Kubernetes v1.37 arrived

The final release has happened and was officially announced in the project's blog tonight. Its codename is Garhwal, a Himalayan region of Uttarakhand, India. As always, it comes with lots of new features, which are described in the formal announcement linked above and other articles we mentioned here before.

#news #releases

Happy to share our newest selection of interesting Kubernetes-related articles to consider for reading during this year's last summer weekend:

1. "Nginx vs Caddy vs Traefik in 2026 — I Ran All Three Under Real Production Load" by Yusuf Seyitoğlu.

A logistics client ran ingress-nginx on EKS for four years. Fine until it wasn’t supported. They asked me to compare Nginx (F5 NIC), Caddy, and Traefik on the same cluster before picking a path forward. Same twelve microservices. Same cert issuer. Same load tests. I ran each as the edge for six weeks.

2. "From intent to enforcement: Lessons from operating Kubernetes controllers at scale" by Sri Saran Balaji Vellore Rajakumar and Jayanth Varavani, AWS.

Kubernetes controllers are what make the platform’s declarative model real. They observe the state, reconcile toward the intent, and keep doing so as the system changes beneath them. At larger scales, though, the hardest problems are no longer about writing the reconcile loop. They are about preserving correctness while caches lag, objects churn, and enforcement depends on a complete view of the world. This post distills what we learned from operating two critical controllers in Amazon EKS at scale.

3. "Shipyard: How We Built Slack’s Next-Generation EC2 Platform" by Archie Gunasekara, Slack.

Service-level deployments were tricky, infrastructure drift was inevitable, and coordinating changes across multiple layers added complexity. Containers solved this for some classes of workloads, but not everything could migrate easily. We needed a new approach—one that brought modern deployment practices like immutability, progressive rollouts, and automated safety directly to EC2 instances.

4. "Where did those 800 pods come from?" by Tibo Beijen.

Recently I merged a pull request that was like any other pull request. But things unfolded quite differently. Things didn’t break, but could have. Things shouldn’t have happened, but did. The typical unlikely combination of factors, involving Argo CD ApplicationSets and mysterious AWS EKS Fargate nodes, resulting in some head-scratching, troubleshooting and interesting take-aways.

5. "Optimizing Kubernetes pod deployments for reliability with topology spread constraints" by Andre Newman, Gremlin.

Pod distribution plays a much bigger role in reliability than you might think. Fortunately, it’s easy to control when, where, and how Kubernetes distributes pods. By adding a few lines to your manifest, you can ensure your deployments are zone-redundant and evenly scalable. The feature is called topology spread constraints, and in this blog, we’ll explain how it works in full detail.

6. "How Kubernetes probes work" by Sam Rose, ngrok.

I’m going to show you, really show you, how probes work in Kubernetes. How they can make your application more resilient, and how they can help you prevent avoidable mistakes. Like restart loops that take hours to recover from, and dropping requests during rollouts. Every interactive demo in this post uses webernetes, my partial port of Kubernetes to TypeScript.

7. "Building an AI factory on Kubernetes" by Hrittik Roy, vCluster.

An AI factory is not just a model or a cluster. It is a pool of GPUs that many teams draw from at once: one team fine-tuning, another serving inference, a third running evaluations, all on the same accelerators. NVIDIA frames it as “infrastructure for the full AI lifecycle, from data preparation through training, fine-tuning, and high-volume inference”. In an enterprise that means one fleet, many teams, and different quotas, policies, and trust boundaries layered on top. The hard question is no longer how to train a model. It is how to give every team safe, isolated access to the same expensive hardware without anyone stepping on anyone else.

#articles

k8gb v1.0.0

k8gb, a Kubernetes Global Balancer, originated at Absa Group. More than six years have passed since the first whiteboard session in Johannesburg, conducted by Yury Tsarev and Bradley Andersen, both employed by this company at the time. In 2021, k8gb was accepted into the CNCF Sandbox, and earlier this year, as we mentioned recently, it became a CNCF Incubating project.

Yesterday, right during its 100th community meeting, the k8gb maintainers pushed the v1.0.0 release. This update highlights a significant milestone in the project's maturity.

#releases #cncfprojects #networking

We all know (and many of us use daily) k9s as a truly flagship CLI tool for Kubernetes. But what if someone were to reimagine it today?

Meet sofka, which reimplements a well-known tool using one generic object pipeline (instead of separate structs for each resource type) and Rust. It performs better and offers lots of features you might need, including:

- Powerful keyboard-based navigation with curated columns, custom views, drill-down navigation, horizontal scrolling, global fuzzy find, compact mode, and mouse support.
- Powerful metrics and health support, covering Pod health, live CPU and memory values, workload health at a glance, evidence-based explanation for unhealthy resources, hierarchical Xray view, watch notifications, and more.
- Extended diagnostic capabilities with incident bundles and snapshots capturing the current table view.
- Embedded Helm and GitOps integration.
- Various executable actions, such as file transfers, debugging containers and Pods, exploring PVC contents, and right-sizing requests.

What makes it different from k9s? Built-in Flux CD and Argo CD support, port-forwarding running in the background, bulk actions with multiselect, skins (12 are available), and more.

▶️ GitHub repo
 
Language: Rust | License: Apache 2.0 and MIT | 672 ⭐️

#tools #CLI

Karmada became a CNCF Graduated project

Karmada extends the standard Kubernetes API, allowing orchestration of applications across multiple clusters, clouds, and regions without modifying the apps themselves. Earlier this month, the CNCF Technical Oversight Committee (TOC) voted to graduate Karmada, and the decision was formally announced on the CNCF blog now.

Karmada originated in Huawei and was publicly announced at the Huawei Developer Conference 2021. It was accepted into the CNCF Sandbox in September 2021 and promoted to the Incubating level in December 2023. Today, Karmada adopters include Alibaba Cloud, Bloomberg, Huawei, Trip.com, Vivo, and Wellhub.

#news #cncfprojects

Talos gets a hypervisor, and Sidero Labs joins Yardi

Big news arrived for Talos Linux, a well-known Open Source operating system designed for Kubernetes. First, this project adds a hypervisor to run virtual machines. Interestingly, their solution is not based on KubeVirt. The authors say that requiring "Kubernetes just to run VMs" is an "unnecessary complexity", so they "brought native hypervisor capabilities into Talos Linux" (based on KVM). It will be Open Source. Talos Hypervisor launch (the alpha release and a public demo) will take place during TalosCon 2026, which will be held on October 15-16 in Amsterdam. Its general availability is expected in December.

Secondly, Sidero Labs, the commercial company behind Talos, joins Yardi. It's a US-based software business focused on the real estate industry, with 10k+ employees across 40+ offices worldwide. As Sidero Labs outlines, it will continue to operate as a standalone company, and Talos Linux will remain fully Open Source under the same license (MPL 2.0).

#news #virtualisation

Sharing the latest version of our curated digest showcasing prominent software updates in the Cloud Native ecosystem!

1. Argo Workflows, a workflow engine for orchestrating parallel jobs on Kubernetes (a part of Argo, a CNCF Graduated project), released its 4.1, which added 31 new features. They cover OpenTelemetry traces for the controller and executor, Kubernetes DRA support, Pod-level requests and limits, initless Pods, streaming save path for artifact drivers, database authentication via AWS RDS IAM and Azure PostgreSQL Entra ID, MariaDB support, workflow-level executor plugin configuration, and more.

2. Prometheus (a CNCF Graduated project) released 3.14.0 with PromQL duration expressions enabled by default and first_over_time promoted to stable, Oracle Cloud Infrastructure compute service discovery, and experimental support for encoding start timestamps in histograms.

3. Crossplane (a CNCF Graduated project) released 2.4.0, which added watching the resources required by each XR, zero replicas for just-launched safe-start provider runtimes (until they become active), vulnerability-scannable container images, hardening across composition and package paths, and version-aware documentation search

4. Strimzi, a Kafka operator for Kubernetes (a CNCF Incubating project), has seen its 1.2.0 with Apache Kafka 4.3.1 support, templated (per Pod) additional volumes, eliminated auto-mounting of Service Account tokens into Pods, server-side apply becoming GA, and more updates.

5. Open Policy Agent (a CNCF Graduated project) released v1.20.0, featuring new Rego keywords (and and or) for combining conditions inside a single rule body as well as dozens of other improvements across the project's whole ecosystem.

6. Istio (a CNCF Graduated project) reached 1.31.0. This release added a GatewayClass for deploying agentgateway as a waypoint proxy, Gateway API AllowInsecureFallback feature implementation for client certificate validation, weighted waypoint canaries, zone-aware load balancing, mesh-wide default traffic policy, FIPS 140-3 compliance policy, ztunnel CPU-aware worker threads, multi-target Prometheus scraping, and many more new features.

7. Inspektor Gadget, a set of tools and framework for inspecting Kubernetes clusters and Linux hosts using eBPF (a CNCF Sandbox project), was updated to v0.56.0. It introduced experimental support for Kubernetes multi-tenancy (based on namespaces), rootless ig image commands, and switching to kubelet's /сonfigz for container runtime socket auto-detection.

#news #releases

Skaffold ceases to exist

Skaffold is a CLI tool from Google designed for local development of Kubernetes applications. It has been around since 2018. According to the Slack announcement posted last month, the project won't be maintained anymore, and its GitHub repo will be archived starting January 15, 2027.

#tools #news

KubeVM from VMware Tanzu joins CNCF Sandbox

Tanzu, VMware's Kubernetes platform, has a VM Operator project that enables virtual machine management via a Kubernetes-style declarative API. It brought to life another project called KubeVM, which was developed in a separate branch of its repo and implemented “a vendor-neutral Kubernetes API for managing the full lifecycle of virtual machines on any hypervisor, implemented through pluggable providers.”

How is it different from KubeVirt? Here's how the KubeVM authors explain: “KubeVM leaves the VM as a native object of the underlying platform and uses Kubernetes as the API surface, delegating placement, migration, and storage to that platform. The two answer the same question for different starting conditions: Kubernetes as the only infrastructure layer, versus Kubernetes as a front door to an existing one. The relationship is intended to be integration: a KubeVirt provider is on KubeVM's roadmap, so the portable API can run on KubeVirt.”

A month ago, KubeVM applied to joining the CNCF Sandbox. A few days ago, the project was accepted by the CNCF TOC.

#news #cncfprojects #virtualisation

Agent Orca, a Kubernetes-native platform for managing AI agents

A few days ago, Matthew Fisher, solutions architect at NVIDIA, announced an Open Source project called Agent Orca. It's a platform for deploying, managing, and running AI agents in Kubernetes at scale. It allows you to use K8s resources to "declaratively define agents, route them to the correct LLM, equip them with tools, and execute them as one-off jobs or long-running services with checkpoints, cost tracking, guardrails, and RAG built in."

There's a quick-start manual for giving Agent Orca a try, seven demos, and quite extensive documentation for both developers and operators.

▶️ GitHub repo
 
Language: Go | License: Apache 2.0 | 61 ⭐️

#news #tools #aiml

gVisor was donated to CNCF and joins its Sandbox

gVisor is a well-known "container sandbox", an application kernel that runs in userspace and implements a Linux-like interface to isolate running applications and the host operating system. It was developed by Google and became Open Source in 2018. Today, gVisor is part of the numerous Google products, including GKE, Google Cloud Run, Gemini, YouTube, and Gmail.

In September, Google opened a formal request to consider gVisor for the CNCF Sandbox. By the end of the month, the CNCF Technical Oversight Committee voted to accept it. In October, a blog post announcing the donation of gVisor to the CNCF was published. It also revealed the gVisor author' intention to begin moving to the CNCF Incubated projects in the next few months.

#news #cncfprojects

Migrating virtual machines from your older infrastructure to Kubernetes? There's a helpful tool to facilitate this process.

Forklift was created specifically to migrate various virtual machines to KubeVirt. The project originated in Red Hat for its OpenShift Virtualization, but then it became a community effort for wider adoption. What it supports:

- migrating VMs from VMware vSphere, Open Virtual Appliances (OVAs), oVirt, OpenStack, Nutanix, Microsoft Hyper-V, and KubeVirt;
- warm migrations for VMware vSphere and oVirt (using CBT snapshots/incremental backup), hot migrations for KubeVirt (v4.20+);
- migrations to remote clusters;
- custom hooks to perform operations on VMs before and after migration;
- validation rules based on Open Policy Agent (OPA) to check VM migration suitability.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 198 ⭐️

#tools #virtualisation

Sharing our latest selection of interesting Kubernetes-related articles to consider for reading:

1. "Comparing Policy Engines in Kubernetes" by Mustafa Erdinç Zorba.

As you may know, ValidatingAdmissionPolicy has been generally available since Kubernetes 1.30, and MutatingAdmissionPolicy became generally available in Kubernetes 1.36. This brought a question to my mind: Do I still need Kyverno? I’ve been using Kyverno very extensively for different reasons, and I have several technical reasons to choose it over Gatekeeper. But now we have a new player in town, and it is natively supported by kube-apiserver (meaning Kubernetes itself)!

2. "Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions" by Nispriha Jagan and Neeraj Krishna Gopalakrishna.

Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention.

3. "Five key autoscaling metrics for Kubernetes" by drmorr, Applied Computing Research Labs.

At ACRL, we’ve identified five “key metrics” that you should be tracking for your autoscaling engines, and—spoiler—they might not be the normal ones you think of. In this post, we’ll do a quick overview, and then spend future posts digging into some details. If you’re curious, follow along below!

4. "Kubernetes Grace Period Is Not Your Grace Period" by Vikas Yadav.

If you only look at the Kubernetes setting, you can end up with a system that looks generous on paper but still kills jobs much earlier in practice. When these timeouts are not aligned, deployments, node drains, and other routine operations can turn into interrupted jobs and hard-to-explain failures. In this article, we follow the shutdown chain, see why the shortest shutdown timeout is the one that matters, and show how to identify and prevent these hidden gaps.

5. "Practical Kubernetes Tips for Everyday Ops" by Gmkziz.

A set of practical Kubernetes tips (or how-tos) that may help you in your day-to-day operations. Formating outputs, filtering objects, waiting for pods and more.

6. "Istio, Hands-On, Part 1: Where Requests Go, and Who Decides" by Filipe Motta.

Istio, Hands-On is a six-part series about running Istio on a platform that has to keep serving traffic while you change it. Every part follows the same payments platform, from payments-api and its first canary to the partners and clusters it reaches at the end. Each part explains the concepts first and then shows them working in a companion repository that builds the scenario on kind and tests what the article claims, most of it by counting responses. The order is the order in which a team meets the problems. Part 1 covers what a mesh is made of and the first decision it takes over, which is routing.

#articles

Cozystack became a CNCF Incubating project

The CNCF TOC has just voted to promote Cozystack to the Incubating level. Cozystack is a platform and framework for building clouds offering Kubernetes and various managed services, including virtual machines, databases, and more, all based on well-known Open Source solutions. The project originated in Ænix and was accepted into the CNCF Sandbox in March 2025.

#news #cncfprojects

KubeVirt and NATS became CNCF Graduated projects

A few days ago, the CNCF Technical Oversight Committee (TOC) voted to graduate KubeVirt and NATS.

KubeVirt, a virtual machine management add-on for Kubernetes, was accepted to the CNCF in 2019 and incubated in 2022. Its adopters today include ARM, Civo, Cloudflare, Microsoft, Nebius, NVIDIA, Oracle, Red Hat, SUSE, and Swisscom.

NATS, a high-performance cloud- and edge-native messaging system, was accepted to CNCF in 2018 as an Incubating project. Last year, this project went through a drama involving its original owner (Synadia) trying to reclaim ownership from the CNCF, but it ended well, and the project was left with the CNCF. Today, NATS's notable adopters include Alibaba, Baidu, Ericsson, Hewlett Packard Enterprise, Mastercard, PayPal, Siemens, and Walmart.

#news #cncfprojects

Excited to present our newest Cloud Native software digest after a while. Here are the significant updates we'd like to highlight:

1. RustFS, an S3-compatible high-performance object storage that originally emerged in February 2024, has reached general availability for production usage with its 1.0.0 release. Currently, it works on Linux, macOS, and Windows and offers full bucket and object lifecycle management, multipart upload for large objects, erasure coding, data tiering, S3 Tables, distributed deployment, pool expansion, data rebalancing, self-healing nodes, event notifications, and multi-tenancy support.

2. Envoy (a CNCF Graduated project) released its v1.40.0, making HTTP/3 and QUIC extensions stable, adding custom post-processing for the matched routes and a new policy to decouple per-worker pool size from cluster size, enabling container-aware CPU detection by default, and adding support for RFC 10008 QUERY method and Redis RESP3 protocol.

3. OpenSearch (a project of The Linux Foundation) made its Kubernetes Operator 3.0 generally available. Its alpha version brought quorum-safe rolling restarts and SmartScaler enabled by default, multi-namespace support, namespace-scoped RBAC, TLS hot reload, init containers and sidecars, and PVC-backed bootstrap Pods. The recent GA release added shard allocation awareness driven by Kubernetes node labels, per-node-pool image overrides, a PVC retention policy, support for running with the security plugin disabled, and host network and hostPath support.

4. Dex, an OpenID Connect identity and OAuth 2.0 provider (a CNCF Sandbox project), was updated to v2.46.0, introducing support for two-factor authentication (TOTP), WebAuthn, and Kerberos, SSO sharing policy, and CEL language expressions.

5. Headlamp, a Kubernetes web UI developed by the Kubernetes SIG, released 0.46.0, introducing alpha support for Kubernetes DRA (Dynamic Resource Allocation). It also got Suspend and Resume actions for Jobs, CompositePodGroup views for hierarchical gang scheduling, and a Copy to Clipboard action in LogViewer.

6. Freelens, an IDE for Kubernetes originated as a community-driven fork of Lens, announced its v2.0.0 as a full internal rewrite, featuring a single electron-vite pipeline (instead of webpack), a UI based on React 19, and a new extension API. New features include a standalone terminal page with its own tabs, relying on the cluster's API discovery to list custom resources, and faster connection to large clusters.

7. Argo CD (a CNCF Graduated project) released v3.6.0 with lots of Web UI improvements, including a new Resources Explorer view, a new Advanced Settings page, better controls in Settings list pages, regex search in Application/ApplicationSet Lists, and enhanced performance. Other updates include a new OCI generator, a new rollback RBAC action for Applications, improved Progressive Sync (no acting on stale data, new metrics, and new conditions), tpl function in ApplicationSet's Go templates, label-based resource filtering, and support for custom deletion messages.

#news #releases

Bitnami engineers are laid off

As Carlos Rodríguez Hernández puts it on LinkedIn, "After 20+ years, the engineering team behind Bitnami has been laid off. We're looking for our next chapter." Carlos has been an engineer at Bitnami since 2016 and later an Engineering Manager at VMware and Broadcom following the related acquisitions.

This team was quite small, but very well known in the DevOps and Cloud Native community, thanks to the hundreds of public container images and Helm charts it produced and maintained. When Broadcom acquired VMware, the Bitnami public catalogue became initially limited and later was removed.

Now, the team behind it was "affected by a corporate restructuring and geographic consolidation." Its members are looking for new roles, and a potential team lift-out to another company is being considered.

#news

Two new AI-related Kubernetes certifications: KAIA & CKIE

KubeCon + CloudNativeCon NA 2026 has already started, and the first announcements are coming in. One of them is related to the certification programs offered by the Linux Foundation Education. Two new certifications are currently being developed: Kubernetes AI Associate (KAIA) and Certified Kubernetes Inference Engineer (CKIE).

At the moment, you can subscribe to updates related to these certifications or join the group of subject matter experts contributing to their content.

In other news, the Certified Kubernetes Network Engineer Certification (CKNE), announced a year ago, is now generally available. Find all the details here.

#news #career #aiml

KubeRay and OpenShell are donated to CNCF

Two new AI-related CNCF Sandbox projects were announced during KubeCon + CloudNativeCon NA 2026.

1. KubeRay, a toolkit and Kubernetes operator to run distributed AI, machine learning, and Python workloads powered by Ray seamlessly on Kubernetes, was donated by the Ray project. Open Source contributors across multiple organisations, including Anyscale, AWS, ByteDance, Google, and Microsoft, created and maintained KubeRay. Now, it's a CNCF Sandbox project.

2. OpenShell, a runtime for securing and governing autonomous AI agents, was donated by NVIDIA. OpenShell was created to manage and monitor agent behaviour, and to provide and enforce policy-based boundaries for what it can do. It is currently adopting Cedar as its policy language. As part of the transition to the CNCF, the project's repos are moving to a separate GitHub organisation.

#news #cncfprojects #aiml #tools

CloudNativePG became a CNCF Incubating project

Earlier this month, the CNCF TOC voted to promote CloudNativePG to the Incubating level. Yesterday, a formal announcement followed.

CloudNativePG is a well-known Kubernetes operator to manage the full lifecycle of highly available PostgreSQL clusters. It originated in EDB and was accepted into the CNCF Sandbox in January 2025. Today, there are more than 50 public adopters of CNPG in production, including Akamai, Ericsson, Google Cloud, IBM, Microsoft Azure, Novo Nordisk, REWE International, and Tesla.

#news #cncfprojects #databases