Sharing the latest version of our curated digest showcasing prominent software updates in the Cloud Native ecosystem!

1. Argo Workflows, a workflow engine for orchestrating parallel jobs on Kubernetes (a part of Argo, a CNCF Graduated project), released its 4.1, which added 31 new features. They cover OpenTelemetry traces for the controller and executor, Kubernetes DRA support, Pod-level requests and limits, initless Pods, streaming save path for artifact drivers, database authentication via AWS RDS IAM and Azure PostgreSQL Entra ID, MariaDB support, workflow-level executor plugin configuration, and more.

2. Prometheus (a CNCF Graduated project) released 3.14.0 with PromQL duration expressions enabled by default and first_over_time promoted to stable, Oracle Cloud Infrastructure compute service discovery, and experimental support for encoding start timestamps in histograms.

3. Crossplane (a CNCF Graduated project) released 2.4.0, which added watching the resources required by each XR, zero replicas for just-launched safe-start provider runtimes (until they become active), vulnerability-scannable container images, hardening across composition and package paths, and version-aware documentation search

4. Strimzi, a Kafka operator for Kubernetes (a CNCF Incubating project), has seen its 1.2.0 with Apache Kafka 4.3.1 support, templated (per Pod) additional volumes, eliminated auto-mounting of Service Account tokens into Pods, server-side apply becoming GA, and more updates.

5. Open Policy Agent (a CNCF Graduated project) released v1.20.0, featuring new Rego keywords (and and or) for combining conditions inside a single rule body as well as dozens of other improvements across the project's whole ecosystem.

6. Istio (a CNCF Graduated project) reached 1.31.0. This release added a GatewayClass for deploying agentgateway as a waypoint proxy, Gateway API AllowInsecureFallback feature implementation for client certificate validation, weighted waypoint canaries, zone-aware load balancing, mesh-wide default traffic policy, FIPS 140-3 compliance policy, ztunnel CPU-aware worker threads, multi-target Prometheus scraping, and many more new features.

7. Inspektor Gadget, a set of tools and framework for inspecting Kubernetes clusters and Linux hosts using eBPF (a CNCF Sandbox project), was updated to v0.56.0. It introduced experimental support for Kubernetes multi-tenancy (based on namespaces), rootless ig image commands, and switching to kubelet's /сonfigz for container runtime socket auto-detection.

#news #releases

Skaffold ceases to exist

Skaffold is a CLI tool from Google designed for local development of Kubernetes applications. It has been around since 2018. According to the Slack announcement posted last month, the project won't be maintained anymore, and its GitHub repo will be archived starting January 15, 2027.

#tools #news

KubeVM from VMware Tanzu joins CNCF Sandbox

Tanzu, VMware's Kubernetes platform, has a VM Operator project that enables virtual machine management via a Kubernetes-style declarative API. It brought to life another project called KubeVM, which was developed in a separate branch of its repo and implemented “a vendor-neutral Kubernetes API for managing the full lifecycle of virtual machines on any hypervisor, implemented through pluggable providers.”

How is it different from KubeVirt? Here's how the KubeVM authors explain: “KubeVM leaves the VM as a native object of the underlying platform and uses Kubernetes as the API surface, delegating placement, migration, and storage to that platform. The two answer the same question for different starting conditions: Kubernetes as the only infrastructure layer, versus Kubernetes as a front door to an existing one. The relationship is intended to be integration: a KubeVirt provider is on KubeVM's roadmap, so the portable API can run on KubeVirt.”

A month ago, KubeVM applied to joining the CNCF Sandbox. A few days ago, the project was accepted by the CNCF TOC.

#news #cncfprojects #virtualisation

Agent Orca, a Kubernetes-native platform for managing AI agents

A few days ago, Matthew Fisher, solutions architect at NVIDIA, announced an Open Source project called Agent Orca. It's a platform for deploying, managing, and running AI agents in Kubernetes at scale. It allows you to use K8s resources to "declaratively define agents, route them to the correct LLM, equip them with tools, and execute them as one-off jobs or long-running services with checkpoints, cost tracking, guardrails, and RAG built in."

There's a quick-start manual for giving Agent Orca a try, seven demos, and quite extensive documentation for both developers and operators.

▶️ GitHub repo
 
Language: Go | License: Apache 2.0 | 61 ⭐️

#news #tools #aiml

gVisor was donated to CNCF and joins its Sandbox

gVisor is a well-known "container sandbox", an application kernel that runs in userspace and implements a Linux-like interface to isolate running applications and the host operating system. It was developed by Google and became Open Source in 2018. Today, gVisor is part of the numerous Google products, including GKE, Google Cloud Run, Gemini, YouTube, and Gmail.

In September, Google opened a formal request to consider gVisor for the CNCF Sandbox. By the end of the month, the CNCF Technical Oversight Committee voted to accept it. In October, a blog post announcing the donation of gVisor to the CNCF was published. It also revealed the gVisor author' intention to begin moving to the CNCF Incubated projects in the next few months.

#news #cncfprojects

Migrating virtual machines from your older infrastructure to Kubernetes? There's a helpful tool to facilitate this process.

Forklift was created specifically to migrate various virtual machines to KubeVirt. The project originated in Red Hat for its OpenShift Virtualization, but then it became a community effort for wider adoption. What it supports:

- migrating VMs from VMware vSphere, Open Virtual Appliances (OVAs), oVirt, OpenStack, Nutanix, Microsoft Hyper-V, and KubeVirt;
- warm migrations for VMware vSphere and oVirt (using CBT snapshots/incremental backup), hot migrations for KubeVirt (v4.20+);
- migrations to remote clusters;
- custom hooks to perform operations on VMs before and after migration;
- validation rules based on Open Policy Agent (OPA) to check VM migration suitability.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 198 ⭐️

#tools #virtualisation

Sharing our latest selection of interesting Kubernetes-related articles to consider for reading:

1. "Comparing Policy Engines in Kubernetes" by Mustafa Erdinç Zorba.

As you may know, ValidatingAdmissionPolicy has been generally available since Kubernetes 1.30, and MutatingAdmissionPolicy became generally available in Kubernetes 1.36. This brought a question to my mind: Do I still need Kyverno? I’ve been using Kyverno very extensively for different reasons, and I have several technical reasons to choose it over Gatekeeper. But now we have a new player in town, and it is natively supported by kube-apiserver (meaning Kubernetes itself)!

2. "Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions" by Nispriha Jagan and Neeraj Krishna Gopalakrishna.

Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention.

3. "Five key autoscaling metrics for Kubernetes" by drmorr, Applied Computing Research Labs.

At ACRL, we’ve identified five “key metrics” that you should be tracking for your autoscaling engines, and—spoiler—they might not be the normal ones you think of. In this post, we’ll do a quick overview, and then spend future posts digging into some details. If you’re curious, follow along below!

4. "Kubernetes Grace Period Is Not Your Grace Period" by Vikas Yadav.

If you only look at the Kubernetes setting, you can end up with a system that looks generous on paper but still kills jobs much earlier in practice. When these timeouts are not aligned, deployments, node drains, and other routine operations can turn into interrupted jobs and hard-to-explain failures. In this article, we follow the shutdown chain, see why the shortest shutdown timeout is the one that matters, and show how to identify and prevent these hidden gaps.

5. "Practical Kubernetes Tips for Everyday Ops" by Gmkziz.

A set of practical Kubernetes tips (or how-tos) that may help you in your day-to-day operations. Formating outputs, filtering objects, waiting for pods and more.

6. "Istio, Hands-On, Part 1: Where Requests Go, and Who Decides" by Filipe Motta.

Istio, Hands-On is a six-part series about running Istio on a platform that has to keep serving traffic while you change it. Every part follows the same payments platform, from payments-api and its first canary to the partners and clusters it reaches at the end. Each part explains the concepts first and then shows them working in a companion repository that builds the scenario on kind and tests what the article claims, most of it by counting responses. The order is the order in which a team meets the problems. Part 1 covers what a mesh is made of and the first decision it takes over, which is routing.

#articles

Cozystack became a CNCF Incubating project

The CNCF TOC has just voted to promote Cozystack to the Incubating level. Cozystack is a platform and framework for building clouds offering Kubernetes and various managed services, including virtual machines, databases, and more, all based on well-known Open Source solutions. The project originated in Ænix and was accepted into the CNCF Sandbox in March 2025.

#news #cncfprojects

KubeVirt and NATS became CNCF Graduated projects

A few days ago, the CNCF Technical Oversight Committee (TOC) voted to graduate KubeVirt and NATS.

KubeVirt, a virtual machine management add-on for Kubernetes, was accepted to the CNCF in 2019 and incubated in 2022. Its adopters today include ARM, Civo, Cloudflare, Microsoft, Nebius, NVIDIA, Oracle, Red Hat, SUSE, and Swisscom.

NATS, a high-performance cloud- and edge-native messaging system, was accepted to CNCF in 2018 as an Incubating project. Last year, this project went through a drama involving its original owner (Synadia) trying to reclaim ownership from the CNCF, but it ended well, and the project was left with the CNCF. Today, NATS's notable adopters include Alibaba, Baidu, Ericsson, Hewlett Packard Enterprise, Mastercard, PayPal, Siemens, and Walmart.

#news #cncfprojects

Excited to present our newest Cloud Native software digest after a while. Here are the significant updates we'd like to highlight:

1. RustFS, an S3-compatible high-performance object storage that originally emerged in February 2024, has reached general availability for production usage with its 1.0.0 release. Currently, it works on Linux, macOS, and Windows and offers full bucket and object lifecycle management, multipart upload for large objects, erasure coding, data tiering, S3 Tables, distributed deployment, pool expansion, data rebalancing, self-healing nodes, event notifications, and multi-tenancy support.

2. Envoy (a CNCF Graduated project) released its v1.40.0, making HTTP/3 and QUIC extensions stable, adding custom post-processing for the matched routes and a new policy to decouple per-worker pool size from cluster size, enabling container-aware CPU detection by default, and adding support for RFC 10008 QUERY method and Redis RESP3 protocol.

3. OpenSearch (a project of The Linux Foundation) made its Kubernetes Operator 3.0 generally available. Its alpha version brought quorum-safe rolling restarts and SmartScaler enabled by default, multi-namespace support, namespace-scoped RBAC, TLS hot reload, init containers and sidecars, and PVC-backed bootstrap Pods. The recent GA release added shard allocation awareness driven by Kubernetes node labels, per-node-pool image overrides, a PVC retention policy, support for running with the security plugin disabled, and host network and hostPath support.

4. Dex, an OpenID Connect identity and OAuth 2.0 provider (a CNCF Sandbox project), was updated to v2.46.0, introducing support for two-factor authentication (TOTP), WebAuthn, and Kerberos, SSO sharing policy, and CEL language expressions.

5. Headlamp, a Kubernetes web UI developed by the Kubernetes SIG, released 0.46.0, introducing alpha support for Kubernetes DRA (Dynamic Resource Allocation). It also got Suspend and Resume actions for Jobs, CompositePodGroup views for hierarchical gang scheduling, and a Copy to Clipboard action in LogViewer.

6. Freelens, an IDE for Kubernetes originated as a community-driven fork of Lens, announced its v2.0.0 as a full internal rewrite, featuring a single electron-vite pipeline (instead of webpack), a UI based on React 19, and a new extension API. New features include a standalone terminal page with its own tabs, relying on the cluster's API discovery to list custom resources, and faster connection to large clusters.

7. Argo CD (a CNCF Graduated project) released v3.6.0 with lots of Web UI improvements, including a new Resources Explorer view, a new Advanced Settings page, better controls in Settings list pages, regex search in Application/ApplicationSet Lists, and enhanced performance. Other updates include a new OCI generator, a new rollback RBAC action for Applications, improved Progressive Sync (no acting on stale data, new metrics, and new conditions), tpl function in ApplicationSet's Go templates, label-based resource filtering, and support for custom deletion messages.

#news #releases

Bitnami engineers are laid off

As Carlos Rodríguez Hernández puts it on LinkedIn, "After 20+ years, the engineering team behind Bitnami has been laid off. We're looking for our next chapter." Carlos has been an engineer at Bitnami since 2016 and later an Engineering Manager at VMware and Broadcom following the related acquisitions.

This team was quite small, but very well known in the DevOps and Cloud Native community, thanks to the hundreds of public container images and Helm charts it produced and maintained. When Broadcom acquired VMware, the Bitnami public catalogue became initially limited and later was removed.

Now, the team behind it was "affected by a corporate restructuring and geographic consolidation." Its members are looking for new roles, and a potential team lift-out to another company is being considered.

#news

Two new AI-related Kubernetes certifications: KAIA & CKIE

KubeCon + CloudNativeCon NA 2026 has already started, and the first announcements are coming in. One of them is related to the certification programs offered by the Linux Foundation Education. Two new certifications are currently being developed: Kubernetes AI Associate (KAIA) and Certified Kubernetes Inference Engineer (CKIE).

At the moment, you can subscribe to updates related to these certifications or join the group of subject matter experts contributing to their content.

In other news, the Certified Kubernetes Network Engineer Certification (CKNE), announced a year ago, is now generally available. Find all the details here.

#news #career #aiml

KubeRay and OpenShell are donated to CNCF

Two new AI-related CNCF Sandbox projects were announced during KubeCon + CloudNativeCon NA 2026.

1. KubeRay, a toolkit and Kubernetes operator to run distributed AI, machine learning, and Python workloads powered by Ray seamlessly on Kubernetes, was donated by the Ray project. Open Source contributors across multiple organisations, including Anyscale, AWS, ByteDance, Google, and Microsoft, created and maintained KubeRay. Now, it's a CNCF Sandbox project.

2. OpenShell, a runtime for securing and governing autonomous AI agents, was donated by NVIDIA. OpenShell was created to manage and monitor agent behaviour, and to provide and enforce policy-based boundaries for what it can do. It is currently adopting Cedar as its policy language. As part of the transition to the CNCF, the project's repos are moving to a separate GitHub organisation.

#news #cncfprojects #aiml #tools

CloudNativePG became a CNCF Incubating project

Earlier this month, the CNCF TOC voted to promote CloudNativePG to the Incubating level. Yesterday, a formal announcement followed.

CloudNativePG is a well-known Kubernetes operator to manage the full lifecycle of highly available PostgreSQL clusters. It originated in EDB and was accepted into the CNCF Sandbox in January 2025. Today, there are more than 50 public adopters of CNPG in production, including Akamai, Ericsson, Google Cloud, IBM, Microsoft Azure, Novo Nordisk, REWE International, and Tesla.

#news #cncfprojects #databases