AI workloads running on accelerators have exposed a fundamental tension in Kubernetes architecture: the scheduler and autoscaler operate as independent control loops that do not share decisions. This causes pods to remain unschedulable even when capacity exists, because the autoscaler provisions nodes the scheduler cannot use. The CNCF blog post, authored by AWS engineers, details how Dynamic Resource Allocation now gives both components a shared vocabulary for topology and device sharing, and how SIG-Autoscaling is developing integration APIs for direct coordination. Gang scheduling remains partially unsolved, with workload-aware scheduling beta in the scheduler but the autoscaler still reasoning pod-by-pod.

A technical report details the migration of n8n from a community-maintained Helm chart to the official version on Amazon EKS. To avoid storage conflicts with AWS gp3 volumes, the team moved from a StatefulSet model to a Deployment model by offloading all state to PostgreSQL, Redis, S3, and AWS Secrets Manager. This allowed for a full cutover without losing workflow history or critical data.

Istio Service Mesh has announced the release of version 1.30.6. This release is part of the ongoing development of the Istio project. The release notes and artifacts for this version are available on GitHub.

At the Observability Summit Europe 2026, a proposal was presented to bring Software Carbon Intensity (SCI) metrics into the OpenTelemetry ecosystem. The initiative seeks to move beyond simple energy measurements by linking carbon emissions to specific functional units of software activity, such as requests or transactions. This would allow engineers to use OpenTelemetry semantic conventions to consistently report and attribute carbon impact across shared cloud-native infrastructures.

The Cilium 1.20.3 release provides a series of bugfixes and minor improvements for the eBPF-based networking solution. Key updates include support for Alibaba Cloud IMDSv2, fixes for Azure agent crashes caused by empty MAC fields, and resolutions for conntrack garbage collection errors that previously affected live connections. The update also improves Gateway API handling and Envoy listener stability.

The Cilium project has released version 1.19.9, focusing on bugfixes and dependency updates. This release addresses a data race in the selector cache that could cause agent panics, fixes endpoint deletion issues, and includes security updates for critical Go modules.

The Cilium 1.18.15 release provides critical bugfixes for eBPF-based cloud-native networking. Key improvements include fixing incorrect endpoint deletion during garbage collection, resolving silent ip6tables chain rename errors, and correcting backend quarantine issues during restarts. The update also includes security patches for golang.org/x/net and go.opentelemetry.io modules.

Cilium has announced the release of version 1.19.9. This release is part of the Cilium project, which focuses on cloud native networking using eBPF. The release was signed with the committer's verified signature.

Nirmata has introduced Nirmata Runtime for Kyverno, an open source tool designed to bridge the security gap between deployment and execution. By utilizing eBPF and Linux Security Modules (LSM), it moves policy enforcement from the Kubernetes API level down to the kernel. This allows for synchronous, in-kernel blocking of unauthorized process executions, file access, and network connections, specifically targeting the unpredictable behaviors of autonomous AI workloads.

A new 0.1.0-alpha plugin for the Headlamp Kubernetes UI has been introduced to assist with troubleshooting Kueue-managed workloads. The plugin provides read-only visibility into Kueue resources, allowing users to distinguish between admission delays caused by Kueue and scheduling delays caused by the Kubernetes scheduler. Users can now inspect Workloads, LocalQueues, ClusterQueues, ResourceFlavors, and Cohorts directly within the Headlamp interface.

OpenTelemetry has released version 0.163.0 of the OpenTelemetry Collector. This update focuses on implementing Profiles development-version metadata within OTLP receivers and exporters, improving the builder configuration for resource detection, and fixing several bugs related to exporter queue deadlocks and batch splitting.

Envoy proxy has released version 1.40.0, featuring a major build system migration from WORKSPACE to bzlmod. The release stabilizes HTTP/3 and QUIC, adds X25519MLKEM768 hybrid key exchange for post-quantum security, and introduces alpha support for an AI Protocol Manager filter. It also includes significant security hardening and several CVE fixes.

The Envoy Proxy project has released version v1.39.4, which addresses several bugs related to route-level configuration and metrics. The fixes include issues with AWS request signing, composite filters, and Prometheus native histogram bucket indices. This release is expected to improve the stability and accuracy of Envoy Proxy for its users.

The Podman container engine has released version 6.1.4, which includes critical bug fixes and dependency updates. The release restores functionality for users running Podman under WSL 3 and patches a security vulnerability in gvproxy. Additionally, the update bumps versions for Buildah and Storage.

The Envoy Proxy project has released version 1.38.7, which includes upstream security fixes, such as bumping wasmtime to 24.0.10 to resolve CVE-2026-54786. Additionally, several bugs have been fixed, including issues with AWS request signing, dynamic modules, and statistics. This release affects users of the Envoy Proxy, particularly those relying on its security and stability features.

The latest release of Podman Container Engine, version 5.8.9, addresses issues with running under WSL 3 and improves the stability of podman machine VMs on Mac. Additionally, it updates gvproxy, Buildah, and Storage to newer versions, resolving a security vulnerability. These changes aim to enhance the overall functionality and security of the container engine.

The Envoy proxy has released version 1.37.9, which includes a critical upstream security update for Wasmtime to resolve CVE-2026-54786. The release also addresses several race conditions affecting AWS filters, local rate limiting, and Secret Discovery Service (SDS) configurations.

The Envoy proxy team has released version 1.36.13, which includes a critical security update for WebAssembly support. The release also resolves several race conditions affecting AWS filters, local rate limiting, and Secret Discovery Service (SDS) configurations.

A new technical guide demonstrates how to use kagent, a CNCF Sandbox project, to run AI agents as Kubernetes resources. By treating agents as custom resources, users can define them using system prompts, models, and tools within standard YAML manifests. The guide specifically shows how to build an 'agent builder' that uses a local model via Ollama to generate and deploy other agents.

A CNCF blog post addresses the organizational failure of implementing NIS2 and DORA regulations within Kubernetes platform teams. It argues that compliance fails when security teams own the regulation name without owning the technical implementation. The article proposes a traceability chain that converts regulatory requirements into specific Kubernetes artifacts and sprint items owned by platform engineers.

The Envoy proxy team has released version 1.39.3 to address two security vulnerabilities. These issues involve service crashes triggered by requests lacking a :path header, such as CONNECT requests, when using oauth2 or api_key_auth filters.

The Envoy proxy has released version 1.38.6 to address two specific security vulnerabilities. These fixes prevent service crashes triggered by requests lacking a :path header, such as CONNECT requests, when using oauth2 or api_key_auth filters.

The Envoy proxy project released version 1.37.8 with security fixes for two crash vulnerabilities. Both flaws involve requests without a :path header, which occurs with CONNECT requests. The oauth2 filter would crash outright, while the api_key_auth filter crashed when hide_credentials was enabled with a query key source and authentication came from another key source. Both filters now reject such requests with HTTP 400.

Kubernetes is transitioning to cgroup v2 to leverage improved resource isolation and modern management features. Starting with Kubernetes v1.35, the failCgroupV1 setting defaults to true, meaning kubelet will fail to start on nodes using cgroup v1 unless manually overridden. This move follows the maintenance mode status of cgroup v1 support initiated in version 1.31.

Following the General Availability of node swap in Kubernetes v1.34, new benchmarks demonstrate how backing swap with fast NVMe SSDs can mitigate memory constraints. The analysis shows that for workloads like sandboxed Python runtimes and headless browsers, pod density can increase by 100% to 300% with minimal latency impact. This approach uses cgroup v2 to provide independent swap accounting, solving previous limitations found in cgroup v1.

The Prometheus 3.13.4 release includes critical security updates to address memory exhaustion via HTTP/2 DATA frame fragmentation. It also resolves issues with float native histogram corruption in federation and fixes scraping failures for specific protobuf float histograms.