Our latest digest of the prominent software updates in the Cloud Native ecosystem:

1. Argo CD (a CNCF Graduated project) released its v3.5 RC, introducing several important features. They include a new ApplicationSet UI with built-in change previews, Impersonation workflows and Source Hydrator promoted to Beta, Helm 4 support, and mTLS support for repo-server. Currently, v3.5.0-rc1 and v3.5.0-rc2 are available, with the GA release scheduled for August.

2. Headlamp, a Kubernetes web UI developed by the Kubernetes SIG, released 0.43.0. It came with ClusterProfile discovery (alpha), a node upgrade visualisation panel, proxy auth support for middleware proxies, a Create Deployment form in the UI, a dedicated Job details view, RTL layout support, and several new localisations.

3. Podman, a tool for managing OCI containers and pods (a CNCF Sandbox project), reached v6.0.0. It significantly upgraded the network infrastructure (iptables → nftables; CNI networking → Netavark; slirp4netns → Pasta; experimental Pesto rootless port forwarding), improved VM experience in Podman Machine with easier operations across different providers and a new podman machine os update command, enhanced quadlet capabilities and the way configuration files are handled.

4. CloudNativePG, a platform designed to manage PostgreSQL in Kubernetes (a CNCF Sandbox project), released 1.30.0, featuring the DatabaseRole CRD for declarative role management as its main highlight. This release also added a Kubernetes Lease object for safe primary election, in-place major upgrades with Image Volume extensions, PgBouncer image management via Image Catalogs, SCRAM-SHA-256 password encoding, and several other improvements.

5. Dragonfly, which implements secure data distribution and acceleration powered by P2P (a CNCF Graduated project), announced v2.5.0. It introduced direct repository downloads from Hugging Face and ModelScope, a Kubernetes mutating admission webhook for automatic P2P capability injection in Dragonfly, a blocklist to disable specific downloads, comprehensive rate limiting, a new command-line tool (dfctl) to manage tasks in the client’s local storage, and many other updates.

6. Flux (a CNCF Graduated project) released 2.9 with a new CLI plugin system and the first two plugins (Mirror and Schema). It also included Server-Side Apply field ignore rules for fine-grained drift control, enhanced secrets decryption, support for Helm post-render strategies, CEL-based health check expressions, and many other new features. The latest release of Flux Operator added a dedicated workload dashboard and a full-featured Pod log viewer to the Flux Web UI.

7. cert-manager (a CNCF Graduated project) released v1.21.0 with experimental ACME Renewal Information (ARI) support, AWS IAM authentication for Vault, certificate renewal policies, support for Modern2026 PKCS#12 profile, Venafi OAuth token observability, runtimeClassName support, and various Gateway API and cainjector improvements.

#news #releases

William Rizzo, a CNCF Ambassador and Global Field CTO at Mirantis, announced his project, KubeSwift, which provides Kubernetes-native VM orchestration on Cloud Hypervisor.

Here’s the idea behind KubeSwift: “KubeSwift runs virtual machines as Kubernetes workloads. You define a VM with a custom resource; controllers reconcile it into a Pod; inside that Pod, swiftletd launches a hypervisor.” (Cloud Hypervisor, on which this project relies, is a VMM (Virtual Machine Monitor) for cloud workloads written in Rust.)

While still being in the pre-1.0 state, KubeSwift already supports disk boot from cloud images and direct kernel boot from OCI artifacts, Multus and OVN-Kubernetes for networking, exposing guest ports as Kubernetes Services, GPU passthrough, disk snapshots, offline and live migrations, managing fleets of identical VMs, swiftctl CLI tool for lifecycle management and operations, and many other features.

▶️ GitHub repo

Language: Go | License: AGPL 3.0 | 18 ⭐️

#news #tools

HAMi became a CNCF Incubating project

HAMi was originally known as k8s-vGPU-scheduler and today stands for Heterogeneous AI computing virtualisation Middleware. It enables slicing a physical GPU into units by memory/core/device count, enforcing hard runtime isolation, and scheduling Pods using binpack, spread, and topology-aware policies. You can learn more about this project from this overview.

HAMi joined the CNCF Sandbox in August, 2024. Two weeks ago, the CNCF TOC voted to promote it to the incubating level. This change was formally announced yesterday.

#news #cncfprojects

Buildpacks graduates, k8gb incubates

Following the CNCF TOC votes that happened over the last weekend, two CNCF projects were promoted to the next level:

1. Buildpacks, a set of specifications and tooling that transform application source code into container images that can run on any cloud, became a Graduated project. It was started by Pivotal and Heroku in January 2018, joined the CNCF Sandbox in October 2018, and became Incubated in November 2020. The companies that adopted Buildpacks include Bloomberg, Google, Microsoft, Red Hat, Salesforce, and VMware by Broadcom.

2. k8gb, a Kubernetes global balancer, became an Incubating project. It originated in Absa Group in 2019 and joined the CNCF Sandbox in March 2021. Current k8gb adopters include Eficode, Millennium bcp, and PagBank.

#news #cncfprojects

KubeSchool by Portainer

As Neil Cresswell, CEO of Portainer, said on Reddit, one of his engineers recently asked him to help better understand Kubernetes architecture and components. Answering this request, he decided to go bigger and launched KubeSchool.

It's an educational website featuring 15 chapters on Kubernetes basics for beginners. They cover the core ideas behind K8s, its main components, pluggable layers (CNI, CSI, CRDs, etc.), and production-ready recommendations.

#career #articles

Confidential Containers became a CNCF Incubating project

Another level up has just happened in the CNCF, with its TOC accepting moving Confidential Containers to the Incubating level. This project enables confidential computing by leveraging hardware-based TEEs (Trusted Execution Environments) to protect containers and data by encrypting data during computation.

Confidential Containers started in 2021 by Red Hat, Intel, IBM, and other companies. It was accepted into the CNCF Sandbox in March 2022. Today, this technology is used in IBM LinuxONE, Red Hat OpenShift, Kubermatic KubeOne, Alibaba Cloud, and several other solutions.

#news #cncfprojects #security

Kubeflow became a CNCF Graduated project

The summer series of CNCF level-ups keeps going, and Kubeflow has just joined the list of the organisation’s most mature (i.e. Graduated) projects. The CNCF Technical Oversight Committee (TOC) voted for this graduation last Friday.

Kubeflow is a machine learning toolkit for Kubernetes that serves as a foundation for K8s-based AI platforms. Its subprojects include Pipelines for end-to-end ML workflows, Trainer for distributed AI model training and LLM fine-tuning, Katib for AutoML, and a Kubernetes operator for Apache Spark.

Kubeflow originated in Google, with its first public announcement in 2017. It was accepted into the CNCF as an Incubating project in July 2023. Today, its adopters include Alibaba Cloud, AWS, Cisco, Huawei, IBM, NVIDIA, Red Hat, and Tencent.

#news #cncfprojects #aiml

OpenTelemetry got a one-command Linux setup

The OpenTelemetry Packaging SIG introduced a ready-to-use opentelemetry package for Linux distributions that installs the OpenTelemetry Injector together with the OpenTelemetry SDKs and auto-instrumentation packages for various programming languages (Java, .NET, Node.js, and Python).

It is now available as an APT repository (for Debian, Ubuntu, and derivatives) and a YUM repository (for Fedora, RHEL, and derivatives). Find more details in this announcement or read the full instructions on GitHub.

#news #observability

Thought of running agents on Kubernetes more efficiently? Here’s a project from Google that you might find useful.

Agent Substrate is an experimental system for running agents and similar workloads on Kubernetes at scale, providing specialised scheduling and controls to improve scalability and reduce latency. It relies on Kubernetes Pods and Pod autoscaling (but not K8s control plane) and manages the lifecycle of "actors" (agents or similar apps): creating and destroying them, assigning them to Pods, and routing traffic to them. It handles OCI containers at the kernel level via gVisor, so it can work with apps that are built on any stack.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 912 ⭐️

#tools