backup

  • vmware-tanzu/velero v1.18.3 - Avoids duplicated InitContainer names generated during CLI installation and bounds WaitRestoreExecHook polling with resourceTimeout to prevent infinite waits.

📰 This Week in Cloud Native

The Kubernetes ecosystem saw significant advancements with the release of v1.37. Key features graduating to Beta include Pod-Level Resource Managers, which enhance resource allocation at the pod level, and Memory QoS, which provides the kernel with better guidance on memory management on Linux nodes using cgroup v2. Additionally, new storage security features, emptyDir permission modes and bind mount options, were introduced to harden container storage. The Changed Block Tracking API for CSI drivers also moved to Beta, indicating increased stability for block-level data change tracking.

In the realm of AI and Cloud Native, there was a focus on integrating AI agents into development and operational workflows. AWS announced capabilities for running self-hosted AI agent sandboxes using Lambda MicroVMs, emphasizing secure and isolated execution environments for tool calls. Discussions also emerged around the cost implications of running AI inference on Kubernetes, highlighting the need for accurate cost accounting in such environments. Google Firebase introduced cost caps for AI and hosting, providing developers with more control over backend expenses.

Security remained a prominent theme, with several reports and discussions on vulnerabilities and data practices. News surfaced about an incident where AWS cloud infrastructure in Bahrain and parts of the UAE was reportedly destroyed, underscoring the importance of disaster recovery planning. Additionally, concerns were raised regarding data retention policies, particularly with Google AI Studio. The CNCF blog featured a post on running OpenBao on Kubernetes with CloudNativePG, promoting self-healing and vendor-lock-in-free secrets management. Container security also saw attention, with discussions on how buildpacks can help enterprises operate security controls at scale.

Observability and developer experience also received updates. The CNCF blog detailed a large-scale migration to OpenTelemetry for metrics, showcasing its adoption for platform-wide observability. Community events, such as KCD Lima 2026, highlighted ongoing efforts to foster local cloud native communities.

💬 Community Buzz

Hacker News discussions this week covered several cloud native topics, including Kubernetes security hardening for emptyDir and bind mounts, methods for suppressing vulnerabilities in Kubernetes context scans, and the concept of secure VMs for Kubernetes using Kata Containers. There was also discussion around escaping Docker’s hypervisor and the implications of unisolated Docker sockets in AI agent harnesses. Other topics included building distributed systems from scratch and selecting between AWS ECS and EKS.

📊 Numbers of the Week

  • Total stable releases: 50 across 20 projects
  • Top 3 projects by commits this week:
    1. backstage/backstage — 205 commits
    2. cilium/cilium — 148 commits
    3. kubernetes/kubernetes — 142 commits
  • Top 3 projects by merged pull requests this week:
    1. keycloak/keycloak — 166 merged PRs
    2. cilium/cilium — 127 merged PRs
    3. envoyproxy/envoy — 89 merged PRs

📚 View all articles from this week →