Kubernative by Palark | Kubernetes news and goodies

Sharing the latest version of our curated digest showcasing prominent software updates in the Cloud Native ecosystem!

1. Argo Workflows, a workflow engine for orchestrating parallel jobs on Kubernetes (a part of Argo, a CNCF Graduated project), released its 4.1, which added 31 new features. They cover OpenTelemetry traces for the controller and executor, Kubernetes DRA support, Pod-level requests and limits, initless Pods, streaming save path for artifact drivers, database authentication via AWS RDS IAM and Azure PostgreSQL Entra ID, MariaDB support, workflow-level executor plugin configuration, and more.

2. Prometheus (a CNCF Graduated project) released 3.14.0 with PromQL duration expressions enabled by default and first_over_time promoted to stable, Oracle Cloud Infrastructure compute service discovery, and experimental support for encoding start timestamps in histograms.

3. Crossplane (a CNCF Graduated project) released 2.4.0, which added watching the resources required by each XR, zero replicas for just-launched safe-start provider runtimes (until they become active), vulnerability-scannable container images, hardening across composition and package paths, and version-aware documentation search

4. Strimzi, a Kafka operator for Kubernetes (a CNCF Incubating project), has seen its 1.2.0 with Apache Kafka 4.3.1 support, templated (per Pod) additional volumes, eliminated auto-mounting of Service Account tokens into Pods, server-side apply becoming GA, and more updates.

5. Open Policy Agent (a CNCF Graduated project) released v1.20.0, featuring new Rego keywords (and and or) for combining conditions inside a single rule body as well as dozens of other improvements across the project's whole ecosystem.

6. Istio (a CNCF Graduated project) reached 1.31.0. This release added a GatewayClass for deploying agentgateway as a waypoint proxy, Gateway API AllowInsecureFallback feature implementation for client certificate validation, weighted waypoint canaries, zone-aware load balancing, mesh-wide default traffic policy, FIPS 140-3 compliance policy, ztunnel CPU-aware worker threads, multi-target Prometheus scraping, and many more new features.

7. Inspektor Gadget, a set of tools and framework for inspecting Kubernetes clusters and Linux hosts using eBPF (a CNCF Sandbox project), was updated to v0.56.0. It introduced experimental support for Kubernetes multi-tenancy (based on namespaces), rootless ig image commands, and switching to kubelet's /сonfigz for container runtime socket auto-detection.

#news #releases

Talos gets a hypervisor, and Sidero Labs joins Yardi

Big news arrived for Talos Linux, a well-known Open Source operating system designed for Kubernetes. First, this project adds a hypervisor to run virtual machines. Interestingly, their solution is not based on KubeVirt. The authors say that requiring "Kubernetes just to run VMs" is an "unnecessary complexity", so they "brought native hypervisor capabilities into Talos Linux" (based on KVM). It will be Open Source. Talos Hypervisor launch (the alpha release and a public demo) will take place during TalosCon 2026, which will be held on October 15-16 in Amsterdam. Its general availability is expected in December.

Secondly, Sidero Labs, the commercial company behind Talos, joins Yardi. It's a US-based software business focused on the real estate industry, with 10k+ employees across 40+ offices worldwide. As Sidero Labs outlines, it will continue to operate as a standalone company, and Talos Linux will remain fully Open Source under the same license (MPL 2.0).

#news

Karmada became a CNCF Graduated project

Karmada extends the standard Kubernetes API, allowing orchestration of applications across multiple clusters, clouds, and regions without modifying the apps themselves. Earlier this month, the CNCF Technical Oversight Committee (TOC) voted to graduate Karmada, and the decision was formally announced on the CNCF blog now.

Karmada originated in Huawei and was publicly announced at the Huawei Developer Conference 2021. It was accepted into the CNCF Sandbox in September 2021 and promoted to the Incubating level in December 2023. Today, Karmada adopters include Alibaba Cloud, Bloomberg, Huawei, Trip.com, Vivo, and Wellhub.

#news #cncfprojects

We all know (and many of us use daily) k9s as a truly flagship CLI tool for Kubernetes. But what if someone were to reimagine it today?

Meet sofka, which reimplements a well-known tool using one generic object pipeline (instead of separate structs for each resource type) and Rust. It performs better and offers lots of features you might need, including:

- Powerful keyboard-based navigation with curated columns, custom views, drill-down navigation, horizontal scrolling, global fuzzy find, compact mode, and mouse support.
- Powerful metrics and health support, covering Pod health, live CPU and memory values, workload health at a glance, evidence-based explanation for unhealthy resources, hierarchical Xray view, watch notifications, and more.
- Extended diagnostic capabilities with incident bundles and snapshots capturing the current table view.
- Embedded Helm and GitOps integration.
- Various executable actions, such as file transfers, debugging containers and Pods, exploring PVC contents, and right-sizing requests.

What makes it different from k9s? Built-in Flux CD and Argo CD support, port-forwarding running in the background, bulk actions with multiselect, skins (12 are available), and more.

▶️ GitHub repo
 
Language: Rust | License: Apache 2.0 and MIT | 672 ⭐️

#tools #CLI

k8gb v1.0.0

k8gb, a Kubernetes Global Balancer, originated at Absa Group. More than six years have passed since the first whiteboard session in Johannesburg, conducted by Yury Tsarev and Bradley Andersen, both employed by this company at the time. In 2021, k8gb was accepted into the CNCF Sandbox, and earlier this year, as we mentioned recently, it became a CNCF Incubating project.

Yesterday, right during its 100th community meeting, the k8gb maintainers pushed the v1.0.0 release. This update highlights a significant milestone in the project's maturity.

#releases #cncfprojects #networking

Happy to share our newest selection of interesting Kubernetes-related articles to consider for reading during this year's last summer weekend:

1. "Nginx vs Caddy vs Traefik in 2026 — I Ran All Three Under Real Production Load" by Yusuf Seyitoğlu.

A logistics client ran ingress-nginx on EKS for four years. Fine until it wasn’t supported. They asked me to compare Nginx (F5 NIC), Caddy, and Traefik on the same cluster before picking a path forward. Same twelve microservices. Same cert issuer. Same load tests. I ran each as the edge for six weeks.

2. "From intent to enforcement: Lessons from operating Kubernetes controllers at scale" by Sri Saran Balaji Vellore Rajakumar and Jayanth Varavani, AWS.

Kubernetes controllers are what make the platform’s declarative model real. They observe the state, reconcile toward the intent, and keep doing so as the system changes beneath them. At larger scales, though, the hardest problems are no longer about writing the reconcile loop. They are about preserving correctness while caches lag, objects churn, and enforcement depends on a complete view of the world. This post distills what we learned from operating two critical controllers in Amazon EKS at scale.

3. "Shipyard: How We Built Slack’s Next-Generation EC2 Platform" by Archie Gunasekara, Slack.

Service-level deployments were tricky, infrastructure drift was inevitable, and coordinating changes across multiple layers added complexity. Containers solved this for some classes of workloads, but not everything could migrate easily. We needed a new approach—one that brought modern deployment practices like immutability, progressive rollouts, and automated safety directly to EC2 instances.

4. "Where did those 800 pods come from?" by Tibo Beijen.

Recently I merged a pull request that was like any other pull request. But things unfolded quite differently. Things didn’t break, but could have. Things shouldn’t have happened, but did. The typical unlikely combination of factors, involving Argo CD ApplicationSets and mysterious AWS EKS Fargate nodes, resulting in some head-scratching, troubleshooting and interesting take-aways.

5. "Optimizing Kubernetes pod deployments for reliability with topology spread constraints" by Andre Newman, Gremlin.

Pod distribution plays a much bigger role in reliability than you might think. Fortunately, it’s easy to control when, where, and how Kubernetes distributes pods. By adding a few lines to your manifest, you can ensure your deployments are zone-redundant and evenly scalable. The feature is called topology spread constraints, and in this blog, we’ll explain how it works in full detail.

6. "How Kubernetes probes work" by Sam Rose, ngrok.

I’m going to show you, really show you, how probes work in Kubernetes. How they can make your application more resilient, and how they can help you prevent avoidable mistakes. Like restart loops that take hours to recover from, and dropping requests during rollouts. Every interactive demo in this post uses webernetes, my partial port of Kubernetes to TypeScript.

7. "Building an AI factory on Kubernetes" by Hrittik Roy, vCluster.

An AI factory is not just a model or a cluster. It is a pool of GPUs that many teams draw from at once: one team fine-tuning, another serving inference, a third running evaluations, all on the same accelerators. NVIDIA frames it as “infrastructure for the full AI lifecycle, from data preparation through training, fine-tuning, and high-volume inference”. In an enterprise that means one fleet, many teams, and different quotas, policies, and trust boundaries layered on top. The hard question is no longer how to train a model. It is how to give every team safe, isolated access to the same expensive hardware without anyone stepping on anyone else.

#articles

Kubernetes v1.37 arrived

The final release has happened and was officially announced in the project's blog tonight. Its codename is Garhwal, a Himalayan region of Uttarakhand, India. As always, it comes with lots of new features, which are described in the formal announcement linked above and other articles we mentioned here before.

#news #releases

Kubernetes Community Days in 2027 H1

CNCF has announced the first batch of KCDs for 2027; they will take place in the first half of next year. The organisation also updated the event tier names that reflect how mature specific KCDs are. Currently, they are Tier 0 for first-time events with up to 200 attendees, Tier 1 for returning events with 350+ attendees, and Tier 2 for established events with up to 600 people.

Here’s the list of KCDs 2027 H1, including their tiers:
- KCD Panama; January; Tier 1
- KCD Pune, India; February; Tier 1
- KCD Vancouver, Canada; February; Tier 0 (new)
- KCD Beijing, China; March; Independent
- KCD Bangkok, Thailand; March; Tier 0 (new)
- KCD Cairo, Egypt; April; Tier 0 (new)
- KCD Texas, USA; April; Independent
- KCD Guadalajara, Mexico; April; Independent
- KCD Hyderabad, India; April; Tier 1
- KCD Valencia, Spain; May; Tier 0 (new)
- KCD San Francisco Bay Area, USA; May; Independent
- KCD Toronto, Canada; May; Tier 1
- KCD Helsinki, Finland; May; Independent
- KCD Cali, Colombia; May; Tier 0 (new)
- KCD New York, USA; June; Independent

P.S. The tiers are not officially specified in the formal announcement and are our best estimate based on previously hosted KCDs.

#events #news

Another kube-oidc-proxy fork is alive, featuring multi-issuer authentication to managed Kubernetes clusters.

This new project, created by Rafal Pieniazek, implements a reverse proxy that enables authentication from multiple OIDC issuers at once to your managed K8s clusters, such as EKS, GKE, and AKS. To achieve this, the proxy sits in front of the API server, validates the bearer token against required OIDC issuers, and maps the token's claims to a Kubernetes identity. Then, impersonated headers for the mapped user are added, so that existing RBAC stays authoritative.

P.S. This project originates from kube-oidc-proxy by Tremolo Security, which itself is an active fork of the eponymous project by Jetstack.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 17 ⭐️

#tools #security

Although GitHub isn't feeling well right now, here comes our newest digest of the prominent software updates in the Cloud Native ecosystem!

1. Rancher released v2.15.0, bringing general availability of native CAPI infrastructure providers, inherited namespace rules for GlobalRoles, restrictions for local UI authentication when EAP is configured, a new high-performance Workloads Overview UI view, and support for Kubernetes v1.36.

2. Karpenter, a Kubernetes node autoscaler developed by the Kubernetes SIG, was updated to v1.14.0, which added the allocator for DRA, extended DRA support for partitionable devices and consumable capacity, a Balanced consolidation policy, per-offering resource overrides, and support for the CapacityBuffer API.

3. Cilium (a CNCF Graduated project) released 1.20.0 with lots of improvements. They include support for TCPRoute and UDPRoute in the Gateway API, encrypting traffic between the gateway and application services, migration to multi-pool IPAM, topology-aware service traffic (PreferSameZone and PreferSameNode in Kubernetes), stable Kubernetes Multi-Cluster Services API support, cluster-scoped policy API from Kubernetes upstream (ClusterNetworkPolicy), per-Service load-balancing mode annotations for VXLAN, and a 4-time smaller cilium-cni binary.

4. Cozystack, a PaaS platform and framework for building clouds (a CNCF Sandbox project), released v1.6.0. It migrated tenant Kubernetes workers from Ubuntu and kubeadm to Talos Linux, made tenant resource quotas hierarchical, moved etcd to etcd-operator v1alpha2, introduced a new tenant-facing and namespace-scoped firewall resource (SecurityGroup), and made several improvements to Keycloak.

5. KServe, a distributed generative and predictive AI inference platform (a CNCF Incubating project), released v0.20.0. It introduced numerous new features, including managed DRA for LLMInferenceService, support for confidential model serving, AutoGluon support, the ability to use multiple OCI sources in storageUris, platform-specific hooks for service customisation, a traffic-splitting API for controlled deployment, and canary rollouts for the RawDeployment mode.

6. wasmCloud, a platform for running WebAssembly workloads (a CNCF Incubating project), reached its v2.7.0. It brought concurrent pooled instances, trusted private OCI CA roots with the e2e registry behind TLS, implements and maps enabled by default, and a unified mechanism for connection limiting.

#news #releases

Headlamp GUI got a plugin for Argo CD

A few days ago, Headlamp, a Kubernetes web UI developed by the Kubernetes SIG and recommended as a successor to the Kubernetes Dashboard, got another prominent plugin: for Argo CD. It adds native views for Argo CD resources in the dashboard. It already supports Applications and AppProjects, can show a GitOps summary (source/destination, revision, health, etc.), managed resources, sync policy and history, and more.

However, it's still in alpha, which comes with numerous limitations (i.e. it can't fully replace the original Argo CD UI). Find more details and screenshots about this plugin on its 0.1.0-alpha release page.

P.S. Last year, Headlamp also got a plugin for another well-known GitOps tool, Flux. It is still actively developed, with its most recent version 0.7.0 released just two weeks ago.

#news #gitops #gui #releases

Community has met KYAML, a strict subset of standard YAML for Kubernetes (KEP-5295), with mixed feelings. However, it will become stable in the upcoming Kubernetes v1.37 release. Thus, yesterday’s Kubernetes blog post on what KYAML is and how to use it* may be helpful.

* TL;DR: via kubectl -o kyaml or yamlfmt (from Kubernetes itself or Google).

#articles

New free Kubernetes workshop

Konrad Heimel announced the Kubernetes Practitioner Workshop, a GitHub repo that offers structured educational content for engineers looking to learn Kubernetes concepts and practice them. It comes with:

- 28 topics (e.g., Containers, StatefulSet, The operator pattern, or Helm), each presented with 20-30 slides and accompanied with a practical lab requiring 15-30 minutes to complete;
- two types of environments for labs: a specific namespace on a shared cluster or a local kind cluster;
- downloadable PDFs provided as GitHub releases;
- facilitator guide with additional notes on setting up the required environment and running this workshop.

All content is free and available as Open Source (under the Zero-Clause BSD permissive license).

#career

What to expect in Kubernetes v1.37

The next Kubernetes release, v1.37, is scheduled later this month, on August 26th. It will come with several important deprecations (e.g., static Pods won't longer reference Secrets/ConfigMaps, the ipvs mode will be removed from kube-proxy) and over 20 new features, including Recreate update strategy for StatefulSets, volume health monitor, default Pod sysctls in Kubelet, CompositePodGroup API, and others.

Learn more about these upcoming changes from the first related articles published last week:

- Kubernetes 1.37: Deep dive into new alpha features on Palark tech blog;
- Kubernetes v1.37 Sneak Peek on the official Kubernetes blog.

#news #articles #releases

Thought of running agents on Kubernetes more efficiently? Here’s a project from Google that you might find useful.

Agent Substrate is an experimental system for running agents and similar workloads on Kubernetes at scale, providing specialised scheduling and controls to improve scalability and reduce latency. It relies on Kubernetes Pods and Pod autoscaling (but not K8s control plane) and manages the lifecycle of "actors" (agents or similar apps): creating and destroying them, assigning them to Pods, and routing traffic to them. It handles OCI containers at the kernel level via gVisor, so it can work with apps that are built on any stack.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 912 ⭐️

#tools

OpenTelemetry got a one-command Linux setup

The OpenTelemetry Packaging SIG introduced a ready-to-use opentelemetry package for Linux distributions that installs the OpenTelemetry Injector together with the OpenTelemetry SDKs and auto-instrumentation packages for various programming languages (Java, .NET, Node.js, and Python).

It is now available as an APT repository (for Debian, Ubuntu, and derivatives) and a YUM repository (for Fedora, RHEL, and derivatives). Find more details in this announcement or read the full instructions on GitHub.

#news #observability

Kubeflow became a CNCF Graduated project

The summer series of CNCF level-ups keeps going, and Kubeflow has just joined the list of the organisation’s most mature (i.e. Graduated) projects. The CNCF Technical Oversight Committee (TOC) voted for this graduation last Friday.

Kubeflow is a machine learning toolkit for Kubernetes that serves as a foundation for K8s-based AI platforms. Its subprojects include Pipelines for end-to-end ML workflows, Trainer for distributed AI model training and LLM fine-tuning, Katib for AutoML, and a Kubernetes operator for Apache Spark.

Kubeflow originated in Google, with its first public announcement in 2017. It was accepted into the CNCF as an Incubating project in July 2023. Today, its adopters include Alibaba Cloud, AWS, Cisco, Huawei, IBM, NVIDIA, Red Hat, and Tencent.

#news #cncfprojects #aiml

Confidential Containers became a CNCF Incubating project

Another level up has just happened in the CNCF, with its TOC accepting moving Confidential Containers to the Incubating level. This project enables confidential computing by leveraging hardware-based TEEs (Trusted Execution Environments) to protect containers and data by encrypting data during computation.

Confidential Containers started in 2021 by Red Hat, Intel, IBM, and other companies. It was accepted into the CNCF Sandbox in March 2022. Today, this technology is used in IBM LinuxONE, Red Hat OpenShift, Kubermatic KubeOne, Alibaba Cloud, and several other solutions.

#news #cncfprojects #security

KubeSchool by Portainer

As Neil Cresswell, CEO of Portainer, said on Reddit, one of his engineers recently asked him to help better understand Kubernetes architecture and components. Answering this request, he decided to go bigger and launched KubeSchool.

It's an educational website featuring 15 chapters on Kubernetes basics for beginners. They cover the core ideas behind K8s, its main components, pluggable layers (CNI, CSI, CRDs, etc.), and production-ready recommendations.

#career #articles