"When an agent goes loose, you might find yourself: your S3 bucket has been deleted by mistake."

Tsahi Duek puts security first when it comes to AI agents. Unlike regular workloads, AI agents execute actions on your behalf — sometimes running code. That means locking them into isolated sandbox environments, scoping their access to specific services, and never giving broad permissions to your entire AWS account.



Watch the full interview: https://ku.bz/2r41YKBZb

This article explains what an attacker can really do with leaked Kubernetes credentials, from kubeconfigs to service account tokens, and how to check the blast radius and shut it down.

More: https://ku.bz/ppRKVtXsb

This week on Learn Kubernetes Weekly 202:

🔥 We Replaced etcd with Google Cloud Spanner
😌 How We Made Deploying a New Service Boring
🐘 Running Zookeeper on GKE with Local SSD (Z4D)
🚀 Kubernetes v1.36: Mixed Version Proxy Graduates to Beta
🌍 Building a Multi-Region EKS Platform with Crossplane, FluxCD, and GitOps

Read it now: https://kube.today/issues/202

⭐️ This newsletter is brought to you by Buoyant — The Buoyant Enterprise for Linkerd service mesh runs in production at Xbox (22,000 pods), Imagine Learning (40% cross-zone cost cut), and IntelliGRC 4× MRR after FedRAMP https://ku.bz/BwZYjDryv

This article asks what a container can block on its own when a dependency turns malicious, and tests nono, a capability-based sandbox that limits file and network access at runtime.

More: https://ku.bz/YdMc3KBZ6

This article explains how Vault piles up unexpired leases when pods keep re-authenticating with default service tokens, why that destabilises the HA cluster, and how batch tokens and shorter TTLs fix it.

More: https://ku.bz/Cn61TJM1G

This tutorial builds a Docker image with a secret, then shows how it still sits in an earlier image layer after you delete it, and pulls it back out with docker history, jq and tar.

More: https://ku.bz/S8r6yFdbS

Heading to KubeCon + CloudNativeCon North America? Join us the day before for our first in-person LearnKube community event.

We have a full day planned:

- A hands-on workshop: diagnose a deliberately broken application with telemetry, then explore how an in-cluster AI SRE agent responds.
- Technical sessions and Q&A: Cost Optimization, Bank Grade Kubernetes, and AI Operations.
- Lightning talks: featuring Artem Lajko, Diana Todea, and Viktor Farcic.
- YAML Games
- Drinks, canapes, and time to meet the community.

Your hosts are Salman Iqbal, Amin Astaneh, and Bart Farrell.

📅 Monday, November 9, 2026 · 10:00–19:00 MST
📍 Hilton Salt Lake City · Salt Lake City, Utah

Thank you to our event sponsors, StormForge by CloudBolt and vCluster, and our community sponsor, Utah Kubernetes Meetup.

We can't wait to meet you in Salt Lake City!

Register for free: https://learnkube.com/learnkube-day-salt-lake-city-2026

This article follows a secret from an external store into a pod through the Secrets Store CSI Driver, explaining the registrar, the SecretProviderClass and the provider plugin.
It also covers syncing back into a native Kubernetes Secret for env vars.

More: https://ku.bz/m70bP2hJs

This article explains how to design a production-grade MCP server for platform teams, with governance, backend clients, tool definitions and auth as four separate layers, plus the RBAC and deployment work needed before it touches a real cluster.

More: https://ku.bz/6c5t89LYj

This tutorial shows how to let cert-manager issue Let's Encrypt certificates for services outside the cluster, using DNS-01 validation and AWS Secrets Manager as the delivery path to an OpenVPN server.

More: https://ku.bz/jgr5PbzgS

This week on Learn Kubernetes Weekly 203:

🔥 Building Modelplane on Crossplane
🚪 Kubernetes Gateway API: Why Ingress Is Being Replaced and Which Gateway Controller to Pick
🛡️ From Fragile VMs to Bulletproof GitOps: Modernizing a DevOps Platform on AWS EKS
💾 How a 500 MB Buffer Killed Our Archival Job, and Why Streaming Fixed It
🎮 How GPU MIG + Kueue Can Transform Multi-Tenant AI Workloads on Kubernetes

Read it now: https://kube.today/issues/203

⭐️ This newsletter is brought to you by LearnKube — understand how Kubernetes works, and what to do when it breaks. Live training with 60% hands-on labs.https://ku.bz/hypSbyc-V

"The next 10 years are going to be boring — in the good sense."

Mauro Morales sees Kubernetes entering its maturity phase: more security focus, more compliance, more standardization. The excitement shifts to AI tooling that helps operators manage growing complexity — like projects using Kubernetes to deploy Kubernetes.

Boring infrastructure is reliable infrastructure.



Watch the full interview: https://ku.bz/8cpgjFfjn

FQDN Network Policy turns hostnames into current IP addresses and creates standard Kubernetes NetworkPolicy rules, so teams can control outbound traffic on any CNI without replacing their network plugin.

More: https://ku.bz/NprbZjd3s