Latest story
ExternalDNS 0.23.0 prevents NS1 and Alibaba Cloud changes during dry-run, while CRD registry users must pin their existing DNSRecord namespace before upgrading.
Read the story →36 stories
Four Gloo Gateway patch releases stop interrupted Envoy validation from being cached as a configuration failure, which could remove a listener during WAF validation.
runc cut its first stable 1.5 release with libpathrs hardening and a new support policy, Prometheus opened a 3.13.0 release candidate with new PromQL functions, and Talos v1.12.9 fixed an etcd client resource leak.
vLLM and SGLang released AI serving updates, while Kubernetes, Kueue, and Helm shipped scheduler, queueing, and release-management fixes.
NVIDIA published NCCL EP v0.1.0 for MoE expert-parallel communication, OpenTelemetry Collector v0.154.0 tightened builder behavior and queue config handling, and cert-manager v1.21.0-alpha.1 added Gateway API and issuer fixes.
Envoy and Istio published June 4 security and mesh patch releases, while NVIDIA NCCL 2.30.7-1 added zero-SM collectives and symmetric-memory improvements for GPU communication.
Fresh analysis covers the Miasma npm supply-chain attack, vLLM serving on DGX Spark, vLLM-Omni GGUF quantization, and CNCF guidance on dynamic Swift service configuration.
Backstage v1.51.0 rewrites the entity listing and facets paths against PostgreSQL indexes, adds incremental Microsoft Graph ingestion, and ships breaking changes to navigation, OIDC defaults, and PortableSchema.
containerd v2.3.1, v2.2.4, v2.0.9, and v1.7.32 fix CVE-2026-46680, a moderate-severity flaw that lets a crafted image override a pod's numeric runAsUser by exploiting integer overflow in OCI USER parsing.
etcd v3.7.0-beta.0 deletes client/v2, v2discovery, and the v2 request path, adds Unix socket endpoints and FastLeaseKeepAlive, and reports up to 2x faster lease, user, and role operations.
Flux v2.8.8 picks up go-git v5.19.1 to address CVE-2026-45571 and CVE-2026-45570, fixes an unbounded memory leak in helm-controller's Kubernetes client transport, and adds GCP sovereign cloud artifact registry support.
An arXiv paper submitted on May 20 introduces Overall FLOP Utilization, a precision-agnostic GPU efficiency metric derived from two on-chip counters, and reports r = 0.78 correlation with application-level MFU across 608 production training jobs on H100 and GB200.
Prometheus v3.12.0-rc.0 introduces experimental start(), end(), range(), and step() PromQL functions, makes head-chunk lookup constant time in range queries, and closes a plaintext-secret exposure in the STACKIT service discovery via /-/config.
SPIRE v1.15.0 graduates Sigstore support in the Kubernetes and Docker workload attestors, ships a HashiCorp Vault Key Manager plugin, and changes CLI JSON output in a way that will break parsers.
vLLM 0.21.0 ships on May 15 with two breaking-class changes — a C++20 compiler requirement and Transformers v4 deprecation — plus the TOKENSPEED_MLA attention backend for DeepSeek-R1 and Kimi-K25 on Blackwell.
Helm v4.2.0 and v3.21.0 both released on May 14, with the v3 release notes now stating that the v3 line is approaching end-of-life — a planning trigger for the long tail of clusters still on v3 charts.
The .spec.externalIPs field on Service objects is formally deprecated in Kubernetes v1.36, with kube-proxy implementation slated for removal in a future minor release. Driven by CVE-2020-8554.
Cilium published v1.19.4, v1.18.10, and v1.17.16 on May 13, fixing IPsec packet drops during key rotation, ARP failures for LoadBalancer services, and a CiliumLocalRedirectPolicy edge case that could override an existing Service frontend.
Kubernetes v1.36 introduces a new PodGroup API alongside the Workload API in scheduling.k8s.io/v1alpha2, separating static templates from runtime state and unlocking DRA for gang-scheduled workloads.
Pressure Stall Information metrics are now GA at node, pod, and container levels in Kubernetes v1.36, giving operators a kernel-grade signal for resource contention without out-of-band tooling.
Kubernetes 1.36.1, 1.35.5, 1.34.8, and 1.33.12 landed on the May 12 cherry-pick window. No CVEs, but a real correctness bug — services getting IPv6 addresses outside their allocated CIDR — is among the fixes.
Released May 12, OTel Collector v0.152.0 adds an alpha processor that normalizes GenAI telemetry from OpenInference and OpenLLMetry to the official OTel GenAI semantic conventions. The Sarama-based implementation inside the kafkametrics receiver is removed and a Cardinality Guardian processor lands in alpha.
On the heels of DRA graduating to GA in v1.36, the May 7 follow-up details one new stable feature — prioritized list — and five betas covering partitionable devices, device taints, device binding conditions, resource health, and extended-resource integration. ResourceClaims also work with the new PodGroup API.
The CNCF Technical Oversight Committee voted to promote Microcks — a multi-protocol API mocking and contract-testing platform — to Incubating status, three years after Sandbox acceptance.
KEP-5866 ships in v1.36 with a new shardSelector field on ListOptions, moving event filtering from clients to the API server. Horizontally sharded controllers no longer pay for the full stream of deserialization on objects they don't own.
CRI-O 1.36.0 and patch releases for 1.35, 1.34, and 1.33 landed on May 5 with CVE-2026-35469 (CVSS 8.7) fixed across the board, alongside new CNI status polling and GOMAXPROCS injection.
The kubelet's CPU, memory, and topology managers extend to pod scope behind the PodLevelResourceManagers and PodLevelResources feature gates. Performance-critical containers keep NUMA alignment while lightweight sidecars share a pod-level budget rather than burning dedicated cores.
Dragonfly's dfget now supports hf:// and modelscope:// with auth and revision pinning. The upside is simpler model distribution and lower origin egress, but benchmark claims still need real cluster data.
Microsoft disclosed a CVSS 10.0 privilege escalation vulnerability in Azure Kubernetes Service. Specific technical details are still sparse, but the confirmed characteristics make this one worth watching.
Kubernetes v1.36, releasing April 22, finalizes DRA to GA, graduates User Namespaces, enables HPA scale-to-zero by default, and formally retires Ingress-NGINX.
Istio's ambient mode gains multicluster support in beta with sidecar-free cross-cluster routing, and integrates the Gateway API Inference Extension for model-aware traffic management.
KubeVirt v1.8 introduces a hypervisor abstraction layer decoupling it from KVM, Intel TDX attestation for confidential VMs, and PCIe NUMA topology awareness for near-native GPU performance.
Kyverno reaches CNCF Graduated status with full CEL adoption, completing its journey from Kubernetes admission controller to a broader policy engine for the cloud native stack.
The distributed LLM inference engine co-created by Red Hat, Google Cloud, IBM Research, CoreWeave, and NVIDIA joins the CNCF, establishing an open standard for inference workloads on Kubernetes.
NVIDIA shifts governance of its Dynamic Resource Allocation driver for GPUs to the CNCF, gets KAI Scheduler accepted as a Sandbox project, and open-sources Grove for AI inference orchestration.
OpenAI announces acquisition of Astral, the company behind Python developer tools Ruff, uv, and ty, with hundreds of millions of monthly downloads. Tools will integrate with Codex.
Anthropic, AWS, GitHub, Google, Microsoft, and OpenAI fund $12.5M through OpenSSF to help open source maintainers cope with the flood of AI-generated security reports and vulnerability discoveries.
Kubernetes, AI infrastructure, and CNCF news by email.
Loading email signup. If it does not load, manage email preferences in account settings.
