Cloud Native & eBPF

Kubernetes is deprecating cgroup v1, with version 1.35 defaulting to a configuration that prevents the kubelet from starting on cgroup v1 nodes.

Envoy 1.40.0 introduces post-quantum hybrid key exchange by default and stabilizes HTTP/3 and QUIC support.

By leveraging cgroup v2 and fast NVMe storage, Kubernetes can now use node swap to significantly increase pod density for bursty or idle workloads.

Envoy 1.37.8 patches two denial-of-service vulnerabilities where CONNECT requests lacking a :path header could crash the oauth2 and api_key_auth filters.

Envoy v1.39.3 addresses two security vulnerabilities that could cause service crashes during specific CONNECT requests.

The Kubernetes community is actively designing integration APIs to make the autoscaler scheduler-aware, addressing failures where GPU pods stay pending despite available cluster capacity.

A production migration of n8n on EKS was achieved by decoupling application state from the main pod to allow a switch from community to official Helm charts.

Istio Service Mesh has released version 1.30.6.

The CNCF is exploring the integration of Software Carbon Intensity (SCI) into OpenTelemetry semantic conventions to provide a standardized way to measure carbon emissions per unit of software work.

Cilium 1.20.3 addresses critical networking bugs, including conntrack garbage collection issues and cloud-specific agent crashes.

Cilium 1.19.9 includes security patches for golang.org/x/net and opentelemetry modules, alongside several networking and stability fixes.

Cilium 1.18.15 addresses endpoint deletion bugs, ip6tables errors, and includes security updates for several dependencies.

Cilium has released version 1.19.9 of its eBPF-based cloud native networking platform.

Nirmata Runtime extends Kyverno's policy enforcement from Kubernetes admission control to kernel-level runtime security using eBPF and LSM.

A new alpha plugin for the Headlamp UI allows users to trace Kubernetes Job admission issues through Kueue resources.

The release introduces development-version metadata for Profiles in OTLP receivers and exporters and improves batch processing efficiency.

Envoy Proxy released version v1.39.4, which includes several bug fixes for issues related to route-level configuration and Prometheus metrics.

Podman 6.1.4 addresses a WSL 3 functionality issue and updates gvproxy to resolve CVE-2026-107935.

Envoy Proxy version 1.38.7 has been released, addressing a security vulnerability and several bugs.

Podman Container Engine has released version 5.8.9, which includes bugfixes and updates to various components.

Envoy v1.37.9 addresses CVE-2026-54786 by updating Wasmtime and fixes multiple thread-safety race conditions.

Envoy v1.36.13 addresses CVE-2026-54786 by upgrading the Wasmtime dependency.

The CNCF Sandbox project kagent allows AI agents to be managed as Kubernetes custom resources via YAML manifests.

Regulatory compliance on Kubernetes fails when regulations are treated as security tickets rather than engineering artifacts.

Envoy v1.38.6 addresses two security vulnerabilities that could cause crashes during CONNECT requests.

Prometheus 3.13.4 addresses a memory exhaustion vulnerability in gRPC and fixes several histogram-related bugs.