This week in Cloud Native saw significant developments in AI integration, with new tools and projects focusing on AI agent management and infrastructure. The Kubernetes ecosystem received updates across various projects, enhancing security, networking, and application orchestration. Additionally, the CNCF reported on community growth and upcoming events.

🚀 Notable Releases

CI/CD

• Argo CD v3.4.6 - This patch release provides installation manifests.
• Argo CD v3.3.13 - This patch release provides installation manifests.

Security

• cert-manager v1.21.1 - Fixes a controller panic for Certificates with spec.renewal.policy: Disabled, resolves log spam and dropped Secret informer events, and addresses Issuers getting stuck at Ready=False when an ACME DNS-01 solver Secret is created after the Issuer.
• Open Policy Agent (OPA) v1.19.0 - Fixes a SQL injection vector in the Compile API, adds stricter safety checking for Rego assignments, replaces wasmtime-go with wazero for a cgo-free WebAssembly runtime, and introduces a new strings.split_n built-in function.
• Kubewarden Controller v1.37.0 - Adds support for context-aware policies when using the kwctl bench command and fixes an issue where stale audit reports were deleted by label selector instead of write-set.

Networking

• Cilium v1.20.0 - This release includes over 2,660 new commits. Users of legacy Mutual Authentication, Envoy Go extensions, Kafka-aware policies, or the cilium.io/v2alpha1 CiliumNodeConfig API may need to take action during upgrade.
• Kube-OVN v1.15.20 - Fixes an issue in MetalLB where internal underlay VIP traffic was not preserved and adds functionality to infer pod subnet from named IPPool.
• Kube-VIP v1.2.2 - Updates k8s.io/client-go from 0.36.1 to 0.36.2 and bumps other Go dependencies.

Registry

• Dragonfly v2.5.1 - Introduces scheduler features for handling local cache in peer registration and upgrading, and implements a sharded keymutex in the peer manager. It also adds capacity and rolling window fields to snapshot statistics for peer piece cost tracking.

Orchestration

• KEDA v2.20.2 - Introduces a dedicated HPAActive condition on ScaledObject that mirrors the HPA’s ScalingActive status, which prevents the Ready condition from flipping to False due to transient HPA metric gaps.
• Karmada v1.18.2 - This patch release includes bug fixes and improvements.
• Karmada v1.17.5 - This patch release includes bug fixes and improvements.
• Karmada v1.16.8 - This patch release includes bug fixes and improvements.
• Volcano v1.15.1 - Upgrades golang.org/x/crypto from v0.49.0 to v0.53.0 for SSH security fixes. Supports both the new vnpus.configs wrapper and legacy array formats for HAMi Ascend vNPU configuration, and recovers from a PVC informer race in addPod.
• Volcano v1.14.4 - Registers PreFilter plugins to skip no-op predicate filters, treats Succeeded pods as ready for job dependencies, fixes potential scheduler panic caused by nil pointers, and honors NeedContinueAllocating after PrePredicate failures.
• Project Capsule v0.13.11 - Improves performance by removing duplicate client calls from all admission paths and corrects tenant ownership resolution with deduplication.

Observability

• Prometheus v3.13.2 - Bumps golang.org/x/text to v0.39.0 (addressing CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (addressing GHSA-hrxh-6v49-42gf). Fixes a PromQL bug by preallocating the active query tracker file to prevent SIGBUS crashes when the data disk is full.
• Thanos v0.42.4 - This release contains no functional changes and addresses broken base image SHAs.
• Thanos v0.42.3 - Fixes a bug to ensure that Receive on shutdown creates a new block and uploads it, preserving previous upload behavior.

Storage

• Rook v1.20.3 - This patch release for the Ceph operator adds toolbox repository and tag settings to Helm, supports multisite CR in the rook-ceph-cluster chart, and enables custom NFS server ports. It also deduplicates external MGR endpoints in EndpointSlice and pool growth prediction series.
• Rook v1.19.8 - This patch release for the Ceph operator updates the Go text module, changes object bucket policy modification to clobber instead of merge, reveals swallowed errors on CephFS reconcile, and ensures volume attachment deletion during unmount.

Build & Container Tools

• Backstage v1.53.1 - Fixes issues where errors in TypeScript configuration schema definitions no longer prevent applications from building or starting, logging them as warnings instead.
• KubeVirt v1.9.0 - This is a promotion of release candidate v1.9.0-rc.2, incorporating 1653 changes from 108 contributors.
• Telepresence v2.31.2 - This release provides updated installation artifacts.
• Telepresence v2.31.1 - This release provides updated installation artifacts.
• Buildah v1.45.0 - Bumps Buildah to v1.45.0-dev and oc/selinux to v1.15.0. Adds a FollowSymlink option to AddAndCopyOptions to allow disabling the dereference of symlinks.
• Skopeo v1.24.0 - Introduces new skopeo copy options: --remove-list-signatures and --strip-removed-platforms.

Messaging

• NATS Server v2.14.4 - Updates Go version to 1.26.5 and various dependencies. The Raft transport layer has been decoupled for improved testing, and the JetStream disk concurrency semaphore has been increased to 4096 slots.
• NATS Server v2.12.14 - Updates Go version to 1.25.12 and various dependencies. The Raft transport layer has been decoupled for improved testing, and the JetStream disk concurrency semaphore has been increased to 4096 slots.

Service Mesh

• Kuma v2.14.2 - Bumps the coredns dependency and includes security updates. Adds a pluggable per-route metadata provider to the API server.
• Kuma v2.13.10 - Bumps coredns, golang.org/x/net, golang.org/x/text, and google.golang.org/grpc dependencies.
• Kuma v2.12.14 - Bumps coredns, golang.org/x/net, golang.org/x/text, and google.golang.org/grpc dependencies.
• Kuma v2.11.18 - Bumps coredns, golang.org/x/text, and google.golang.org/grpc dependencies, and includes security updates.
• Kuma 2.9.19 - Bumps coredns, golang.org/x/text, and google.golang.org/grpc dependencies, and includes security updates.
• Kuma v2.7.29 - Bumps coredns, golang.org/x/net, golang.org/x/text, and google.golang.org/grpc dependencies.

📰 This Week in Cloud Native

This week, the Cloud Native landscape saw a concentrated focus on Artificial Intelligence and its integration with existing infrastructure. The CNCF announced that Kubeflow is advancing its cloud native capabilities for AI workloads and highlighted Subaru’s adoption of cloud native infrastructure to accelerate AI development, which reduced AI container image pull times by 60x. The CoHDI project was accepted into the CNCF Sandbox, aiming to evolve Kubernetes into composable disaggregated infrastructures, a development relevant for AI deployments. News also covered Gartner’s projection that AI is the largest infrastructure project globally, alongside Meta and BlackRock’s plans for a 1-GW data center in Texas, and Nvidia’s negotiations for a substantial guarantee for OpenAI’s access to a 10-Gigawatt data center. OpenAI also reduced API costs, while Amazon reportedly scaled back several of its Nova AI models to focus on a few frontier models. Discussions emerged around designing APIs for AI agents, the security implications of AI-generated software, and approaches to building AI SRE teams.

In the Kubernetes ecosystem, new tools and operational insights were shared. The CNCF published guidance on scaling Kubernetes pods with KEDA based on Amazon SQS queue depth and introduced KubeElasti’s ProbeResponse to prevent health checks from unintentionally scaling services back up from a scale-to-zero state. A sneak peek into Kubernetes v1.37 outlined upcoming features, deprecations, and removals. Additionally, an article explained the internal workings of the controller-runtime cache, and Amazon EKS was noted for its efforts in simplifying and securing cluster lifecycle management during upgrades. A CNCF blog post also detailed runtime supply chain verification using the Node Resource Interface (NRI) for enhanced container security.

Security updates were prominent, with several projects addressing vulnerabilities and strengthening practices. OPA v1.19.0 fixed a SQL injection vulnerability, and Prometheus v3.13.2 included dependency bumps to address CVEs in golang.org/x/text and google.golang.org/grpc. Volcano v1.15.1 upgraded golang.org/x/crypto to incorporate SSH security fixes. Discussions also covered privilege escalation in AWS EKS and the application of Kyverno policies for Kubernetes cluster security. The importance of managing DNS as infrastructure was highlighted, and CISA released a guide to help federal agencies securely use open-source software.

Community and platform developments also occurred. The CNCF reported that Japan’s Cloud Native community has reached nearly 1 million developers, with a significant increase in AI developers leveraging cloud native technologies. The foundation also announced the schedule for the debut Observability Summit Europe. Lima v2.2 was released, adding support for Windows guests and TPM 2.0 emulation, expanding its capabilities for running virtual machines.

💬 Community Buzz

Hacker News discussions this week centered on the tooling and infrastructure for AI agents, including Kubernetes Custom Resource Definitions (CRDs) for agent runtimes, specialized control planes for AI workloads, and local sandbox environments. Other topics included Kubernetes clients focused on application views, methods for securing Kubernetes clusters with policy engines, and the operational aspects of distributed databases like CloudNativePG.

📊 Numbers of the Week

• Total stable releases: 35 across 22 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 152 commits
  2. telepresenceio/telepresence — 94 commits
  3. cilium/cilium — 90 commits
• Top 3 projects by merged pull requests this week:
  1. cilium/cilium — 100 merged PRs
  2. envoyproxy/envoy — 72 merged PRs
  3. kubescape/kubescape — 68 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 32

A complete list of all cloud native articles and news from this week.

Azure DevOps Blog (1)

• Find any commit in seconds: Commit Search comes to Azure DevOps

CNCF Blog (10)

• Scaling Kubernetes pods with KEDA based on Amazon SQS queue depth
• Runtime Supply Chain Verification using the Node Resource Interface (NRI)
• Your Kubernetes health checks are accidentally waking your services. Here’s the fix.
• CNCF and SlashData Report Finds Japan’s Cloud Native Community Reaches Nearly 1 Million Developers
• Subaru Wins CNCF End User Case Study Contest for Accelerating AI Development with Cloud Native Infrastructure
• Welcome CoHDI to the CNCF: Evolving Kubernetes into composable disaggregated infrastructures
• Lima v2.2: Windows guests and TPM 2.0 emulation
• How Japan’s 250% Training Surge is Shaping Global AI Talent
• Kubeflow unveils new cloud native innovations to supercharge AI
• CNCF Announces Schedule for Debut Observability Summit Europe

Hacker News (142)

• Kubeside – a Kubernetes client that shows your app, not your cluster
• Agent Sandbox: A Kubernetes CRD and controller for AI agent runtimes
• Privilege Escalation in AWS Elastic Kubernetes Service (2023)
• Kyverno Policies to Secure Your Kubernetes Cluster
• Triton Control – an open-source control plane for Nvidia Triton on Kubernetes
• Show HN: PidgeIoT – open-source IoT/Embedded device management for all (free*)
• Show HN: Warpgate 0.27 (FOSS Teleport alternative) adds RDP/VNC support
• It was surprisingly hard to break CloudNativePG replication
• Reproducing Split Brain on CloudNativePG
• Show HN: Scalix World – AI native Neo cloud built by two engineers in Rust
• Show HN: Widen – Open-source Mac Postgres GUI with local or cloud text-to-SQL
• Show HN: Local text, image, video, music and 3D from one CLI, no Python
• Condui – A single desktop app for SSH, SFTP, tunnels, Docker over SSH
• The physics of Docker build caching
• Docker alternatives for AI agents: Podman, bwrap and Firejail
• Show HN: Supapool – a Supabase per coding agent in ~400 ms
• Show HN: Flashpaper – Self-destructing secret sharing with no database
• Show HN: Dreeve, a self-hosted dashboard for your sports and fitness data
• Ask HN: How to deal with security implications of running/installing projects?
• Show HN: TaskView – self-hosted project management for teams
• Show HN: DispatchSEO – open-source SEO manager tool for Claude Code
• Show HN: Dn – plan collaboratively, let agents execute
• Show HN: Hotcell – local sandboxes for AI agents
• Nerd culture is murdering intellectuals
• Lightweight Spring Boot Monitoring Without Prometheus and Grafana
• Sam Altman says AI won’t shorten the workweek because humans enjoy being busy
• Show HN: Echologue – the private AI voice journal I built for myself
• Show HN: Open-source Cloudflare deployed agent native task management and wiki
• Show HN: Dozenal – A Game of Spatial Arithmetic
• Show HN: Cockpit for you Claude Code agents in Rust
• The Mistake That Cost Me a Year
• Show HN: SeaTicket – AI agent that resolve GitHub and Discord issues
• What is the downside of coaching that I may not be seeing yet?
• Show HN: Use iPhone’s camera as a lux meter
• Show HN: GlobeHoppr – find a route between cities using limited-distance jumps
• Show HN: STE-Code a distillation and adaptation of ASD-STE100 for code
• Ask HN: When will the AI version of 911 happen?
• Show HN: Cosmos47, a public chronological feed without algorithms
• Show HN: Lorraine, an open source notetaker with speaker recognition
• Show HN: Darkslide – A keyboard-centric photo editor
• Computer History of Yugoslavia
• How Google helped destroy adoption of RSS feeds (2023)
• Italy Blocks Reproductive Health Websites Women on Web and Women Help Women
• Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware
• Schools are adding pepper-spraying drones to help combat active shooters
• How Videos Helped Me Uncover Abuse at an Arkansas Private School
• OpenAI, Anthropic Staff Share Letter Asking US to Help Pace AI Progress
• Bessent and the Fed help Japan reverse months of yen losses
• Musk Plans to Spend at Least $100M to Help Republicans in the Midterms
• Pulverised recycled glass helps boost farm productivity with benefits to soil
• Show HN: NegativeEV – I built a tool to help people see how bad their bets are
• How AI Is Helping One-Person Companies Scale to $1M–and Beyond
• The ‘internet radical’ who helped Microsoft get email and AT&T get online
• CISA Guide Helps Fed Agencies Securely and Effectively Use Open Source Software
• LLMs can’t trade and higher reasoning doesn’t help
• Lasers could help provide fuel for nuclear reactors
• Pokémon is turning to facial recognition scans to help combat scalpers
• Replacing gas stove can help asthmatics as much as some drugs, US experts find
• Proposal wouldn’t hide that a wipe occurred and would help adversaries
• To Find Happiness, I Stopped Talking. It Helped
• AI helps Stanford scientists discover natural Ozempic without usual side effects
• Show HN: UnUI – Help coding agents make better design decisions
• Thymus-derived hormone may help suppress age-related inflammation
• Show HN: Damn Center (the page) – extension that helps centering any website
• When Your Chatbot Is So Eager to Help, It Forgot Whose Side It’s On
• Microfossils Help Crack Mystery More Than 100 Million Years in the Making
• Teen hackers tell BBC how police are helping them use their skills for good
• Guides to help you learn more about Ruby
• Brain waves once seen as noise could help build a biological model of reality
• Hey everyone, wanted to share something I built in case it helps someone here
• Whats: A CLI command explainer, pure man pages, –help outputs
• Ask HN: Can AI breakthroughs in mathematics help non-mathematicians feel better?
• Launch HN: Rise Reforming (YC S26) – Turning Waste Gases into Valuable Chemicals
• Twenty-five years ago it was cryptography, today it’s model weights
• Algorithms on billion-scale graph using 10GB RAM: I love DataFusion
• The time filter in Google Search broke a few days ago
• 60 Years Ago, a Submerged Submarine Circled the Globe for the First Time (2020)
• Firefighter arson a long-standing issue – expert
• A simple clustering algorithm for lists
• Intel unveiled its iconic Core 2 Duo family 20 years ago – dethroned AMD Athlon
• An old-new take on argument parsing in Rust
• the death of uppercase: a bet I made around 20 years ago (that i lost)
• Where Was Your Backyard 145M Years Ago?
• Milky Way flipped in collision with dwarf galaxy 10B years ago
• FAA just made an airplane legal that could not have been certified a month ago
• Show HN: I was tired of opening 2 tabs for every HN link, so I made a userscript
• Show HN: Distilling DeepSeek into GPT-OSS doesn’t transfer censorship. Try it
• Show HN: Kedge – Full-stack cloud with forkable VM snapshots and global SQLite
• Show HN: What should the GUI for AI agents look like?
• Show HN: Yap – OSS on-device voice dictation for macOS with no model to download
• Tell HN: I hate your fuzzy search
• Launch HN: Prized (YC S26) – Let non-engineer staff build secure internal tools
• Launch HN: Tokenless (YC S26) – Automatic model switching to save money
• Ask HN: My domain registrar rug-pulled me for $3000 [fixed]
• Tell HN: Amazonbot aggressively scraping my website and ignoring robots.txt
• Belkin killed my smart switch. I got it working again without their app
• Ask HN: What have you been curious about?
• Show HN: Beakdown – a game inspired by Joust/Skirmish
• How to get more coding productivity with LLMs
• Ask HN: How would you learn AI-assisted development from the ground up?
• Old.reddit.com is now requiring users to log in
• GitHub shadowbanned an NPM package with 37M+ weekly downloads
• Show HN: Hiring Method – a deterministic, math-driven recruitment platform
• Show HN: Tilde Pay – Give your AI agent a bank account to pay for things
• Ask HN: What’s Next for LLMs?
• Show HN: My public second brain – 660 notes, 15 years, open source
• Show HN: I spent 2.5 years developing my 3D portfolio website, all under 5 MB
• Show HN: EvoChess – start with 8 pawns, evolve your army
• ask HN: How do I run Android 15 on a system with Andr 12 vendors?
• Show HN: A Dark Cave – minimalist survival/settlement building game
• Show HN: APIs as First-Class Citizen
• Show HN: Project ESPAÑOL: Find level-appropriate Spanish-language poems
• Show HN: I spent 3 years building the CRM I wanted to use
• OpenAI Usage Reset 4th time in 7d
• Ask HN: What Is Stripe Today?
• Show HN: Kota – Bring AI agent CLIs into the same room
• Show HN: Doodlea.day – A daily step-by-step marker drawing lesson
• Flux9s: A K9s-inspired terminal UI for Flux and GitOps state
• Graph Engineering Needs a Compiler
• Kaisel – Routes as Values. Dart 3 Native Router for Flutter
• Flume Water Monitor 915 MHz Security Is Pretty Good
• I made Squirrel game with Flutter and Flame
• Flue 2.0
• Fluency Is Not Authority: Building Local AI Characters for Signal Drift
• Vakonomic Fluids
• Ask HN: Anyone else tired of brands discontinuing your favorite everyday items?
• Show HN: Penca – branchable, versioned OLTP+OLAP on one open copy of your data
• Ask HN: I lost any interest in technology. What do I do?
• Show HN: Cadence Money – a budgeting app with no AI features, just an MCP server
• AI Automation Without the Hype
• Is AI Capable of Novelty?
• Show HN: Reading Pacer – A “Struggle Detector” for kids learning to read
• Seedance 2.5
• Reddit communities with “sensitive” Trump or Israel-Palestine posts throttled
• Kimi K3 Technical Report
• I built a f.lux alternative because the M5 Max firmware broke existing solutions
• Instrumenting my espresso machine with OpenTelemetry
• Can Grafana Labs’ web testing agents beat Wordle? [video]
• Show HN: Sitrep - AI Copilot For Incidents
• Go LLM SDK for streaming, tool-calling AI backends (plus frontend React lib)
• CLIs in the age of agents: how we designed gcx
• Show HN: Cynative – Read-only CLI in Go that explains your live infrastructure

Heise Cloud (8)

• Europäische Cloud 2026: Anspruch und Wirklichkeit digitaler Souveränität
• Meta und BlackRock bauen 1-GW-Rechenzentrum in Texas
• Microsoft-Aktie zieht nach deutlich gewachsenen Geschäftszahlen kräftig an
• Amazon fährt die meisten hauseigenen Nova-KI-Modelle zurück
• BigQuery DataFrames: Ivan Santa Maria Filho im Gespräch
• Nvidia verhandelt über 250-Milliarden-Dollar-Bürgschaft für OpenAI
• iX-Workshop: IT-Infrastrukturen mit OpenTofu aufbauen und verwalten
• Gartner: KI ist das größte Infrastrukturprojekt der Menschheit

InfoQ Cloud Native (3)

• Presentation: The Free-Lunch Guide to Idea Circularity
• Article: The Hard-Stop Rule: From 3 HCM Monoliths to 120 Domain Microservices
• Presentation: Clean Architecture for Serverless: Business Logic You Can Take Anywhere

Kubernetes Blog (2)

• Kubernetes v1.37 Sneak Peek
• How the controller-runtime Cache Actually Works, and Why Your Controller Does Not Crash the API Server

The New Stack (26)

• Kubernetes upgrades don’t have to break things: How EKS is making cluster lifecycle management simpler and safer
• Designing APIs for agents
• What Claude’s real-world breaches reveal about AI safety tests
• Temporal 5x’d AI spend and doubled revenue. CEO Samar Abbas says he can’t prove they’re connected.
• Forget humans “in” the loop. Harness engineering puts humans “on” the loop.
• Nscale just bought Anyscale. Here’s why it matters for multi-cloud neutrality.
• Gemini Robotics 2 brings us one step closer to physical AGI
• Why your company should (try to) build its own AI SRE
• OpenAI slashes API costs amid rising global competition
• AI-generated software is forcing yet another platform rethink
• OpenAI and Elastic are tackling the AI problem enterprises can’t ignore
• DNS is infrastructure. It’s time to manage it that way.
• Why linting alone can’t govern agentic development
• When do AI agents need permission boundaries?
• IBM says quantum computers are getting harder to verify. That’s progress.
• OpenAI fixed GPT-5.6 Sol’s most frustrating flaw: Burning limits while it waits
• Anthropic backs urgent call for the most powerful AI labs to hit the brakes
• “The beast needs a cage”: Why PortSwigger’s agentic pentesting is kept safe behind bars
• OpenAI, Anthropic, and Cursor all localized pricing for India. Only two focused on value.
• Opus 5 vs. Fable 5: What does half the price buy?
• The AI “vibe shift”: Why NanoClaw and Echo have teamed up to stop the next Hugging Face Breach
• “Stateful systems are incredibly hard to build”: How Perplexity thinks about AI agent sandboxes
• Turning 10x developers into 10x value
• Your team isn’t “ignoring security.” They’re just underwater.
• Kernel of truth: GPT-5.6 Sol can cut its own costs, says OpenAI
• Modus’s operandi: To give AI agents just the right amount of context

← Back to Newsletter

This week saw a series of maintenance releases across core Cloud Native projects, alongside significant developments in the AI and Kubernetes ecosystems. OpenTelemetry achieved CNCF graduated status, while discussions continued on leveraging Kubernetes for AI infrastructure and the evolving landscape of AI agents.

🚀 Notable Releases

Orchestration

• Crossplane v2.3.4 - This patch release addresses user-reported issues, including a fix for repeated owner updates for composed Usages, and incorporates security updates for Crossplane and its dependencies.
• Crossplane v2.2.4 - A patch release focusing on user-reported issues and security updates. It includes a fix for repeated owner updates for composed Usages.
• Crossplane v2.1.8 - This patch release provides fixes for user-reported issues, such as repeated owner updates for composed Usages, and includes security updates for Crossplane’s dependencies.
• Crossplane v1.20.11 - A patch release addressing user-reported issues, including a fix for repeated owner updates for composed Usages, and security updates for Crossplane’s dependencies.
• Kubernetes v1.36.3 - A patch release providing bug fixes and security updates.
• Kubernetes v1.35.7 - A patch release providing bug fixes and security updates.
• Kubernetes v1.34.10 - A patch release providing bug fixes and security updates.
• Capsule v0.13.10 - Adds improved metadata enforcement and ingress rules, new administrator capabilities, leader-election tuning, and managed-by labels for emitted events.

Build

• Dapr v1.18.2 - This update contains bug fixes for SPIFFE SVID component operation propagation, MCP servers with secret-referenced credentials reloading, and actor reminders/jobs failing due to special characters in names or actor IDs.
• KubeVela v1.11.0 - Includes documentation updates, fixes for podDisruptive not triggering pod restarts, and addresses nil pointer panics in getMatchingDefinitionRevision.
• Telepresence v2.31.0 - This release provides official installers with an option to run the root daemon as a system service.
• Buildah v1.44.1 - Adds new CI GitHub actions and fixes an opaque whiteout pull error regression.

Networking

• etcd v3.7.1 - A patch release that includes bug fixes and security updates.
• etcd v3.6.14 - A patch release that includes bug fixes and security updates.
• etcd v3.5.33 - A patch release that includes bug fixes and security updates.

CI/CD

• Flux2 v2.9.3 - This patch release fixes issues with empty lines in rendered Helm chart manifests, HelmReleases being marked as tested when test hooks did not run, and spec.images entries discarding fields.
• OpenCost v1.121.0 - Features KubeModel changes, memory optimizations, and initial implementation for AI inference cost reporting.

Observability

• OpenTelemetry Collector v0.157.0 - Introduces a breaking change by replacing histogram bucket boundaries for otelcol_exporter_queue_batch_send_size_bytes and otelcol_processor_batch_batch_send_size_bytes metrics with a power-of-2 byte-scale set.

Security

• Kubescape v4.0.11 - Adds caching for compiled CEL programs, derives VAP policy metadata from embedded bundles, embeds VAP YAML, expands encryption and decryption coverage for resource metadata, and fixes air-gapped mode issues.
• BOMHort v0.6.1 - A patch release for BOMHort 0.6.0.
• BOMHort v0.6.0 - Rebrands SeeBOM to BOMHort, introduces a faceted global search feature, fixes Kubernetes health probes, and includes security patches across Go, UI, and dependencies. This release requires a one-time migration for existing deployments.

Container Runtime

• Lima v2.2.0 - Adds experimental support for Windows Server 2025 and Windows 11 guests, and introduces an option to opt out of password-less sudo.
• Podman v6.0.2 - Fixes issues related to WSL provider VM cleanup on Windows, incorrect path modification by the Windows installer, and remote client connections.

Configuration

• Baremetal Operator v0.13.2 - This release restores delete permissions on secrets and updates Go and CAPI dependencies.
• Baremetal Operator v0.12.6 - This release restores delete permissions on secrets and updates Go and CAPI dependencies.
• Meshery v1.0.63 - Adds PriorityClass Reference Relationships for Kubernetes Workloads and includes schema updates.
• Meshery v1.0.62 - Introduces a registry purge subcommand to mesheryctl and addresses error notification spam for broken connections and nil machine contexts.
• Meshery v1.0.61 - Fixes environment creation failures on remote providers and migrates UI component authorizations.
• Meshery v1.0.60 - Includes schema updates, purges old model versions, and fixes a variable name typo in the server.

📰 This Week in Cloud Native

The Cloud Native ecosystem saw continued activity this week, particularly in the areas of AI integration, observability, and core infrastructure updates. The Cloud Native Computing Foundation (CNCF) announced that OpenTelemetry has achieved graduated status, signifying its maturity and widespread adoption. Additionally, the CNCF Japan chapter launched an AI Infra Special Interest Group (SIG), aiming to address the growing demand for scalable AI infrastructure using Cloud Native technologies.

Discussions around artificial intelligence and its interaction with Cloud Native architectures were prominent. Several reports explored the role of AI agents, their operational capabilities, and the infrastructure required to support them. Topics included building systems for AI agents, integrating agents with documentation, and the varying approaches taken by cloud providers in offering agent sandboxes. Kubernetes’ role as an infrastructure layer for AI workloads was a recurring theme, with some sources discussing its potential as a “de facto operating system for AI.”

In Kubernetes and cloud operations, Amazon EKS introduced support for Kubernetes version rollbacks within seven days of an upgrade, providing a new recovery option. AWS also announced zone-aware routing in Amazon ECS Service Connect and ARC zonal shift support for EKS Auto Mode and Karpenter, enhancing resilience and operational flexibility. Confidential Containers was accepted as a CNCF incubating project, focusing on protecting data in use within containerized environments. Other notable discussions included multi-cluster database architectures on Kubernetes and the application of policy engines like Kyverno for security and compliance.

💬 Community Buzz

Hacker News discussions this week centered on Kubernetes, particularly concerning self-hosting options, its suitability for various scale deployments, and its evolving role as an AI agent runtime. The emergence of open-weight AI and AI agent development platforms was also a significant topic, alongside debates on container runtimes and the concept of immutable GitOps homelabs.

📊 Numbers of the Week

• Total stable releases: 29 across 13 projects
• Top 3 projects by commits this week:
  1. kubernetes/kubernetes — 461 commits
  2. meshery/meshery — 243 commits
  3. cilium/cilium — 119 commits
• Top 3 projects by merged pull requests this week:
  1. kubernetes/kubernetes — 153 merged PRs
  2. cilium/cilium — 151 merged PRs
  3. kumahq/kuma — 126 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 31

A complete list of all cloud native articles and news from this week.

AWS Compute (1)

• Serverless ICYMI Q2 2026

AWS Containers (3)

• Announcing zone-aware routing in Amazon ECS Service Connect
• ARC zonal shift support for EKS Auto Mode and Karpenter
• JVM memory, CPU, and classpath best practices for Java containers on AWS

Azure DevOps Blog (1)

• July Patches for Azure DevOps Server

CNCF Blog (10)

• My LFX mentorship journey with kgateway
• OpenTelemetry has graduated… Now what?
• Launch of the AI Infra SIG under the CNCF Japan chapter: First meetup and call for speakers
• Sustaining OpenTelemetry: What a 10-week contributor cohort actually looks like
• When Kubeflow meets Cilium: Debugging 60% idle GPUs in Kubernetes
• The future of AI is community driven and open
• Confidential Containers becomes a CNCF incubating project
• Multi-Cluster databases on Kubernetes: Architecture and deployment
• I made a policy engine think it was in production
• Why your agent needs access to your documentation

Hacker News (147)

• Open-weight AI is having its Kubernetes moment
• Cheap self-hosted Kubernetes on Hetzner cloud (2025)
• Nobody needs Kubernetes for eleven users
• K0s – The Zero Friction Kubernetes
• Show HN: Managing on-premise servers without Kubernetes
• I built Kubernetes for Rust. One command deploys your binary to every server
• A production-grade OCR pipeline on Kubernetes with vLLM and Rust
• Cloudfleet – A Freemium Kubernetes Control Plane
• Show HN: Paste a job description, get a broken Kubernetes cluster to fix
• Running Apache DolphinScheduler with Spark on Kubernetes: A Deployment Guide
• Kubernetes won the container decade. Google’s Agent Substrate wants the next one
• Show HN: SquadAI is the Kubernetes-like control plane for Codex agents
• Build a self-scaling OCR pipeline with Qwen 3.5 and Kubernetes
• OpenShell Kubernetes Operator
• Local Kubernetes on Mac: A Multi-Node Cluster with UTM
• Srenix – self-healing Kubernetes in a 30MB binary (Apache-2.0)
• Show HN: The0 – self-hosted runtime for trading bots, bring your own language
• Show HN: We stopped feature-gating our open source BI platform
• Show HN: Avoiding the Memory Wall by computing LLM inference directly inside RAM
• Pip install Postgres – no Docker/Brew/apt
• Show HN: X402vps – Docker containers for AI agents, paid per hour with USDC
• StemDeck: Free local stem separation, DAW mixer, mobile UI, Docker support
• How to Back Up PostgreSQL in Docker (Local, S3, and Plakar)
• ArcBox: From-Scratch Container Runtime for macOS in Rust (Docker, K8s, MicroVMs)
• Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents
• Show HN: Agent in 9 Lines Python
• Show HN: Port Zero – how I learned to stop worrying and love PORT=0
• Show HN: Millwright – Rust-based, self-hosted LLM router
• Show HN: ValuePair – a friendship app that cares about values first
• Show HN: Cygnus – A fast, lightweight self-hostable serverless runtime and PaaS
• Ask HN: What’s your experience with GPT-Live been like?
• Show HN: Working Async – The new wave of remote work is async-first
• Show HN: Codify – Terraform for Developer Environments
• Show HN: I built claw-coder which is the first atonomous local AI agent
• Grok is a surprisingly good automated theorem prover
• Show HN: Ohnrscript – A systems language and HTTP unikernel in JavaScript syntax
• Show HN: Setoku – Self-hosted knowledge server for AI agents
• Laptop Is the New Production Environment
• Decker, a platform that builds on the legacy of Hypercard and classic macOS
• Tell HN: Protect Privacy, Leave FCC Comment, Deadline Tomorrow
• Show HN: DocCharm – The help center that keeps itself up to date
• Proxying inference requests in 6ms with Pingora, Envoy, and Spanner
• Brazil denies visas to U.S. officials who aimed to impugn electoral system
• Some more things about Django I’ve been enjoying
• The Metaverse Fever Dream – Pixel Envy
• Show HN: Envy - A flat-file, frictionless note-taking application for macOS
• Show HN: Physically accurate black hole you can put in your room
• Show HN: Writemark, a dependency free web component for inline Markdown editing
• Show HN: Audio Player with “Binaural Beats” tuned to the same key as your music
• Show HN: Simple HIIT timer for efficient workouts
• Show HN: An interactive game of British Columbia
• Ask HN: Do you delete your browsing history?
• Show HN: I built a blind taste test for Claude and Codex designs
• Show HN: I built a chat client that uses embeddings to cluster messages by topic
• Show HN: Open-plan-annotator – local annotation UI for working with agent plans
• Ask HN: What other professions are software programmers considering?
• Show HN: I rebuilt Microsoft Comic Chat’s layout engine in one HTML file
• Single-click and remote OpenCode session right in the browser
• Show HN: Notebooker.ai – NotebookLM alternative, your own models, keys, storage
• Where Did All the Computer-Science Professors Go?
• The Vikings didn’t wear horned helmets. So who did?
• Poverty of attention. Text became free. Attention didn’t. (German)
• Jacobian conjecture is false (with help of Fable)
• With the Help of Codex: A Reproducible Proof Against the Jacobian Conjecture
• Replacing gas stove can help asthmatics as much as some drugs
• Videos Helped Me Uncover Abuse at an Arkansas Private School
• The Resistance Liberal Lawyers Helping Trump Take over the Media
• Claude Opus 4.5 defied CEO, helped employee blow whistle about safety concerns
• Claude helps reduce our technical debt
• The Computer That Helped Win World War II
• AI tool may help doctors, but sample size too small
• Study Claiming AI Helps Students Learn Retracted
• Open Erdos problems solved with the help of GPT-5.6 Sol
• AI helps scientists design the next generation of medicines
• $100 to Facebook employee for multiple sclerosis help
• Ask HN: Google BotGuard is blocking my web browser (Northstar), how I get help?
• Viral syncytia help SARS-CoV-2 evade interferon and antibodies
• Substack adds an AI detector to help spot blogs written by no one
• Hugging Face Turned to Chinese LLM for help after US models blocked Blue Team
• Help: Using reflection to discovery and invoke methods
• Tell HN: Namecheap gave my account to an unverified third party
• Show HN: Palmier Pro – Open-source macOS video editor built for AI
• Show HN: Cactus Hybrid: We taught Gemma 4 to know when it’s wrong
• Launch HN: Bloomy (YC S26) – AI-powered mastery learning for K-12
• Launch HN: Screenpipe (YC S26) – Record how you work and turn that into agents
• Show HN: Anypost – transactional and broadcast email API, 8¢ per 1k
• Show HN: An MCP server that turns async-work practices into tools
• Ask HN: Does anyone have an old Goodreads API key?
• Show HN: Orate – On-device neural text-to-speech queue for Mac
• Ask HN: Why don’t we solve aging?
• Ask HN: How do I find startups that are looking for a dev? How to approach them?
• Tell HN: ChatGPT exports do not contain all conversation messages
• Show HN: Claude is getting an attitude
• Show HN: I built remembered checkout for Voice calls
• Show HN: Kalvir Clock
• D-FINE-seg – detection, instance and semantic segmentation in one model
• Why is programming so captivating, yet so agonizing?
• Hunter-gatherers introduced fish to a mountain lake 7000 years ago
• AMD announced its $5.4B ATI acquisition 20 years ago today
• Scientists Uncover Lost ‘Golden Age’ of Languages That Ended 1,000 Years Ago
• Viking 1 landed on Mars 50 years ago
• Show HN: Bento - An entire PowerPoint in one HTML file (edit+view+data+collab)
• Show HN: I made some transistor animations
• Is surveillance risk chilling your online speech?
• Show HN: Open-weight OCR got so cheap I had to share it
• Ask: Why does everything Microsoft create lately feel fragile and half-baked?
• Claude used my pipeline to find a counterexample to the Jacobian conjecture
• ASK HN: Why has technology become so unreliable?
• A B2B marketing agency grew to $1.5M ARR in 6 months by betting on AI
• Ask HN: Is Zig worth it over Rust in 2026?
• Show HN: A browser-based canvas for custom physical notepads
• Show HN: CDXE – Cyber Defence Exercise Environment
• Show HN: Anakin – API for your AI agents to access the most difficult websites
• Show HN: Foomchat – an AI chat where the interface is whatever you want
• The Cost of Seamlessness
• Show HN: Termic – desktop app for running CLI coding agents (Claude Code, Codex)
• Show HN: SimpleBLE 1.0, a cross-platform Bluetooth LE library
• Ask HN: Convince me to not to shelve my app (I’ve decided to)
• Ethics Is the Skill That Matters Most Now
• Flux 3
• Flux 3 X Mimic: The Next Generation of Video-Action Models
• Flux 3: One multi-modal model for Image, Video, Audio and Action-Prediction
• Flux 3 seems to be imminent
• Show HN: Reproducibility Benchmark a Risk Quantitative Model
• HomeLab #2: Immutable GitOps homelab and MikroTik hardening
• What’s horned, fluffy, and ethically dubious? Yak clones
• Bing Copilot (ChatGPT-4) Flunks Math [pdf] (2024)
• Show HN: Computable – Buy, sell, and redeem GPU for the exact weeks you want
• Show HN: TunD. Make friends’ PCs appear on the same VLAN
• Show HN: ChatPanel, A Privacy-first AI Agent browser side panel
• Show HN: Note taking and book Library, all-in-one AI KnowledgeBase
• Show HN: Find undervalued bikes near you with ML
• Show HN: Roll Solver – daily multiplayer word puzzle PWA
• Show HN: After a break up I made an app to fix how I feel
• Producing ammonia and fertiliser using wind power in Morris, Minnesota
• The Usefulness of Useless Knowledge (1939) [pdf]
• Sarah’s Wager
• Retry Storm Lab
• Garmin $200 no subscription whoop alternative
• What Sam Altman will tell the White House this week
• Show HN: Simple Daily Game
• LLM Margin Lab
• OpenTelemetry Collector: A Production-Ready Guide
• Show HN: Playwright end-to-end tests as OpenTelemetry spans
• Re: Bye Bye Gravatar
• Ask HN: What’s the best hands-on path to learn ML inference infrastructure?
• Show HN: CobaltCode – Dedicated persistent computer for Codex

Heise Cloud (10)

• Nur die halbe Luna: Amazon baut Cloud-Gaming in Prime Video ein
• Collabora Online: lokale oder Cloud-KI nach Nutzerwunsch
• Alphabet wächst weiter zweistellig, aber auch die Ausgaben steigen deutlich
• Last Call: M365 für Admins – Sichere Konfiguration & effiziente Verwaltung
• Neue Eskalation im Nahen Osten: Iran hat AWS-Infrastruktur in Bahrain „zerstört“
• Schwarz Digits eröffnet seinen 3500-Mitarbeiter-Campus im Süden Deutschlands
• Exchange Online PowerShell: Mehr Zeit für die Authentifizierungs-Migration
• Nextcloud: Wirrwarr um Website-Störung – Cyberangriff bestätigt
• Microsoft setzt AMDs Helios-Server mit Next-Gen-Hardware ein
• Sinnvoll kollaborieren bei Entwicklung und Nutzung von Software aus der Cloud

InfoQ Cloud Native (1)

• Amazon EKS Adds Kubernetes Version Rollback Within 7 Days of an Upgrade

The New Stack (26)

• MCP’s biggest update removes the machinery many servers were built around
• Microsoft and Google DeepMind agree on AI control — but not on who holds it
• 5 ways SRE AI agents are set to augment human capabilities
• Stop correcting AI code. Build the system agents need.
• 5 steps to build great service architecture and operational resilience
• How routing keys isolate Kafka consumer tests on a shared broker
• Microsoft, Nvidia, Meta and 22 others defended open weights. Anthropic and OpenAI didn’t sign.
• Opus 5 costs a third of the price — and that’s actually the problem
• Jensen Huang made his first X post. He used it to lobby Washington about open-weight AI.
• Anthropic’s Opus 5 is almost Fable 5
• What really happened in the Hugging Face breach
• AWS, Google Cloud, Microsoft Azure, and Cloudflare now all offer agent sandboxes. None built them the same way.
• Alert fatigue is breaking SOCs. Sumo Logic says it has a way out.
• Test data wait times are slowing AI adoption more than code ever did
• OpenAI and Anthropic both speak at once with dueling voice updates
• Nvidia’s new DNA model learns what token prediction misses
• “We love the world where we can use both”: How Nvidia thinks about local and frontier models
• Cursor, Ramp, and Meta are all building model routers — but two have major model ambitions themselves
• Personalization is a ranking problem — architecture makes it work
• How regulated organizations can increase AI code velocity safely
• Can prompt caching tame RAG costs without sacrificing accuracy?
• Kimi K3: White House alleges Fable 5 siphoning
• Agents keep changing their answers. Harness just built delivery pipelines that don’t care.
• OpenAI built support agents for its own customer service line, now it hopes big enterprises will trust them too
• “Every few months, a new model made part of our roadmap unnecessary”: Why Mendral’s founders gave up their startup for Anthropic
• Moonshot launched Kimi K3. Then demand shut down subscriptions in 48 hours.

← Back to Newsletter

This week in Cloud Native saw several project updates across networking, observability, and security. Noteworthy developments included HAMi becoming a CNCF incubating project, focusing on GPU resource scheduling for AI, and discussions around operating AI/ML workloads on Kubernetes. The community also addressed various bug fixes and stability improvements in core projects.

🚀 Notable Releases

Networking

• Cilium v1.19.6 - Adds support for configuring Gateway access logs via spec.telemetry.accessLogs in CiliumGatewayClassConfig. Uses L3 sockets for solicited node multicast signaling in the L2 responder.
• Cilium v1.18.12 - Introduces support for configuring Gateway access logs through spec.telemetry.accessLogs in CiliumGatewayClassConfig. Addresses incorrect policy denials for traffic to L7 load balanced services.
• Cilium v1.17.18 - Fixes incorrect policy denials for traffic to L7 load balanced services. Resolves an issue where multi-pool IPAM did not wait for zero prealloc requests.
• Envoyproxy v1.39.0 - Requires Bazel 8 for builds, which necessitates --enable_workspace and --noenable_bzlmod flags. Disables the Intel DLB connection balancer for all builds due to a broken source archive. Deprecates enforce_rsa_key_usage in TLS.
• Kubernetes Gateway API v1.6.1 - Adjusts the port used in the TCPRouteMultipleRoutesAttachment conformance test. Ensures CleanupTestResources is respected for BackendTLSPolicy, TCPRouteMultipleRoutesAttachment, and UDPRouteMultipleRoutesAttachment.

Service Mesh

• Istio 1.30.3 - A patch release providing stability updates.
• Istio 1.29.6 - A patch release providing stability updates.
• Kuma v2.14.1 - Updates the Go version to 1.26.4. Includes updates to kumahq/kuma-gui.

Observability

• Jaeger v2.20.0 - Removes support for Elasticsearch v6. Promotes Elasticsearch rotation and index-cleaner feature gates to beta. Merges the jaegermcp extension into the jaegerquery extension.
• Thanos v0.42.2 - Released due to broken base image SHAs, contains no functional changes.
• Thanos v0.42.1 - Increases timeout values in the Shipper component of the Receiver to address an issue with previously set small timeouts.
• Inspektor Gadget v0.54.1 - Fixes an issue in the OCI module to ensure the oci-store directory exists before locking.

Security

• External-Secrets v2.8.0 - Corrects Barbican find semantics and adds documentation for property/extract.
• External-Secrets helm-chart-2.8.0 - Provides the Helm chart for external secrets management.
• Cosign v3.1.2 - The maintainers state this may be the final v3.1 release, with deprecated functionality slated for removal in v4. Migration to the bundle format is encouraged.
• Cosign v2.6.4 - Backports OCI manifest fixes and enhances support for cosign attestation download when using a mix of older signatures and the bundle format.

CI/CD & Build

• FluxCD v2.9.2 - Addresses a regression from v2.9.1 where Kustomizations with openapi.path referencing a URL failed reconciliation. Corrects several CRD field descriptions.
• Dapr v1.17.11 - Fixes an issue preventing actor reminders and jobs from registering when their names or actor IDs contained characters such as | or @.
• Backstage v1.53.0 - Removes the deprecated Server-Sent Events (SSE) MCP transport from @backstage/plugin-mcp-actions-backend, requiring MCP clients to use Streaming RPC.
• Telepresence v2.30.1 - Includes installers with an option to run the root daemon as a system service, which removes the requirement for elevated privileges during use.
• Telepresence v2.30.0 - Introduces installers that allow the root daemon to run as a system service, eliminating the need for elevated privileges when using Telepresence.

Cluster Management

• KubeEdge v1.23.1 - A patch release. Refer to the CHANGELOG-1.23.md for specific details.
• KubeEdge v1.22.2 - A patch release. Refer to the CHANGELOG-1.22.md for specific details.
• KubeEdge v1.21.2 - A patch release. Refer to the CHANGELOG-1.21.md for specific details.
• Kubernetes SIGs Cluster API v1.13.4 - Increases management cluster client QPS and Burst. Addresses a bug in the clusterctl v1.10 upgrade test related to the Kind image. Supports Kubernetes management clusters from v1.32.x to v1.36.x and workload clusters from v1.30.x to v1.36.x.
• Kubernetes SIGs Cluster API v1.12.10 - Fixes a Kind image issue in the clusterctl v1.10 upgrade test. Corrects PrettyPrint behavior in WaitForCondition. Supports Kubernetes management clusters from v1.31.x to v1.35.x and workload clusters from v1.29.x to v1.35.x.

Configuration & Tooling

• Meshery v1.0.59 - Logs human-readable summaries in SaveConnection debug lines. Improves environment assignment discoverability in the UI.
• Meshery v1.0.58 - Updates meshery/schemas to v1.3.34 and v1.3.33. Records failed Kubernetes connections as error notifications. Renames Meshmodel API routes to /api/registry.
• Meshery v1.0.57 - Updates websocket-driver. Adds parent capability to VPC and corrects relationship between EKS addon and cluster. Adopts meshery/schemas v1.3.32.
• Meshery v1.0.56 - Adds the F5 BIG-IP Controller for Kubernetes model. Migrates Kubernetes connection and controller subscriptions from GraphQL to SSE/REST in both the CLI and UI.
• LitmusChaos v3.31.0 - Fixes probe comparator type initialization from loaded probe data. Updates dependencies in graphql/server to address vulnerabilities.

Application Frameworks

• KServe v0.18.1 - A patch release, includes a fix for Helm charts.
• Fermyon Spin canary - This is a canary release of recent commits on the main branch and is not stable. It is intended for developers evaluating the latest features, some of which may not be fully implemented.

Database

• CrateDB 6.4.1 - A patch release, refer to release notes for details.
• CrateDB 6.3.6 - A patch release, refer to release notes for details.

📰 This Week in Cloud Native

This week, the Cloud Native landscape saw significant activity related to Artificial Intelligence (AI) and its integration with Kubernetes. HAMi, a project focused on efficient GPU sharing and resource scheduling for AI workloads, was accepted as a CNCF incubating project. Concurrently, discussions emerged around the optimal deployment unit for AI agents within Kubernetes, with considerations for running self-hosted Large Language Models (LLMs) using tools like vLLM. Kubernetes also saw the introduction of a Headlamp plugin for Kubeflow, aiming to streamline the operation of AI/ML workloads. Furthermore, the concept of “Agent Substrate” from Google was highlighted as a potential direction for future AI agent runtimes, alongside efforts to standardize AI agent infrastructure through initiatives like the x402 Foundation.

In infrastructure and platform engineering, there were updates from major cloud providers. AWS introduced self-managed Amazon S3 buckets for Lambda function code, which addresses storage limits and provides customers with more control over deployment artifacts. New enhanced AssetState dimensions for AWS Outposts capacity metrics were also released. Additionally, AWS announced the cessation of sales for its original 1U and 2U Outposts servers, directing customers towards Outposts Racks. A significant billing error was reported by Amazon Web Services, where some customers were shown astronomically high estimated costs due to a technical fault. The concept of cloud sovereignty and how architectural decisions influence cloud costs were also subjects of discussion.

Security and observability components also received attention. The CNCF blog highlighted OpAMP as a tool for operating OpenTelemetry at scale, facilitating remote management and configuration of collectors across diverse environments. Kubernetes provided guidance on building custom metrics exporters to expand beyond built-in CPU and memory metrics for scaling decisions. A security bulletin from Tailscale disclosed a vulnerability (TS-2026-009) where insecure argument handling in Tailscale SSH could permit root access. Microsoft open-sourced its legacy Comic Chat application, making its codebase publicly available.

💬 Community Buzz

Discussions on Hacker News this week included technical topics such as implementing Kubernetes within a MicroVM, benchmarking gRPC load balancing solutions on Kubernetes (Linkerd, Istio, Cilium), and recommendations for containerization and security of AI agents. Other technical subjects discussed involved building self-hosted personal finance applications, creating a local image compressor, and developing a pure Go immediate-mode GUI library without CGO.

📊 Numbers of the Week

• Total stable releases: 35 across 21 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 247 commits
  2. kubernetes/kubernetes — 244 commits
  3. cilium/cilium — 148 commits
• Top 3 projects by merged pull requests this week:
  1. cilium/cilium — 131 merged PRs
  2. kubernetes/kubernetes — 129 merged PRs
  3. kumahq/kuma — 126 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 30

A complete list of all cloud native articles and news from this week.

AWS Compute (4)

• Introducing self-managed Amazon S3 buckets for AWS Lambda function code
• New: Enhanced AssetState dimension for AWS Outposts capacity metrics on Amazon CloudWatch
• Introducing modularized kernel cryptography in Amazon Linux
• Eliminating Java cold starts with AWS Lambda Managed Instances

AWS Containers (1)

• Accessing private Git repositories from Amazon EKS capability for Argo CD

AWS Open Source (1)

• Open Protocols with the Strands Agents SDK

CNCF Blog (8)

• Flipkart and LitmusChaos at KubeCon + CloudNativeCon India 2026: A recap
• CNCF Strengthens Partnership with Broadcom as a Platinum Member to Advance AI-Ready Cloud Native Infrastructure
• Running a self-hosted LLM in Kubernetes with vLLM
• HAMi becomes a CNCF incubating project
• On-prem DBaaS in 2026: Platforms, standards, and gaps
• KeycloakCon Japan 2026: Navigating cloud native identity and the AI frontier
• Is a Pod the right deployment unit for an AI agent?
• Operating OpenTelemetry at scale with OpAMP

Hacker News (123)

• Smol Machines: Kubernetes-in-a-Microvm
• Benchmarking gRPC Load Balancing on K8s in 2026: Linkerd vs. Istio vs. Cilium
• Show HN: Docket (system for active note-taking) now self-hosted after HN asked
• Show HN: Update on my media editor in browser no back end
• Show HN: UniFi OS Server in Docker
• Show HN: uplpgsql – PL/pgSQL compiled to native code
• Ask HN: AI Agent and harness containerization/security recommendations
• Show HN: Shikigami, run AI coding agents in parallel, each in a Git worktree
• Show HN: One MCP setup for 22 clients, with lazy tool discovery
• Show HN: Knowledge graph skill for Claude/Kimi Code
• Show HN: Kosh – a self-hosted personal finance app
• MicroVM sandbox on Win, Mac, Linux, with policy engine
• Most Supreme Court Rulings Are Secretive Votes with Little Justification
• Getting organized: personal inventory management
• Barefoot shoes are trendy after years of mockery. Do they work?
• Show HN: An MCP server that frames screen recordings and shots in Apple bezels
• Motorola Envoy
• What makes soccer so enjoyable to watch?
• Show HN: Opening lines of famous literary works
• Show HN: Be the ChatBOT
• Show HN: An Interactive Guide for Castlevania II: Simon’s Quest
• Show HN: Spellsurf – Create words from words
• Show HN: Cascade Chat – A Hackable IRCv3 Client for macOS, Windows, and Linux
• Ask HN: Having a child before career has taken off
• Show HN: I made a local image compressor to save you from popups andsubscription
• Show HN: BYO AI free notetaking with optional screen reading for OpenClaw/hermes
• Show HN: Companion eBook for The Odyssey audiobook narrated by AI Michael Caine
• Thinking: Alternate Distribution for Filmmakers
• Show HN: Swagsocial
• Show HN: DriftTrip – A Virtual Road Trip
• Show HN: Justif – Knuth-Plass justification and microtypography for the web
• Notes Toward a New Romanticism: Or why it’s 1800 all over again
• Ask HN: I feel like I’ve lost my identity due to AI
• Thanks HN for 15 years of support and helping me find my life’s work
• Fable 5 vs. GPT-5.6 Sol on an NP-Hard Problem: Does /goal help?
• Helium escaping from atmosphere of nearby rocky exoplanet in a habitable zone
• Mind game helps men reduce Alzheimer’s risk by 25% but not women
• Trump blames Canada for wildfire smoke, says he’ll add cost to tariffs
• Brain implant helps paralysed man to feed himself and drink from cup
• Tweet claiming Claude Fable 5 has helped disprove the Jacobian conjecture
• OpenAI Strategic Lead Defines Open-Source AI as Dystopian Hellscape
• 15 years of helping software engineers relocate: Here’s what changed
• Help me be accountable with my time
• The Work of Helping A.I. Destroy Work
• Jordan Ellenberg explains how geometry helps us understand the world
• Statistical test helps judge the value of personalization
• AI helped me write every game I ever wanted to make
• Web-ext 10.5 – A command line tool to help build, run, and test web extensions
• Trump made $1.4B from crypto in one year. Is Justin Sun the man who helped him?
• Watching Nature Videos Can Help Relieve Stress, Study Finds
• Major trial finds healthy behaviors help brain health in older adults
• Pastors Using AI to Help Write Sermons Grapple with Where to Draw the Line
• MLB restricts dugout iPad use to prevent AI help with strategy. Mets involved
• Show HN: I replaced a $120k bowling center system with $1,600 in ESP32s
• AWS: Inaccurate Estimated Billing Data – $1.7 billion
• Show HN: Mojibake – A low-level Unicode library written in C
• Show HN: FixBugs – Reproduce production bugs and verify fixes
• Launch HN: Traceforce (YC S26) – Company-wide security monitoring for AI apps
• Show HN: Rejourney – Open-source revenue leak prediction for web and mobile apps
• Show HN: Ratel, give agents unlimited tools and skills without context bloat
• Show HN: Libretto PR agents – Automatically fix failing playwright scripts
• Ask HN: Does it still make sense to write code by hand?
• X permanently banned my 15-year-old account for sharing my own open-source lib
• Show HN: SirixDB 1.0 Beta – Git-Like Versioning, Diffs, Time-Travel Queries
• Show HN: Algotrek – Algorithms visualized, problem shape shifting and a tutor
• Show HN: ContextVault – Shared memory layer for your AI and your team
• Show HN: Microphone – Talk out your side-project ideas, then test them with ads
• Ask HN: cybersecurity refusal for turning a jailbroken kindle into a monitor
• Show HN: HTML, CSS and JavaScript in the Terminal
• TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access
• RISC-V Is Inevitable: State of the Union Keynote Argues
• Revisiting Yliluoma’s ordered dither algorithm
• Talk: The Art of Braiding Algorithms
• I argued with the father of open source for 2 years Now the AI fight is the same
• Why Argentina Has Almost No Black People [video]
• Reviewing AI Code Is Not a Viable Argument
• Welcome to the wild world of AI Argentina
• Neanderthals, modern humans may have shared culture 59,000 years ago in Turkey
• Show HN: A Monte Carlo model that called the World Cup finalists 2 weeks ago
• Mornings in Cupertino Have the Aroma of Napalm Once Again
• Social media algorithms: accumulated aesthetic artifacts
• Blog about hiring was written 23 years ago (Still valid) (2009)
• Netflix says around 300 titles used generative AI
• From Algorithms to Autonomy:How AI Is Rewriting Architecture of SW and Mobility
• We Merged with Machines a Long Time Ago – Futurology and Berggruen Institute [video]
• GLP-1 Receptor Agonists and Risk for Ischemic Optic Neuropathy
• Cursor Forgets What You Did 20 Minutes Ago. So I Built a System to Fix That
• Show HN: I implemented a neural network in SQL
• Launch HN: Agnost AI (YC S26) – Extract user feedback from agent conversations
• Launch HN: Coasty (YC S26) – An API for computer-use agents
• Show HN: Oodle.ai – $10 per million agent traces
• Show HN: Simulator for a custom 8-bit discreet logic computer
• Show HN: Flashbang – DuckDuckGo bangs resolved locally with a Service Worker
• Ask HN: I built it and nobody came. What got you your first users?
• Ask HN: What is the one YouTube channel you recommend I subscribe to?
• Ask HN: USB-to-WiFi print server for old printers – do you want it?
• Show HN: Deadly Dispatch – A physics puzzle game 13 years in the making
• Ask HN: What are you working on(2026)?
• How Google decided to Destroy its Search Monopoly
• Ask HN: Is anyone else feeling bad about Reddit’s mechanisms
• Ask HN: Anyone working for Reddit?
• Show HN: Proton – A Pure Go, Immediate-Mode GUI Library (Zero CGO)
• Ask HN: Are you teaching your kids to program?
• Show HN: I can’t seem to text properly on an iPhone, so I built my own keyboard
• Show HN: BlazeRules – YAML rule engine for streaming data, 3M records/SEC
• Show HN: Regularly, hand-picked daily logic and number puzzles, no ads
• SQLite: The Advantages of Flexible Typing
• Show HN: Fluent, tiny lang for reactivity and autograd
• Akihiro Miwa, Actor and Singer with Gender-Fluid Glamour, Dies at 91
• Show HN: FlexInference LLM Router
• FluencyLoop – A lighter, developer-centric SpecKit alternative
• Microsoft tests Windows Search without all the ads and fluff
• Ask HN: Should I do a CS masters at Cambridge or start as a new grad at Amazon?
• Ask HN: What makes someone good at using Claude Code?
• Show HN: Made a Free LLM Router
• Getting Clients Cold Calling
• Socialists should embrace luxury apartments
• Sealed tomb filled with paintings and inscriptions discovered in Egypt
• Migrate from Datadog to Grafana
• Show HN: NetBox plugin that turns config changes into Grafana annotations
• Ask HN: Are AWS Certs worth getting for experienced Devs?
• Show HN: Running server scripts from smartphone via SSH
• 11,700 Free Photos from John Margolies’ Archive of Americana Architecture

Heise Cloud (8)

• Billionenbeträge berechnet: Abrechnungsfehler bei Amazon Web Services
• AWS stoppt Verkauf der ursprünglichen Outposts-Server
• Gemini Notebook: Google tauft sein KI-Recherchetool NotebookLM um
• Souveränität in der Cloud: Von Abhängigkeit zu Eigenverantwortung
• Samsung Health: Entwarnung bei KI-Datennutzung
• Proaktive IT-Security mit Pentesting – Ethical Hacking für Admins
• S&P stuft Oracle auf BBB- herab – nur noch eine Stufe über Ramschniveau
• Warum Cloud-Kosten Architekturentscheidungen sind

InfoQ Cloud Native (1)

• Article: Removing a Hidden Round Trip from a Multi-Region AWS API

Kubernetes Blog (3)

• Building a Custom Metrics Exporter for Kubernetes
• Operating AI/ML Workloads on Kubernetes: A Headlamp Plugin for Kubeflow
• Kubernetes Dashboard to Headlamp: A Step-by-Step Guide

Microsoft Open Source (1)

• Microsoft Comic Chat is now open source

The New Stack (26)

• Spark 4.2 has a feature that could retire your vector database
• Move code review before the code
• Self-healing GPU nodes in Kubernetes: What we learned building the EKS node monitoring agent
• AI didn’t replace our security team — it multiplied it.
• The bottleneck for AI agents isn’t the model anymore. It’s the context layer.
• Platform engineering’s new job: serving environments at agent speed
• I trust Claude for everything. This test made me rethink that.
• Musk open-sourced Grok Build to fight Anthropic. Anthropic pays him $1.25 billion a month.
• Kimi K3 tops Arena’s coding leaderboard — and it’s open-weight
• 1Password’s new browser integration for Claude changes how AI uses your credentials
• “They’re dead if they don’t offer this”: DoorDash’s CLI for agents may be out of necessity
• Why every AI agent decision needs a receipt
• Arm and Google offer a smarter option to run agentic AI workloads
• From intent to enforcement: Lessons from operating Kubernetes controllers at scale
• Microsoft just open-sourced the app that put Comic Sans on the map
• AI hasn’t shifted the bottleneck from coding to code review
• GoDaddy opened its registrar to AI agents. Then it had to build guardrails.
• You don’t have a deployment problem. You have a validation problem.
• Why smarter AI caching sometimes makes everything slower
• Linux creator Linus Torvalds tells AI haters to walk away from Linux, or go fork it
• OpenAI’s GPT-Red automates prompt injection testing to harden AI agents
• “There are no laws, only suggestions”: What AI agents do with your instructions
• Kubernetes won the container decade. Google’s Agent Substrate wants the next one.
• Trust, transactions and tokenomics: AI agent infrastructure begins to standardize
• Elon Musk: “We will make the entire codebase of X open source, with no exceptions.”
• Atlassian wants developers to finally like Jira

← Back to Newsletter

This week saw a significant number of stable releases across the Cloud Native ecosystem, with updates to container runtimes, CI/CD tools, and observability platforms. Discussions centered on the expanding role of AI in cloud environments, alongside continued focus on security and Kubernetes operational practices.

🚀 Notable Releases

CI/CD

• Argo CD v3.4.5 - A patch release that includes updated install manifests and release signatures for container images.
• Flux v2.9.1 - A patch release that disables Flux variable substitution on Flux CRDs to prevent schema corruption from Kustomizations with post-build substitution.
• Helm v4.2.3 - A patch release.
• Helm v3.21.3 - A patch release.
• Meshery v1.0.55 - Adopts schemas v1beta3 for User and integrates with Meshery Cloud account consolidation.

Container Runtime

• containerd v2.3.3 - Fixes the SystemTemp environment variable on Windows for SYSTEM services and addresses a nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit.
• containerd v2.2.6 - Addresses a nil pointer dereference in NRI GetIPs and rejects CreateContainer calls when the target sandbox is not running.
• containerd v2.0.11 - Limits fallback to the /blobs endpoint during reference resolution to mitigate content store pollution.
• containerd v1.7.34 - Fixes an issue where container exit events were lost if they arrived before container information was cached.
• Podman v6.0.1 - Fixes an issue where Podman Machine VMs on Mac using the libkrun provider could be shut down by host port-scanning, and addresses podman machine init failures on Windows with the hyperv provider when WSL is not installed.
• Podman v5.8.5 - Fixes an issue where Podman Machine VMs on Mac using the libkrun provider could be shut down by host port-scanning.

Database

• CrateDB 6.4.0 - A new stable release with changes detailed in its release notes.
• CrateDB 6.3.5 - A patch release with changes detailed in its release notes.
• CrateDB 6.2.11 - A patch release with changes detailed in its release notes.
• CrateDB 6.1.6 - A patch release with changes detailed in its release notes.
• CrateDB 6.0.8 - A patch release with changes detailed in its release notes.
• TiKV v8.5.7 - This release includes features, improvements, and bug fixes as detailed in the TiDB v8.5.7 release notes.

Networking

• CoreDNS v1.14.6 - This patch release addresses ARM and MIPS build issues by downgrading the dd-trace-go dependency and includes improvements for forwarding and secondary zone support.
• CoreDNS v1.14.5 - Improves DNS transport security and operational reliability through safer DoH/DoH3 handling, enhanced forwarding configuration, and improved dnstap support. It also includes robustness improvements across various DNS functions.
• Kube-OVN v1.15.19 - Bumps GoBGP to v4.7.0 and adds support for HCP ovn-central scheduling within the Helm chart.
• Kube-OVN v1.15.18 - Adds support for HCP ovn-central chart deployment and updates the golang.org/x/text module to v0.39.0.

Observability

• OpenTelemetry Collector v0.156.0 - Adds support for defining stability levels and semantic convention references for resource attributes in mdatagen, and introduces health events for the memory_limiter processor.
• Prometheus v3.13.1 - A bugfix release that addresses an issue where the head-chunk cache returned incorrect samples or spurious not-found errors to range queries after head-chunk truncation.
• Prometheus v3.5.5 - Built with Go 1.25.12, this release fixes CVE-2026-53606 by updating sanitize-html to v2.17.5 in the UI.
• Thanos v0.42.0 - Includes improvements to the Receive component’s tenant lifecycle handling and per-endpoint configuration. It also displays fanout information in Thanos Query and fixes exemplar proxy stripping external label matchers in multi-tier query topologies.
• Inspektor Gadget v0.54.0 - The advise_networkpolicy tool can now generate Cilium NetworkPolicy resources in addition to Kubernetes NetworkPolicy. Users can now define CPU and memory requests and limits on the Kubernetes deployment.

Orchestration

• etcd v3.7.0 - This is a new major stable release. Users are advised to consult the changelog and upgrade guide for a full list of changes and potential breaking changes.
• Capsule v0.13.9 - Fixes a cache timeout issue for the RBAC controller.

Security

• cert-manager v1.21.0 - Adds ACME Renewal Information (ARI) support and AWS IAM authentication for the Vault issuer. It includes several security hardening changes and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values.
• Kyverno v1.18.2 - Fixes dynamic watchers restarting on 410 errors, prevents required validation abortion on non-matching images, and allows multiple CRDs in the --crd-path file for the CLI.
• SPIFFE/SPIRE v1.15.2 - Adds support for configuring JTI claim inclusion in JWT-SVIDs at the entry level. It introduces experimental per-caller rate limiting for the agent Workload API and Envoy SDS, and adds TLS support for the Prometheus metrics endpoint using a SPIRE SVID. Optional verification of client certificate IPs is now available in the x509pop node attestor, and a SPIFFE Broker endpoint and API have been introduced.
• Keycloak 26.7.0 - This release introduces SCIM API for user provisioning (preview) and simplified multi-cluster high availability without external caches (preview). It also includes enhanced reverse proxy guides.

Service Mesh

• Kuma v2.13.9 - Updates Envoy to version 1.36.8 and Go to version 1.26.4. It includes security updates and adds configurable zone proxy probes via Helm. Fixes an issue distinguishing an unreachable leader from a leader change.
• Kuma v2.12.13 - Updates Envoy to version 1.35.12 and Go to version 1.26.4. It includes security updates and fixes an issue distinguishing an unreachable leader from a leader change, as well as unwrapping DeletedFinalStateUnknown in the Kubernetes event listener.
• Kuma v2.11.17 - Includes security updates. Fixes an issue distinguishing an unreachable leader from a leader change and unwrapping DeletedFinalStateUnknown in the Kubernetes event listener. It also removes a noisy log for MeshMetrics/metrics coexistence.
• Kuma 2.9.18 - Updates Envoy to version 1.35.12 and Go to version 1.26.4. It includes security updates and fixes an issue distinguishing an unreachable leader from a leader change, as well as unwrapping DeletedFinalStateUnknown in the Kubernetes event listener.
• Kuma v2.7.28 - Updates Envoy to version 1.35.12 and Go to version 1.26.4. It includes security updates and fixes an issue distinguishing an unreachable leader from a leader change.

Developer Tools

• Telepresence v2.29.3 - Provides installers that include an option to run the root daemon as a system service, which removes the requirement for elevated privileges during use.

📰 This Week in Cloud Native

The Cloud Native landscape this week was characterized by a strong emphasis on Artificial Intelligence, with numerous announcements and discussions surrounding its integration into cloud infrastructure and development workflows. Several CNCF blog posts addressed the deployment of AI workloads, data storage requirements for AI, and the establishment of network boundaries for AI agents, including considerations for sandboxing and platform engineering for AI-native applications. AWS announced Lambda MicroVMs, designed to provide VM-level isolation and near-instant startup for serverless compute environments, specifically highlighting their utility for secure code execution by AI agents. AWS also introduced Loom for building secure AI agents at scale and an open-source Model Context Protocol (MCP) server for AI-powered dataset discovery.

In the Kubernetes ecosystem, the upcoming retirement of the Kubernetes SIG Network ingress-nginx controller by March 2026 was highlighted, with a focus on preparing for the post-retirement landscape. The etcd project announced its v3.7.0 release, a significant update for the Kubernetes backing store. Discussions also covered migrating Amazon EC2 instances to EKS Auto Mode and implementing full request and response compliance logging on Amazon EKS. Other related news included projects exploring Kubernetes-native VM orchestration and bridging the local-to-cluster development gap.

Security remained a consistent theme, with several projects releasing updates addressing vulnerabilities and hardening measures. cert-manager v1.21.0 introduced security hardening changes, and Prometheus v3.5.5 fixed a UI security issue. SPIFFE/SPIRE v1.15.2 added features for configuring JTI claims in JWT-SVIDs and experimental rate limiting for the agent Workload API, along with TLS support for Prometheus metrics. Cloudflare introduced temporary accounts for autonomous worker deployment, which can be used by AI agents, prompting considerations for secure deployment practices. The concept of software supply chain risk beyond zero-vulnerability code packages was also explored.

The broader cloud native community engaged in discussions around developer productivity in the age of AI, with conversations on the potential for AI to introduce bottlenecks in code review processes and the evolving role of engineers. The CNCF marked two months since the launch of its Open Community Groups, an open-source online meetup platform, indicating ongoing efforts to foster community engagement and collaboration.

💬 Community Buzz

Hacker News discussions this week frequently revolved around the impact of AI agents on software development and productivity, including concerns about workflow interruptions and the role of developers. Topics also included Kubernetes ecosystem tooling, alternative container orchestration approaches, and various open-source data and analytics projects. Supply chain security for GitHub Actions and general developer tools and personal projects were also subjects of community interest.

📊 Numbers of the Week

• Total stable releases: 41 across 24 projects
• Top 3 projects by commits this week:
  1. kubernetes/kubernetes — 245 commits
  2. telepresenceio/telepresence — 122 commits
  3. cilium/cilium — 114 commits
• Top 3 projects by merged pull requests this week:
  1. cilium/cilium — 138 merged PRs
  2. kubernetes/kubernetes — 102 merged PRs
  3. kumahq/kuma — 85 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 29

A complete list of all cloud native articles and news from this week.

AWS Compute (5)

• Architecting for IOPS and throughput performance on AWS Outposts racks
• Announcing Lambda MicroVMs: serverless compute environments with VM-level isolation and near-instant startup
• Secure code execution for AI agents with AWS Lambda MicroVMs
• Accelerate multiplayer game hosting with AWS m8azn instances
• Uncover new performance insights using Amazon detailed performance statistics on Windows

AWS Containers (2)

• Migrate Amazon EC2 to EKS Auto Mode using Kiro CLI and MCP servers
• Full request and response compliance logging on Amazon EKS

AWS Open Source (2)

• Building secure AI agents at scale: Introducing Loom for AWS
• Introducing MCP server for Registry of Open Data on AWS

Azure DevOps Blog (1)

• Shrinking Azure Pipeline task extensions using esbuild

CNCF Blog (8)

• Where should AI workloads run? A sovereign and sensible approach
• Navigating the ingress-NGINX retirement
• The CNCF Data Storage in Cloud Native AI White Paper
• Network boundary for AI agents using NGINX and OpenTelemetry
• Two months of Open Community Groups
• Why sandboxing your agent is not enough
• Evolving platform engineering for AI-native workloads
• The 4-body problem of SRE: Why autonomous operations depend on context

Hacker News (112)

• Understanding ECS from Kubernetes Perspective
• Rebuilding My Homelab with Compose, Ruby, IPv6, and No Kubernetes
• KubeSwift, Kubernetes-Native VM Orchestration on Cloud Hypervisor
• Show HN: Prebuilt RISC-V64 Binaries for GCC, PyTorch, Kubernetes, and More
• Zero-Trust Workload Identity in Kubernetes with Spiffe, Spire, and Cilium
• Using WebObjects at web-scale with Kubernetes and Firebase
• Show HN: Spice 2.0 – Real-Time Analytical Query on Operational Data, Without ETL
• Show HN: FlareDB – Apache Beam native streaming database for realtime analytics
• Show HN: UniFi OS Server in Docker
• Show HN: Cpulse – See why your Docker Compose stack is stuck
• Show HN: Autoops – Multi-region data and service mesh operated by a Makefile
• Show HN: Aether – Run Claude Code, Codex, or OpenCode in devboxes you can watch
• Show HN: Itara – Distributed system topology as an explicit, executable layer
• Show HN: I created Redis alternative in Go that even runs natively on Windows
• GitHub cuts short offer to burn repos on CD after mockery ensues
• Show HN: Action-locker: pin, verify, and vendor GHAs
• Indio Solari, Argentine Rocker Who Packed Stadiums, Dies at 77
• GitHub abandons offer to burn repos on CD
• People Can’t Identify AI Poetry, but Enjoy It Less When Told It’s by an AI
• Show HN: Yamanote.fun – A complete soundscape for Tokyo’s Yamanote line
• Tell HN: I De-Googled Myself
• Ask HN: Do we need a support group for developers alienated by LLMs?
• Ask HN: Best Podcasts of 2026 [So Far]
• I coded a shoot ’em up alone at 18 after learning Lua in a single week
• I Need a Job, Anything
• Show HN: The Quiet Map – Earth’s quietest place, measured by seismometers
• Show HN: Threes with Bot Game
• Show HN: Arda Translate, free private on-device (iOS) translation
• Show HN: JMT – Java Based MultiTool
• Show HN: The Line of Hope – how current teams compare to past champions
• The Certainty Trap
• Being lonely taught me how to be me
• Show HN: SharpSkill – Test your IT skills in 15 different spoken languages
• Istota, a multi-user AI agent and personal operating system
• What does a 13-year-old see on Snapchat in a normal week?
• AI Can’t Recreate the Thrust Game (But It Can Help You Understand It)
• Creatine doesn’t just build muscle. It may also help fight cancer
• Maine librarians are helping patrons resist AI and Big Tech
• Can lucid dreaming help your mental health? What the evidence says
• The families using tech to help grandma stay independent longer
• The Work of Helping A.I. Destroy Work
• Safe from AI: which jobs will help you thrive in the future?
• Show HN: OpenBenchmarks – Helping agents discover and pick the right SaaS APIs
• Less Apocalyptic Rhetoric Can Help Mitigate Anti-Tech Violence
• Study: Cerebellum helps AI ignore the ordinary for more efficient computing
• Learned helplessness at fifty: Insights from neuroscience
• Brown says AI make student brain no work good, teacher should help use it better
• AI that helps you BE, not just DO
• We Helped an Auto Parts Plant Cut MES Query Times by Up to 116x
• Special food additive that helps prevent weight gain is approved in the EU
• Discovery helps explain why solid-state batteries often fail
• CO2 helps viruses stay alive longer in the air
• Hard time deciding? Let nuclear 8 ball help you
• Show HN: Getting GLM 5.2 running on my slow computer
• Show HN: Ant – A JavaScript runtime and ecosystem
• Show HN: Rowboat – Open-source, local-first alternative to Claude Desktop
• Show HN: Pulpie – Models for Cleaning the Web
• Show HN: Fast, native Mac file manager (filters, fuzzy find, 9 MB, no Electron)
• Show HN: Reviving my 2001 college band with AI
• Show HN: Halo – open-source, tamper-evident runtime evidence for AI agents
• Show HN: Devthropology – Better Insights for GitHub Repos
• Show HN: I built a web tool to see and edit what an AI thinks before it answers
• Show HN: Arcaide – Explore code with multi-level call graphs
• Show HN: SubjectiveZero, an open-source agentic node editor for creative coding
• Anyone here with an “in” with eBay?
• Ask HN: I hate coding agents. Is this skill issue?
• Sam Altman and Elon Musk Argue over Who’s Running the Bigger Scam
• We cannot wait for better post-quantum signature algorithms
• Facebook takes no action on AI far-right influence campaign flagged a month ago
• Ask HN: Why is not using AI considered a form of arrogance?
• Breakup of Gondwana 100M Years Ago May Be Why Antarctica Has Ice Today
• The SBC hobby is dying (Geerling, 3 months ago) [video]
• Show HN: RandoFont – A browser for Google Fonts
• Show HN: Kurvengefahr – browser CAD/CAM for pen plotters
• Ask HN: I am not able to find a job. Should I switch stacks?
• Show HN: An interactive, interlinked city exploration project (St. Louis)
• Ask HN: Does Apple not care about fake apps in the App Store?
• Show HN: Vicinae – open-source, Raycast-compatible command palette, now on macOS
• Show HN: Bike4Mind – open-core AI workbench; any model, agents, RAG, self-host
• Show HN: A short walking sim based on 3DGS that runs in the browser
• Ask HN: How to recover from thin content or de-indexing penalty on Google
• Show HN: The Flint Programming Language
• Who has been caught out by this anti-pattern from Google?
• Bring seamless PQC encryption into every messenger you already use
• Show HN: DoodleMeme – Animate Hand Drawings Without Generative AI
• Show HN: PAI, a Linux-y personal-assistant for Mac
• Show HN: Patterns with Friends – free multiplayer tile game (no sign-up, no ads)
• Show HN: Learn to Read with SRS++
• Show HN: Replace emails and phone numbers with
• Show HN: The Book of Uncertain Light – A Philosophical Text for LLMs
• Show HN: Day planner shaped like a clock (2-way calendar and Todoist sync)
• Show HN: GhostedWatch, an extension that detects silent removals on patriots.win
• Show HN: Sfotty Pie – A browser-based Atari 8-bit emulator in TypeScript
• Show HN: A map of every UK company, updated monthly
• FluxCD turns 10 today, stats and nostalgia
• Meta datacenter contractor flushed contaminated water
• IDE with agentic support built using Flutter
• This Factory was severely short on workers. Then it offered flexible work
• Pluralistic: Workplace “flexibility” isn’t
• Show HN: Drag boxes around and watch a layout engine infer the Flexbox (no AI)
• Show HN: Whentofly – flexible-date flight search that says if the price is good
• We Know Simple Fluids Can Flow. Turns Out, Some Can Fracture.
• A factory was severely short on workers. Then it offered flexible work
• The Dangerous Myth of Flexibility
• Show HN: OnlyFoundrs – Twitter for founders, minus the flex
• Show HN: FormGrid – Forms that can look like CLIs, pixel art, GeoCities and more
• Show HN: CLRK, an open-source agent runtime with gVisor and MitM guardrails
• The Biggest Conspiracy of All
• Unexpected Solidlike Fracture in Simple Liquids
• AI and the Fall of Writing
• Show HN: TraceGen – realistic OpenTelemetry traces, incl. AI-agent, one binary
• Yggdrasil Agent: general purpose, parallel and adaptive reasoning depth

Heise Cloud (6)

• Open-Source-Strategie: Mecklenburg-Vorpommern will auch Microsoft Office ablösen
• Offene Datenbank: Nextcloud GmbH behebt potenzielles Datenleck
• Digitale Souveränität: Wie der Plattformwechsel gelingt
• DE-CIX: Fußball-WM sorgt für neuen Datenverkehrsrekord
• Cloud und KI befeuern deutsche Digitalwirtschaft – international abgehängt
• M365 für Admins – Sichere Konfiguration & effiziente Verwaltung lernen

InfoQ Cloud Native (1)

• Cloudflare Introduces Temporary Accounts for Autonomous Worker Deployment

Kubernetes Blog (1)

• Announcing etcd v3.7.0

The New Stack (26)

• APIs aren’t dead. Here’s where MCP fits alongside them.
• How async processing hides latency and improves responsiveness
• Anthropic’s newest enterprise partner is training 20,000 people on Claude — here’s the shift it signals
• Meet Brain, the AI that decides when Azure is officially down
• 85% say code review is the new bottleneck. Here’s what the AI coding narrative leaves out.
• The impressive AI demo is dead. Here’s what actually reaches production
• Microsoft joins Google in backing Go for AI agents — OpenAI and Anthropic lag
• In 24 hours, OpenAI, SpaceXAI, and Meta turned AI into a race to the bottom on price
• Meta’s Iris push signals the next phase of AI infrastructure
• Why retrieval quality is becoming the defining challenge in AI agent architecture
• What running Kubernetes across millions of clusters taught AWS about zonal failures
• Anthropic wants you to use AI to decide whether or not you should use AI.
• OpenAI, Microsoft & Anthropic agree on who runs the agent. They disagree on what you can take back.
• “Every IC engineer is really a front line manager now.” But are they productive?
• Why zero vulnerability code packages could still be your biggest software supply chain risk
• Meta debuts Muse Spark 1.1 — its first paid AI model
• OpenAI is folding Codex into the ChatGPT app — and taking aim at Claude Cowork
• OpenAI’s GPT-5.6 is now live
• Enterprise AI benchmarks are broken
• Jensen Huang says traditional coding is dead. Here’s what comes next.
• Why a five-minute sniff test is your secret supply chain defense
• Develop like you deploy: closing the Kubernetes local-to-cluster gap
• The “silent hallucination” loop: how our autonomous data pipeline poisoned its own vector store
• Agentic AI in observability: accelerating root cause analysis
• “The Switzerland of AI”: OpenClaw becomes a non-profit foundation
• “Opus-class, but faster”: What Elon Musk says about beating Anthropic

← Back to Newsletter

This week saw a series of maintenance releases across container runtimes, networking, and security projects. Key developments included the graduation of UDPRoute and TCPRoute to GA in Kubernetes Gateway API, updates to several core Cloud Native components, and ongoing discussions around AI infrastructure and data sovereignty.

🚀 Notable Releases

• CRI-O v1.36.2 - This is a maintenance release with uncategorized changes since v1.36.1.
• CRI-O v1.35.5 - This is a maintenance release with uncategorized changes since v1.35.4.
• CRI-O v1.34.10 - This release includes bug fixes and uncategorized changes since v1.34.9.
• etcd v3.6.13 - This release includes a list of changes detailed in the changelog, with potential breaking changes outlined in the upgrade guide.
• etcd v3.5.32 - This release includes a list of changes detailed in the changelog, with potential breaking changes outlined in the upgrade guide.
• Flux v2.9.0 - Introduces a Flux CLI Plugin System with Mirror and Schema plugins, and Server-Side Apply field ignore rules for Kustomization resources.
• Harbor v2.15.2 - Updates the Go version from 1.25.9 to 1.26.3 and makes the openapi-generator-cli download URL configurable.
• Istio 1.28.10 - A maintenance release for the 1.28.x series.
• Open Policy Agent v1.18.2 - Fixes an opa fmt regression introduced in v1.18.0, restoring intended behavior for newlines in single-item collections.
• Open Policy Agent v1.18.1 - Addresses a memory leak in AnnotationSet via runtime.AddCleanup introduced in OPA v1.17.0.
• Prometheus v3.13.0 - This Long Term Support (LTS) release fixes a cross-site scripting vulnerability (CVE-2026-44990) in the UI, embeds third-party npm dependency licenses in the binary, and uses SHA-256 for API instead of SHA-1.
• Karmada v1.18.1 - A maintenance release for the 1.18.x series.
• Karmada v1.17.4 - A maintenance release for the 1.17.x series.
• Karmada v1.16.7 - A maintenance release for the 1.16.x series.
• Kubescape v4.0.10 - Adds an operator remediate CLI subcommand, removes an orphan SecurityException CRD, fixes async scan failures in the Results endpoint, and adds a CEL env builder for the VAP engine.
• KubeVela v1.9.14 - Fixes preservation of last-applied-configuration for shared resources in applications and prevents an unbounded read in the Terraform remote configuration loader (GHSA-fmgp-q6jx-gg3x).
• KubeVela v1.10.9 - Fixes status.details CUE import statements compilation and prevents an unbounded read in the Terraform remote configuration loader (GHSA-fmgp-q6jx-gg3x).
• Lima v2.1.4 - Includes fixes for qemu fallback from hvf to tcg on macOS, updates nerdctl to v2.3.4, and adds support for 9p mounts in FreeBSD-15 templates.
• Longhorn v1.11.3 - Introduces improvements and bug fixes, including critical stability fixes for v1 volumes not being operable after iSCSI connection issues.
• NATS Server v2.14.3 - Updates Go version to 1.26.4 and demotes noisy per-connection log lines to debug level.
• NATS Server v2.12.12 - Updates Go version to 1.25.11, demotes noisy per-connection log lines, and applies writer options consistently for s2_fast compression.
• OpenFGA v1.18.1 - Adds diagnostic logging in weighted_graph_check, Expand, and ListUsers to surface authorization models that may be affected by future v1 deprecation.
• Capsule v0.13.8 - Addresses security vulnerabilities GHSA-jr6p-8pjj-mfx6 and GHSA-68cj-mvg9-rgm2, which relate to incomplete fixes for cluster-scoped resource creation and lack of webhook validation for NodeMetadata regex fields.
• Kube-OVN v1.15.17 - Fixes skipping non-security-group port groups in security group garbage collection and resolves an issue with VPC egress local policy without BFD.
• KubeArmor v1.7.4 - Includes updates to stable v1.7.3, fixes CI for Red Hat image certification, and updates actions and Go module dependencies.
• Meshery v1.0.54 - Upgrades to MeshKit v1.0.21, upgrades MeshSync and Operator, and fixes a typo in controller helper symbols.
• Meshery v1.0.53 - Guards empty design response in mesheryctl apply to prevent index out of range errors and exposes MeshSync, Operator, and Broker configuration.
• Meshery v1.0.52 - Migrates event streaming from GraphQL to Server-Sent Events (SSE) and adds date-fns dependency.
• Meshery v1.0.51 - Syncs go.mod, updates schemas to v1.3.22, standardizes “Method Not Allowed” error, and renames Extension to VisualDesignerExtension.
• Meshery v1.0.50 - Syncs wasm module to MeshKit v1.0.19, removes maintainer assignment, deletes scripts and server/meshmodel directories, and adds AWS VPC core relationship definitions.
• Submariner v0.20.3 - A maintenance release.
• Telepresence v2.29.2 - Provides installers with the option to run the root daemon as a system service.
• Kubernetes Gateway API v1.6.0 - UDPRoute and TCPRoute have graduated to GA (v1 API version). The v1alpha2 versions of these APIs are deprecated.
• ko v0.19.1 - Fixes YAML encoding to skip when a selector filters all documents and bumps dependencies including Sigstore Rekor from 1.5.1 to 1.5.2.
• Sigstore Rekor v1.5.3 - Uses bytes.Equal for inclusion proof root hash comparison, returns 499 if the client disconnects instead of 500, and bumps google.golang.org/grpc from 1.80.0 to 1.82.0.
• Trivy v0.72.0 - This release includes various new features and enhancements detailed in the changelog.

📰 This Week in Cloud Native

The week’s news highlighted continued advancements in Kubernetes capabilities, a significant focus on AI infrastructure and its economic implications, and ongoing discussions around data management and security.

In the Kubernetes ecosystem, Dynamic Resource Allocation (DRA) reached General Availability in Kubernetes v1.35, allowing for more flexible resource management. The etcd-operator project was donated to Cozystack, introducing a new v1alpha2 API for deploying and maintaining etcd clusters. AWS announced Amazon EKS Version Rollback, a new capability for managing cluster upgrades. Additionally, the AWS DevOps Agent can now diagnose Kubernetes control plane performance issues, including 429 throttling. The CNCF re-introduced kpt as a toolchain for infrastructure automation, emphasizing a package-centric approach.

AI and its infrastructure dominated much of the news. Several reports from The New Stack discussed the substantial investments by Microsoft, AWS, and Anthropic in AI infrastructure, often not directly tied to model improvements. Topics included the economic layer of the AI web, the infrastructure lock-in costing AI companies, and the challenges of traditional CI/CD for LLMs. Anthropic released Claude Sonnet 5, Fable 5, and Claude Science, an AI workbench for scientific research. AWS also launched a desktop environment for agents (WorkSpaces) and introduced durable functions in AWS Lambda for building fault-tolerant multi-agent AI workflows. Gartner projected significant changes in the business software market due to the increasing adoption of AI agents.

Regarding data and security, the concept of data sovereignty was explored, shifting the focus from geographical server location to legal jurisdiction over data. AWS introduced Amazon S3 Annotations, allowing teams to attach metadata to S3 buckets. Microsoft announced the upcoming removal of NTLM support in Git (libcurl), impacting Azure DevOps Server customers. A “Cordyceps flaw pattern” and a Codecov supply chain attack were discussed, underscoring CI/CD pipelines as part of the attack surface.

💬 Community Buzz

Hacker News discussions this week centered on porting Kubernetes to the browser, fixing Kubelet memory leaks, and tools for Kubernetes observability and incident investigation. There was also significant engagement around local-first applications, including password managers, clipboard managers, and Docker alternatives for macOS (Apple Container, Dory, Fruitbox, WSL Containers). AI agents and their underlying infrastructure were a recurring theme, with projects focused on shared context, memory, and orchestration for coding agents.

📊 Numbers of the Week

• Total stable releases: 37 across 22 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 212 commits
  2. cilium/cilium — 160 commits
  3. kubernetes/kubernetes — 138 commits
• Top 3 projects by merged pull requests this week:
  1. keycloak/keycloak — 110 merged PRs
  2. cilium/cilium — 93 merged PRs
  3. kubernetes/kubernetes — 93 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 28

A complete list of all cloud native articles and news from this week.

AWS Compute (1)

• Building fault-tolerant multi-agent AI workflows with AWS Lambda durable functions

AWS Containers (2)

• Diagnose Kubernetes Control Plane Performance Issues with AWS DevOps Agent
• Announcing Amazon EKS Rollback for safe and reliable management of cluster upgrades

Azure DevOps Blog (1)

• Upcoming Change: NTLM Removal in Git (libcurl) – Impact to Azure DevOps Server Customers

CNCF Blog (7)

• How data sovereignty is changing cloud native infrastructure design
• (re)introducing kpt: Your toolchain for infrastructure automation
• Understanding dynamic resource allocation in Kubernetes
• Kepler, re-architected: Improved power accuracy and a community call to action!
• Dragonfly v2.5.0 is released
• OTel and mesh-derived metrics: A 2026 reference
• etcd-operator joins Cozystack with a new v1alpha2 API

Hacker News (130)

• I ported Kubernetes to the browser
• Fixing a kubelet memory leak in Kubernetes 1.36
• The SRE Guide to Kubernetes Observability: Red vs. Use Methods
• Automatic Kubernetes workload resource adjuster
• Show HN: Kube-insight – retained Kubernetes evidence for incident investigations
• Show HN: Groot – Kubernetes incident evidence in one .tar.gz
• Secure AI Sandboxes on Kubernetes
• Show HN: Marmot, context layer for agents and humans
• Show HN: ServerKit – A mobile UI for server management
• Show HN: Sibyl – self-hosted cross-agent memory for AI coding agents
• Architectural Patterns: Moving Beyond Cloud-Native to Local-First
• Show HN: Bramble – Local-first password manager
• Show HN: HyperPaste – a free, open-source clipboard manager for macOS
• Show HN: Local MCP – Claude/ChatGPT read your iMessage, Teams, files on-device
• Show HN: Pglayers – PostgreSQL extensions as stackable Docker layers
• Show HN: Fleet – a local-first console for managing Dockerized Hermes AI Agents
• Apple Container 1.0 Released as a Native Docker Alternative for macOS
• Real Linux. In a browser tab. No install. No server. No Docker
• Show HN: Fruitbox – Docker Compose for Apple’s container runtime
• Microsoft reveals Windows 11’s Docker Replacement WSL Containers to ship soon
• Dory: Docker and Linux containers, native to your Mac
• Show HN: I built an open-source alternative to Claude Cowork
• Show HN: TraceAIO – open-source LLM visibility tracker
• Is it practical to host a real production app on a Mac mini?
• Show HN: I indexed 37h of my videos using an RTX 4090 and local ML models in 24h
• Show HN: Is grep enough? A transparent benchmark for agentic code navigation
• Show HN: Valmis, an OpenClaw alternative built for work, with security in mind
• Show HN: Tesserae, self-hosted dashboards for the e-paper panel you own
• Show HN: OpenATP: A platform for automated theorem proving in Lean
• Nvidia own mockery of a bad product release (2003)
• Ask HN: What books did you enjoy reading recently?
• I still enjoy building websites without AI
• How to Enjoy John Ashbery
• Ask HN: It’s World Social Media Day. Which current ones you do and don’t enjoy?
• Show HN: Agentic Orchestrator, a TUI for long-running coding agents
• Show HN: I built a website showing the likelihood of the AI bubble to pop
• Well it’s been 3 years of unemployment and $250k in debt
• Show HN: Shoaku – Your Coding Navigator
• Show HN: Gist Discover – TikTok for ArXiv Summaries
• Show HN: Scout.kids – Agents that find activies for families
• Show HN: Statuslin.es – a community library of custom Claude Code status lines
• Show HN: OpenSfM v1.0
• Show HN: microide, a 100% vibecoded IDE that LLM agents can drive
• Show HN: Ultracodex – Run Claude Ultracode Dynamic Workflows with Codex Agents
• Show HN: I made an app that can accelerate cures and nobody fucking cares
• Istota – a multi-user AI agent and personal OS
• Wireless LAN SD
• How to ask for help from people who don’t know you
• European ISPs Want Rightsholders Held Accountable for Overblocking Damage
• My dad helped build North America’s oat supply chain: Can it be remade?
• Show HN: CLI that helps AI agents avoid vulnerable dependencies
• XMM-Newton helps revise distance to outer spiral arms
• The Bureaucratic Hell of Getting a Job in 2026
• Researchers affirm long-held belief that viruses can trigger Parkinson’s disease
• I helped build adtech’s tracking tools. They’re on government sites now
• Google commercial imagines Declaration of Independence written with help from AI
• Show HN: My first SaaS to help human developers and AI agents share context
• Help Us Save MeshCore
• Claude Helped a Hacker Find a Way to Issue Tickets to US Music Festivals
• GLP-1’s help women find work, and men to leave their partners
• Ask HN: What things might help me to become inference engineer?
• Ask HN: Help my web browser project be better
• Birdsong data from Merlin ID app to help global biodiversity project
• Show HN: Papa – open-source Hemingway-style readability linting for Markdown
• Show HN: Collection of skills to help improve UX and AI Product design
• Show HN: A tool to help people in social situations
• Help, my dentist started coding – or: a little history of low code solutions
• Help investigate if California’s new data broker opt-out tool works
• Show HN: Ovi AI – AI QA partner that helps startups ship fast at high quality
• Launch HN: Manufact (YC S25) – MCP Cloud
• Show HN: KiCad in the Browser
• Show HN: My 13-year-old built an ant colony tracker
• Ask HN: Why are so many “AI evangelists” posting such insufferable content?
• Launch HN: Parsewise (YC P25) – Reason Across Documents with an API
• Show HN: QUALITY.md – open format/specification, agent skill, and CLI
• Show HN: I hated how much my 12-year-old played Roblox, so we built our own FPS
• Show HN: GeoSpoof – your VPN hides your IP, but the browser leaks your location
• Ask HN: America turns 250 today. What does it mean to you?
• Show HN: Opbox – CRDT based sync for text files on disk
• Ask HN: How would you launch an open-source app with a small budget?
• Burned out, how do I get out of the rut?
• Show HN: Margarita - Programming language for Agents using Markdown-ish syntax
• Most arguments are about ego, not ideas
• New serious vulnerabilities spiked around release of Claude Mythos Preview
• I Accidentally Started a Small Business Three Weeks Ago
• DNSGlobe – Rust TUI to watch DNS propagate around the world
• The Scanline Sweeper: A Glyph Rendering Algorithm [pdf]
• Optimizing an algorithm that’s quadratic by design
• In the age of algorithms and AI, is traditional media democracy’s defence?
• GoDaddy argues India’s fake site crackdown could damage internet
• FlashAttention-4: Algorithm and Kernel Pipelining Co-Design
• Show HN: Dockside – I turned unused space around the macOS Dock into a workspace
• Hypermind-Swarm: P2P social network with no servers, no algorithms, no history
• No, There Wasn’t An Advanced Civilization 12,000 Years Ago (2017)
• Ask HN: Why are the upvote arrows so small?
• Show HN: Battle City Like Game I Made with Classmates 14 Years Ago
• Reshaping the Quantum Arrow of Time
• Tell HN: Installing Cursor on iOS irreversibly changes your privacy settings
• Show HN: Homegames. An open-source game platform I’ve been making for 8 years
• Show HN: Mail Memories – A desktop app to rescue photos from Gmail
• Show HN: Claudoro, Pomodoro timer embedded in the Claude Code statusline
• Ask HN: Since when does Craigslist’s front page have emojis?
• Show HN: I measured the half-life of 41,301 Show HN launches. It’s 7 hours
• Show HN: Curvytron 2, I rewrote my browser party game, 10 years later
• Email from Reddit for age verification on a deleted account
• Show HN: Run AI chat, image gen, vision, and voice offline on your Mac
• Show HN: Waypoint.nvim – A Neovim plugin for bookmarking lines of code
• Apple sells me a MacBook to deliver $1700; cancels 5 days later quoting $2000?
• Ask HN: Why about a third of the submissions become dead in mere minutes?
• Ask HN: Is Codex with GPT 5.5 Extra High being dumbed down?
• Show HN: A bedside camera detects REM sleep and agrees with a clinical EEG
• Show HN: Visualize Model Spikiness in 3D
• Show HN: An unmetered LLM API–$6/month, no token tracking, no limits
• Show HN: Social and context-aware AI platform to do math
• Return of RSS Feeds
• Court filing: Adafruit seeks declaratory judgment against Flux [pdf]
• No one thinks Midjourney is alive. That matters for those who think Claude is
• Flexible metaprogramming with Rhombus
• Loss of Cognitive Flexibility, Not Memory, May Be Earliest Sign of Alzheimer’s
• Flu drugs show promise against cognitive decline
• After culling his flock, US poultry farmer now fears bird flu
• Oracle Cloud’s $304 Flex VM: First Observations from Fresh Deployments
• Show HN: A local-first eBook reader with a journal for each book you read
• Show HN: Logo Design for Busy Founders
• Show HN: A free, no-ad, no-account, no-server iOS calorie budgeting/diet app
• Show HN: Create agents that grow to fulfill their purpose
• Meta data center water discharges suspended for contaminating water supply
• Show HN: Selbstbild – What Fable 5 thinks of your HN comment history
• Show HN: Xenoeye – analyze network without AI using netflow, PostgreSQL, Grafana
• Show HN: Pull Claude Code transcripts into your Codex session, and vice versa

Heise Cloud (5)

• iX-Workshop: IT-Infrastrukturen mit OpenTofu aufbauen und verwalten
• Cloud wird zur Achillesferse der deutschen Wirtschaft
• Bericht: Meta will überschüssige Kapazität aus KI-Rechenzentren vermieten
• Azure Linux 4.0 startet mit neuer Container-Variante
• KI-Agenten: Bis zu 234 Milliarden US-Dollar Softwareumsatz in Gefahr

InfoQ Cloud Native (2)

• AWS Introduces Amazon S3 Annotations
• Podcast: Architectural Patterns: Moving Beyond Cloud-Native to Local-First - Insights from Adam Wiggins

The New Stack (26)

• Microsoft, AWS and Anthropic are spending billions — and not on better models
• 10 moments that defined AI’s turbulent first half of 2026
• The AI revolution will not be televised — it’ll be quantized
• Why cheaper models alone won’t save your AI budget
• Apple just turned Safari into something AI agents can control
• The $1.3 million theft that exposed AI’s blind spot
• Microsoft just admitted its biggest AI mistake — and spent $2.5 billion fixing it
• “AI contributions are demoralizing”: Godot bans coding agents to save its mentoring model
• What comes after attention? This startup says it already knows.
• Your social login buttons run on third-party cookies. FedCM doesn’t.
• Why traditional CI/CD fails for LLMs (and the release gates we built to fix it)
• OpenClaw’s new app doesn’t run AI on your phone. That’s the whole point.
• Cordyceps flaw pattern is more proof CI/CD is part of the attack surface
• Cloudflare wants to build the economic layer of the AI web
• “You Only Compute Once”: How Clockwork wants to put an end to AI training restarts
• The call is coming from inside your pipeline: the anatomy of a Codecov attack
• How Anthropic is bringing Fable 5 back — and when it’ll cost you
• Fable is coming back: Federal government lifts export controls on Anthropic AI model
• Anthropic’s Claude Sonnet 5 system card says more about the future of AI than its benchmarks do
• The infrastructure lock-in costing AI companies hundreds of millions
• Anthropic Sonnet 5: It closes the gap with Opus 4.8, and is cheap until August
• Anthropic launches Claude Science, an AI workbench for scientific research
• AWS launches a desktop for agents
• AWS just put $1 billion into forward deployed engineers. Here’s why it matters for enterprise teams.
• “The harness is where the hard work is”: Harness bets on agents that enterprises can trust in production
• Aikido acquires Root to backport open source fixes without forcing upgrades

← Back to Newsletter

This week in Cloud Native saw significant updates across security, AI integration, and core ecosystem projects. Multiple projects released security patches addressing various vulnerabilities, while the discussion around AI agents and their operational implications continued to grow. Kubernetes ecosystem projects also received updates, enhancing management and observability capabilities.

🚀 Notable Releases

Security

• cert-manager v1.20.3 - Addresses a security vulnerability (GHSA-8rvj-mm4h-c258) where the cert-manager-edit ClusterRole granted namespace users permission to create ACME Challenge and Order resources directly.
• cert-manager v1.19.6 - Addresses a security vulnerability (GHSA-8rvj-mm4h-c258) where the cert-manager-edit ClusterRole granted namespace users permission to create ACME Challenge and Order resources directly.
• Crossplane v2.3.3 - Fixes a package signature verification time-of-check-to-time-of-use (TOCTOU) flaw (GHSA-mf7q-r4rv-jv94) that could allow malicious OCI registries to serve unsigned content after initial verification.
• Crossplane v2.2.3 - Fixes a package signature verification time-of-check-to-time-of-use (TOCTOU) flaw (GHSA-wfqx-gjrf-g28r) that could allow malicious OCI registries to serve unsigned content after initial verification.
• Crossplane v2.1.7 - Includes security updates for dependencies, updating github.com/quic-go/quic-go to v0.59.1 and golang.org/x/net to v0.55.0.
• Crossplane v1.20.10 - Includes security updates, bumping Go to 1.25.11 and updating go.mongodb.org/mongo-driver to v1.17.7.
• Envoy v1.38.3 - Includes security fixes for CVE-2026-47205 (Authz per route crash), CVE-2026-47207 (ext_proc response handling), and CVE-2026-47221 (router internal redirects).
• Envoy v1.37.5 - Includes security fixes for CVE-2026-47205 (Authz per route crash), CVE-2026-47207 (ext_proc response handling), and CVE-2026-47221 (router internal redirects).
• Envoy v1.36.9 - Includes security fixes for CVE-2026-47205 (Authz per route crash), CVE-2026-47207 (ext_proc response handling), CVE-2026-47221 (router internal redirects), and CVE-2026-47775 (OAuth2 code verifier padding oracle).
• Envoy v1.35.13 - Includes security fixes for CVE-2026-47207 (ext_proc response handling), CVE-2026-47221 (router internal redirects), CVE-2026-47775 (OAuth2 code verifier padding oracle), and CVE-2026-48044 (HTTP/2 flood vulnerability).
• Keycloak 26.6.4 - Addresses security vulnerabilities including CVE-2026-9099 (group-admin escalation to realm-admin) and CVE-2026-9083 (Keycloak admin console XSS).
• Capsule v0.13.7 - Addresses security vulnerabilities GHSA-gxjc-74v5-3vx3 (malformed ForbiddenAnnotations.Regex bypassing Tenant validation) and GHSA-gjw4-3v3v-rqxg (Tenant owner bypasses forbidden label/annotation enforcement).
• Podman v6.0.0 - Addresses CVE-2026-57231, where a malicious image could leak host environment variables into containers via malformed Env entries. This release also introduces breaking changes.
• Podman v5.8.4 - Addresses CVE-2026-57231, where a malicious image could leak host environment variables into containers via malformed Env entries, and updates golang.org/x/crypto to v0.55.0.
• Ko v0.19.0 - Rejects -toolexec in the GOFLAGS environment variable for security, adds a repeatable --ldflags flag for go build, fixes defaultFlags application in .ko.yaml, and writes directory headers in kodata tar archives.
• External Secrets v2.7.0 - General updates include releasing Helm charts 2.6.0 and adding an Infisical provider e2e test suite.
• External Secrets helm-chart-2.7.0 - Helm chart release for external secrets management in Kubernetes.

Orchestration & Cluster Management

• Open Policy Agent (OPA) v1.18.0 - Introduces a breaking fix to the outbound User-Agent header to conform to RFC 9110, adds container-aware resource limits with automatic GOMAXPROCS and GOMEMLIMIT support, and includes opa fmt correctness fixes.
• Volcano v1.14.3 - Fixes Network-Topology-Aware scheduling soft mode for jobs, corrects scalar in-queue resource accounting to use milli-units, and clears device-related annotations when releasing pods.
• Clusternet v1.0.0 - Introduces support for Kubernetes 1.32, includes Protobuf serialization optimizations, adds new field patch type support, and resolves multiple defects.
• Cluster API v1.13.3 - Supports Management Cluster v1.32.x -> v1.36.x and Workload Cluster v1.30.x -> v1.36.x. Adds DefaultTransform on CacheOptions and fixes 3 bugs.
• Cluster API v1.12.9 - Supports Management Cluster v1.31.x -> v1.35.x and Workload Cluster v1.29.x -> v1.35.x. Fixes 2 bugs, including skipping update check for clusterctl completion and granting RBAC for OwnerReferencesPermissionEnforcement.
• Baremetal Operator v0.13.1 - Fixes reconciliation for Host Firmware Settings (HFS) created before BareMetalHosts (BMH) and updates cluster-api to v1.13.3.
• Baremetal Operator v0.12.5 - Updates cluster-api to v1.12.9 and Go version to 1.25.11.

Networking & Service Mesh

• Envoy v1.38.3 - (See Security section for details).
• Envoy v1.37.5 - (See Security section for details).
• Envoy v1.36.9 - (See Security section for details).
• Envoy v1.35.13 - (See Security section for details).
• Istio 1.30.2 - This is a patch release.
• Istio 1.29.5 - This is a patch release.
• Istio 1.28.9 - This is a patch release.
• Kube-OVN v1.15.16 - Updates golang.org/x/tools to v0.47.0 and refreshes kubectl golang.org/x dependencies.
• Kube-VIP v1.2.1 - Adds dhcp-broadcast annotation, includes endpointless reconciliation after service refactor, and bumps Go to 1.26.4.
• Kuma v2.11.16 - Bumps Envoy from 1.35.11 to 1.35.12, updates Go version from 1.26.3 to 1.26.4, and fixes policy matching for ignored inbounds for Dataplane.

Observability

• Fluentd v1.19.3 - Implements strict host validation for dynamic HTTP endpoints, enforces size limits on decompressed payloads, and changes default visibility for in_monitor_agent config.
• OpenTelemetry Collector v0.155.0 - Removes stabilized feature gates confighttp.framedSnappy, configoptional.AddEnabledField, confmap.newExpandedValueSanitizer, and exporter.PersistRequeue.
• OpenCost v1.120.4 - Updates UI image build commands, fixes custom provider GPU default pricing, and adds queryProjectID field to BigQuery integration.
• Meshery v1.0.49 - Adds telemetry routes to Next.js and de-duplicates Artifact Hub registrant summary in startup logs.
• Meshery v1.0.48 - Refactors context handler methods, improves connection persistence logging, and fixes error handling in mesheryctl tests.
• Meshery v1.0.47 - Fixes UI build issues due to mui-tree ESM mismatch, updates connection and credential handling for local provider, and adds Telemetry support with Grafana dashboards and Prometheus metrics.
• Meshery v1.0.46 - Updates Meshery Schemas to v1.3.16, fixes duplicate ErrInvalidUUID errors, and adds release-scoped cache headers for the served UI.

Database

• Vitess v24.0.2 - This is a patch release with 34 merged Pull Requests.
• Vitess v23.0.5 - This is a patch release with 35 merged Pull Requests.
• Crate v6.3.4 - Patch release.
• Crate v6.2.10 - Patch release.
• Crate v6.1.5 - Patch release.

Registry

• Dragonfly v2.5.0 - Adds support for direct repository downloads from Hugging Face and ModelScope for its client.
• Dragonfly v2.4.4 - Fixes a scheduler issue where missing seed peers in refresh were treated as an error instead of a warning.

Messaging

• Strimzi Kafka Operator 1.1.0 - Requires v1 CRD API; older v1beta2, v1beta1, and v1alpha1 APIs are no longer supported.

Build & Application Frameworks

• Backstage v1.52.1 - Fixes an internal refactor issue for app sign-in runtime, resolves scheduler tasks stuck with NULL next_run_start_at when switching trigger types, and corrects a broken configuration schema in @backstage/plugin-kubernetes-react.
• Telepresence v2.29.1 - Provides official release artifacts with installers that include an option to run the root daemon as a system service.
• Spin v4.0.2 - Uses P3-friendly WAC in spin-environments.
• Spin canary - This is an unstable release intended for developers to try out the latest features.

Edge

• K3s v1.36.2+k3s1 - Updates Kubernetes to v1.36.2 and includes backports for June 2026.
• K3s v1.35.6+k3s1 - Updates Kubernetes to v1.35.6 and includes backports for June 2026.
• K3s v1.34.9+k3s1 - Updates Kubernetes to v1.34.9 and includes backports for June 2026.
• K3s v1.33.13+k3s1 - Updates Kubernetes to v1.33.13 and includes backports for June 2026, and bumps Traefik to v3.7.4.

Backup

• Velero v1.18.2 - Skips VolumeGroupSnapshots (VGS) cleanup when backups did not use them, and fixes a backup performance regression with includedNamespaces ["*"] by restoring cross-namespace API listing optimization.

📰 This Week in Cloud Native

The cloud native landscape saw continued focus on AI integration and its operational implications. Multiple reports discussed the development and governance of AI agents, with Vercel introducing Eve, an open-source framework for building AI agents. The integration of AI agents within Kubernetes clusters, leveraging tools like Argo CD and GitOps for CI/CD, was also explored. Discussions extended to considerations for keeping AI inference close to data for security and compliance, with some organizations focusing on FedRAMP boundaries for AI agent governance. The Kubernetes Working Group Device Management highlighted new requirements for hardware management driven by AI and Edge workloads, underscoring the need for advanced hardware specification beyond traditional CPU and memory metrics.

Security and supply chain hardening remained a key theme this week. The CNCF blog featured updates on the Security Profiles Operator v1, noting its stable APIs and role in shaping upstream Kubernetes security. Hardening CI/CD pipelines was also detailed, with a focus on credentials and verification processes to enhance security. Additionally, an open-source security body, Akrites, was launched by Anthropic and other organizations to coordinate vulnerability responses. In the Java ecosystem, efforts were highlighted to address unpatched JVM vulnerabilities and provide remediated libraries to mitigate security backlogs.

In the Kubernetes ecosystem and observability space, new plugins for Headlamp were introduced, extending its UI capabilities to manage Cluster API, Volcano workloads, and Knative serverless functions. These additions aim to provide enhanced visual context and debugging for various Kubernetes components. For distributed tracing, Jaeger’s ClickHouse backend was discussed, demonstrating significant data compression ratios. AWS announced performance and scalability improvements for Amazon EKS Auto Mode, alongside a new capability for customer-routed control plane egress through VPC, enhancing network control and security for EKS clusters.

Developer experience and open-source community dynamics also received attention. The role of open-source maintainership in the age of AI was debated, as more contributors leverage AI tools for patch generation. The Rust Foundation debuted official training programs to address the language’s learning curve. Discussions also covered practical aspects like achieving zero-downtime deployments with Docker Compose and federating Kubernetes clusters. The announcement of a new community governance model for MySQL by Oracle marked a step towards broader community involvement in the database’s future development.

💬 Community Buzz

Discussions on Hacker News this week frequently addressed the implementation, scaling, and debugging of AI agents, along with challenges and tooling for managing their context and identity. Topics also included strategies for achieving zero-downtime deployments using Docker Compose and federating Kubernetes clusters, as well as experiences with rebuilding Kubernetes operators for improved scalability. The impact of AI on software development practices and developer jobs also generated commentary.

📊 Numbers of the Week

• Total stable releases: 54 across 30 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 370 commits
  2. kubernetes/kubernetes — 162 commits
  3. kubevirt/kubevirt — 139 commits
• Top 3 projects by merged pull requests this week:
  1. envoyproxy/envoy — 97 merged PRs
  2. kubernetes/kubernetes — 77 merged PRs
  3. keycloak/keycloak — 70 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 27

A complete list of all cloud native articles and news from this week.

AWS Compute (4)

• Build reliable voice analytics workflows with AWS Lambda durable functions and Amazon Bedrock
• Maximize Amazon EC2 Capacity Reservations with Capacity Manager data exports
• Modernizing Lambda + S3 workloads with Amazon S3 Files
• Simplify AWS Outposts lifecycle management with new self-service capabilities

AWS Containers (2)

• Faster nodes, smarter scaling: What’s new inside Amazon Elastic Kubernetes Service (Amazon EKS) Auto Mode
• Amazon EKS now supports control plane egress through your VPC

AWS Open Source (2)

• Building a Stateful IT Service Desk Agent with LangGraph on Amazon EKS
• Open Governance for MySQL: A Step Forward for the Community

CNCF Blog (7)

• Security Profiles Operator v1: Stable APIs, Security Hardened, and Shaping Upstream Kubernetes
• Securing CI/CD for an open source project, part 3: Credentials, verification, and what’s next
• Building a Cluster-Aware AI Agent with Kubernetes, Argo CD, and GitOps
• From Awareness to Engineered Accessibility in Open Source
• Agent Auth: A lawyer’s day in court
• Building Jaeger’s ClickHouse backend: 8.6× compression on 10 million spans
• Telemetry that matters: Designing sustainable, high-impact observability pipelines

Hacker News (120)

• Zero-Downtime Deployments with Docker Compose – No Kubernetes Required
• Our Kubernetes Operator Didn’t Scale, So We Rebuilt It
• Federating Clusters for Zero-Downtime Kubernetes
• Show HN: Marmot, context layer for agents and humans
• Show HN: peerd – AI agent harness that runs entirely in your browser
• Show HN: Keynap – On-device AI voice typing app for Windows
• Applied AI Implementation Engineer Freelance
• Show HN: RapidCam – Browser-based, parametric 2D CAD/CAM app for CNC and laser
• CasaOS: An open-source home server OS for Docker apps
• Docker-compatible REST API on top of Apple container
• AI DevOps Engine – bot posts PR fixes after testing in network-isolated Docker
• Show HN: ZeroDrop – Disposable email inboxes for CI pipelines (no Docker)
• Show HN: Shumai – open-source Frame.io alternative for creative work
• Show HN: Mute non-ENG Mastodon posts and RSS GitHub wall (browser automation)
• Show HN: Build and Host AI apps on your own servers
• Show HN: uvx ptn and expose any system to agents (dangerously)
• Show HN: Keep all microservices consistent and make batch changes
• Best way to integrate your devtool with companies
• Show HN: Docket Fleet – mobile device cloud
• Show HN: BetterDB, MIT Valkey-native context layer for AI agents
• Synth beats Fable 5 on deep research
• Routing for serverless servers with Pingora, Envoy, and Spanner
• Envoy AI Gateway 1.0 – A Stable, Production-Ready AI Gateway
• Show HN: FastUbu – An Ultrafast Video Archive
• Ask HN: Yahoo deleted all my emails. Now what?
• Show HN: I built a hardware quantum RNG and wired it into a Magic 8-Ball
• Do Course Certificates Matter?
• Show HN: Puzzle with Strangers. A free multiplayer jigsaw
• Ask HN: Do you use web apps on your smartphone?
• Ask HN: Anyone got a 43" 4K? Thoughts?
• Show HN: SharpSkill, a LeetCode alternative built in 15 spoken languages
• Show HN: We built a LeetCode alternative in 15 foreign languages
• With crossplanes, Helm is all you need
• A German AI publisher rewrites Hacker News posts and strips the sources
• The most popular sites that still don’t support passkeys
• A man was gifted his dream car by Kevin Mitnick, who he helped put in prison
• Micron Suggests Apple Helped Cause Memory Price Crisis
• Cloudflare teams up with big browsers to help websites detect unwelcome visitors
• Pakistan’s solar miracle – how the hell did they do it?
• Pollen (CEO Negus-Fancey, CTO Wright) tried to remove article, and Google helped
• $1.4T investment helps China restore freshwater ecosystem’s oxygen
• White House Helped Mark Zuckerberg and the Google CEO Dodge a Senate Grilling
• If AI Helped Me Write This, Is It Still Mine?
• I patched llama.cpp to gain 20% prompt processing TPS. Help me make a PR
• AI glasses help students cheat in exams – test-obsessed Asia is ground zero
• How Remote Work Has Helped a Generation of Working Parents
• Strong Relationships, Loosely Held
• AI is reshaping work. A new group aims to help people adapt and thrive
• Show HN: We Help Voice AI Handle Group Conversations
• Dear researchers: help me deal with incidents [pdf]
• The world is heating up, and policies are not helping
• Snap’s Evan Spiegel, Miranda Kerr help erase $550M in med debt for Californians
• Hermetic builds help contain Shai-Hulud attacks
• Democracy has a listening problem. These AI tools might help
• You can’t stop scrolling (and what helps)
• Oracle’s 21,000 layoffs help drive its debt-fueled AI investments
• Butterfly that barely ages could help unlock longevity secrets
• Ask HN: Can someone help me find HN post about 00s console emulation?
• A Free Tool Is Helping Drivers Dodge Automatic License Plate Readers
• I built a app to help founders plan and build organized apps – AMA
• ‘The View’ Asks Its Audience for Help in Battle with FCC
• South Korea’s FoodNeverComes app helps users feel the rush of making purchases
• IBM has unveiled chip technology that could help extend Moore’s Law another dec
• Where U.S. Salary Ranges Help Job Seekers
• Where migrants live: Interactive tool that helps us see where migrants were born
• GitKraken Unveils Code Flow to Help Teams Navigate the AI Era
• New chip could help tiny robots traverse complex environments
• Gold coins help crack a centuries-old shipwreck mystery
• Show HN: LoomStack – Helping engineering orgs scale AI-driven development
• You Increased Your Prices – Did It Help or Hurt?
• From Tokenmaxxing to Token Minimalism
• The last Romans are still around
• Working around dragons with the Lemote Yeeloong laptop and OpenBSD
• The open source DOCX editor submitted to HN a few weeks ago has been deleted
• Ask HN: Books about Genetic Algorithms
• Hate “The Algorithm?” RSS Is One of the Tools You’ve Been Looking For
• The largest scorpion lived 415M years ago
• 50 Years Ago, Sugar Industry Paid Scientists to Point Blame at Fat(2016)
• Your Last Paycheck was 726 Days Ago
• 100 Years Ago, Students Took the First SAT. Where Is It Headed?
• Show HN: TikZ Editor – WYSIWYG editor for figures in LaTeX
• Show HN: Adrafinil – keep a lid-closed Mac awake only while agents work
• Show HN: Starglyphs - A constellation puzzle game based on Euler paths
• Show HN: Appaca – AI Workspace for Operators
• Ask HN: Norway bans AI in elementary schools
• Show HN: Git-lazy-mount mount a repo without cloning it. Works with ordinary Git
• Ask HN: Smallest amount of working ML weights that can be tattooed on a body?
• Ask HN: Is there a quiet market for ’no enforced AI’ dev jobs?
• GitHub’s new “search bar” sucks
• My website gets more attacks than human visitors
• Show HN: Sipp – Run small local LLMs in browser 3x faster
• Show HN: Pressn’t, a site where you can have a single post
• Show HN: Pgrust, Postgres in Rust (passing 100% of Postgres regression tests)
• Show HN: Tree, truth, druid and tar share one Proto-Indo-European root
• Ask HN: What should I advise my son?
• Where are all the supposed productivity gains going on HN?
• Ask HN: Have the founders of Palentir and Anduril ever read Tolkien?
• Ask HN: How do you know when an Ad campaign is doing well?
• Ask HN: Best AI Gateway?
• Extreme Heat conference cancelled due to extreme heat warning
• The PM’s Guide to Managing AI Debt
• My decade-old budget Android phone is faster than my 2024 flagship iPhone
• Show HN: Jargo – a Golang port of Pipecat for conversational-AI apps
• Show HN: Looped Whisper (FOSS) – Voice transcription menubar app for macOS
• Synthetic Infrastructure Testing with Canary Checker and Flux
• CXMT is set to challenge DRAM incumbents
• Military branches restore flu shot requirement after virus swept through base
• Years without fluoridated water show pattern of tooth decay experts warned about
• Fluid Paint
• $500M fund to make respiratory infections like colds and flu a thing of the past
• Big Tech critic loses House race in New York as AI lobby flexes political power
• Don’t Make Gates Optional, Make Them Flexible
• JSON-LD and fluree for human and agents interactions [video]
• Software Design for Flexibility: How to Avoid Programming Yourself into a Corner
• Show HN: ccMarvin – Just Email with AI
• How do you handle high-stakes decisions when your brain is at 99% capacity?
• The US Army Issued Ocarinas to Soldiers in World War II
• Memory-as-a-Graph for Coding Assistants
• Louis Pope Gratacap, a Curator in Lost Worlds
• Show HN: Orchid – Local-first record and replay for AI agent debugging

Heise Cloud (9)

• 77 Pfund pro Person: Das könnte Apple iCloud-Nutzern in Großbritannien zahlen
• Drei Fragen und Antworten: So klappt der Abschied von Microsoft 365
• Contra Microsoft 365 – der Kommentar: Mit Support-Ende in die Cloud gezwungen
• Pro Microsoft 365 – der Kommentar: Pragmatisch gesehen die beste Wahl
• Umstieg von M365 auf Nextcloud – eine Anleitung
• Cloud-Hosting im Preischeck: Virtuelle Server werden spürbar teurer
• Serverless mit Pausenfunktion: AWS stellt Lambda MicroVMs vor
• Video-KI: ByteDance gibt Vorschau auf Seedance 2.5 mit 30-Sekunden-Clips
• HPE: AI-Factory als Turnkey-System

InfoQ Cloud Native (1)

• Vercel Introduces Eve, an Open-Source Framework for Building AI Agents

Kubernetes Blog (5)

• Open source maintainership in the age of AI
• Introducing the Cluster API plugin for Headlamp
• Inspect Volcano workloads faster with Headlamp
• See your serverless: introducing the Headlamp plugin for Knative
• Spotlight on WG Device Management

The New Stack (26)

• “Bring it to our shop”: Workday’s pitch for keeping AI agents close to your most valuable data
• Okta is the first to bring AI agent governance inside FedRAMP boundaries
• Greptile, Cursor, and Devin agree that agents should run their code. What they run it against matters.
• Vibe slop is the symptom. Context debt is the disease.
• After Fable 5 ban, Anthropic and 19 organizations launch open source security body
• The US government just told OpenAI who’s allowed to use the next GPT 5.6 model
• AWS, Microsoft, and Google agree the session is the new unit of compute. They disagree on how to isolate it.
• Your engineering org needs an AI slop registry
• Shopify taught AI to spot duplicate products. Here’s why retailers are scrambling.
• The AI agent identity problem nobody’s talking about
• Public cloud vs. on-prem: Summit on where each workload belongs
• “Code should be regenerated, not maintained”: Codeplain makes the case for spec-driven development
• Trust in Rust: Foundation debuts official training to tackle steep learning curve
• Template-based data extraction is dead. Here’s what comes next.
• How we cut AI costs by 80%
• Agent Toolkit for AWS includes 20+ agent skills, but your agent might not load them without this one file
• OpenAI wants to claim more of the AI stack with Jalapeño, its first custom chip
• Azul wants to find your unpatched JVMs before AI does
• Will it Mythos? One coder’s verdict on Anthropic’s blend of debugging
• Chainguard targets Java’s unpatched vulnerability backlog with drop-in remediated libraries
• Agentic infrastructure operations begin with accurate, reliable infrastructure data
• Sakana Fugu is more than a router. But it’s not the blueprint for AI sovereignty, either.
• Kubernetes teams trust automation to ship code but not to touch CPU, and AI is raising the stakes
• Anthropic gives @Claude a permanent seat in your Slack channels
• OpenClaw and Hermes agree on what an agent is. They disagree on what controls it.
• Developers are now validating code they didn’t write — and may not understand

← Back to Newsletter

This week saw a significant number of patch releases across various Cloud Native projects, addressing security vulnerabilities and bug fixes. The Cloud Native community also highlighted developments in AI integration with Kubernetes, advancements in cloud native education, and ongoing discussions around data sovereignty and cloud infrastructure.

🚀 Notable Releases

CI/CD

• Argo CD v3.4.4 - This patch release provides installation manifests and confirms container images are signed by cosign for provenance.
• Argo CD v3.3.12 - A patch release offering installation manifests and signed container images for provenance.

Networking

• Cilium v1.19.5 - Extends troubleshoot commands for kvstore and clustermesh, removes the loadBalancer.standalone option from Helm, and fixes WireGuard MTU calculation.
• Cilium v1.18.11 - Extends troubleshoot commands for kvstore and clustermesh, and fixes weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API.
• Cilium v1.17.17 - Extends troubleshoot commands for kvstore and clustermesh, and fixes retries for CiliumNode Get errors in multipool configurations.
• Kube-OVN v1.15.15 - Updates containerd dependency to v2.2.5 and includes a fix for reconciling VPC BFD HA chassis on node changes.
• Kube-OVN v1.14.41 - Updates containerd dependency to v2.2.5 and includes a fix for reconciling VPC BFD HA chassis on node changes.

Container Runtime

• containerd v2.3.2 - This patch release includes security updates addressing CVE-2026-50195, CVE-2026-53488, and CVE-2026-53492.
• containerd v2.2.5 - A patch release containing security updates for CVE-2026-50195, CVE-2026-53488, and CVE-2026-53492.
• containerd v2.1.9 - This patch release includes security updates for CVE-2026-50195, CVE-2026-53488, and CVE-2026-53492.
• containerd v2.0.10 - A patch release with security updates for CVE-2026-53488 and CVE-2026-47262.
• containerd v1.7.33 - This patch release includes security updates for CVE-2026-53488 and CVE-2026-47262, and a go-jose security update for CVE-2026-34986.
• Lima v2.1.3 - Includes cherry-picks from the master branch, fixes for containerd.user=true on non-Linux guests, a fallback to scp for copytool with remote sources, and switches the default image to ubuntu-26.04. It also disables ssh.overVsock by default.

Build & Automation

• Dapr Runtime v1.18.1 - Fixes workflow event-timer reminders leaking with repeated event names, addresses sidecars becoming permanently unavailable after configuration reloads, and resolves unnecessary sidecar restarts on operator configuration resyncs.
• Dapr Runtime v1.16.16 - Fixes Sentry failing to sign certificates when the issuer key type does not match the CSR signature algorithm, and resolves Helm downgrade failures on the scheduler StatefulSet storage size from versions 1.17 or 1.18.
• Dapr Runtime v1.17.10 - Fixes resiliency retry matching being ignored on the pubsub publish path, meaning configured httpStatusCodes or gRPCStatusCodes for retries had no effect on Publish or BulkPublish errors.
• Helm v3.21.2 - A patch release that updates Kubernetes client libraries to align with Kubernetes v1.36.
• Helm v4.2.2 - This is a patch release.
• Backstage v1.52.0 - BREAKING CHANGE: The default discovery API implementation in @backstage/plugin-app has changed to FrontendHostDiscovery.
• KubeVirt v1.8.4 - A patch release that includes 31 changes and bug fixes.
• Meshery v1.0.45 - Bumps go.mongodb.org/mongo-driver to 1.17.7, restores gofrs/uuid library usage, and addresses a UI issue preventing the Connections icon from disappearing.
• Meshery v1.0.44 - Bumps github.com/containerd/containerd to 1.7.33, removes obsolete WASM filter startup seeding, and fixes a missing logo for the AWS API Gateway model in the UI.
• Telepresence v2.29.0 - Provides installers that include an option to run the root daemon as a system service, removing the requirement for elevated privileges during use.

Observability

• Prometheus v3.5.4 - This release fixes multiple security issues, including secrets being exposed in plaintext via the /-/config endpoint (GHSA-39j6-789q-qxvh) and bumps golang.org/x/net and OpenTelemetry dependencies to address reported CVEs (GO-2026-5026, GO-2026-4918, GO-2026-4985).
• Inspektor Gadget v0.53.2 - A bugfix release that addresses a container-hook fanotify self-deadlock by caching config.json.

Storage

• Rook v1.20.1 - A patch release focusing on feature additions and bug fixes to the Ceph operator, including adding rook-compatible Ceph CSI driver values to Helm, ensuring require-osd-release is set after major Ceph upgrades, and bumping golang.org/x/crypto to v0.52.0.
• Rook v1.19.7 - A patch release focusing on feature additions and bug fixes to the Ceph operator, including setting the default Ceph version to 19.2.4, configuring Helm ownership for CSI resources, and supporting node labels for OSD device class assignment.
• OpenEBS v4.5.1 - Introduces bug fixes, including a critical issue in Replicated PV Mayastor (issue #2004) that involved unnesting thread fd_group before destroy in interrupt mode, and reverts to ARC descriptor group.

Messaging

• Strimzi Kafka Operator 1.0.1 - Important: This version supports only the v1 CRD API; older v1beta2, v1beta1, and v1alpha1 APIs are no longer supported. Users must convert custom resources and upgrade CRDs before upgrading. Entity Operator cross-namespace watching is now controlled by the STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACES environment variable.

Security

• OpenFGA v1.18.0 - Operational warning for MySQL users: This release contains a migration that acquires a shared lock on the tuple and changelog tables, which can be a lengthy process during which Write operations will be blocked. It is recommended to avoid auto-migrations on startup for production instances with large datasets.
• Trivy v0.71.2 - Bumps Alpine Linux to version 3.24.1 and updates several common dependencies.

Orchestration

• Capsule v0.13.6 - Includes bug fixes for webhook release annotation on bounded ResourcePoolClaim, service account validation for tenant owners and tenants, and a racing condition for terminating namespaces.

Chaos Engineering

• Litmus Chaos 3.30.0 - Adds a metrics port to litmusportal-server manifests, updates the Go version in backend tests, and fixes GraphQL endpoint configuration to use ChaosGraphQLEndpoint.

Database

• CrateDB 6.3.4 - This is a patch release. Refer to the project’s release notes for detailed changes.
• CrateDB 6.2.10 - This is a patch release. Refer to the project’s release notes for detailed changes.
• CrateDB 6.1.5 - This is a patch release. Refer to the project’s release notes for detailed changes.

Application Frameworks

• Fermyon Spin Canary - This is a canary release, representing the most recent commits on the main branch. It is not considered stable and is intended for developers to test features that may not be fully implemented.

📰 This Week in Cloud Native

This week, the Cloud Native landscape saw a convergence of AI and infrastructure discussions, significant community announcements from KubeCon + CloudNativeCon India, and continued focus on data sovereignty.

A prominent theme was the integration of AI with Cloud Native platforms. Multiple reports and announcements detailed the use of Kubernetes for building multi-agent AI security platforms and the necessity of robust infrastructure for AI agents. AWS introduced services like “AWS Context” for knowledge graphs and “Kiro” for agentic coding supervision on mobile. Vercel launched “Eve,” an open-source framework treating agents as directories. Discussions also highlighted the challenges of securing AI pipelines, debugging probabilistic AI systems, and the need for a trust layer in AI, with Google, Microsoft, and OpenAI collaborating on specifications for AI behavior. There were also concerns raised about AI dependencies and the potential for “agentjacking” through exposed Sentry keys.

The Cloud Native Computing Foundation (CNCF) made several announcements from KubeCon + CloudNativeCon India. Flipkart was recognized for its Kubernetes and chaos engineering scale. The CNCF’s CARE Program was expanded, allowing a Certified Kubernetes Security Specialist (CKS) certification to extend a Certified Kubernetes Administrator (CKA) certification. A partnership with Udemy was announced to provide unified cloud native training and certification opportunities. New research confirmed India as a significant Cloud Native community with 2.25 million developers, noting rising hybrid cloud adoption and platform engineering maturity. The CNCF also welcomed new Silver members, indicating growing enterprise adoption of Kubernetes for platform engineering and AI workloads.

Discussions around data residency and digital sovereignty continued, with a focus on architectural patterns for cloud native platforms. Reports from Heise Cloud detailed Google Cloud’s timeline for a sovereign cloud in Germany and the EU’s potential classification of AWS and Azure as “Gatekeepers” under the Digital Markets Act, which could impose higher regulations. Concerns were raised about companies underestimating their AI dependencies and the legal implications of cloud provider locations versus actual data sovereignty. Additionally, there were reports on cloud pricing adjustments, with Hetzner increasing server costs and Oracle reducing free-tier resources, alongside predictions from Broadcom about a shift of AI workloads from public to private clouds due to cost.

💬 Community Buzz

On Hacker News this week, discussions frequently revolved around Kubernetes, with topics including job interview experiences, the concept of feedback loops in its operation, and tools for running Kubernetes in the browser or as a self-hosted playground. AI agents were another significant subject, covering agentic testing platforms, open-source frameworks for agents, and the infrastructure required to support them. Other technical discussions included Docker architectures, self-hosted applications, and various aspects of code review and observability.

📊 Numbers of the Week

• Total stable releases: 37 across 20 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 179 commits
  2. kubernetes/kubernetes — 134 commits
  3. kubevirt/kubevirt — 118 commits
• Top 3 projects by merged pull requests this week:
  1. kubernetes/kubernetes — 72 merged PRs
  2. cilium/cilium — 70 merged PRs
  3. argoproj/argo-cd — 63 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 26

A complete list of all cloud native articles and news from this week.

AWS Compute (2)

• Upgrading Lambda function runtimes at scale with AWS Transform custom
• Simulating Amazon EC2 EBS burst credits before downsizing an instance

AWS Open Source (1)

• Governing AI Assets at Scale with MCP Gateway and Registry

Azure DevOps Blog (1)

• Retirement of Azure DevOps issuer in Workload identity federation service connections

CNCF Blog (9)

• KubeCon + CloudNativeCon, OpenInfra Summit and PyTorch Conference Unite in China to Scale AI
• Flipkart Wins CNCF End User Case Study Contest for Kubernetes and Chaos Engineering Scale
• Expanding CARE: Passing CKS can now extend your CKA certification
• CNCF and Linux Foundation Education Partner with Udemy to Provide a Unified Cloud Native Training & Certification Opportunity
• CNCF and SlashData Report Confirms India as One of the Largest Cloud Native Communities with 2.25 Million Developers
• CNCF Welcomes New Silver Members as Global Demand for Cloud Native Infrastructure Grows
• Why cloud native belongs at the heart of agentic AI: Lessons from building a multi-agent security platform on Kubernetes
• From data residency to digital sovereignty: Architectural patterns for cloud native platforms
• Improving Arm64 support in CNCF projects with OCI credits

Hacker News (132)

• What job interviews taught me about Kubernetes
• The feedback loops behind Kubernetes
• Kubernetes in the Browser
• What I learned using AI to build a Kubernetes Operator for Supabase’s Multigres
• Kubernetes Runs on Feedback Loops
• Show HN: KubeKosh – Self-Hosted Kubernetes Playground in a Docker Container
• High Performance Distributed Inference with Ray Serve LLM
• Show HN: BlitzGraph – Supabase for graphs, built for LLM agents
• Trillions of dollars spent just to work on customer services?
• Show HN: Write Your GitHub Actions in TypeScript
• Messing with My CNC
• A Modern Proxmox Docker Architecture with Disposable VMs, VirtIO-FS, and ZFS
• Show HN: Agentspace – long-running YOLO agent sessions in Docker
• Show HN: AWF – run parallel AI coding agents, each in its own Docker workspace
• A Dwarf Fortress in Docker
• Show HN: Working Async – The new wave of remote work is async-first
• Show HN: QuickRetro – Open-source sprint retrospective app
• Anthropic Pauses Its Claude Agent SDK Billing Change
• Show HN: Persona.js – a vanilla-JS agent UI library with native WebMCP (MIT)
• Prometheus raises $12B to build an artificial general engineer
• EU Air travellers to enjoy free cabin luggage and keep delay compensation
• Show HN: Pen and paper resource development game with an emergent world
• Show HN: Submarius – Global water clarity for divers
• Show HN: Ember – self-hosted RSS reader in a single Go binary, AI is optional
• Show HN: Codyssey – control system programming game (open beta)
• Show HN: I built a free timestables game for kids
• Show HN: Boba, a one button platformer for PICO-8
• Seeking Advice
• Show HN: Western Highway Alerts
• Show HN: SunCalc v2 – a tiny JavaScript library for sun and moon calculations
• Show HN: Quickish – Instant HTML Hosting
• Problems with the Rust language
• ‘Helmsniff’; a Helm Security Scanner
• Canyon HUD helmet for road riding
• Show HN: Dev-friendly native OTel: only OSS stateful, on-the-wire Observability
• Show HN: I’m 15, built an AI that watches your screen and acts before you ask
• Has AI already killed self-help nonfiction books?
• Help I accidentally a wigglegram
• With Wall Street’s help, you’re about to be forced to buy stock in SpaceX
• New Super Pac Aims to Rally Tech Workers to Help Limit A.I
• Hello World: A new category of workplace for the next generation of builders
• UK considers putting age limits on VPNs to help enforce social media ban
• Clojure is almost as fast as C (with some help)
• America’s Founders helped create a world they were not yet ready to live in
• How Stephen Colbert’s Replacement Is Helping Tank the Rest of CBS
• Josh helps Rust manage code across multiple repositories
• Daily Probiotic May Help Fight Depression in Older Adults
• AI helped diagnose 18 children whose rare diseases had stumped doctors
• Anthropic’s latest feud with the admin may help it, sales data suggests
• Most indie devs build the wrong features. Here’s one pattern that helps
• Using AI to help physicians diagnose rare genetic diseases affecting children
• Forward to Hell? Misusing Transparent DNS Forwarders for Amplification Attacks
• Trade bans and local conservation helped save a dazzling blue gecko
• Microsoft turns to Amazon for help with GitHub’s AI-driven capacity issues
• Show HN: Phone Number for AI Agents Like Hermes and OpenClaw
• Poggle: Helping Engineering Teams Ship Better Software, Faster
• help how can i delete this :’)
• Google, Microsoft offer specs to help you prove your AI is behaving nicely
• Los Alamos method helps expose hallucinations in vision-language AI
• Show HN: A prompt generator to help AI agents implement my new email API
• Looking for a front end dev to help me build a math website
• Deep-sea metals may have helped early life use phosphate
• Would you help me achieve some karma for an important project post?
• DeFi Labelling in Argos: How We Classify Every Transaction on Ethereum
• Show HN: Multiplayer – open-source local debugging agent, unsampled runtime data
• Emacs 31 is around the corner: The changes I’m daily driving
• Show HN: Ember, a native iOS Hacker News reader I built around accessibility
• Show HN: Modeloop – From visual algorithms to microcontroller C code
• Hop.Earth – Google Maps and Need For Speed. World around created while driving
• Adblock Plus doing just fine after updating to Manifest V3 two years ago
• EC Ruled Months Ago That Google’s Integration of Gemini in Android Violates DMA
• Hunter-gatherers in Siberia died of a plague outbreak 5,500 years ago
• Ask HN: Favorite Sorting Algorithm?
• Ask HN: Will programmers write more efficient code during the memory shortage?
• Launch HN: TesterArmy (YC P26) – Agents that test web and mobile apps
• Show HN: Talos – Open-source WASM interpreter for Lean
• Show HN: My Windows XP portfolio with working Game Boy and iPod
• Show HN: CleverCrow: give tokens to your favorite projects
• Show HN: Lean bulk, cut, body recomp. Calculate maintenance calories
• Ask HN: What tools are you using for AI-assisted code review?
• Ask HN: How long have you been looking for a job?
• Show HN: Domphy – plain-object UI for tool apps, AI-correctable output
• The AI Conundrum: We are living in highly subsidized, interesting times
• Show HN: Chainstack Self-Hosted, hosting your own blockchain nodes made simple
• Show HN: git-lrc – Free, Micro AI Code Reviews That Run on Git Commit
• Show HN: lpviz – Interactive linear programming visualization in the browser
• GitHub Banned All CI for Our (OSS) Org Because of Bad Drive-By Contributors
• Ask HN: AI models are built on all of us, should their weights act like patents?
• Show HN: Lastwordonearth.com
• Ask HN: Why Do AI Credits Expire
• Why do people suddenly see so many competitors once they start marketing?
• Show HN: I built an open-source financial research terminal (SEC data and SQL)
• Show HN: Morning Stack finds real job openings, tweaks resume and cover letter
• Ten Years of Just (and Lists)
• Ask HN: Which AI subscription is worth paying for now?
• Anyone else receive a “GPU droplet destroyed” email from DigitalOcean
• Ask HN: Claude renamed my VM from the inside?
• My Opinion on RL
• Show HN: I built an email agent for founders who are stuck in email
• Are we asking the right questions?
• Show HN: Wirewright, an experimental symbolic physics environment
• Show HN: A Browser Built for Browser Automation
• Show HN: A C++ ALNS routing engine for LEO satellite mesh networks [video]
• Show HN: Rocannon – Any Ansible module to MCP Tool, record sessions as playbooks
• Show HN: Email client focused on reducing phishing risk and inbox overload
• Show HN: Video on the map marketplace 1 year – still bad traction
• Forked CozoDB to give agents cognitive primitives
• The price of liberty is eternal vigilance
• Just made an app and MCP Server to convert Markdown to Google Docs
• Ask HN: Active GitHub accounts (probably) delivering malware, now what?
• We Need to Start Planning Beyond Leo
• Australia confirms first case of H5N1 bird flu as virus reaches every continent
• Ratchets: a Rust tool that polices style violations with a flexible budget
• Flue 1.0 Beta
• Tradeoff Between Expertise and Flexibility: A Cognitive Entrenchment Perspective
• Flexible Rate Limit Resets for Codex (bank rate limit resets)
• Nanogram – Private social media from your Raspberry Pi
• Atlassian “Data Contribution” – Privacy and Welfare
• Show HN: Trustmux – Lightweight Secure Daemon for Mobile Shell Access
• Show HN: I built a spelling app for kids with my 7-year-old
• Advent of recorded music is much like a BEC
• Show HN: Intelligrade – EU Based Digital Exams
• Everything I Learned Training Frontier Small Models – Maxime Labonne, Liquid AI [video]
• Show HN: All 194 YC Spring 2026 startups scored from public data
• Introducing the next Surface Pro and Surface Laptop
• Reminiscences of Tolstoy, Chekhov and Andreyev by Maxim Gorky
• Show HN: ML condenses billions of logs into a tiny snapshot your LLM can debug
• Bonfires in the Dark: Ritual, Science, and AI as Compression Interfaces
• Show HN: Hosted version of Mathesar, intuitive open source UI built on Postgres
• Hetzner Price Adjustment
• Show HN: Mira – Open-source and self-hosted AI code reviewer
• Show HN: Jumpjet – a WASM runtime for game developers

Heise Cloud (15)

• Agentic Resource Discovery: Suchmaschine für KI-Agenten
• Google Cloud: Souveräne Cloud in Deutschland bis Ende 2026
• Firmen unterschätzen ihre KI-Abhängigkeiten massiv
• Juristische Fallstricke in Cloud-Architekturen
• Bericht: EU stuft AWS und Azure bald als Gatekeeper laut Digital Markets Act ein
• HPEs neuer Switch: QFX5140 liefert 16 Tbit/s auf 1 HE
• Proaktive IT-Security mit Pentesting – Ethical Hacking für Admins
• Die souveräne Cloud, die keine ist: ein Etikett für die falsche Ebene
• Unternehmen wünschen sich deutsche Hyperscaler und buchen US-Cloud
• Schluss mit Sidecar-Files: AWS führt S3 Annotations ein
• Oracle halbiert kostenlose Cloud-Ressourcen
• Broadcom prognostiziert: Kosten treiben KI-Workloads aus der Public Cloud
• FreeBSD 15.1: WiFi-Treiber von Linux 7.0, mehr Cloud und viel KI
• Play-Update: Google bringt WhatsApp-Backupverwaltung in Geräteeinstellungen
• Kräftige Preiserhöhung bei Hetzner: Cloud-Server teilweise dreimal so teuer

InfoQ Cloud Native (3)

• Article: Designing Continuous Authorization for Sensitive Cloud Systems
• Presentation: Practical Performance Tuning for Serverless Java on AWS
• Podcast: Increasing Users’ Data Agency: from BlueSky’s AT Protocol to the Local-First Software Movement

Microsoft Open Source (1)

• What’s new with Microsoft in open source and Kubernetes at Open Source Summit and KubeCon India

The New Stack (26)

• A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
• Your agent wants to search like a 2010 quant
• “An agent is an LLM and a harness”: What Nvidia really thinks about OpenClaw
• Gemini CLI vs. Antigravity: What works, not the spec sheet
• Backporting bug fixes is dead, Project Valkey now sends in the bots
• Losing Fable made the best case yet for AI models you can run yourself
• “Time to clean up human slop”: Why AI now reviews code better than your teammate.
• Checkmarx’s new SAST engine isn’t about the LLM. It’s about what happens after.
• “I think this is costing us more than we realize”: what permissionless ownership really asks of you
• Anthropic overhauled Claude Design to fix the handoff. A designer and an engineer disagree on whether it worked.
• Gusto Cofounder: An AI agent that runs payroll, HR, and benefits without waiting to be asked
• MCP gets its missing enterprise authorization layer
• Cursor, GitLab and Zed agree GitHub is breaking. They disagree on how to rebuild it.
• Neoclouds, sovereign AI and Postgres: The new operating model for regulated enterprises
• The database storage problem is solved. Here’s what comes next.
• Fable 5 ban: 4 open models responded before Anthropic could restore access
• Your AI pipeline is broken, and your dashboards don’t know it
• “A data lake of nuance for AI agents to swim in”: AWS Context gets shipshape on reasoning
• Kiro goes mobile: AWS brings agentic coding supervision to the iPhone
• Vercel launches eve, an open-source framework that treats agents as directories
• How Block manages its fleet of AI coding agents from Slack
• Chainguard Agent Skills matures
• AWS puts an AI bouncer at the merge queue
• “Agents need boring infrastructure around them”: Why we need to take an interest in ‘invisible’ AI
• Google, Microsoft, and OpenAI join forces to help create AI’s missing trust layer
• Your AI isn’t broken. Your data is.

← Back to Newsletter

This week in Cloud Native saw a range of stable releases, with updates spanning networking, orchestration, and security projects. Key developments included Dapr’s new verifiable execution capabilities and multiple patches for core Kubernetes versions. News highlights focused on the expanding role of AI agents, alongside continued discussions on CI/CD security and Kubernetes storage management.

🚀 Notable Releases

Networking

• coredns/coredns v1.14.4 - Improves transport security with enhancements for DoH3 and DoQ, refines DNSSEC signing behavior, and adds support for the loong64 architecture. Additional features include configurable cache verification and hostname resolution for forward targets.
• envoyproxy/envoy v1.38.2 - Fixes a runtime guard override removal issue and introduces opt-in histograms for HTTP/2 header statistics, including header-entry count and header-map byte size.
• envoyproxy/envoy v1.37.4 - Fixes a runtime guard override removal issue and introduces opt-in histograms for HTTP/2 header statistics.
• envoyproxy/envoy v1.36.8 - Fixes a runtime guard override removal issue and introduces opt-in histograms for HTTP/2 header statistics.
• envoyproxy/envoy v1.35.12 - Fixes a runtime guard override removal issue and introduces opt-in histograms for HTTP/2 header statistics.
• antrea-io/antrea v2.6.2 - Migrates the UUID library, updates the lumberjack dependency, and upgrades Kubernetes dependencies to 1.36.1.
• kubeovn/kube-ovn v1.15.14 - Updates Golang to v0.46.0 and resolves an issue where service/endpointslice enqueueing was not skipped when load balancing is disabled.

Orchestration

• crossplane/crossplane v2.3.2 - A patch release addressing reported issues and security vulnerabilities in dependencies, specifically fixing regressions in the Crossplane CLI’s render commands.
• kedacore/keda v2.20.1 - Fixes a concurrent map read/write data race in the fallback updateStatus function and resolves an issue with the KEDAScalersStarted metric.
• kubernetes/kubernetes v1.36.2 - A patch release.
• kubernetes/kubernetes v1.35.6 - A patch release.
• kubernetes/kubernetes v1.34.9 - A patch release.
• kubernetes/kubernetes v1.33.13 - A patch release.
• projectcapsule/capsule v0.13.5 - Adds configurable controller RBAC, new action types for rules and regex cache, and rule-based QOS enforcement. Fixes an issue where terminating namespaces were skipped for Tenantresources.

Security

• falcosecurity/falco 0.44.1 - Updates LIBS to version 0.25.4 and DRIVER to version 10.2.0.
• open-policy-agent/opa v1.17.1 - Updates Go to version 1.26.4 to address standard library vulnerabilities affecting OPA’s HTTP handler and crypto builtins.
• containers/podman v5.8.3 - Addresses CVE-2026-44517, which involved a vulnerability where ADD or COPY instructions could cause files outside the build context to be included. Updates Buildah to v1.43.2 and gvisor-tap-vsock to v0.8.
• sigstore/cosign v3.1.1 - Deprecates several flags related to verification material input and the bundle format, with the standardized bundle format now being the default for signing and verifying.
• aquasecurity/trivy v0.71.1 - Fixes OCI artifact filename validation, forwards ospkg detector options, and loads VEX documents from within the repository directory.

Build

• dapr/dapr v1.16.15 - Contains a bug fix for Sentry failing to start with “unsupported key type” when the issuer key is Ed25519 or RSA.
• dapr/dapr v1.18.0 - Introduces optional cryptographic signing and verification for workflow history and attestation for child workflow and activity completions. A new WorkflowAccessPolicy resource controls which application IDs may invoke workflows.
• helm/helm v4.2.1 - A patch release.
• helm/helm v3.21.1 - A patch release.
• backstage/backstage v1.51.2 - Fixes an issue where an empty userSelect parameter caused all users to be dropped in the msgraph module.
• containers/buildah v1.43.2 - Bumps c/common to v0.67.1, c/image to v5.39.2, and includes a security fix.

Observability

• open-telemetry/opentelemetry-collector v0.154.0 - The --skip-get-modules flag for cmd/builder no longer regenerates the go.mod file, which is a breaking change.

Container Runtime

• fermyon/spin v4.0.1 - Updates unversioned environments if not recent and includes support for falling back to webpki roots in the default TLS configuration.

Messaging

• nats-io/nats-server v2.12.11 - Updates Go to version 1.25.11. Fixes a regression in v2.12.7 that could result in “Message Not Found” errors in JetStream when a max messages per subject limit is configured.

Database

• crate/crate 6.0.7 - A patch release.
• crate/crate 6.3.3 - A patch release.
• crate/crate 6.2.9 - A patch release.

Chaos Engineering

• chaos-mesh/chaos-mesh v2.8.3 - Resolves container image CVEs by upgrading the Go toolchain to 1.25.11 and containerd to 1.7.32. The memStress helper was rebuilt with a modern Go toolchain, and the chaos-daemon image switched to a headless JRE.

Configuration

• meshery/meshery v1.0.43 - Bumps the shell-quote dependency and fixes broken mesheryctl reference page anchor links.
• meshery/meshery v1.0.42 - Uses filepath.Join for local provider package location and adds support for installing extensions in the local provider.
• meshery/meshery v1.0.41 - Skips namespace creation for cluster-scoped resources in CreateK8sResource and fixes a CI workflow condition.
• meshery/meshery v1.0.40 - Fixes printf-style logging calls flagged by go vet and hardens design import file resolution in the UI.
• meshery/meshery v1.0.39 - Preserves credential ID when saving connections, fixes rendering of imported designs, and resolves a UI crash in Registry Models.

Service Mesh

• kumahq/kuma v2.14.0 - Introduces mesh-scoped Zone Ingress/Egress deployments, allowing individual targeting by policy. Sidecar containers are now enabled by default.

Framework

• kserve/kserve v0.19.0 - Propagates spec.labels and annotations to service for llmisvc, removes incorrect CRDs in llmisvc-crd, and normalizes legacy deploymentMode in status.

📰 This Week in Cloud Native

The Cloud Native ecosystem this week saw significant attention on the expanding capabilities and operational implications of AI agents. Dapr 1.18 introduced verifiable execution, which includes cryptographic signing and verification of workflow history and attestations for child workflow completions. This feature aims to enhance security and detect tampering in distributed applications by providing an auditable execution history. Reports also highlighted developments in AI coding agents, with claims of models outperforming others in coding endurance tests and the emergence of new challenges in debugging and auditing their actions. The increasing autonomy of AI agents, particularly when interacting with production data, emphasizes the need for robust verification and control mechanisms.

Security remained a focus, with projects like Podman addressing vulnerabilities such as CVE-2026-44517, which could lead to unauthorized file inclusion during container image builds. A CNCF blog post outlined strategies for securing CI/CD pipelines through dependency lockdown, aiming to mitigate supply chain risks in open-source projects. Additionally, the External Secrets Operator was presented as a tool to manage secret sprawl in multi-account Kubernetes environments, addressing a common operational challenge.

Updates from major cloud providers included AWS detailing how Amazon EKS Auto Mode integrates with Istio Ambient Mesh to automate infrastructure management and provide mTLS-based service-to-service security. AWS also announced formal verification of the hypervisor in its Nitro Isolation Engine, contributing to the security of EC2 instances. Microsoft Azure DevOps released June patches for its self-hosted server products and continued to recommend migrations to GitHub, citing new AI-powered features like Copilot Autofix and Code Reviews for GitHub Advanced Security and Azure Repos. The Kubernetes SIG Storage group was also spotlighted, discussing its ongoing contributions to persistent storage management within the project.

💬 Community Buzz

Hacker News discussions this week frequently centered on AI agents, covering topics such as running agent code on Kubernetes, tools for managing Kubernetes contexts for SREs and AI agents, and security firewalls designed for agents. Debates also addressed the technical challenges of verifying AI agent behavior and the implications of agents writing to production data.

📊 Numbers of the Week

• Total stable releases: 40 across 18 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 255 commits
  2. kubernetes/kubernetes — 189 commits
  3. cilium/cilium — 152 commits
• Top 3 projects by merged pull requests this week:
  1. cilium/cilium — 107 merged PRs
  2. kubernetes/kubernetes — 105 merged PRs
  3. envoyproxy/envoy — 104 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 25

A complete list of all cloud native articles and news from this week.

AWS Compute (4)

• AWS Nitro Isolation Engine: Formally verifying the hypervisor in the AWS Nitro System
• Build RAG-powered AI solutions at the edge with AWS Local Zones and Outposts
• Optimize EC2 costs with AWS Compute Optimizer right sizing
• Integrating Event Source Mappings with AWS Lambda tenant isolation mode

AWS Containers (1)

• Better Together: Amazon EKS Auto Mode and Istio Ambient Mesh

Azure DevOps Blog (4)

• June Patches for Azure DevOps Server
• Copilot Autofix for GitHub Advanced Security for Azure DevOps
• Copilot Code Reviews for Azure Repos
• Enterprise Live Migrations: Moving from Azure DevOps Repo to GitHub with minimal disruption

CNCF Blog (3)

• Securing CI/CD for an open source project: Locking down dependencies
• Introducing Verifiable Execution in Dapr 1.18
• Solving secret sprawl in multi-account Kubernetes with External Secrets Operator

Hacker News (119)

• Kina, Kubernetes but Apple Containers
• Kelsey Hightower: Kubernetes and retiring at the top [video]
• SkyPilot Sandboxes: Run Agent Code on Your Own Kubernetes, at Scale
• Show HN: Kctx – A read-only Kubernetes context engine for SREs and AI Agents
• Kubernetes and retiring at the top with Kelsey Hightower [video]
• Introduction to nixidy – Kubernetes GitOps with Nix
• Show HN: Kaupang – deploy one config to Docker Compose, Swarm, or Kubernetes
• Show HN: Claw Patrol, a security firewall for agents
• Show HN: HelixDB – A graph database built on object storage
• Show HN: LLMForge – Orchestrate your LLM pipeline. Locally
• Whissle Gateway – Run Multi-Modal Voice AI Locally in a 500MB Docker
• Show HN: Nucleus – A security-hardened, Nix-native container runtime
• Show HN: Papermill Press – An AI-friendly markup language for PDF generation
• Show HN: A terminal writing environment with Git, E2EE sync and temporal search
• Show HN: Ray Hosting – Topology-aware game server orchestrator made from scratch
• Show HN: Pistachio – A declarative schema migration tool for PostgreSQL
• Show HN: RiddleRun – AI run end-to-end browser tests
• Claude Cowork June double usage promotion
• Jeff Bezos Wants to Build an ‘Artificial General Engineer’
• Show HN: Performative-UI – A react component library of design tropes
• Show HN: Command Center, the AI coding env for people who care about quality
• Ask HN: Influence of Legend of Zelda in Backrooms Movie?
• Show HN: Feed-Repeat, a Tool to Repeat Old Posts from Web Feeds
• I vibe coded a world cup cheer guide for fans
• Show HN: G# –> a new dotnet language like Go/Swift/Kotlin with C# interop
• Show HN: Local RAG memory system that AI can write directly to
• Ask HN: Developers, are you being forced into prompt-only engineering?
• Show HN: Domain Rating – a leaderboard of startup website Domain Ratings
• Show HN: Topolog – Plans as typed DAG programs, deadlines computed, not guessed
• Show HN: This Week in Obsidian – Obsidian Newsletter Published Every Tuesday
• What I Got Right and Wrong Building a Solo Project Around Real Life
• Helm AI Kernel, a fail-closed execution firewall for AI agents
• Fugee, an agentic AI assistant for displaced people and asylum seekers [video]
• If Claude Fable stops helping you, you’ll never know
• Historic co-determination helps monasteries navigate digital change
• Cheap Iranian drone downed $25M US Army helicopter–maybe by chance
• How much of Elon Musk’s wealth comes from government help? Virtually all of it
• Yserver: Modern X11 Server Written in Rust with the Help of Claude Code
• Ask HN: I Need Help for a Product
• Ask HN: Which Free Software or Open Source Project Needs Help?
• Louisiana senator helped secure Meta data center. Then sold the land beside it
• Musk Looks to an Army of Loyalists to Help Make Him a Trillionaire
• Mechanical forces from the beating heart may help prevent cancer cell growth
• Whales are showing up in San Francisco Bay. New ship alerts help protect them
• Oliver Tree, ‘Alien Boy’ Musician, Dies at 32 in Helicopter Crash
• How an astrophysicist uses Codex to help simulate black holes
• How a Linguist Helped Me Understand C
• Australia’s Social Media Ban Is Floundering. Can It Still Help Younger Kids?
• AI helped me give a better talk
• git-stk: Git-native stacked branch workflow helper
• U.S. Military Helping Move 7M Bpd Out of Persian Gulf, Wright Says
• Fable will NOT help if it thinks your ML research/ML engineering is interesting
• Robotaxis almost happened in 1964–with help from the U.S. government
• Tiny wasp helps prevent first global bird extinction in Britain for 60 years
• Can smartphones help explain the drop in birth rates?
• AI Agents Can’t Help with Intent Debt
• The Chinese parents dancing on live streams to help their children fight cancer
• Science confirms: Cats help you only when there’s something in it for them
• I’m Eric Ries, author of “The Lean Startup” and new book “Incorruptible” – AMA
• Launch HN: Intuned (YC S22) – Build and run reliable browser automations as code
• Ask HN: Favorite text heavy blogs that are a joy to read?
• Show HN: Script to bulk delete Claude chats from the web UI
• Launch HN: Transload (YC P26) – Measuring freight items with CCTV
• Apple reveals new AI architecture built around Google Gemini models
• Ultrafast machine learning on FPGAs via Kolmogorov-Arnold Networks
• Quivers: A year of linear algebra by drawing arrows
• HN seems dead compared to say 10-15 years ago
• Gram Newton-Schulz: A Fast, Hardware-Aware Newton-Schulz Algorithm for Muon
• France’s Own Hack Is the Best Argument Against Its War on Encryption
• A clear fishing wire is tied around the island of Manhattan
• Half of Americans say they’re worse off financially than a year ago
• Argentina Wants to Let AI Own Companies. Here’s What That Means
• ‘AI will free us’: Javier Milei’s plan for Argentina
• The APLR(1) algorithm for compact LR(1) parsers is simpler and more capable than
• Where was your backyard millions of years ago?
• For People with Misophonia, Everyday Noises Can Be Agony
• Omarchy on Asahi creator lost access to his GitHub account two weeks ago
• ‘It’s a hurricane warning’: Guardrails around powerful AI models may be too late
• Mathematical and Algorithmic Specification of an Advanced Cognitive Architecture
• Elon Musk drifted from Larry Page 10+yrs ago, companies now closer than ever
• What Goes Around Comes Around and Around (2024) [video]
• Does a token buy you more or less now than it did a few months ago?
• Show HN: Gravity – Interactive solar-system simulator, from Newton to Einstein
• Show HN: I am building a map of people who lived in the Roman Empire
• Ask HN: Are you still using a Vision Pro?
• Show HN: Trace – Offline Mac meeting transcripts you can flag mid-call
• Show HN: 3D print Z reinforcement via injected loops
• Launch HN: BitBoard (YC P25) – Analytics Workspace for Agents
• Show HN: Learn from 30 historical figures, open source, nonprofit, self-hosted
• FTX’s former Anthropic stake would be worth about $75B at today’s valuation
• Show HN: Turn your name into a tree in an infinite procedural shanshui landscape
• Show HN: Mach – A compiled systems language looking for contributions
• Show HN: Quick games disguised as boring spreadsheets
• Ask HN: How do you cope when your startup contracts?
• Ask HN: Why won’t you be replaced by AI?
• Ask HN: Is anyone growing further from capitalism?
• Tell HN: I’m making 1K USD per hour with AI
• Authorization via Gmail and Apple ID Banned in Russia
• Story of How Im Running an Unlimited $6/Month AI Provider on 4x RTX 3090s
• Ask HN: Options for critical thinking and learning outside work?
• Ask HN: Depression
• Mercedes‑Benz starts large‑scale production of electric axial flux motor
• Adafruit files suit against Flux.ai over legal threats [pdf]
• Adafruit vs. Flux [pdf]
• Brute-force SSH attacks in the wild and how to stop them
• Fluorine Fermi – Monero’s Biggest Update
• Yale reinstates SAT, ACT requirement after six years of flexible policy
• Claude Fable 5 and Mythos are pure marketing fluff
• Flu Vaccines Should Not Be This Hard
• Show HN: Llmbuffer – Python library for cache-optimized LLM conversation history
• Show HN: Inkwash, a watercolor sketching app and explanation
• Show HN: The first agentic coding engine that hot-reloads the full stack
• Sophia NLU Home Assistant – On Device, Low Compute, No Internet, Voice Assistant
• Show HN: Smartass – TypeScript test assertions with type-narrowing signatures
• Show HN: Astro Sidey – A simple, minimalistic personal blog theme
• Can’t Stop the Signal. Poison It
• Show HN: Open-source plugin that builds single-file HTML decks for coding agents
• Is Privacy the Latest Luxury?
• Show HN: Atlasphere – Live Infrastructure Diagrams

Heise Cloud (9)

• VW setzt auf die Telekom: T-Systems baut weltweite Cloud für Volkswagen
• Kubernetes auf Azure: in drei Monaten zur Enterprise-Plattform
• Document Foundation vs. Euro-Office: „De facto ein Verbündeter von Microsoft“
• Schluss mit doppelter Lizenzierung: Microsoft SQL Server in Amazon RDS
• Nextcloud Hub 26 Spring: Euro-Office fordert Collabora heraus
• Euro-Office: Erste Version des quelloffenen Web-Office ist da
• M365 für Admins – Sichere Konfiguration & effiziente Verwaltung lernen
• MDM aus der Cloud: So funktioniert der Umstieg auf Microsoft Intune
• Google ganz nah – und doch auf Distanz: So erklärt Apple seinen KI-Deal

InfoQ Cloud Native (1)

• Presentation: Confidently Automating Changes across a Diverse Fleet

Kubernetes Blog (1)

• Spotlight on SIG Storage

The New Stack (26)

• Xiaomi’s MiMo Code claims it beats Claude Code past 200 steps
• What your logs can’t tell you when an AI agent acts alone
• PagerDuty’s CAIO says most AI incident tools are missing a critical layer
• Fable 5 and Mythos 5 remain suspended: “The ball is in Anthropic’s court”
• Why AI retrieval and ranking need more than vector search
• Can JetBrains close the IDE skills gap before AI widens it further?
• Loops are replacing prompts. Verification is about to be your biggest problem.
• Fable 5 vs Opus 4.8: The real stakes, not the spec sheet
• Claude Fable cost $9 in one coding test. GPT-5.5 cost $1.50. Model triage is the new AI skill.
• Federal government orders Anthropic to pull Fable 5 and Mythos 5, three days after launch
• Who gets to be Switzerland in the enterprise agent wars?
• Coding agents have questions, too — so Stack Overflow built them a home
• “Don’t just grab random stuff off the internet”: What Chainguard found in 52,000 open-source packages
• “AI is disrupting everything”: Where do entry-level tech jobs go now?
• “The manual model breaks”: What happens when agents write to production data
• Beyond the stack trace: why AI requires a new debugging paradigm
• How to delegate 40% of tickets to AI
• AI agents need infrastructure: Why Europe’s regional cloud strategy matters
• Agentic development hinges on verification. For cloud-native software, that is a runtime problem.
• Transform your AI coding agent into a deterministic Java Spring expert
• WeAreDevelopers is coming to the US to give unsung developers a bigger voice
• Cleaner AI training data, fewer bugs: Sonar’s SonarSweep explained
• Observability overload is drowning engineers
• Google’s DiffusionGemma is 4x faster than its other Gemma models
• Fable 5: Guardrails and burn rate are annoying users, who say it’s still better than Opus 4.8
• The Anthropic leader who built Claude Code says he ditched prompting — now he just writes loops.

← Back to Newsletter

This week in Cloud Native saw a range of project updates, including security fixes across container runtimes, networking components, and service meshes. Discussions focused on the evolving landscape of AI in cloud native environments, developer experience, and ongoing security challenges in CI/CD pipelines.

🚀 Notable Releases

Container Runtimes

• containerd v2.1.8 - Addresses CVE-2026-46680. Fixes handling of out-of-range USER values in OCI specifications and resolves bugs in the sandbox service.
• CRI-O v1.36.1 - Contains various fixes and updates.
• CRI-O v1.35.4 - Contains various fixes and updates.
• CRI-O v1.34.9 - Contains various fixes and updates, including bug fixes.
• CRI-O v1.33.13 - Contains various fixes and updates.
• Lima v2.1.2 - Fixes limactl shell mount checks, adds a --param shortcut for template parameters, and corrects path quoting for rsync.

Orchestration

• Crossplane v1.20.9 - Addresses user-reported issues and security vulnerabilities in dependencies. Introduces a crossplane beta upgrade check command to assess v2 upgrade readiness.
• KEDA v2.20.0 - Records Kubernetes events through the events.k8s.io API group, requiring RBAC updates for custom deployments.
• Capsule v0.13.4 - Fixes status reconciliation for best-effort patches and adjusts the match strategy.
• Capsule v0.13.3 - Preserves CA bundles injected by external providers and updates Go to version 1.26.4.
• Capsule v0.13.2 - Adds observedgeneration to CRD status objects, includes a tenant list in CapsuleConfiguration status, and adds conditions and tenant references for TenantOwners status.

Networking

• Envoy v1.38.1 - Includes security fixes for CVE-2026-47774, resetting HTTP/2 streams that exceed header list size limits and counting uncompressed cookies towards header limits.
• Envoy v1.37.3 - Includes security fixes for CVE-2026-47774, resetting HTTP/2 streams that exceed header list size limits and counting uncompressed cookies towards header limits.
• Envoy v1.36.7 - Includes security fixes for CVE-2026-47774, resetting HTTP/2 streams that exceed header list size limits and counting uncompressed cookies towards header limits.
• Envoy v1.35.11 - Includes security fixes for CVE-2026-47774, resetting HTTP/2 streams that exceed header list size limits and counting uncompressed cookies towards header limits.
• etcd v3.6.12 - Contains various fixes and updates.
• etcd v3.5.31 - Contains various fixes and updates.
• etcd v3.4.45 - Contains various fixes and updates.
• NATS Server v2.14.2 - Updates the Go version to 1.26.3 and exposes the client ID via the embedded ClientAuthentication API.
• NATS Server v2.12.10 - Updates the Go version to 1.25.10 and makes the client ID available through the embedded ClientAuthentication API. Fixes a race condition.
• Kube-OVN v1.15.13 - Updates Go to v1.26.4 and corrects the egress sync status field upon ACL update failures.
• Kube-OVN v1.14.40 - Updates Go to v1.26.4 and backports IP port mapping updates.
• Kube-OVN v1.16.2 - Introduces support for multiple network interfaces from the same subnet and updates Go to v1.26.4.
• Submariner v0.25.0-m0 - Contains various fixes and updates.

Storage

• Rook v1.20.0 - Requires the Ceph CSI operator for managing CSI driver settings; existing settings remain functional.
• Longhorn v1.12.0 - Announces the General Availability (GA) of the V2 Data Engine. Adds topology-aware provisioning, dual-stack and V2 IPv6 support, and improved observability.
• OpenEBS v4.5.0 - Introduces improvements for disk detachment, hot removal, offline node/pool management, and usability fixes across various storage provisioners.
• Kubernetes CSI External Snapshotter client/v8.6.0 - Promotes the VolumeGroupSnapshot API to GA (v1) and updates controllers to utilize v1 VolumeGroupSnapshot APIs.

Service Mesh

• Istio 1.30.1 - Contains various fixes and updates.
• Istio 1.29.4 - Contains various fixes and updates.
• Istio 1.28.8 - Contains various fixes and updates.
• Kuma v2.13.8 - Includes security updates and updates Envoy to version 1.36.7.
• Kuma v2.12.12 - Includes security updates and updates Envoy to version 1.35.11.
• Kuma v2.11.15 - Includes security updates and updates Envoy to version 1.35.11.
• Kuma 2.9.17 - Includes security updates and updates Envoy to version 1.35.11.
• Kuma v2.7.27 - Includes security updates and updates Envoy to version 1.35.11.
• Kuma v2.13.7 - Aligns the Envoy go-control-plane fork, bumps golang.org/x/crypto and golang.org/x/net dependencies, and adds a DiscoveryResponse size histogram.
• Kuma v2.12.11 - Aligns the Envoy go-control-plane fork, bumps golang.org/x/crypto and golang.org/x/net dependencies, and updates Helm.
• Kuma v2.11.14 - Aligns the Envoy go-control-plane fork, bumps golang.org/x/crypto and golang.org/x/net dependencies, and updates Helm.
• Kuma 2.9.16 - Aligns the Envoy go-control-plane fork, bumps golang.org/x/crypto and golang.org/x/net dependencies, and updates Helm.
• Kuma v2.7.26 - Aligns the Envoy go-control-plane fork, bumps golang.org/x/crypto and golang.org/x/net dependencies, and updates Helm.

Observability

• Jaeger v2.19.0 - Implements the findtracesummaries gRPC handler, supports the query.attributes filter in /api/v3/traces, and adds TLS configuration for ClickHouse.
• Inspektor Gadget v0.53.1 - Includes security hardening fixes for USDT/uprobe ELF/ld.so.cache parsing.
• Inspektor Gadget v0.53.0 - Adds a new trace_link gadget and modifies ustack, ebpf, and symbolizer to remove the [N] prefix from stack symbols, showing binary and offset.

Security

• Keycloak 26.6.3 - Includes security fixes, such as CVE-2026-4800 related to lodash.
• OpenFGA v1.17.1 - Prevents v2Check fallback for throttling and validation, and updates the Go toolchain to 1.26.4.
• OpenFGA v1.17.0 - Introduces a configurable trace sampler (trace.sampler) supporting standard OpenTelemetry strategies, defaulting to traceidratio.
• External Secrets helm-chart-2.6.0 - Helm chart release for external secrets management.
• External Secrets v2.6.0 - Implements the provider_api_calls_count metric.
• Kubewarden Controller v1.36.0 - Fixes a typo in spec.namespacedPoliciesCapabilities and updates the sigstore-rs dependency.
• SeeBOM v0.5.0 - Transforms SeeBOM into a multi-cluster, multi-format SBOM platform with project-level grouping, optional API authentication, and Kubernetes deployment improvements. Increases API endpoints from 19 to 24.
• Trivy v0.71.0 - Contains various fixes and updates.

Build & Development

• Dapr Runtime v1.17.9 - Fixes a workflow retention purge failure on Azure Cosmos DB when customStatus is not persisted.
• KubeVirt v1.8.3 - Contains various fixes and updates.
• KubeVirt v1.7.4 - Contains various fixes and updates.
• KubeVirt v1.6.6 - Contains various fixes and updates.
• Spin canary - A canary release intended for developers to test the latest features, noted as not stable.
• Kind v0.32.0 - Includes critical dependency updates and bug fixes. Defaults to Kubernetes 1.36.1. Requires upgrading kind for compatibility with new node images due to a containerd upgrade.

Configuration

• Meshery v1.0.38 - Updates go.mod for wasm policy.
• Meshery v1.0.37 - Upgrades Meshery schemas and adds an evaluate button for design relationship evaluation in the UI.
• Meshery v1.0.36 - Ships policy-engine wasm and wasm_exec.js in the server image.
• Meshery v1.0.35 - Adds doc.go for the native Go policy engine.

CLI Tools

• k9s v0.51.0 - Contains general fixes and enhancements.

📰 This Week in Cloud Native

The cloud native ecosystem continued its integration with Artificial Intelligence, with discussions highlighting the concept of “Cloud native is now AI-native.” The New Stack reported on the challenges of high-velocity AI deployments, noting that existing pipelines may not be equipped for deployment rates of 1,000 times per month. Microsoft’s strategy around AI agents, developer experience, and data context was a prominent theme, with announcements regarding a free agent runtime, new AI development tools like Rayfin, and an emphasis on data context for enterprise AI. Google also contributed to the local AI landscape with the Gemma 4 12B model, which reportedly runs on laptops while approaching the performance of larger models.

Security remained a critical focus. The CNCF published a whitepaper on Identity and Access Management in distributed cloud native architectures and discussed securing CI/CD pipelines for open-source projects. Inspektor Gadget completed its first independent security audit, with results released this week. Multiple projects, including containerd, Envoy, and Keycloak, released patches addressing security vulnerabilities. Concerns were also raised regarding AI-related supply chain attack vectors, specifically mentioning hooks from Claude, Gemini, and Cursor, which could lead to compromised GitHub organizations.

In the broader Kubernetes ecosystem, the transition from the Kubernetes Dashboard to Headlamp was detailed, offering insights into evolving cluster management interfaces. AWS published an architecture for multi-region event-driven failover using EventBridge and Route 53, demonstrating approaches to enhance resilience. Discussions also resurfaced around when Kubernetes might be considered overkill for certain deployments, alongside the introduction of new tools like StackPulse for Kubernetes observability and Kubelize for multi-cluster management. Reddit’s engineering team shared an update on their shift from proxy-based to proxyless architectures for feed serving, specifically regarding the removal of Envoy.

💬 Community Buzz

Hacker News discussions this week centered on the practical implications of AI agents in development, including their memory management, cost optimization, and potential security risks highlighted by “coding agent horror stories.” There was also interest in Kubernetes alternatives and management tools, as well as Docker-related developer tools for logging and management.

📊 Numbers of the Week

• Total stable releases: 63 across 26 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 189 commits
  2. cilium/cilium — 100 commits
  3. cockroachdb/cockroach — 89 commits
• Top 3 projects by merged pull requests this week:
  1. keycloak/keycloak — 112 merged PRs
  2. envoyproxy/envoy — 87 merged PRs
  3. cilium/cilium — 71 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 24

A complete list of all cloud native articles and news from this week.

AWS Compute (1)

• Multi-Region event-driven failover architecture with Amazon EventBridge and Route 53

Azure DevOps Blog (2)

• How Microsoft is migrating repositories to GitHub
• Azure DevOps and GitHub: Journeying into the AI Era

CNCF Blog (6)

• Identity and Access Management Whitepaper
• Securing CI/CD for an open source project: Controlling who runs what
• Inspektor Gadget: Results from the first security audit
• Mumbai Maha Mahotsav – KubeCon + CloudNativeCon India edition
• Cloud native is now AI-native: Engineering production-ready AI
• Dynamic configuration for cloud native Swift services

Hacker News (118)

• You Don’t Need Kubernetes
• StackPulse – One Command Kubernetes Observability Platform
• Kubelize – Free tool to manage multiple Kubernetes clusters
• Launch HN: Expanse (YC P26) – Unlock Wasted GPU Capacity
• Show HN: Mercek – A Desktop IDE for AWS ECS
• Show HN: Nightwatch, The open-source, read-only AI SRE
• Arconia for Spring Boot: DevEx, Observability, Multitenancy, GenAI, Cloud Native
• I Replaced My AI Agent’s Flat Fact Store with a Graph Database
• Show HN: Voice control coding agents on your machine via smartwatch / CarPlay
• Show HN: AudioTap, record calls, transcribe and diarize locally
• Launch HN: Hyper (YC P26) – Company brain to power agentic development
• Self-hosted dev sandboxes with preview URLs (Docker, Go, no K8s)
• Dozzle: Real-time Docker logs, stats, and debugging – in the browser
• Dockhand: Modern Docker Management
• A Modern Proxmox Docker Architecture with Disposable VMs, VirtIO-FS, and ZFS
• Show HN: Lowfat – pluggable CLI filter that saved 91.8% of my LLM tokens
• Show HN: I embedded 685M public texts in 32 minutes (on 8x A100, Rust, TensorRT)
• Show HN: Lich, start a dev stack per coding agent in parallel
• Show HN: Agents Remember – Git-aware memory for coding agents
• Show HN: TabyAgent – A lighter and easier alternative to OpenClaw/Hermes
• Show HN: Terse, TypeScript First Workflow Builder
• Show HN: One-click open-source ecommerce starter (Magento), drive it with Claude
• Coding Agent Horror Stories: The rm -rf ~/ Incident
• 1982 World Championship Double Decker Bus Racing (1982) [video]
• Show HN: Nano – open core siem built on rust and ClickHouse
• From Proxy to Proxyless: Removing Envoy from Reddit’s Feed Serving Path
• Are You Enjoying Our Linguine? (2025)
• TSMC CEO: I envy their 80% gross margins, but I would never do that
• Show HN: ssh late.sh - a cozy command-line Clubhouse for computer people
• I hadn’t coded in 30 years. Then I built a space game with Godot
• Architect MCP and TUI
• Show HN: Circus Chief – Claude Code, Codex, and Gemini from Your Phone
• Show HN: Gridiculous, my homebrew Game Boy Advance logic puzzle collection
• My Humble AI Market Prediction
• A modular impact diverting mechanism for football helmets [pdf]
• Do agents.md files help coding agents?
• Facing life-threatening miscarriage in Arkansas, calls to governor didn’t help
• How big tobacco helped shape the design of ultra-processed foods
• ‘More Harmful Than Helpful’: Young People Sour on AI
• Dreaming: Better memory for a more helpful ChatGPT
• Anthropic warns AI could soon help build its own successors
• Cannabis meta-study finds no evidence it helps anxiety, depression, or PTSD
• Show HN: Help SourceLibrary.org Translate the Renaissance
• Tell HN: Helium is the best browser I ever used
• The Manhattan Institute Helped Kill DEI. Now It’s Coming for Protests
• Data centers need water. Could Texas oil companies help?
• How much do amd64 microarchitecture levels help in Go?
• More harmful than helpful’: young people sour on AI
• Canada says AI strategy will help create 250k jobs, boost GDP by 3%
• Help choose the animals to go on the UK banknotes
• YC is helping Rick Rubin find an AI guru
• How Online Sleuthing Helped Catch the ‘Google Insider’ on Polymarket
• Open-Source Software Is Starting to Help Robots Think
• Trying to get Claude to help me buy a car
• Beyond the Memory Wall: The CPU Was Helping You All Along
• Download cash counter and help me
• Open Source Initiative Helps G7 Deliver Vision on AI Openness
• Using Claude Code to help me write
• The color of this new and unusual blue octopus is what helps it survive
• GPU probably isn’t helping your retrieval system
• Message Queues and Brokers Help with Temporal Decoupling
• Need a little help from everyone here
• Show HN: icantmarket – A verified help exchange for devs who can’t market
• Show HN: 0llm is a small app to help you spend time away from AI
• 4K years ago, Mohenjo-daro grew more equal over time
• Algorithmic Monocultures in Hiring
• Tesla retroactively added ‘supervised’ to FSD contracts owners signed years ago
• Show HN: NoSuggest – Watch YouTube without the recommendation algorithm
• “Terrorists?”: The Suffragette Arson and Bombing Campaign – Egham Museum
• A discovery about GCC’s unidirectional rotation algorithm
• Jeff Bezos Is Funding a Wild Hunt for the Brain’s ‘Core Algorithm’
• “The Law Doesn’t Apply to Me”: Why Sovereign Citizen Arguments Always Fail
• Meta’s Metaverse lead left 4 months ago
• Show HN: Uruky (EU-based Kagi alternative) now has Image Search and URL Rewrites
• Show HN: Infinite canvas notes in the non-Euclidean Poincaré disk
• Ask HN: So what happened to Facebook “localhost” tracking?
• Show HN: Boxes.dev: ditch localhost; run Claude Code and Codex in the cloud
• Show HN: Formally verified polygon intersection – Opus 4.8 oneshots, prev failed
• Show HN: Live breath detection and biofeedback from a phone microphone
• Show HN: Cost.dev (YC W21) – making agents cost-aware and cheaper to call
• Supply chain attack alert: .github/setup.js
• Google killed my $1M ARR startup overnight
• Learn from my lesson, don’t take your pre seed through stripe = Account Closure
• Ask HN: High school student – is learning programming still worthwhile?
• Laid off. Broke. Depressed. & idk how to market my SaaS
• Show HN: Hydron – Hardware-aware coding agent
• Show HN: Lessons learned from running Claude Code swarms at scale
• I underestimated how hard audio waveforms are in the browser
• Show HN: I created a RAW to HDRI stacker in (mostly) Common Lisp
• Ask HN: What is the AI setup for an experienced dev starting on a new project?
• Ask HN: I got a fake job offer, but why?
• Ask HN: I made an image watermarking tool. What are the issues open-sourcing it?
• WSL vs Wine
• Show HN: MCP for the ChatGPT Ads API – Query ChatGPT Ads from Claude and Codex
• The Art of Language
• Show HN: Verifiable E2E encrypted task manager built by a ceramics retailer
• Adafruit receives demand letter from Fenwick legal counsel on behalf of Flux.ai
• Roadmap 2026 – Fluxer
• Basic Soldering Lesson 1 – “Solder and Flux” [video]
• Show HN: Dynamically Generated Fluid UI’s
• Bird flu, screwworm monitoring among foreign aid programs killed by DOGE
• Flu Vaccines Should Not Be This Hard
• The tiniest logging stack: Fluent Bit, Parquet and DuckDB
• Flutter: macOS Malvertising Campaign Spreads New FlutterShell Backdoor
• Show HN: I Derived a Pancake
• Show HN: On-device transcriber that’s 97% accurate at identifying speakers
• Ask HN: Is Azure capacity this constraind or am I doing it wrong?
• Show HN: an AI app that settles small couple arguments
• Show HN: Micron: a high performance C++23 (re)implementation of Libc and the STL
• Miz Framework Story
• Show HN: Realistic procedural fire effect via naive algorithm
• Backrest – a web UI and orchestrator for restic backup
• I wrote a book about refusing to claim authorship of an AI “million dollar"proof
• Observing LLM Applications with OpenTelemetry
• Insaion – Automated ROS2 fleet monitoring, now with OpenTelemetry bridging
• Google will pay SpaceX $920M per month for compute
• Microsoft debuts Surface RTX Spark Dev Box to run LLMs without cloud costs
• Show HN: SleekCMS – Lovable for Websites

Heise Cloud (5)

• Kommentar: Warum Microsoft jetzt auf Open Source setzt
• Perplexity verteilt automatisiert KI-Rechenbedarf zwischen Gerät und Cloud
• Wegwischen – Die unsichtbaren Kosten der Reibungslosigkeit
• Digitale Unabhängigkeit: EU plant harten Zugriff auf staatliche IT-Strukturen
• Zoom: KI-Agent schließt ab, was Meetings beginnen

Kubernetes Blog (1)

• From Kubernetes Dashboard to Headlamp: Understanding the Transition

The New Stack (26)

• AI teams now deploy 1,000 times a month. Your pipeline wasn’t built for that.
• Microsoft just made the agent runtime free — and kept everything around it
• “Whoever builds the most joyous product wins”: The agent war begins
• Netlify CTO Dana Lawson: Writing code is no longer the job
• From Jupyter Notebook to production: How to ship AI systems that actually work
• OpenClaw used Gavriel Cohen’s code and exposed the AI Agent accountability problem
• Replit shows how vibe coding is getting its own financial stack — and a path to profit
• Cloudflare aqui-hires VoidZero: Did a piece of the open web just stabilize, or become more brittle?
• Cursor cuts prices and adds enterprise spend controls amid “tokenomics” reckoning
• Google Gemma 4 12B nearly matches 26B benchmarks — and runs on your laptop
• Snowflake thinks it knows what’s really slowing developers down
• Autonomous agents have met their biggest challenge yet: The database.
• Why agentic AI makes the ops platform the most important layer in the enterprise
• How to dramatically improve enterprise security alert tuning to battle cyberattacks
• Why the need for humans won’t disappear in the age of autonomous databases
• How to secure Kubernetes in the age of AI workloads
• Asana says its new AI “chief of staff” turns your Slack chaos into trackable work
• Nvidia’s best model is now live
• The AI cost crisis finally has a watchdog — just not the companies causing it
• How to get operational data off the factory floor without creating an IT breach
• Why CPUs still matter in the age of AI agents
• Rayfin: Microsoft’s answer to the gap between vibe coding and enterprise production
• Microsoft bets the enterprise AI race will be won on data context, not model power
• “A successful attack could be catastrophic”: Anthropic gives more groups access to Claude Mythos
• How GitHub plans to win developers back
• Microsoft really, really, really wants developers to love Windows again

← Back to Newsletter

This week in Cloud Native saw a concentration of new stable releases across orchestration, security, and configuration management projects. Discussions in the community centered on the expanding role and challenges of AI agents within cloud native environments, alongside ongoing conversations about Kubernetes ecosystem tooling and security.

🚀 Notable Releases

CI/CD

• Argo CD v3.4.3 - A maintenance release that includes container image signing by cosign.
• Argo CD v3.3.11 - A maintenance release that includes container image signing.
• OpenCost v1.120.3 - Includes an initial Kubernetes model proposal, adds support for shorter node names in container keys, and fixes a memory leak on scrape targets.

Build

• Dapr Runtime v1.17.8 - Addresses a workflow deadlock issue and a security vulnerability (CWE-346) related to Sentry OIDC discovery.
• Backstage v1.51.1 - A patch release addressing issues such as CTE materialization bottlenecks in queryEntities, a 406 response for GitLab archive retrieval, and msgraph user group member filtering.
• Buildah v1.44.0 - Modifies configuration file lookup behavior and fixes an issue where --tag oci-archive did not work with simple images.

Security

• Falco 0.44.0 - A new minor release.
• Open Policy Agent v1.17.0 - Introduces improved negation semantics with future.keywords.not, adds rule labels to decision logs, and publishes JSON schema for IR and bundle manifests.
• SPIRE v1.15.1 - Fixes a security vulnerability in the azure_imds server node attestor plugin where forged attested documents could be accepted.
• SPIRE v1.14.7 - Fixes a security vulnerability in the azure_imds server node attestor plugin where forged attested documents could be accepted.
• Kubescape v4.0.9 - Fixes partial GVR collection failures, accepts advertised base URI format in the vulnerability manifest parser, and includes additional unit tests.
• OpenFGA v1.16.1 - Fixes incorrect fallback behavior in the experimental weighted_graph_check algorithm and addresses metric labeling for it.
• KubeArmor v1.7.3 - Uses Kubernetes informers to watch host and network policies and fixes a system monitor verifier error on Ubuntu 18 with clang 12.
• KubeArmor v1.7.2 - Addresses an init UBI container build issue, upgrades Go dependencies, bumps the Podman package for a vulnerability fix, and improves init container compatibility on x86-64-v3 architectures.
• Sigstore Rekor v1.5.2 - Enforces a maximum size limit on decompression, adds support for restricting kinds on insertion, and fixes TLS ServerName stripping in gRPC dials for the Trillian client.

Observability

• Prometheus v3.12.0 - Addresses two security vulnerabilities (DoS in remote-write, secret exposure in STACKIT SD), and includes new PromQL and Service Discovery features, along with TSDB performance improvements.

Storage

• Rook v1.19.6 - A patch release for the Ceph operator, adding cluster labels to Prometheus metrics, honoring per-device deviceClass in raw-mode OSD preparation, and improving self-signed certificate creation retry logic.
• Rook v1.18.11 - A patch release for the Ceph operator, enabling disk zapping for forceful OSD installation and fixing CSI provisioner priority class assignment.
• Kubernetes CSI External Snapshotter v8.6.0 - Updates support for CSI Spec v1.11.0, where VolumeGroupSnapshot moves to GA, and sets the minimum supported Kubernetes version to 1.25.

Configuration

• Cloud Custodian 0.9.51.0 - Adds WAFv2 support for API attributes, introduces guardrail features, improves AWS Config compliance matching, and sanitizes Lambda VpcConfig for SecurityHub findings.
• Meshery v1.0.34 - Fixes a goroutine context detachment issue in the server, enables Docker extension UI builds on the build platform, and addresses UI issues related to dashboard resource tables and icon clicks.
• Meshery v1.0.33 - Migrates MUI Box and Grid2 system props to sx for v9 compatibility and updates Sistent icon imports.
• Meshery v1.0.32 - Refactors mesheryctl by renaming the --register flag to --skip-registration and resolves a UI issue causing a ConnectionTable loop.
• Meshery v1.0.31 - Enhances end-to-end testing setup by consolidating CI workflows and adding a wait for E2E route readiness.
• Meshery v1.0.30 - Updates provider capabilities, removes unused manifest URL fixtures from mesheryctl, and decouples MeshMap extension tests.
• Meshery v1.0.29 - Fixes silent config corruption on YAML parse failure, resolves a cluster count issue, and addresses provider timeout errors in the server and UI.

Orchestration

• Karmada v1.18.0 - A new minor release with general improvements.
• Karmada v1.17.3 - A patch release with general improvements.
• Karmada v1.16.6 - A patch release with general improvements.
• Karmada v1.15.9 - A patch release with general improvements.
• Volcano v1.15.0 - Introduces Gang-scheduling to support converged general-purpose and AI computing workloads.
• Capsule v0.13.1 - A patch release correcting Helm documentation and values schema for webhook service ports.
• Capsule v0.13.0 - Changes the default behavior to use cert-manager certificates for admission webhooks, requiring explicit re-enablement of the Capsule TLS controller if cert-manager is not installed.

Networking

• Kube-OVN v1.14.39 - Fixes hook log file permissions.
• Kube-VIP v1.2.0 - Reintroduces BGP configuration via node annotations, ensures node names are RFC 1123 compliant, and adds end-to-end tests for endpoint watcher leader election.
• Submariner v0.21.3 - A new patch release.

Container Runtime

• Lima v2.1.2 - Addresses shell mount path checks, adds a --param shortcut to limactl, fixes rsync path quoting, and improves limactl ls output for unknown terminal widths.

Container Tools

• Skopeo v1.23.0 - Modifies configuration file lookup behavior.

📰 This Week in Cloud Native

The cloud native landscape this week was significantly shaped by discussions around AI agents and their integration into existing infrastructure. Multiple reports highlighted the operational challenges of AI at scale, including escalating cloud costs, termed “tokenmaxxing,” and the need for dedicated systems to manage AI retrieval and context. Security concerns were prominent, with analyses indicating that AI-generated code introduces new vulnerabilities and that current security paradigms are not adequately equipped to handle the rapid pace of AI-driven development. Initiatives like Google Cloud’s “AI Threat Defense” platform and IBM/Red Hat’s $5 billion commitment to open-source security for the AI era reflect industry efforts to address these emerging risks.

In the realm of Kubernetes and platform engineering, the conversation focused on practical implementation and optimization. Articles detailed approaches to building cloud-native internal developer platforms leveraging Kubernetes, GitOps, and supply chain security practices. The complexities of integrating core cloud native components like Prometheus and Cilium within Kubernetes environments were also explored, alongside strategies for GPU autoscaling with KEDA to support demanding AI workloads. Dell announced a disaggregated private cloud architecture designed for independent scalability of compute, storage, and cloud stacks.

Observability tools are adapting to new architectural patterns, with Jaeger evolving to trace AI agents using OpenTelemetry. This development reflects the increasing need for visibility into probabilistic AI systems. Additionally, the Kubernetes project published an update on reconciling records for unfixed CVEs, emphasizing transparency in security disclosures. Efforts to optimize cloud infrastructure included guidance on migrating Java applications to AWS Graviton processors and architecting cloud-native Kafka for a diskless future, aiming for improved efficiency and reduced operational overhead.

💬 Community Buzz

Hacker News discussions this week covered various Kubernetes topics, including deep dives into the Gateway API, provisioning private clusters, and comparing managed Kubernetes offerings. A significant portion of the conversation focused on the impact of AI agents, particularly regarding the security of AI-generated code, the financial implications of AI model usage (“tokenmaxxing”), and the development of new frameworks and tools for managing AI agent teams. Docker and container-related tools, such as Dockerfile linters and running Docker on Android, also saw engagement.

📊 Numbers of the Week

• Total stable releases: 38 across 25 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 283 commits
  2. cockroachdb/cockroach — 218 commits
  3. backstage/backstage — 156 commits
• Top 3 projects by merged pull requests this week:
  1. cockroachdb/cockroach — 216 merged PRs
  2. keycloak/keycloak — 104 merged PRs
  3. cilium/cilium — 84 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 23

A complete list of all cloud native articles and news from this week.

AWS Compute (1)

• Migrating your Java applications to AWS Graviton using AWS Transform custom

AWS Containers (1)

• Scaling StarRocks on Amazon EKS with KEDA and Karpenter for enterprise OLAP workloads

CNCF Blog (6)

• Dynamic configuration for cloud native Swift services
• Building a cloud native internal developer platform with Kubernetes, GitOps, and supply chain security
• The Kubernetes integration tax: Prometheus, Cilium and production reality
• GPU autoscaling on Kubernetes with KEDA: Building an external scaler
• Three TAG leads walk into the TOC
• How Jaeger is evolving to trace AI agents with OpenTelemetry

Hacker News (124)

• Reconciling Kubernetes cost estimates with CUR / FOCUS billing data
• Deep Dive into Kubernetes Gateway API
• Provisioning a Private Talos Kubernetes Cluster on Hetzner Cloud
• EU Managed Kubernetes Comparison
• Kubernetes in Anger
• My client is replacing me with Claude for all DevOps/infra and most feature dev
• Show HN: Cordium: FOSS sandbox platform that eliminates credential injection
• Show HN: Open-source tool for deploying applications to K8s/OpenShift
• The CNF Illusion: Navigating the Realities of Cloud-Native Networking
• Show HN: Screendrop – open-source cleanshot alternative
• K-Meleon CCF: tiny Gecko engine browser reborn with agent built-in
• Docker on Windows Server Felt Easier After I Tried VisualDock Server
• Show HN: Droast, a Dockerfile linter that stopped being polite
• Docker-On-Android: Guide to run Docker containers directly on Android
• Show HN: Posthorn, self-hosted mail gateway
• Show HN: Open Envelope – an open schema for defining AI agent teams
• Sqlit – A lazygit-style TUI for SQL databases
• Show HN: Lite-Harness – Self-Hosted Cursor Agents (Use Claude Code/OpenCode)
• Show HN: Heypi – Like OpenClaw but for Your Team (Slack, Discord, etc.)
• Ask HN: Wishlist for an Immich-macOS-App?
• Dirty Frag: a kernel zero-day vs. container and microVM sandboxes
• Bill Gates AI on AI (one month later)
• Show HN: Chunk sidecars for validating agent-generated code before pushing to CI
• A quick reading level quiz to guide student reading
• Artificial Intelligence Floods Court Dockets with Home-Brewed Lawsuits
• Show HN: The Prometheus org has 188 cross-repo dependencies (no signup)
• Show HN: I built a tool that finds unused Prometheus metrics
• Show HN: Open-Source AI Racing Harness
• Show HN: Hm – a task runner with a Python DSL, growing into a CI/CD system
• Show HN: Gochan – A library of channel architectures for Go, inspired by Rust
• Show HN: Built a tool to create brand-consistent images using AI
• Show HN: Stumpy – StumbleUpon Re-Created
• Popular YouTuber says upcoming AI course expecting several million in revenue
• Show HN: Pictolab (online HDR image editor)
• The people who actually want AI to replace humanity
• Show HN: Helm plugin for working with OCI-based Helm charts
• Show HN: Helios – what plug-in solar could generate for any address in Britain
• Creusot helps you prove your Rust code is correct
• Iron-rich immune cells help homing pigeons navigate
• A Comma and a Question Mark, Redux: Quick Terminal Helpers Using Pi
• 1M Ancient Greek fragments soon to be translated with the help of AI
• Ruby inventor Matz working on native compiler with AI help
• Balcony solar could help fight rising US utility costs
• How Online Sleuthing Helped Catch the ‘Google Insider’ on Polymarket
• Encrypted Client Hello Doesn’t Help With Privacy
• OpenAI Foundation commits $250M to help navigate AI disruption
• Show HN: I help founders kill doom scrolling and hook people’s attention fast
• Google AI Threat Defense to help you outpace the adversary
• Hermes Agent is now natively supported on Windows
• Operation Jailbreak uses lessons from Ukraine to help weapons talk to each other
• CompletionKit – stop guessing whether your prompt change helped
• ML-KEM and X-Wing Patches Posted for Linux to Help with Post-Quantum Security
• Launching Avrea: CI that helps teams ship faster
• Online Sleuthing Helped Catch the ‘Google Insider’ on Polymarket
• Show HN: A tool to debug complex Stripe interactions (built with Claude’s help)
• I added vi-modal bindings to my blog, a Chinese AI helped me do it
• Using Git’s rerere feature to escape recurring conflict hell
• Hermes Agent co-founder defends Polymarket skill coming pre-installed
• Show HN: I made an emergency page for my family
• Show HN: AISlop, a CLI for catching AI generated code smells
• $100 to a Debian Developer who can get Fresh Editor into Trixie
• Show HN: Filemat – an open-source web-based file manager
• Ask HN: Any advice on how to learn good software architecture practices?
• Show HN: Game Boy pixel pipeline explorer
• Garnix, the Nix CI, is shutting down
• Argonne flexes spare supercompute to build private AI inference service
• The Eye of Argon
• Erin Brockovich made a map to track data centers around the country
• High Density Living, 2000 Years Ago: Inside the Roman Apartment Building
• Mechanical Pencil: An illustrated celebration of the engineering around us
• Thiel moves family to Milei’s libertarian Argentina
• A Probabilistic Algorithm for Repairing All Roads in Lebanon via Papal Visits (2025)
• UA flight – ’turn Bluetooth off or we’re turning around’
• Why Peter Thiel Is Decamping to Argentina
• Flight turned around over Atlantic as a boy named his Bluetooth device “bomb”
• Peter Thiel’s Move to Argentina Reflects Billionaire Trend
• Software engineer wanted to resist the usual algorithms, so he created his own
• Show HN: Strudai, browser based agentic wrapper around Strudel
• AI Didn’t Create These Problems. It Just Stopped Routing Around Them
• Seriously Off-Topic, But: Things My Girlfriend and I Have Argued About
• Hacking my way around a fake STM32
• Gen Z but Two Centuries Ago
• Intl.RelativeTimeFormat: the browser knows how to say ‘2 hours ago’
• United flight forced to turn around because of a Bluetooth speaker name
• Tell HN: Meta’s AI support feature allows Instagram accounts to be stolen
• Show HN: Ouijit, an open-source task and terminal manager for coding agents
• Show HN: Map drawing tool where the map lives in the URL
• Show HN: Integuru – Integrate with platforms via the source code
• Show HN: AT4K Launcher - Apple TV inspired Launcher for Android TVs
• Show HN: I brought back Airbnb categories
• FYI: Dreamina is shady; do not use
• Ask HN: What/how are you teaching your kids in the age of AI?
• Ask HN: Corporate Disconnect Between “Tokenmaxxing” and Token Optimization
• Show HN: Breadboard – Figma for Breadboard Hackers
• Show HN: An update to our long-turn FreeCiv experience
• Show HN: Phive, a Gomoku-like game to play with friends or solo
• Show HN: leaf – one month later: website, releases and lots of improvements
• Show HN: I made samspov.com to easily track updates
• Show HN: I made Pokémon but with real animals in the real world
• Coworkers Producing Shit Code
• Ask HN: Books for someone who is transitioning from FAANG to finance
• I built an Android-like OS that runs in the browser
• Show HN: Train Claude Code’s replacement (ds4 and pi and aoe)
• Show HN: Shamefile – Enforce docs for linter bypasses
• Am I too pessimistic about Python’s future?
• Show HN: Kakeibo – a simple budget tracking app for simple people
• Content Distributor & tool builder
• Try on Any Garment Faster
• Navier-Stokes fluid simulation explained with Godot game engine
• Canonical takes over Flutter desktop maintenance
• Fluid Fire Simulation Sandbox
• ‘World’s first fluid circuit board’ can be physically rewired in under a minute
• Canonical takes over Flutter desktop maintenance and roadmap
• Don’t Forget To Flush (2025) [video]
• I Built the Same App with Five GUI Frameworks: Tauri Slint Egui Dioxus Flutter
• The status quo should be fluent
• Fluid Simulation for Dummies
• Show HN: Fungible – A local personal finance app in the terminal
• Show HN: Jynx, a matchmaking app to find gaming teammates
• Ask HN: Has AI affected negatively the job market for devs?
• WP Engine and Automattic Trade Accusations
• Garnix Is Shutting Down
• Is Claude Code Getting Worse? How to Measure Degradation with OpenTelemetry
• Show HN: CakeML-based self-verifying, self-improving system

Heise Cloud (7)

• Mistral Vibe: Die neuen agentischen Oberflächen Work und Code ausprobiert
• Google Cloud: Neue KI-Plattform soll Schwachstellen in Minuten schließen
• Kommentar: Mehr Office-Chaos, bitte
• IBM und Red Hat: 5 Milliarden Dollar für sicherere Open-Source-Software
• KI-Funktionen sicher auf europäischer Infrastruktur nutzen
• Klage gegen Cloud-Abgabe: Der Verband CISPE zieht in Italien vor Gericht
• Dell disaggregiert Private Cloud für mehr Skalierbarkeit

InfoQ Cloud Native (1)

• Article: Architecting Cloud-Native Kafka: From Tiered Storage Towards a Diskless Future

Kubernetes Blog (1)

• Reconciling the Past: Correcting Records for Unfixed Kubernetes CVEs

The New Stack (26)

• Gavriel Cohen found his own code inside OpenClaw, so he walked away
• AI retrieval at scale is becoming a systems problem, not a tooling problem
• The DIY platform trap that’s burning out engineering teams
• I tested Cursor’s new Jira integration and it’s 5 stars, no notes. Here’s why.
• Why GPT-5.4, Claude, and Gemini can’t agree on basic, real-world facts
• Replit’s vibe coding platform just got a Visa-backed identity layer for AI agents — and it changes how agents spend money
• Opus 4.8 Made Claude Smarter. Token Discipline Got Urgent.
• Why Linux creator Linus Torvalds gets angry hearing “99% of code is AI”
• Vendor neutrality isn’t magic: A hard look at the OpenTelemetry ecosystem
• “The AI did it” won’t save you when EU regulators come knocking
• The fix for soaring AI cloud bills exists — so why won’t we trust it?
• AI is shipping code faster than security was built to handle
• Why AWS scrapped OpenSearch’s architecture to chase agent workloads
• Claude Opus 4.8 is here: effort controls, dynamic workflows, cheaper fast mode, better honesty, less deception
• Percona celebrates 20th birthday with new foundation — and a goat cake
• Why OpenAI and Anthropic are hiring forward deployed engineer teams
• Claw-style AI agents are coming to the enterprise. The governance infrastructure is still catching up.
• The agentic identity crisis: Why your security isn’t ready for the AI revolution
• Debugging the undebuggable: building observability into probabilistic AI systems
• Snowflake commits $6B to AWS as it pushes deeper into AI
• Why MotherDuck refuses to fork DuckDB
• Researcher “gave Claude Code ‘ADHD’… and it thinks 2x better now.” Outside experts want more proof.
• “There is no accountability”: AI coding agents are installing packages no one owns
• “Tokenmaxxing is real, expensive & it’s spreading”: AI budgets are exploding
• With Google’s debut, the most important AI agent feature is now the most boring one
• Why AI agents need a Context Lake

← Back to Newsletter

This week in Cloud Native saw the graduation of OpenTelemetry to a CNCF Graduated project, signaling its widespread adoption as an observability standard. Multiple projects released patch updates addressing security vulnerabilities and introducing various fixes. Discussions also continued around the integration of AI agents within cloud native development and infrastructure.

🚀 Notable Releases

Container Runtime

• containerd v2.3.1 - This patch release includes a security update for CVE-2026-46680 and fixes a bug where failed gRPC plugins were not tolerated during listener startup.
• containerd v2.2.4 - This patch release includes security updates for CVE-2026-46680 and CVE-2026-34986, and uses the mount manager during image volume processing to support snapshotters requiring writable block volumes.
• containerd v2.0.9 - This patch release includes a security fix for CVE-2026-46680, ensures container exit events are retained during containerd restarts, and applies hardening against TOCTOU race conditions in tar extraction.
• containerd v1.7.32 - This patch release includes a security fix for CVE-2026-46680, allows hosts.toml to contain root-level fields without an explicit [host] section, and fixes handling of out-of-range USER values in OCI specs.
• containerd API 1.11.1 - This patch release includes a fix for sandbox task API endpoints when using non-runc runtimes.

Orchestration

• Crossplane v2.3.1 - This patch release addresses user-reported issues and includes security updates for dependencies, such as golang.org/x/crypto.
• Crossplane v2.2.2 - This patch release fixes user-reported issues and includes security updates for dependencies, such as github.com/in-toto/in-toto-golang and github.com/go-git/go-git/v5.
• Crossplane v2.1.6 - This patch release addresses user-reported issues and includes security updates for dependencies, such as golang.org/x/net and go.opentelemetry.io/otel.
• Crossplane v1.20.8 - This patch release fixes user-reported issues and includes security updates for dependencies, such as github.com/docker/cli and golang.org/x/net.
• Crossplane v2.3.0 - This release introduces a local rendering engine, finer-grained reconciliation control for XRs and managed resources, and alpha deletion protection for Provider packages.

CI/CD

• Flux v2.8.8 - This patch release includes CVE fixes via go-git, reliability fixes in helm-controller and source-controller, moves Helm back to upstream v4.2.0, and adds support for GCP sovereign cloud artifact registries.
• OpenCost v1.120.2 - This release updates Go dependencies, supports shorter node names, and includes a fix for a memory leak during scrape target processing.

Service Mesh

• Istio 1.30.0 - This is a new stable release of the service mesh.
• Istio 1.29.3 - This is a patch release for the 1.29 series.
• Istio 1.28.7 - This is a patch release for the 1.28 series.

Security

• Kyverno v1.18.1 - This release adds support for cluster-scoped resource generation in GeneratingPolicy and passes AdmissionRequest to update requests for mutate existing policies.
• SPIRE v1.15.0 - This release adds an account_id selector for aws_iid nodeattestor, TLS support for the Prometheus metrics sink, and a feature to prevent prefetching of X509-SVIDs for specific registration entries. It also adds rootless Podman support for the Docker workload attestor.
• Keycloak 26.6.2 - This release includes security fixes for CVE-2026-33871 (HTTP/2 CONTINUATION Frame Flood Denial of Service) and CVE-2026-33870 (RFC violation).
• OpenFGA v1.16.0 - This release adds datastore ping timeout configurations, reports allowed results and tuple_key on Check and experimental weighted_graph_check resolution trace spans, and fixes cache key collisions in experimental weighted_graph_check union resolution.

Observability

• OpenTelemetry Collector v0.153.0 - This release includes breaking changes by stabilizing feature gates for configoptional.AddEnabledField, confmap.newExpandedValueSanitizer, exporter.PersistRequestContext, and otelcol.printInitialConfig.
• OpenTelemetry Collector v0.152.1 - This release adds the otelcol_exporter_in_flight_requests metric to track the number of concurrent export requests per exporter.

Build

• Backstage v1.51.0 - This release removes the deprecated NavItemBlueprint from @backstage/frontend-plugin-api, with navigation items now discovered from PageBlueprint extensions.

Framework

• KServe v0.17.1 - This patch release includes fixes for installation scripts and Helm charts.

Chaos Engineering

• LitmusChaos 3.29.0 - This release includes a dependency bump for google.golang.org/grpc to v1.79.3, addressing CVE-2026-33186, and prevents duplicate chaos experiment triggers under concurrent reconciles.

Messaging

• NATS Server v2.14.1 - This release updates the Go version to 1.26.3, updates dependencies, and adds new metrics (in_client_msgs, in_client_bytes, out_client_msgs, out_client_bytes) for client message and byte counts.
• NATS Server v2.12.9 - This release updates the Go version to 1.25.10, updates dependencies, and adds new client metrics (in_client_msgs, in_client_bytes, out_client_msgs, out_client_bytes).

Networking

• Kube-OVN v1.14.38 - This release includes Go dependency updates.
• Kube-OVN v1.15.12 - This release backports u2o overlay-only routing and packages the ipvlan plugin in the kube-ovn image.
• Kube-OVN v1.14.37 - This release backports u2o overlay-only routing and packages the ipvlan plugin in the kube-ovn image.

Configuration

• Meshery v1.0.28 - This release includes UI fixes for Next.js build imports and builder dependencies.
• Meshery v1.0.27 - This release updates meshery/schemas to v1.2.23, indexes matchlabels and binding identification loops, and fixes batch-loading of connection environments.
• Meshery v1.0.26 - This release includes Dockerfile updates.
• Meshery v1.0.25 - This release updates meshery/schemas to v1.2.22, fixes non-determinism in the relationship evaluation engine, and refactors provider naming.
• Meshery v1.0.24 - This release includes UI fixes to stop React update-depth loops on /management/connections, fixes performance dashboard crashes on null test_start_time, fixes permission issues in the configuration panel, and restores Navigator icons.
• Meshery v1.0.23 - This release updates meshery/schemas to v1.2.20, fixes a URL path, removes a test directory, and guards MeshSync metadata lookup when registry tables are absent.

Scheduling

• Descheduler Helm Chart 0.36.0 - This is a Helm chart release for the Kubernetes Descheduler.
• Descheduler v0.36.0 - This release adds init container support to the Helm chart and updates Helm RBAC to account for PVC failures.

Edge

• K3s v1.36.1+k3s1 - This release updates Kubernetes to v1.36.1, includes May backports, and updates the rancher/local-path-provisioner image version.
• K3s v1.35.5+k3s1 - This release updates Kubernetes to v1.35.5, includes May backports, and updates the rancher/local-path-provisioner image version.
• K3s v1.34.8+k3s1 - This release updates Kubernetes to v1.34.8, includes May backports, and updates the rancher/local-path-provisioner image version.
• K3s v1.33.12+k3s1 - This release updates Kubernetes to v1.33.12, includes May backports, and updates the rancher/local-path-provisioner image version.

Database

• ScyllaDB Operator v1.21.0 - This is a new stable release of the ScyllaDB Operator.

Backup

• Velero v1.18.1 - This release fixes wildcard expansion when includes are empty and excludes have wildcards, and adds a 2-second gap between temporary CSI VolumeSnapshotContent creation and deletion.

📰 This Week in Cloud Native

The Cloud Native Computing Foundation (CNCF) announced that OpenTelemetry has graduated, signifying its maturity and widespread adoption as a vendor-neutral standard for observability across traces, metrics, and logs. This milestone reflects its use in production environments and its role in modern cloud native architectures. Related discussions covered techniques for designing end-to-end ingress request tracing in multi-tenant SaaS platforms and how Jaeger achieved significant data compression using ClickHouse as a storage backend.

The intersection of AI/ML and Cloud Native continued to be a prominent theme. NetEase Games shared insights on achieving 30-second cold starts for Large Language Models (LLMs) on Kubernetes, addressing the challenge of elastic compute for data-intensive AI workloads. New open-source initiatives like Prempti were introduced to provide policy and visibility for AI coding agents, which are increasingly integrated into developer workflows. Automation of Confidential Containers (CoCo) infrastructure with Kyverno was explored as a method to enhance security for containerized AI workloads. AWS highlighted Kubernetes Dynamic Resource Allocation as a way to simplify AI infrastructure management for specialized hardware like AWS Trainium and Elastic Fabric Adapter. Microsoft discussed the foundational role of open source in AI and agentic systems, introducing STATE-Bench as a benchmark for AI agent memory. Camunda announced ProcessOS, which incorporates an intelligence layer designed to learn from and optimize business processes using AI.

In Kubernetes Ecosystem news, the Kubernetes blog announced the availability of etcd 3.7.0-beta.0. CVS Health joined the CNCF as a Platinum member, expanding collaboration on cloud native initiatives. A field guide was published for the upcoming KubeCon + CloudNativeCon India event. A technical post discussed the limitations of kubectl debug in retaining termination container records, highlighting a “silent evidence gap” for debugging ephemeral states. AWS also announced that Bitnami container images will no longer be available on Amazon ECR Public Gallery starting June 10th, 2026, requiring users to adjust their image pulling strategies.

Security updates were released across several projects, including containerd, Crossplane, FluxCD, Keycloak, and Litmus Chaos, addressing various CVEs and dependency vulnerabilities. Discussions also touched upon the security implications of AI coding agents and the importance of supply chain security, with calls from the Open Source Security Foundation (OpenSSF) for broader industry support for open source maintainers.

💬 Community Buzz

Hacker News discussions this week covered various aspects of Kubernetes, including new runtimes for AI agents, deep dives into Kubernetes internals, and tools for infrastructure-as-code that integrate with Kubernetes and Helm. Topics also included strategies for cost optimization in Kubernetes environments through off-hours scaling and analyses of default insecure CoreDNS configurations. Docker-related threads explored reverse-engineering undocumented microVM APIs and techniques for reducing Docker container image sizes. The broader impact of AI agents on development, local AI model execution, and the creation of reliability layers for LLM tool-calling also generated discussions.

📊 Numbers of the Week

• Total stable releases: 43 across 20 projects
• Top 3 projects by commits this week:
  1. falcosecurity/falco — 263 commits
  2. meshery/meshery — 233 commits
  3. cockroachdb/cockroach — 228 commits
• Top 3 projects by merged pull requests this week:
  1. cockroachdb/cockroach — 184 merged PRs
  2. cilium/cilium — 116 merged PRs
  3. keycloak/keycloak — 84 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 22

A complete list of all cloud native articles and news from this week.

AWS Compute (2)

• Streamline your infrastructure: Automating AMI creation with Kiro CLI and EC2 Image Builder
• Sharing Capacity Blocks for ML Across Your AWS Organization

AWS Containers (3)

• AI-powered event-driven Amazon EKS AMI updates with GitOps
• Bitnami image removal from ECR Public
• Simplify AI infrastructure for AWS Trainium and Elastic Fabric Adapter with Kubernetes Dynamic Resource Allocation

CNCF Blog (8)

• Designing end-to-end ingress request tracing for multi-tenant SaaS platforms
• Aamchi Mumbai: A KubeCon + CloudNativeCon field guide
• Cloud Native Computing Foundation Announces OpenTelemetry’s Graduation, Solidifying Status as the De Facto Observability Standard
• How NetEase Games achieved 30-second LLM cold starts on Kubernetes
• Introducing Prempti: Policy and visibility for AI coding agents
• Automating Confidential Containers (CoCo) infrastructure with Kyverno
• CNCF Welcomes CVS Health as a Platinum Member To Expand Cloud Native Collaboration
• What kubectl debug doesn’t tell you: The silent evidence gap

Hacker News (109)

• Show HN: Agyn, an open-source Kubernetes runtime for AI agents
• Show HN: A deep dive into Kubernetes internals
• Show HN: Formae now supports Kubernetes, Helm, .tfvars and a public plugin hub
• LLMKube – A Kubernetes operator for local LLMs across Nvidia and Mac fleets
• A solution for schlep blindness in agentic development for Kubernetes envs
• Kubernetes in Anger
• Show HN: GoKubeDownscaler – Off-Hours Kubernetes Scaling Cuts Costs by 70%
• Kubernetes’ Default CoreDNS Configuration Is *Insecure
• What Copy Fail looked like on a minimal OS
• CloudNativePG and Crunchy PGO: an honest, opinionated comparison
• Show HN: Compose-to-Cloud Pulumi Providers for AWS, GCP, and Azure
• Show HN: Forge – Guardrails take an 8B model from 53% to 99% on agentic tasks
• Show HN: Charm – on-device spelling, grammar, and prediction for macOS
• We Reverse-Engineered Docker Sandbox’s Undocumented MicroVM API
• We reduced a real Node.js production Docker image from 1.2GB to 78MB
• Why Your Docker Container Is 1.2GB When It Should Be 80MB
• Shocker: Docker implemented in ~300 lines of bash
• Launch HN: Runtime (YC P26) – Sandboxed coding agents for everyone on a team
• Show HN: TLS Certificate Management and PKI
• Ask HN: How to increase depth instead of breadth as 10 yoe as swe?
• Show HN: I built a RAG and knowledge graph agent that runs locally
• Show HN: I built a powerful RAG and knowledge graph agent that runs locally
• Peak unemployment for a software engineer. What did I do wrong?
• The Oats Protocol – Open Agent Tools for Local Coding Agents
• NTSB pulls docket after AI recreates dead pilots’ voices
• Internet Sleuths Reconstruct Audio of Ups Plane Crash, NTSB Takes Down Dockets
• Bezos brushes off concerns of an AI bubble: ‘You shouldn’t worry about it’
• Do you enjoy reading any type of AI written text?
• We let AIs run radio stations
• Show HN: I made a tactical map-based WWII submarine simulator (public beta)
• Show HN: Free Fonts – a collection of 400+ original, open-source typefaces
• Show HN: MyUUIDshop, Generate UUIDs and never worry about duplicates
• Show HN: Bevel – Guess the book from its opening passage
• Show HN: Cervantes yet Another HN Reader
• HN: Updating our Databases on AniTroves to provide biggest Anime, Manga database
• Show HN: 5 Minute Frenzy – free multiplication practice game for kids
• Show HN: ReTab – a Cmd+Tab-style switcher for Safari tabs
• Show HN: atrium – a resumable, tiling workspace manager for Claude Code, Codex
• Show HN: Proposalkit.io – you write the content, we control the design
• Show HN: How Expensive Is Your (Steam) Wishlist?
• Flipper One – we need your help
• Show HN: Anyone interested in a tool helps to explore C++ ASTs
• Superficie – Surface Syntax for Clojure to Help Exposition/Onboarding
• Shitfixer.app – helps you reframe negative experiences and find optimism
• The Definitive Guide to Helping People Trapped in a Cult
• Trump official helped secure US visa for fugitive Polish minister
• Jailbroken Gemini helped Russian-speaking fraudster target MAGA crypto users
• We were building infra for OpenClaw, and today I just tried Hermes and holy shit
• An AI system to help scientists write expert-level empirical software
• Supercharging Immune Cells May Help Control HIV Long-Term
• Pressure from Silicon Valley helped block Trump’s expected order on AI
• I Need Help
• What Models? Helps Match Local AI Models to Your Hardware
• Light pollution is washing out the sky. A remote telescope farm helps stargazers
• Did Amphetamines Help Erdős?
• Quantum ‘Jamming’ Could Help Unlock the Mysteries of Causality
• Open-Source Software Is Starting to Help Robots Think
• Marketing Help
• The Gemini app becomes more agentic, delivering proactive, 24/7 help
• Phrasing helps you become fluent in multiple languages
• BudgetBites – AI meal planning app that helps you save money on groceries
• Actions-cool/issues-helper GitHub Action Compromised
• I’m looking for people who can help us become a 3rd level civilization
• Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking
• Alternatives to HN for “tech outside of AI” discussion?
• Show HN: Haystack – Review the PRs that need human attention
• Show HN: Hocuspocus 4 – self-hosted Yjs collaboration backend
• Show HN: I Made a Claude Skill for Spec-Driven Development (SDD)
• Show HN: I made a 2D Lua game engine using Rust with code and asset live reload
• Show HN: Daily word puzzle game based on polysemy
• z386: An Open-Source 80386 Built Around Original Microcode
• Agora-1: The Multi-Agent World Model
• Bug 1950764: Work Around Crash on Intel Raptor Lake CPU
• Fast Factorial Algorithms
• Companies Are Just a Graph of Algorithms
• An asteroid discovered days ago will narrowly miss Earth – RNZ News
• An asteroid discovered days ago will narrowly miss Earth
• 25 years ago Sega figured out the internet with Phantasy Star Online
• Launch HN: Superset (YC P26) – IDE for the agents era
• Show HN: Agent.email – sign up via curl, claim with a human OTP
• Ask HN: Is $300/HR too low these days for custom full stack?
• Show HN: Sylph – the open-source company brain behind my YC startup
• “An (important) message from Infomaniak’s founder”
• Ask HN: Does anyone what a “RiotCache.dat” file was doing in my EFI partition?
• Ask HN: What are Stainless users doing now that Anthropic has killed it?
• Ask HN: How often do you code the expected way instead of a better one?
• Show HN: Generate free golf yardage books from OpenStreetMap data
• Show HN: Boatswain, A macOS menu bar app for Fathom Analytics
• Can one run AI on source code with the prompt “Find below-avg swear rate files”?
• Show HN: how I fixed my ai goose tutor to stop punishing understanding
• Show HN: Antimemetic message that escapes screen capture
• Tell HN: The Threat to US Citizen’s ID / Voting Is Private Services
• Show HN: Yes, I vibed coded something But not sure what to do with it
• Show HN: SaveNeighbor – food delivery through your own personal network
• Show HN: Computer Police – block malicious NPM/pip installs locally
• The current AI pricing was always going to go away
• Bolt CEO says he let go of HR team for creating problems that didn’t exist
• The brain’s code seems to be in constant flux. Neuroscientists are baffled
• Five months after switching Fluxzy from Electron to Tauri
• How did Asterix and Obelix learn to speak fluent Hindi? (2019)
• Rich Flu(2026): Deadly virus targets the wealthy and panic erupts in the streets [video]
• Obsidian: The free and flexible app for your private thoughts
• Ask HN: How can you have fun doing corporate dev work in the age of AI tools?
• Show HN: Superlog (YC P26) – Observability that installs itself and fixes bugs
• Grafana says stolen GitHub token allowed attackers to download its codebase
• Show HN: Visual studio for cloud
• Why I Sacrificed a Goat to AWS Gods
• Show HN: I built an AI cloud architect that ships working infrastructure
• The CLOUD Act gap in Canadian defence infrastructure

Heise Cloud (9)

• Fotoanbieter Portraitbox: Erpressung nach Sicherheitsvorfall?
• Nachrichten einsammeln, filtern und weitergeben mit Inoreader
• Camunda: ProcessOS optimiert Geschäftsprozesse mit KI
• IT Summit 2026: heise-Konferenz zu Digitaler Souveränität
• Freitag: Robotaxi-Probleme in den USA, Australiens Kinderschutz-Strafe gegen X
• Mit dem Deutschland-Stack samt Zertifizierung zur digitalen Souveränität
• Ethical Hacking für Fortgeschrittene – sich selbst hacken, bevor es andere tun
• Google und US-Investor bauen gemeinsame Rechenzentren auf Basis von Google-TPUs
• DeepL: Deutscher Übersetzungsdienst setzt jetzt auf AWS

Kubernetes Blog (1)

• Announcing etcd 3.7.0-beta.0

Microsoft Open Source (2)

• Introducing STATE-Bench: A benchmark for AI agent memory
• From open source to agentic systems: Microsoft at Open Source Summit North America 2026

The New Stack (26)

• Who’s monitoring the agents?
• How Jaeger hit 8.6× compression on 10 million spans with ClickHouse
• What ClickHouse learned from a year of coding with AI agents
• OpenClaw passed 300,000 GitHub stars. Then Google launched Spark.
• Anthropic’s $300M Stainless deal lands hardest on OpenAI and Google
• How MCP and synthetic data are reshaping compliance in the agentic era
• What Anthropic and OpenAI launched in 72 hours has Wall Street paying attention
• JetBrains is selling independence as the rest of AI coding picks sides
• Three ways operational debt will break your AI strategy, and how to recover
• I buried 20 problems in a fake P&L to see if Claude for Small Business could find them
• Why enterprise AI keeps stalling — and how data streaming could unlock it
• JFrog report recaps a tumultuous year in supply chain security
• Kore counts down to Artemis, its moonshot for governable AI agents
• How to build your first end-to-end AI workflow in n8n
• CI wasn’t built for coding agents. Here’s what comes next.
• “Morally repugnant shortsightedness”: Why open source security leaders say companies must stop freeloading on maintainers
• After becoming cloud computing’s telemetry standard, OpenTelemetry graduates into the AI infrastructure era
• Building the agentic agreement enterprise: How developers are unlocking agentic experiences with Docusign’s MCP server and platform
• Cut your AI search costs without sacrificing quality
• NanoCo bets the future of enterprise AI is one sandboxed agent per employee
• Why six AI labs built the same product for knowledge workers in four months
• Building for accessibility in an AI-first development world
• Cursor bets on cheaper coding with Composer 2.5 and Kimi K2.5
• At Google I/O 2026, Antigravity gets a new job description
• Anthropic hires OpenAI co-founder Andrej Karpathy to lead Claude pre-training research
• Google launches $100 AI Ultra plan and cuts top tier to $200

← Back to Newsletter

This week saw a focus on Kubernetes stability and new features with several patch releases and the v1.36 update bringing advancements in scheduling and proxy capabilities. Security remained a key theme, with numerous projects addressing CVEs and updating dependencies. Discussions around AI agents and their integration into cloud native workflows continued to generate community interest.

🚀 Notable Releases

CI/CD

• Argo CD v3.2.12 - A patch release providing installation manifests and signed container images.
• Argo CD v3.3.10 - A patch release providing installation manifests and signed container images.
• Argo CD v3.4.2 - A patch release providing installation manifests and signed container images.
• Flux2 v2.8.7 - Includes a bug fix in kustomize-controller for object annotation management and a CVE fix in source-controller and image-automation-controller via go-git v5.19.0.

Networking

• Cilium v1.19.4 - When --k8s-service-proxy-name is set, EndpointSlices are now filtered by the service.kubernetes.io/service-proxy-name label. Operators managing EndpointSlices must stamp the matching label.
• Cilium v1.18.10 - Fixes a cilium-agent crash during CiliumNode updates by implementing retries. Addresses an issue where CiliumLocalRedirectPolicy addressMatcher could override an existing Service’s frontend.
• Cilium v1.17.16 - CiliumLocalRedirectPolicy addressMatcher now prevents overriding an existing Service’s frontend by default; the previous behavior can be restored via a flag. Fixes a panic in parseSPI with malformed input.
• Kube-OVN v1.15.11 - Blocks VPC deletion if SNAT, DNAT, or FIP rules are actively using it.
• Kube-OVN v1.14.36 - Includes updates to Go dependencies.
• Submariner v0.24.0 - A new stable release.

Build

• Dapr v1.17.7 - Resolves an issue where Workflow GetWorkItems gRPC streams were terminated when history payloads exceeded maximum size. Addresses orphaned workflows after scheduler pod restarts under load.
• Helm v4.2.0 - A feature release.
• Helm v3.21.0 - A feature release; Helm v3 is approaching end-of-life.
• Telepresence v2.28.0 - Provides official release artifacts, including installers that support running the root daemon as a system service.
• Buildah v1.39.9 - Addresses CVE-2025-49713 by updating x/crypto to v0.43.0. Bumps Go Jose to v4.1.4 to address CVE-2026-34986.

Orchestration

• Kubernetes v1.36.1 - A patch release for Kubernetes v1.36.
• Kubernetes v1.35.5 - A patch release for Kubernetes v1.35.
• Kubernetes v1.34.8 - A patch release for Kubernetes v1.34.
• Kubernetes v1.33.12 - A patch release for Kubernetes v1.33.

Observability

• Jaeger v2.18.0 - Introduces breaking changes to metrics due to OpenTelemetry collector package upgrades and removes the min step api from metricstore. Adds auto-detection of UI base path from browser URL.
• OpenTelemetry Collector v0.152.0 - Adds otelcol_exporter_in_flight_requests metric to track the number of in-flight export requests per exporter.

Security

• Open Policy Agent v1.16.2 - Updates the Go version used to build binaries and images to 1.26.3, addressing multiple vulnerabilities.
• The Update Framework (Python) v7.0.0 - A major release primarily due to a minor ngclient API adjustment. Fixes GHSA-qp9x-wp8f-qgjj related to incorrect delegation path matching on Windows. Updater() now explicitly requires a named bootstrap argument.
• External Secrets v2.5.0 - Includes general updates and a documentation fix for VaultDynamicSecret examples.
• External Secrets Helm Chart v2.5.0 - A Helm chart release for external secrets management.
• KubeArmor v1.7.1 - Fixes controller and operator UBI image releases and updates workflows for separate UBI image builds.
• SeeBOM v0.4.3 - Container images are signed with cosign and attested with SLSA provenance.
• SeeBOM v0.4.2 - Container images are signed with cosign and attested with SLSA provenance.
• SeeBOM v0.4.1 - Container images are signed with cosign and attested with SLSA provenance.
• SeeBOM v0.4.0 - Introduces a package search feature to find dependencies by name across ingested SBOMs and identify projects using them.
• Skopeo v1.11.5 - Addresses CVE-2025-65637 by updating Logrus. Bumps Go Jose to v3.0.5 to address CVE-2026-34986.

Service Mesh

• Kuma v2.13.6 - Updates golang.org/x/net from 0.48.0 to 0.53.0 and helm.sh/helm/v4 from 4.0.2 to 4.1.4. Exposes Control Plane HPA behavior. Addresses dp-server shutdown and context propagation.

Configuration

• Meshery v1.0.22 - Updates remote provider URLs and fixes a workspace crash in the Meshery UI.
• Meshery v1.0.21 - Bumps meshery/schemas to v1.2.19 and v1.2.18. Pins Node.js to v22 in the eslint-gh workflow. Fixes server handling of comma-separated PROVIDER_BASE environment variables.

Application Frameworks

• Spin canary - A canary release of the latest commits, not intended for stable use.

Cluster Management

• Cluster API v1.13.2 - Fixes a Tilt kube-state-metrics deployment issue and an in-place update problem for KCP with InfraMachine webhooks.
• Cluster API v1.12.8 - Fixes a Tilt kube-state-metrics deployment issue and an in-place update problem for KCP with InfraMachine webhooks.
• Cluster API v1.11.11 - Bumps github.com/moby/spdystream to v0.5.1 and adds a kubeadm cluster role for KCP.

Database

• CrateDB 6.3.2 - A patch release.
• CrateDB 6.2.8 - A patch release.

📰 This Week in Cloud Native

Kubernetes project developments included several patch releases across older versions (v1.33.12, v1.34.8, v1.35.5) and a new patch for v1.36.1. The v1.36 release also introduced new alpha metrics for Route Sync in the Cloud Controller Manager, graduated the Mixed Version Proxy to Beta, and deprecated the .spec.externalIPs field for Services. Workload-Aware Scheduling in Kubernetes v1.36 advanced with features for AI/ML and batch workloads, and Pressure Stall Information (PSI) Metrics for Kubernetes graduated to GA. Discussions within the CNCF community highlighted strategies for reducing engineering time spent on Kubernetes upgrades and building cloud native platforms from the ground up using tools like Kairos, k0rdent, and bindy.

The integration of AI agents into cloud native environments was a significant theme. The CNCF published articles on extending AI gateways with Rust for custom transformations and on KubeStellar’s use of AI agents for PR acceptance. Microsoft announced Conductor, an open-source CLI for deterministic orchestration of multi-agent AI workflows using YAML definitions. GitHub introduced updates to Copilot individual plans with flex allotments and a new desktop application. Anthropic launched its Claude Platform on AWS. The New Stack covered various aspects, including the energy consumption of AI, the role of AI in security operations centers, and the requirements for an “agent-native cloud.” MinIO’s MemKV was noted for its potential to improve GPU utilization by reducing AI recompute overhead.

Cloud security and governance received attention, with Cloud Custodian marking a decade of managing public cloud environments, Kubernetes, and infrastructure as code. Open Policy Agent (OPA) v1.16.2 updated its Go version to address vulnerabilities, and The Update Framework (python-tuf) v7.0.0 included a security fix for delegation path matching. SeeBOM v0.4.0 introduced a package search feature to assist with supply chain incident response by identifying dependency usage across SBOMs. Containers/Buildah and Skopeo also released updates addressing CVEs. In Europe, Germany’s BSI updated its C5 criteria catalog for cloud security and introduced the C3A catalog for sovereign clouds, prompting discussions on digital sovereignty and potential digital taxes for cloud software providers.

💬 Community Buzz

Discussions on Hacker News covered various aspects of Kubernetes, including TUI tools, local-first GitOps workspaces, secret management, and the implications of memory requests. The role of AI agents in development and operations was also a recurring topic, with discussions on agent-native cloud architectures, LLM observability, and structured multi-agent AI frameworks. Other popular topics included self-hosted media streaming platforms, Prometheus exporters for TLS certificate expiration, and the broader implications of AI in software development, including concerns about AI fatigue and over-reliance.

📊 Numbers of the Week

• Total stable releases: 40 across 16 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 1013 commits
  2. kubescape/kubescape — 280 commits
  3. cockroachdb/cockroach — 209 commits
• Top 3 projects by merged pull requests this week:
  1. meshery/meshery — 155 merged PRs
  2. cockroachdb/cockroach — 152 merged PRs
  3. kumahq/kuma — 111 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 21

A complete list of all cloud native articles and news from this week.

AWS Containers (3)

• Maximizing value with Amazon EKS Auto Mode: Strategies for visibility, control, and optimization
• Back up and restore your Amazon EKS cluster resources using Velero
• Implement centralized observability for multi-account Amazon EKS

Azure DevOps Blog (1)

• May Patches for Azure DevOps Server

CNCF Blog (6)

• Extending AI gateways with Rust: Custom transformations in agentgateway and kgateway
• When AI agents become contributors: How KubeStellar reached 81% PR acceptance
• CNCF Debuts KubeCon + CloudNativeCon Japan 2026 Schedule
• Building a cloud native platform from the ground up with Kairos, k0rdent, and bindy
• A decade of governance: Cloud Custodian at 10 and its role in the agentic AI era
• How to get engineering time back from Kubernetes upgrades

Hacker News (104)

• Show HN: LFK – A Fast Kubernetes TUI
• Show HN: Kunobi 1.0 – A local-first Kubernetes workspace for GitOps teams
• Getting Secret Management Right in Kubernetes
• C8s: A Confidential Kubernetes Architecture
• Kubernetes memory requests don’t do what you think (until you enable MemoryQoS)
• Kubernetes Networking Clicked When I Stopped Starting with Kubernetes
• Elastic Cloud on Kubernetes, simplified: zone awareness, restarts, and mTLS
• Show HN: X509-certificate-exporter – Prometheus exporter for TLS cert expiration
• What an “agent-native cloud” needs to look like
• Show HN: Headless Cloud Security – Headless SaaS has come to security
• Show HN: Personal Trainer – Lift, share plans, and rank with friends
• Slopsmith: A Self-Hosted Rocksmith Alternative That Runs in Docker
• Secrets at Rest: SOPS and Age for Docker Compose Homelabs
• Ask HN: Has any YC startup from the last 6–7 years scaled like Stripe or Docker?
• Show HN: Torrix, self hosted, LLM Observability,(no Postgres, no Redis)
• Show HN: GlycemicGPT – Open-source AI-powered diabetes management
• Show HN: Serene Bach – a Go weblog engine that runs as CGI or HTTP
• Show HN: Machine – per-project dev VMs with session-only secrets
• Show HN: SwarmWright, structured multi-agent AI defined in markdowns
• Show HN: Setup a box on demand and run your agent on it remotely
• Show HN: Duckflix, an open-source self-hosted media streaming platform
• Show HN: I built an anonymous social platform after fighting with LinkedIn’s API
• XS Programming Language
• Tell HN: Mindie.dev is scraping emails from profiles to send spam
• Show HN: Browser based sythesizer, drum machine and squencer
• Can you help reconcile my first/second-hand LLM Experience with HN’s Experience?
• Show HN: I spent $100 in Claude tokens and 1k battles training my AI tank
• Show HN: Get dopamine from real action instead of doomscrolling
• Show HN: Chuddy, self-hosted media downloading, translation and OCR Telegram bot
• Show HN: Objo Studio
• Show HN: PandoCast: open-source Pandora player to solve an annoyance I had
• Show HN: Incorporator, Turn any API/File into typed Python graph with pipeline
• Show HN: A Claude Skill to render resume templates. CV/Resumes are HTML and JSON
• Show HN: Swpui, a TUI for case-aware search and replace
• “The Prompting Company, Inc., All Rights Reserved”
• Show HN: Recursant, a mesh-based control plane for AI agents
• Bitcoin trader recovers wallet with help of Claude
• I let AI build a tool to help me figure out what was waking me up at night
• “Not Medically Necessary”: Helping America’s Health Insurers Deny Coverage
• MCP Hello Page
• Unknowable Math Can Help Hide Secrets
• What the Hell Was Going on with Cigarette Ads in the 70s? (2024)
• Datacenters slurping juice help drive 75% jump in PJM power prices
• Simplifying our homepage helped increase trial signups by 84%
• AI helps man recover $400k in Bitcoin 11 years after
• Apple’s Security Has Been Tough to Crack. Mythos Helped Find a Way In
• Ice vests or daily cold showers could help people lose weight, study finds
• FCC angers small carriers by helping AT&T and Starlink buy EchoStar spectrum
• Teens Helped Bring Malls Back to Life. Now They’re Getting Banned.
• Claude helped recover 5 BTC that was thought lost for 11 years
• Lawsuit accuses ChatGPT of helping gunman plan FSU mass shooting
• Show HN: Hermes-agentmemory, pull-model episodic memory with real deletes
• I used AI to help market my bagel shop. Then the one-star reviews came in
• Cars often keep people poor. Waymo could help
• Edith Eger, Auschwitz Survivor Who Helped Others Cope with Trauma, Dies at 98
• Use your Grok subscription in Hermes agent
• Anthropic’s Mythos helped find macOS bugs that bypass Apple security
• Escuelita Maker – a free 28-day online program to help people launch projects
• Show HN: I made a weird language and if you no think it dumb, I want your help
• Lawsuit Blames ChatGPT Maker OpenAI for Helping Plan a School Shooting
• Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
• Show HN: Agentic interface for mainframes and COBOL
• Show HN: Gigacatalyst – Extend your SaaS with an embedded AI builder
• Ask HN: What are you working on (non-AI)?
• Ask HN: Do you still spend time maintaining Claude.md / AGENTS.md files?
• Two Thousand Line educational operating system released by Cornell University
• Neanderthals drilled cavities to treat a toothache 59,000 years ago
• The latest X algorithm has been published to GitHub
• Neanderthals used stone drills to treat cavities 59k years ago, tooth suggests
• ‘News will find me’ mindset makes people trust algorithms and online networks
• 3months ago, I predicted OpenClaw wouldn’t uninstall cleanly and prepared for it
• Show HN: Needle: We Distilled Gemini Tool Calling into a 26M Model
• Ask HN: When did computers stop being fun?
• Show HN: GridTravel – A community based travel app for users to share routes
• Show HN: A Dark Cave – Minimalistic Graphics in the Age of AI Slop
• Ask HN: What’s the hardest part of building a SaaS that users keep paying for?
• Show HN: Infinite Swap – Trade a bottle cap up to a house
• Show HN: JDS – a Copilot skill suite for structuring AI coding behavior
• Show HN: VisiSign – $0.10 per envelope e-signatures with no monthly fee
• Show HN: We sent a humanoid robot to clean a stranger’s apartment in SF
• Show HN: ShaderKit – A browser GLSL editor I built for my own art
• Show HN: Mainline – a project tool with no backlog, story points or surveillance
• Show HN: Raybeam – A better way to screen share on macOS
• Show HN: Diom – Open-source back end primitives with no runtime dependencies
• Ask HN: Does anyone know what a monad is?
• Show HN: Cooklang Rich Preview
• Show HN: Vibe – Responsible AI Review for Cq (Stack Overflow for Agents)
• Ask HN: How do you deal with AI fatigue?
• Ask HN: Will writing code by hand remain a part of work?
• Five months after switching Fluxzy from Electron to Tauri
• Ask HN: I am 17 years old, which college should I apply if I have some projects?
• GitHub Copilot introduces flex allotments in Pro and Pro+, and a new Max plan
• A Firebase Mistake Led to a €3,167 AI Bill Overnight in My Flutter App
• Continuous lamination unlocks production of large-area flexible circuit boards
• GitHub Copilot individual plans: Introducing flex allotments
• Show HN: FLOX C++ trading systems framework with MCP
• Show HN: PileaX – AI Chat and note and book Library, all-in-one KnowledgeBase
• Trump’s More Than 3,700 Trades Astonish Wall Street Insiders
• Update on GitHub Copilot usage-based pricing
• JSON logging isn’t enough anymore: A deep dive into OTel Logs
• Grafana Labs internal source code accessed
• Show HN: I made an iOS app to gauge AI over-reliance and AI psychosis
• Launch HN: Ardent (YC P26) – Postgres sandboxes in seconds with zero migration
• Show HN: How we made MCP development feel good

Heise Cloud (9)

• Montag: Neue Digitalsteuer für Big-Tech, Meta-Smartglasses mit mehr Funktionen
• KI-Boom reicht nicht: Kalifornien plant Digitalsteuer für Cloud-Software
• Kommentar: Das Ende der SaaS-Gelddruckmaschine
• Google vs. Wildberger: Wie der Bund US-Konzerne aus Staatsaufträgen drängen will
• software-architektur.tv: John Romeros Prinzipien – mit Tom Asel
• C3A: Der neue BSI-Maßstab für souveräne Clouds im Überblick
• BSI aktualisiert C5-Kriterienkatalog für Cloud-Sicherheit
• Google Cloud: „Wenn Anthropic das richtige LLM hat, sollen Kunden Claude nutzen“
• Dienstag: Rechtsstreit zwischen Shein und Temu, Schweiz gegen US-Cloud-Dominanz

InfoQ Cloud Native (3)

• Cloudflare Introduces Workflows V2 with Deterministic Execution and 50K Concurrent Workflows
• Anthropic Launches Claude Platform on AWS
• Presentation: Evolution of a Backend for a Streaming Application

Kubernetes Blog (5)

• Kubernetes v1.36: New Metric for Route Sync in the Cloud Controller Manager
• Kubernetes v1.36: Mixed Version Proxy Graduates to Beta
• Kubernetes v1.36: Deprecation and removal of Service ExternalIPs
• Kubernetes v1.36: Advancing Workload-Aware Scheduling
• Kubernetes v1.36: PSI Metrics for Kubernetes Graduates to GA

Microsoft Open Source (1)

• Conductor: Deterministic orchestration for multi-agent AI workflows

The New Stack (26)

• The Mac mini just became infrastructure
• The clean-up cost of AI-generated code is what the velocity narrative leaves out
• GitHub takes aim at Claude Code and Codex with its new Copilot app
• Forward deployed engineer is AI’s hottest job as OpenAI and Google race to hire. Here’s how to become one.
• Why Block handed Goose to the Linux Foundation
• AWS found bugs in 60% of software requirements. Its fix isn’t more AI — it’s a 50-year-old logic engine.
• The software fix that could shrink AI’s energy bill without new hardware
• Why AI is failing in the security operations center
• The hidden cost of build vs. buy for agentic AI in regulated industries
• OpenAI brings Codex to the ChatGPT mobile app
• Cloud code: Conductor joins the rush toward remote coding agents
• GitLab is betting a 19th-century economic theory will shape its AI era
• Anthropic splits billing again: Agent SDK gets separate credit pools
• The Rust sidecar pattern that fixes Python AI’s biggest weakness
• Fivetran’s CPO: Closed data stacks won’t survive the agent era
• MinIO’s MemKV promises 95% better GPU utilization by ending AI recompute tax
• Red Hat’s skill packs give AI agents something a bigger model never could: 20 years of institutional memory
• Anthropic’s Claude Code agent view is a better dashboard. So why aren’t developers convinced?
• OpenAI’s Daybreak and Anthropic’s Glasswing have nearly identical benchmarks — and 3 of the same partners
• I tested OpenAI’s three claims about GPT-5.5 Instant, and only one fully held up
• Temporal hits 3,000 paying customers with its crash-proof workflow engine
• Why agent harnesses fail inside cloud-native systems
• Cimento emerges from stealth to secure the one thing no firewall can protect
• Cloud native application challenges: installing the walking skeleton
• How to build a skills library for your engineering team
• Why enterprise AI needs customization

← Back to Newsletter

This week in Cloud Native saw significant updates across the Kubernetes ecosystem, with several core features graduating to General Availability in Kubernetes v1.36. The increasing integration and impact of AI agents on development workflows and cloud operations also remained a prominent theme, alongside various security and observability enhancements in projects and platforms.

🚀 Notable Releases

CI/CD

• Argo CD v3.4.1 - This release aligns how Argo CD interprets Kubernetes cluster versions with Helm 3.19.0 behavior. This change impacts Application Sets with Cluster Generators that use argocd.argoproj.io/auto-label-cluster-info on cluster secrets.
• Argo CD v3.1.16 - This marks the final release of the 3.1 series, which reached end-of-life on May 6th, 2026. The project maintainers advise upgrading to a supported version (v3.2, v3.3, or v3.4) as this version will no longer receive bug fixes or security updates.

Container Runtime

• CRI-O v1.36.0 - This is a new stable release that includes updated dependencies and provides release bundles with SHA-256 checksums, cosign signatures, and SPDX bills of materials.
• CRI-O v1.35.3 - Includes features and other changes since v1.35.2.
• CRI-O v1.34.8 - Contains dependency changes and other updates since v1.34.7.
• CRI-O v1.33.12 - Features dependency changes and other updates since v1.33.11.

Registry

• Harbor v2.15.1 - Fixes the “Last Pull” time on parent/child artifacts and on creation, adds a User-Agent to all requests, and addresses an issue with proxy cache serving local content when remote is not found.
• Harbor v2.14.4 - Includes fixes for session regeneration arguments and lifetime, prevents background polling from renewing session TTL, and resolves an issue related to the scanner API.

Security

• KubeArmor v1.7.0 - Introduces DNS enforcement capabilities, including support for allow policies and audit logging for DNS activity.
• KubeArmor v1.6.19 - Addresses a bug where the liveness probe was not functioning by making it configurable via environment variables. It also fixes a bpflsm enforcer verifier issue and increases the livenessProbe timeout and failure threshold.
• Kubescape v4.0.8 - Includes fixes for back-propagating connector URLs to configObj during initializeCloudAPI and updates related to VAP timeout.
• Kubescape v4.0.7 - Contains fixes for portforwarder host trimming, and updates related to service discovery and exception expiration filters.
• Kubescape v4.0.6 - Provides fixes for the OPA processor, applying namespace filters in failedIDs pre-seed, surfacing rule evaluation errors, and resolving namespace filter issues for cluster-scoped resources.
• OpenFGA v1.15.1 - Reuses a single MySQL container across tests to improve performance and reduce resource usage. It also fixes a potential panic in command error handling, a bug propagating expected errors from list objects, and cache invalidation logic for the Check API.
• SeeBOM v0.3.2 - Releases container images signed with cosign (keyless) and attested with SLSA provenance.
• SeeBOM v0.3.1 - Releases container images signed with cosign (keyless) and attested with SLSA provenance.
• SeeBOM v0.3.0 - Releases container images signed with cosign (keyless) and attested with SLSA provenance.

Database

• Vitess v24.0.1 - This release includes 6 merged Pull Requests.
• Vitess v23.0.4 - This release includes 44 merged Pull Requests.

Storage

• Longhorn v1.11.2 - Introduces improvements and bug fixes aimed at enhancing system quality, resilience, stability, and security. This includes several critical stability fixes, such as a replica rebuild progress fix.

Orchestration

• Volcano v1.14.2 - Addresses security vulnerability CVE-2026-44247, which relates to a Webhook Server Out-of-Memory (OOM) issue due to unbounded HTTP request body size, along with multiple other bug fixes.
• Volcano v1.13.3 - Addresses security vulnerability CVE-2026-44247, which relates to a Webhook Server Out-of-Memory (OOM) issue due to unbounded HTTP request body size, along with multiple other bug fixes.
• Volcano v1.12.4 - Addresses security vulnerability CVE-2026-44247, which relates to a Webhook Server Out-of-Memory (OOM) issue due to unbounded HTTP request body size, along with multiple other bug fixes.

Configuration

• Baremetal Operator v0.13.0 - Introduces breaking changes by uplifting CAPI to v1.13.0-rc.1, k8s group to v0.35.4, and controller-runtime to v0.23.3. It removes the iRMC driver and deprecates BMH.Spec.Firmware. New features include allowing forced detachment of a host from Ironic, accepting per-host pull secrets for external OCI registries, and adding libvirt network creation and deletion to vbmctl.
• OpenYurt v1.7.0 - OTA (Over-The-Air) upgrade for DaemonSet workloads now supports image preheating. This shifts image pulling to an earlier phase than the Pod restart, which can reduce service downtime in edge environments with limited network connectivity.
• Meshery v1.0.20 - Bumps meshery/schemas to v1.2.15, fixes X-API-Key setting for the anonymous global token, and corrects the catalog path in DefaultLocalProvider.
• Meshery v1.0.19 - Bumps meshery/schemas to v1.2.13 and v1.2.12, fixes post-login redirect locally via cookie, replaces JSON schema-version bridges with typed copies, and standardizes event metadata keys to canonical camelCase.
• Meshery v1.0.18 - Fixes style hydration on evaluator-added components, ensures camelCase server metadata keys in payloads, pins docker/cli to v28.5.1 to match docker/compose/v2 v2.40.3, and clarifies design fetch/get/delete error messages.

Build

• Buildah v1.33.15 - Bumps Go Jose to v3.0.5 and addresses CVE-2026-34986.
• Buildah v1.29.8 - Bumps Go Jose to v3.0.5 and addresses CVE-2026-34986.
• Buildah v1.26.11 - Bumps runc to 1.2.9 to address CVE-2025-52881, CVE-2025-31133, and CVE-2025-52565. It also includes a fix for CVE-2025-47913 related to x/crypto and a minimum Go version bump.

Networking

• Gateway API monthly-2026.05 - This is the monthly release for the Gateway API experimental channel, incorporating the latest features and fixes from the project’s main branch.

Edge

• K3s v1.36.0+k3s1 - Updates Kubernetes to v1.36.0. Changes include the addition of a firewall section to check-config.sh and an update to golangci-lint.

📰 This Week in Cloud Native

This week, Kubernetes v1.36 introduced several features to General Availability, including Volume Group Snapshots and Declarative Validation for native types, enhancing data management and configuration reliability. Dynamic Resource Allocation (DRA) also saw updates with new features and drivers. For scalability, Server-Side Sharded List and Watch was introduced to help controllers manage high-cardinality resources in large clusters, while new admission policies prevent deletion of critical security configurations. In the broader ecosystem, Microcks became a CNCF incubating project, and Kyverno released version 1.18, its first update since graduating within the CNCF.

The integration of AI agents into development and operational workflows continues to be a focal point. Benchmarking efforts evaluated AI agent performance on Kubernetes bug fixes, and new tools emerged for securing GitHub Actions CI dependencies. Cloud providers are also adapting, with AWS introducing Trusted Remote Execution (Rex) for policy-enforced scripts and enabling AI agents to interact with legacy applications via WorkSpaces. DigitalOcean announced an AI-Native Cloud for production AI workloads, and Atlassian is leveraging AI agents for routine tasks. However, discussions also highlighted security concerns, such as potential remote bash command execution via ChatGPT and Claude web frontends, and the reported compromise of the Antrea Kubernetes networking project.

Observability and operational efficiency received attention, with ongoing discussions about the complexity of managing multiple observability stacks despite available tools like OpenTelemetry. AWS enhanced EKS Container Network Observability to track inter-AZ and NAT gateway traffic, providing insights for cost and performance optimization. Additionally, OpenYurt v1.7.0 introduced image preheating for DaemonSet OTA upgrades, aiming to reduce service downtime in edge environments by decoupling image pulling from Pod restarts. This week also saw several releases across projects like Harbor and Buildah addressing security vulnerabilities and dependency updates, reinforcing the continuous effort to maintain secure and stable cloud native infrastructure.

💬 Community Buzz

Hacker News discussions this week centered on the security and sandboxing of AI agents, with several new tools and approaches showcased for isolating agent execution environments. Kubernetes management and homelab setups were also recurring topics, alongside the broader implications of AI on software development jobs and workflows. Conversations also covered containerization technologies like Docker Compose in production and comparisons between WebAssembly and Docker images.

📊 Numbers of the Week

• Total stable releases: 31 across 15 projects
• Top 3 projects by commits this week:
  1. cockroachdb/cockroach — 259 commits
  2. meshery/meshery — 240 commits
  3. kubernetes/kubernetes — 181 commits
• Top 3 projects by merged pull requests this week:
  1. cockroachdb/cockroach — 203 merged PRs
  2. kubernetes/kubernetes — 111 merged PRs
  3. envoyproxy/envoy — 80 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 20

A complete list of all cloud native articles and news from this week.

AWS Containers (3)

• Gradual deployments in Amazon ECS with linear and canary strategies
• Cross-Region disaster recovery for Amazon EKS using AWS Backup
• Track inter-AZ and NAT gateway traffic with EKS Container Network Observability

AWS Open Source (1)

• Introducing Trusted Remote Execution: Policy-Enforced Scripts for AI Agents and Humans

CNCF Blog (5)

• Benchmarking AI agent retrieval strategies on Kubernetes bug fixes
• Microcks becomes a CNCF incubating project
• The tools are ready. So why are most cloud native teams still running three observability stacks?
• Announcing Kyverno release 1.18!
• Securing GitHub Actions CI dependencies: Recipe card

Hacker News (116)

• Show HN: KubeAstra–Open-source AI agent that debugs and recovers Kubernetes pods
• Popular Kubernetes Networking Project Antrea Compromised
• Kubeli – A modern, beautiful Kubernetes management desktop application
• Planning My Kubernetes Homelab
• Show HN: Shoehorn – Backstage without the maintenance overhead
• Toolkit for building declarative K8s operators
• DigitalOcean AI-Native Cloud for Production AI Workloads
• Qbeast 0.6: Multi-cloud SaaS, AI-native access, and faster queries
• Show HN: Runs AI coding agents inside isolated Docker containers
• I Like Using Docker Compose in Production
• Docker images are MB; a full game engine compiles to 35MB WASM
• Show HN: Bundlebase – Docker for Data
• Show HN: Armorer – A secure local control plane to sandbox AI agents in Docker
• Show HN: Agent-isolated remote envs with full Docker Compose support
• Access your Docker Compose services via easy-to-remember names
• Tor Onion Service with Docker Compose and Lighttpd
• Show HN: I indexed 8,643 BSides talks across 227 chapters and 6 continents
• Show HN: Ant – A from-scratch JavaScript runtime in 9 MB
• Show HN: Armorer – A secure local control plane for AI agents
• Show HN: Airlock – self-upgrading compiled AI agents
• Show HN: Download your resume.io resume as PDF without paying
• Show HN: An OTel exporter that posts the cause to your incident channel
• Tell HN: ChatGPT and Claude web frontends can run bash commands remotely
• Comparing Sandboxing Approaches for AI Agents
• 30x faster than Prometheus: How we rebuilt ES as a leading columnar datastore
• Show HN: 10K English words traced to 4 foundations(Space, Time, Energy, Pattern)
• Adobe’s ‘Modern’ User Interface Is Just Webpages – Pixel Envy
• Ask HN: Is there a term for feeling sad about forced AI adoption?
• Show HN: Blamo A vibecoded app for vibecoding vibe games
• Do I just forget everything I’ve learned?
• Ask HN: Would you tell your kids to learn to code?
• Show HN: Naval Strike – simultaneous turn-based fleet combat in the browser
• Show HN: Prospero Is Superpowers for Writing
• I’m looking for an AI Automation Engineer role or gig
• Show HN: Recursant, “Istio for agents”, is now open source
• Show HN: KI im Mittelstand oder KI-Frustration? inkl. Demo
• VC fired all analysts, is using AI to help run deals for its new $75M fund
• My first post scored 1. Karpathy’s autoresearch idea helped me repost
• DNA donors help identify Franklin expedition members
• Companies help parents try to pick their babies’ traits. Experts are wary
• Could Contact-Tracing Apps Help with the Hantavirus? Not
• Frontier models refuse to help organizers, so we built our own activist AI
• How Two Duke Alumni Helped Conservatives Take over the NEH
• 3D-printed house could help solve Japan’s construction crisis
• 10 years helping Rails devs reach App Store. Today, someone shipped without me
• Ask HN: Can you make money from writing short stories with the help of AI?
• Anthropic and FIS Are Building an AI Agent to Help Banks Police Financial Crimes
• Show HN: Full Python GUI apps in the browser – no JavaScript, no server
• Show HN: Free tool to mark points and polygon regions
• Ask HN: How to start up as an individual developer?
• Show HN: Crit – local review tool for agent plans and code diffs
• Show HN: I trained a chess engine to play like humans
• Reviewing in the Age of AI
• Show HN: The independent guide to agent orchestrators
• Reflections on NetBSD 11
• Show HN: LaoTzu Writer Studio
• Ask HN: Is the future everyone having 100 MCP processes running on their PC?
• Ask HN: Before Open Source took over the server, what was the discourse like?
• Ask HN: Can a tinnitus be triggered by high frequency noises?
• Show HN: Dreamwork – a job search site I made after Indeed fired my pregnant wif
• Show HN: Layers – AI skills for deep product design
• Show HN: SecretEnv – Run any process with secrets from all your backends
• Ask HN: Which LLM are you using to evaluate your ideas?
• Ask HN: How are you handling QA being bottlenecked with more AI-generated PRs?
• Show HN: wfb-link, a userspace WiFiBroadcast radio stack for macOS
• Cancelling Claude subscription renewal immediately revokes Design access
• Show HN: Ced – C REPL in 50 lines of POSIX shell
• Al-Khwarizmi didn’t in any way originate, invent or create the algorithm
• How long ago would the MacBook Neo be Apple’s fastest computer?
• Surprising Signs of an Atmosphere Around a Tiny World, Billions of Miles Away
• What If Ed Tech Peaked 200 Years Ago?
• Ask HN: We just had an actual UUID v4 collision…
• Show HN: I made a Clojure-like language in Go, boots in 7ms
• Show HN: Stage CLI – An easier way of reading your AI generated changes locally
• Show HN: GETadb.com – every GET request creates a DB
• Show HN: Create flashcards with Space CLI
• Ask HN: What do you still do manually in 2026 that should be automated?
• Ask HN: The death of software development as a job?
• Tell HN: Claude claims the AGPLv3 license violates it’s content policy
• Show HN: My AI agents bully each other to prevent context drift
• Show HN: Drawers – macOS has apps and files, but no projects
• So that’s why they call it “YOLO-mode”
• Show HN: Rudel – Claude Code / Codex sessions reveals 9 types of AI coder
• Show HN: Query months of HN discussions and comments as a knowledge graph
• I just sent out my first Quote as a business owner
• Ask HN: Former master-tech building AI systems – how to break into software?
• Show HN: A Codex/Claude Code plugin for persistent product context thru sessions
• Show HN: Capsule Bash – Sandboxed Bash for Agents
• Ask HN: What’s the most compelling paranormal evidence you found online?
• Show HN: Great Little Software – interviews with solo developers
• Show HN: Gulugulu, an old-style client-side search engine for the old weird web
• Recapping Cap Table?
• Show HN: Anycrap – REST API for 35k absurdist AI-generated products
• Show HN: NyaayWatch – Observability layer for the Indian judiciary
• Show HN: Looties – a marketplace for tech swag fans
• Show HN: Vibe-coding video games with Claude (Day 21: Blackjack)
• NPM UUID’s random number gen contains shared mutable state bug since 3 weeks
• A multiplayer poll where you have 10 seconds to answer
• Need Some Testers
• Richard Dawkins and the Claude Delusion
• Félix Guattari – The Image Machine (1990)
• Asami: A flexible graph store, written in Clojure
• Salary isn’t everything: Why flexibility to work remotely is the future of work
• Brembo’s fluid-free electronic braking system is coming to a car near you
• Y-Zipper: 3D Printing Flexible-Rigid Transitions in One Click [video]
• Flu a and B Viral Shedding in Adults Who Get Live Attenuated Flu Vax
• 3D Print Flexible–Rigid Transition Mechanism for Rapid and Reversible Assembly
• Fluctuating Accuracy in LLM Responses
• Show HN: Agent-evals – Claude skill to build your own evals
• Show HN: Replacing spec-driven development with just facts
• Ask HN:How’s you experience building an app on Cloudflare? (Workers, D1,R2 etc.)
• Show HN: MySigner – Ship iOS and Android apps with one command
• Show HN: Coding agents can control desktop software without MCPs
• Show HN: ‘Safari-Like’ 2-finger nav gesture for IntelliJ (Java Swing) on macOS
• ‘Microshifting’ puts a new spin on 9-to-5 schedules
• Gcx: A CLI for managing Grafana Cloud resources

Heise Cloud (11)

• Kärcher dampft zu Google Workspace: „Microsoft weitermachen wollte man nicht“
• UpdateAWS-Ausfall in den USA legt Coinbase lahm
• Atlassian: KI-Agenten übernehmen die Routinearbeit
• iCloud-Lock-in: Apple droht weiter Milliardenstrafe in Großbritannien
• La Suite Docs 5.0.0: Neue API, Bruch mit alten Clients
• AWS öffnet seine Cloud für KI-Agenten
• AWS WorkSpaces: KI-Agenten steuern Legacy-Apps
• Teams-Alternativen: Diese Videokonferenz-Tools bietet der europäische Markt
• IT Summit 2026: heise-Konferenz zu Digitaler Souveränität
• Xbox-Games streamen: So geht’s auf Apple-Geräten
• Sovereignty Washing: Wie man Cloud-Souveränität wirklich bewertet

Kubernetes Blog (5)

• Kubernetes v1.36: Moving Volume Group Snapshots to GA
• Kubernetes v1.36: More Drivers, New Features, and the Next Era of DRA
• Kubernetes v1.36: Server-Side Sharded List and Watch
• Kubernetes v1.36: Declarative Validation Graduates to GA
• Kubernetes v1.36: Admission Policies That Can’t Be Deleted

The New Stack (26)

• Why 157,000 developers are hedging against Anthropic with OpenCode
• Claude can now follow users across Outlook, Word, Excel, and PowerPoint
• Why Prometheus couldn’t see Cilium metrics at 2 a.m.
• Anthropic puts the “myth” in Mythos with its HackerOne bug bounty program
• The attack surface moved inside the agent. So did Arcjet.
• Tanzu Platform’s 15-year head start meets the AI moment
• Datadog and T-Mobile leaders reveal the reality of deploying AI agents in production
• How Anthropic and Elon Musk cornered Sam Altman this week
• OpenAI Codex arrives in the browser with new Chrome extension
• “Several known limitations”: Developers react to Cursor’s promising but still-moving SDK
• AI startups are scrambling to survive in big tech’s shadow
• “The terminal still matters”: Amp rebuilds its CLI for an agentic future beyond the command line
• Anthropic recruited SpaceX’s 220,000-GPU Colossus 1 to fix what Claude users kept complaining about
• How Microsoft is governing thousands of Kubernetes clusters without manual intervention
• Temporal reveals a serverless option for its Durable Execution platform
• OpenAI brings GPT-5-level reasoning to its speech models
• Elastic architects reveal how to query observability data in plain English
• I tested the new OpenAI Codex features on a real Python codebase, and it’s the strongest Claude Code rival yet
• GitHub builds an immune system for AI coding agents running on MCP
• With the launch of Meko, Yugabyte targets the data layer that’s breaking multi-agent AI systems
• The introverts’ edge: How AI is leveling the developer floor
• How a Cursor AI agent wiped PocketOS’s production database in under 10 seconds
• Why long-running AI agents break on HTTP and how Ably is fixing it
• Anthropic will let its managed agents dream
• Developers will use whatever AI coding tool they want. ServiceNow is building for that reality.
• Why Atlassian is letting Claude Code into its own data graph

← Back to Newsletter

This week in Cloud Native saw significant security updates across several projects, including critical fixes for Argo CD, Prometheus, and SPIFFE/SPIRE. Kubernetes v1.36 introduced new alpha and beta features for resource management and controller observability. Discussions also focused on the increasing integration of AI agents within cloud native environments and their associated security and operational considerations.

🚀 Notable Releases

Security

• Argo CD v3.3.9 - Contains a security fix for a critical vulnerability (GHSA-3v3m-wc6v-x4x3).
• Argo CD v3.2.11 - Contains a security fix for a critical vulnerability (GHSA-3v3m-wc6v-x4x3).
• Kyverno v1.18.0 - Adds configurable blocklist and scoped token authorization for HTTP context loading and introduces support for namespaced secrets and pod-level references for image registry credentials.
• Open Policy Agent v1.16.1 - Addresses a regression in the plugin manager that could cause the service to hang on shutdown.
• Open Policy Agent v1.16.0 - Introduces uri.parse and uri.is_valid built-in functions, adds data API request/response metadata, and exports Prometheus metrics via OTLP. The release notes advise users to upgrade directly to v1.16.1 due to a plugin manager regression.
• Prometheus v3.11.3 - Fixes multiple security issues, including a remote-read snappy decode vulnerability, an AzureAD OAuth client_secret exposure, and an old UI XSS vulnerability.
• Prometheus v3.5.3 - Fixes multiple security issues, including a remote-read snappy decode vulnerability, an AzureAD OAuth client_secret exposure, and an old UI XSS vulnerability.
• SPIFFE/SPIRE v1.14.6 - Fixes an issue in the aws_iid server node attestor plugin where an attacker could impersonate EC2 instances during node attestation.
• SPIFFE/SPIRE v1.13.6 - Fixes an issue in the aws_iid server node attestor plugin where an attacker could impersonate EC2 instances during node attestation.
• Backstage v1.50.4 - Contains security fixes for @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities-common version, and @backstage/plugin-catalog-unprocessed-entities.
• Kubewarden Controller v1.35.0 - Fixes a security vulnerability (GHSA-wqcw-g35j-j578) and adds a host-capabilities whitelist feature.
• Kuma v2.13.5 - Fixes localhost admin authentication, addresses KDS mux client reconnection issues, and deduplicates access logs for shared inbound ports.
• Kuma v2.12.10 - Fixes localhost admin authentication, addresses KDS mux client reconnection issues, and deduplicates access logs for shared inbound ports.
• Kuma v2.11.13 - Fixes localhost admin authentication, addresses KDS mux client reconnection issues, and deduplicates access logs for shared inbound ports.
• Kuma v2.9.15 - Fixes localhost admin authentication, addresses KDS mux client reconnection issues, and deduplicates access logs for shared inbound ports.
• Kuma v2.7.25 - Fixes localhost admin authentication, addresses KDS mux client reconnection issues, and deduplicates access logs for shared inbound ports.
• Distribution v3.1.1 - Fixes CVE-2026-41888, bounds-checks the file basename in PurgeUploads Walk callback, adds S3 Express One Zone support, and fixes the tag list endpoint in proxy mode.
• External Secrets v2.4.1 - Supports multiple replicationLocations on PushSecret for GCP.
• External Secrets Helm Chart v2.4.1 - Updates the Helm chart for external secrets management.
• Kubernetes-sigs/secrets-store-csi-driver v1.6.0 - Replaces the dedicated secret rotation controller with the CSI RequiresRepublish mechanism, causing kubelet to re-fetch secrets from the provider when rotation is enabled.
• Skopeo v1.14.6 - Bumps Go Jose to v3.0.5 to address CVE-2026-34986 and fixes an issue where listing tags in JFrog Artifactory could fail.
• OpenFGA v1.15.0 - Implements edge pruning in the list objects pipeline algorithm, which improves request latency for complex authorization models. It also fixes the experimental weighted_graph_check query cache being skipped.

Container Runtime

• containerd v2.3.0 - Focuses on stability, new features, and improvements. It marks the first annual LTS release under a new schedule aligned with Kubernetes releases, offering extended support.
• containerd API v1.11.0 - Adds transfer types for container filesystem copy and updates the sandbox API to include a spec field. It also adds os.features support for EROFS native container images.

Orchestration & Cluster Management

• Karmada v1.17.2 - Contains bug fixes and improvements; refer to the changelog for details.
• Karmada v1.16.5 - Contains bug fixes and improvements; refer to the changelog for details.
• Karmada v1.15.8 - Contains bug fixes and improvements; refer to the changelog for details.
• Kubernetes-sigs/cluster-api v1.13.1 - Adds support for Management Clusters v1.32.x to v1.36.x and Workload Clusters v1.30.x to v1.36.x. It also includes dependency updates.
• K3s v1.35.4+k3s1 - Updates Kubernetes to v1.35.4 and includes flannel v0.28.4.
• K3s v1.34.7+k3s1 - Updates Kubernetes to v1.34.7 and includes flannel v0.28.4.
• K3s v1.33.11+k3s1 - Updates Kubernetes to v1.33.11 and includes flannel v0.28.4.

Databases

• etcd v3.6.11 - Contains bug fixes and improvements; refer to the changelog for details.
• etcd v3.5.30 - Contains bug fixes and improvements; refer to the changelog for details.
• etcd v3.4.44 - Contains bug fixes and improvements; refer to the changelog for details.
• Vitess v24.0.0 - Introduces window function pushdown for sharded keyspaces, view routing rules, tablet targeting via USE statement, VTGate Binlog Streaming support, and structured logging.
• CrateDB v6.2.7 - Contains bug fixes and improvements; refer to the release notes for details.

Messaging

• Dapr v1.17.6 - Fixes an issue where pub/sub messages were incorrectly routed to the dead-letter queue during graceful shutdown or hot-reload of a pub/sub component.
• NATS Server v2.14.0 - Adds feature flags in the server configuration and introduces fast-ingest batch publishing for JetStream. Requires Go 1.26.2.
• NATS Server v2.12.8 - Refactors and simplifies setting pinned headers in consumers and improves scanning for the starting sequence for consumers in JetStream. Requires Go 1.25.9.
• NATS Server v2.11.17 - Fixes reload logic on gateways. Requires Go 1.25.9.
• Strimzi Kafka Operator v1.0.0 - Removes support for the v1beta2 API; only the new v1 CRD API is supported. Upgrades require conversion of custom resources and CRDs.

Observability

• OpenCost v1.120.1 - Corrects lookup fallbacks, provider detection, and network support for Carbon. It also makes MCP server opt-in by defaulting MCP_SERVER_ENABLED to false and adds an AWS Spot Price History API caching layer.
• OpenTelemetry Collector v0.151.0 - Changes replace statements in the generated Collector Go module to use relative paths by default, which may affect existing build use-cases.

Storage

• Rook v1.19.5 - Grants scc to the rook-ceph-nvmeof service account, removes newlines from liveness probe scripts, adds Helm ownership annotation to CSI resources, and fixes CRUSH device class not being applied during OSD re-discovery.

Application Frameworks

• KServe v0.18.0 - Includes updates to the build process, fixes for Helm chart packaging, and refactoring for endpoint testing and chart naming.
• Fermyon Spin Canary - A canary release reflecting recent commits on the main branch, intended for developers to preview features that may not be fully implemented.

Configuration

• Meshery v1.0.17 - Fixes server authentication for shutdown deregister and logout, and addresses a nil pointer dereference in processEvaluationResponse.
• Meshery v1.0.16 - Prevents ProviderUIHandler from emitting an empty meshery-provider cookie.
• Meshery v1.0.15 - Addresses a redirect loop in enforced-provider mode for /user/login and /provider endpoints, and updates github.com/meshery/schemas to v1.2.6.
• Meshery v1.0.14 - Promotes raw error passthroughs to MeshKit codes and includes various server-side chore tasks.

📰 This Week in Cloud Native

The integration of Artificial Intelligence (AI) into cloud native ecosystems was a prominent theme this week. Multiple reports and discussions highlighted the increasing presence of AI agents in development workflows and operational environments. Concerns were raised regarding the security implications of autonomous AI agents, particularly their ability to find and exploit zero-day vulnerabilities, prompting calls for robust sandboxing mechanisms and enhanced security measures within Kubernetes. The CNCF also released initial data on AI’s impact on open-source development, indicating growing adoption and exploration within cloud native projects.

Kubernetes itself saw updates with announcements for v1.36 features. This includes the introduction of Pod-Level Resource Managers as an alpha feature, designed to provide more granular resource control. In-Place Vertical Scaling for Pod-Level Resources graduated to Beta, allowing dynamic adjustment of container resources without restarting pods. Other v1.36 features include updates to Memory QoS for tiered memory protection and improvements to staleness mitigation and observability for controllers. The ability to modify container resource requests and limits in pod templates for suspended Jobs also moved to beta.

💬 Community Buzz

📊 Numbers of the Week

• Total stable releases: 50 across 22 projects
• Top 3 projects by commits this week:
  1. meshery/meshery — 321 commits
  2. cockroachdb/cockroach — 311 commits
  3. kubernetes/kubernetes — 123 commits
• Top 3 projects by merged pull requests this week:
  1. cockroachdb/cockroach — 208 merged PRs
  2. cilium/cilium — 87 merged PRs
  3. meshery/meshery — 81 merged PRs

📚 View all articles from this week →

📚 All Articles

📚 All Articles from Week 19

A complete list of all cloud native articles and news from this week.

AWS Compute (2)

• Enhancing network observability with new AWS Outposts racks LAG metrics
• Serverless ICYMI Q1 2026

AWS Containers (2)

• Simplify hybrid Kubernetes networking with Amazon EKS Hybrid Nodes gateway
• Implement SPIFFE/SPIRE authorization on Amazon EKS

CNCF Blog (3)

• AI sandboxing is having its Kubernetes moment
• The state of AI in CNCF projects: A first look at the data
• Kubernetes for platform teams: Leveraging k0s and k0rdent

Hacker News (128)

• K3k: Kubernetes in Kubernetes
• Our agent found a bug with WireGuard in Google Kubernetes Engine
• Kubereboot/Kured: Kubernetes Reboot Daemon
• Radar: Local-first Kubernetes UI in a single Go binary
• Show HN: ClusterdOS – Kubernetes without the platform team
• C8s: A Confidential Kubernetes Architecture
• Rusternetes : A ground-up reimplementation of Kubernetes in Rust
• Show HN: Superkube - Rewriting Kubernetes in Rust
• Show HN: C# based Kubernetes Operator to deploy SurrealDB
• TypeKro: Write TypeScript. Deploy Kubernetes
• Ask HN: Enterprise Agent Orchestration Recommendations?
• AliothPress – self-hosted, cloud-native CMS with a wizard-based installation
• Show HN: Rocky – Rust SQL engine with branches, replay, column lineage
• Show HN: Lssh – Terminal-native remote access suite for SSH and cloud targets
• Show HN: Ramble, iOS voice notes that send webhooks
• Show HN: Snitchmd – Cloudflare-protected URLs into clean Markdown via Docker
• Show HN: DD Photos – static photo albums, now with Docker and 1-command deploy
• Should I Run Plain Docker Compose in Production in 2026?
• Docker 29 has changed its default image store for new installs
• Docker vs. Podman: Which Containerization Tool Is Right for You – DataCamp
• Show HN: Piruetas – A self-hosted diary app I built for my girlfriend
• Show HN: LavinMQ, an open-source message broker written in Crystal
• Show HN: Bhatti – Self-hostable Firecracker orchestrator with auto pause/wake
• Why Codex works better than Claude Code for my production monolith
• Show HN: A Multi User Multi Task Board MCP Server
• Show HN: AgentPort – Open-source Security Gateway For Agents
• Show HN: My OSINT dashboard with 60+ feeds now has a pseudonymous P2P comms
• Show HN: Self hosted video feed for children
• Show HN: Integrations gateway for agents with 2FA for destructive ops (OSS)
• Ask HN: How do you self-host your apps?
• Show HN: ToolMesh – turn all your REST APIs into MCP tools via declarative YAML
• Rvidia-exporter – Prometheus metrics exporter for Nvidia GPUs
• Spain Approves Regularization Process for Migrants Residing in the Country
• Southwest Headquarters Tour
• Show HN: My retired dad and I made a daily, somewhat difficult, quiz
• Show HN: SimDrive – a browser racing game with your phone as the controller:D
• Show HN: Omar – A TUI for managing 100 coding agents
• Ask HN: How do you feel about AI assisted blogging?
• The Isolator (Helmet)
• HERMES.md in commit messages causes requests to route to extra usage billing
• Letting AI play my game – building an agentic test harness to help play-testing
• Welcome to Hell Developer
• Show HN: I built a tool that helps predict HN front page success
• Automating Hermitage to see how transactions differ in MySQL and MariaDB
• Hermit – uniform tooling for Linux and Mac
• Who’s on call? How Opus 4.6 helped us calculate this 2,500x faster
• Ask HN: Where can I go to ask for help?
• Show HN: Hello, World in many different languages
• ChatGPT/Gemini can now draw on your screen to help you navigate complex software
• Mayo Clinic AI helps specialists detect pancreatic cancer up to 3 years early
• My $5K smart bed needs to shut the hell up
• California man uses elaborate drone show to help delivery drivers find his house
• Encrypted Client Hello (ECH) Is Done, but Can We Make It Work?
• “Slow Metabolism” May Help Explain High Dieting Failure Rates
• Vibecoded my dream game, GeoGuesser for guns, now its helping with student bills
• Help a fellow dev on AI-localization?
• Scientists Develop Bioengineered Chewing Gum That Could Help Fight Oral Cancer
• About St Helena, in the South Atlantic Ocean
• B.C. researcher taps magic of Dungeons and Dragons to help kids
• AI could help human scientists pick promising research topics
• Help me to find cure for my brother (thalassemia)
• My Agent Memory Library Helps Write Indie Articles
• Don’t fly if you can help it
• Professor’s bold prediction: AI could help cure all diseases within a decade
• Ask HN: Please, I need your help to try out an iOS app I work on
• Birdora – a calm app to help you notice birds around you
• Show HN: Drive any macOS app in the background without stealing the cursor
• Show HN: State of the Art of Coding Models, According to Hacker News Commenters
• Show HN: Adblock-rust Manager – Firefox extension to enable the Brave ad blocker
• Show HN: AI CAD Harness
• Ask HN: Who wants to be fired? (May 2026)
• Show HN: Large Scale Article Extract of Newspapers 1730s-1960s
• Show HN: I built a RISC-V emulator that runs DOOM
• Show HN: Memory Safe Argon2 Implementation in Pure Swift 6
• AI Self-preferencing in Algorithmic Hiring: Empirical Evidence and Insights
• Neanderthals ran ‘fat factories’ 125k years ago (2025)
• New copy of earliest poem in English, written 1,3k years ago, discovered in Rome
• Supreme Court to hear arguments in landmark Roundup weedkiller case
• Advanced Quantization Algorithm for LLMs
• A more efficient implementation of Shor’s algorithm
• Show HN: WeSearch – Anonymous news aggregator with no algorithm, 700 sources
• Show HN: 1990s Game Dev Algorithms for Distributed Systems
• Milei Ends Argentina’s Deficit After 123 Years – Global Finance Magazine
• Ask HN: GitHub flagged my org two weeks ago. No reason given, no appeal response
• Kon-Tiki Set Sail 79 Years Ago Today
• Regression: malware reminder on every read still causes subagent refusals
• Show HN: DAC – open-source dashboard as code tool for agents and humans
• Show HN: Agent-desktop – Native desktop automation CLI for AI agents
• Show HN: Pu.sh – a full coding-agent harness in 400 lines of shell
• Tell HN: An update from the new Tindie team
• Show HN: Site Mogging
• Show HN: Mljar Studio – local AI data analyst that saves analysis as notebooks
• Show HN: Filling PDF forms with AI using client-side tool calling
• Tell HN: One Medical Is a Nightmare
• Ask HN: Will hardware ever be cheap again?
• Show HN: I built a dual crossword puzzle where two crosswords share one grid
• Why don’t AI coding tools like REST?
• Show HN: Software Engineer to Novelist: Writing a Book Like Coding
• The “just build it with Claude” paradox
• Show HN: Parrot – a fun, skeuomorphic audio recorder to hear yourself
• GitHub Copilot is moving to usage-based billing and retiring annual plans
• $38k AWS Bedrock bill caused by a simple prompt caching miss
• My friends left me because I told them I was a furry
• Show HN: Vibe-coding video games with Claude (Day 14: Tetris)
• Ask HN: Rant, Am I bad or is this a company with a poor tech culture?
• Ask HN: What does your agentic software dark factory look like?
• Show HN: Can a person’s chess mind outlive them? An attempt with 41 masters
• Show HN: I made a simulator for personal finance (5 year update)
• Show HN: Herald – Local-first terminal email client
• Show HN: Shuck – a fast shell linter written in Rust
• Ask HN: Is there any good open-source alternative to MinIO?
• Make HN great again: Neovim vs. IDEs
• Richard Dawkins and the Claude Delusion
• Flue is a TypeScript framework for building the next generation of agents
• Santa Cruz restaurant changes logo after flurry of negative reviews for AI art
• Flue Sandbox Agent Framework
• Realtime Faux-Raytraced Interactive 125,000 hair particles on Web
• Monero is simpler, Zcash is more flexible
• Body motion linked to fluid movement in the brain
• Show HN: I made a website to clean up recipe websites
• Show HN: Bumpy – versioning/changelog tool, fixed 120 open changesets issues
• Ask HN: Will fixed applications become a thing of the past with agentic AI?
• Show HN: Harness – Manage parallel Claude Code agents across Git worktrees
• Ask HN: Macbook or Linux Laptop for devs and heavy users?
• Which (tech) companies have the best work life balance?
• OpenAI has effectively abandoned first-party Stargate data centers
• Dutch central bank ditches AWS and chooses Lidl for European Cloud
• Agentic AI made DevOps and Agile obsolete

Heise Cloud (15)

• Ethical Hacking für Fortgeschrittene – sich selbst hacken, bevor es andere tun
• KI-Agent löscht Daten: Katastrophe für PocketOS
• CODE-DE Lab: Deutschland startet zentrale Cloud-Plattform für Satellitendaten
• Nach Drohnenangriff: AWS schwört Nahost-Kunden auf lange Ausfallzeit ein
• Storage, Server, Network: Call for Proposals für Konferenz S2N verlängert
• Mistral AI: Neues Sprachmodell Medium 3.5 und Cloud-Coding-Agenten
• Souveräner Bezahldienst Wero klebt noch an AWS, aber gelobt Besserung
• Donnerstag: Googles KI-Suche als Umsatztreiber, Speicherkrise belastet Microsoft
• Microsoft steigert Einnahmen weiter, aber Speicherkrise verteuert Rechenzentren
• Google erweitert Gemini in Deutschland um Personalisierungsfunktionen
• Tauziehen um Behörden-Cloud: Google verzögert deutsche Souveränitätspläne
• Datev: Anwendungen seit Dienstagmittag gestört
• Microsoft stopft Lücke mit Risiko-Höchstwertung in Entra ID
• PaaS-Komfort auf eigener Infrastruktur mit Open-Source-Tool Coolify umsetzen
• Google Cloud zieht bei KI-Kosten die Notbremse