September 2026

👋 Intro

Welcome to the September edition of CloudNative.Now - a monthly newsletter that covers all that has been happening in the cloud native world in the past month!

Hello from wonderful 🇧🇬 Sofia, Bulgaria!

Yesterday I had the absolute honour of being the host for KCD Sofia and it was total blast! I had so much fun, the place was packed with eager, friendly community members and the speakers were great! 👏 Huge congratulations to Orlin, Spas and Yoana for putting on such a successful event. If you weren't able to make it, I was spamming LinkedIn all day yesterday with photos and updates so you can go experience the FOMO.

This month's issue heavily focusses on the roundup of Kubernetes v1.37 features and changes. Lots of interesting things in this release and some very welcome improvements.

As always, you’re invited to subscribe to the email newsletter or add the RSS feed to your favourite feed reader to make sure you don’t miss anything! And please help to spread the word and recommend this to your friends and network if you find the content useful! 💙

If you have any feedback or have any links you’d like to suggest please reach out on Bluesky or Mastodon! 💬

📰 News & Articles

• More Kubernetes v1.37 Feature Roundup:
  As Kubernetes v1.37 released right at the end of last month I didn't get a chance to include all the related blog posts that came out over the following couple weeks so here they are for you this month. Enjoy!
  • etcd RangeStream Cuts Memory Use on Large List Reads
  • KubeletInUserNamespace (aka Rootless mode) Graduates to Beta
  • DRA Updates
  • Scale Workloads to Zero with HorizontalPodAutoscaler
  • Advancing Workload-Aware Scheduling
  • Introducing Node Lifecycle Conditions
  • Scheduler Preemption for In-Place Pod Resize (Alpha)
  • Native Histograms Graduates to Beta
  • Memory QoS Graduates to Beta
  • Pod-Level Resource Managers graduated to Beta
  • Hardening Container Storage with Bind Mount Options and EmptyDir Permissions
  • Tracking When a PersistentVolumeClaim Was Last Used (Beta)
• The Life of a Metric - Jesús Espino
  Follow a single metric through its whole life inside VictoriaMetrics: born as a counter in your process, exported over the wire, given an identity and an inverted-index entry, written through an LSM tree, compressed into columnar blocks on disk, read back by a rate() query, downsampled as it ages, and finally deleted when retention runs out.
• Terraform is the wrong tool for building developer platforms - Marc Schnitzius
  Terraform lacks the continuous reconciliation and APIs required for Internal Developer Platforms. Here is why control planes like Crossplane are taking over.
• Klustered Winter 2026 starts 30 October - David Flanagan
  Klustered returns on Friday, 30 October 2026. Contestants race the clock to diagnose and fix deliberately broken Kubernetes clusters.
  I've taken part in this twice before and it's a lot of fun! I highly recommend giving it a try if you're up for it! (Keep an eye out for these showing up in future editions of CloudNative.Now 😉)

🔒 Security

• ⚠️ CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion - kubernetes
  A Medium (5.8 CVSS) vulnerability on Windows nodes where subPath in pod volumeMounts can be set to a symlink, enabling NTLM coercion attacks. This affects Kubernetes pods that mount volumes using symlinks on Windows-based worker nodes.
• ⚠️ CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation - kubernetes
  A Medium (5.9 CVSS) confused deputy attack in the StatefulSet controller allowing users with namespace-scoped write permissions on StatefulSet and ControllerRevision resources to create pods in other namespaces.

🧑‍🏫 Tutorials, Videos & Podcasts

• 📺 Exploring Tetragon in GitHub Actions - eCHO
  Liz Rice and Duffie Cooley demonstrate how to deploy Tetragon's eBPF-based runtime observability in GitHub Actions CI/CD pipelines. They show how to monitor untrusted code execution on runners to detect supply-chain attacks in pipeline infrastructure.
• 📺 What Are SPIFFE and SPIRE? Workload Identity Explained - Whitney Lee
  How do workloads prove who they are? Humans have fingerprints and facial recognition, but a process spinning up in Kubernetes starts with nothing.
  Whitney Lee and Volkan Özçelik explain how SPIFFE and SPIRE solve workload identity bootstrapping in Kubernetes by assigning cryptographic identity at the process level rather than the machine level.
• 📺 Build and Run AI Agents on Kubernetes with Kagent - Whitney Lee
  Kubernetes is already where most production workloads live, and here is a hot take: AI agent workloads belong there too.
  Lin Sun joins Whitney to talk about deploying AI agents directly onto Kubernetes infrastructure using Kagent.
• 📺 OpenLineage - A Common Observability Framework for Data Pipelines - Datadog
  Julien Le Dem, Datadog principal engineer and OpenLineage project lead, explains what OpenLineage is, how it replaces a tangle of brittle one-off integrations with a single common standard, and what the benefits look like in practice.

🧰 Tools

• Tailcat: An open-source CLI for Tailscale’s WireGuard®, NAT traversal, and DERP - Brad Fitzpatrick
  Tailscale has open-sourced tailcat, a Go package and CLI that reuses Tailscale's open-source data plane (WireGuard, NAT traversal, and DERP relay) while dropping the proprietary control plane.
• sofka - Nikola Milojević
  A Kubernetes TUI, reimagined in Rust - built on kube-rs and ratatui, async-first from the ground up.
  If you've used k9s before (which I'm a fan of) this will feel quite familiar. There's a lot of overlap but also some noticeable differences (such as progressively loading resources which really helps on massive clusters)
• unbounded: Kubernetes Without Boundaries - Azure
  From the README: "Run Kubernetes worker nodes anywhere — across clouds, on-prem, and at the edge — connected back to a single control plane."
  This is far from the first time this approach has been attempted (I even wrote about way back in 2021) but this coming from Azure is interesting and could be enough to help it stick.
• kube53 - Cirrostratus.cloud
  Kubernetes on Route53: a hosted zone as the datastore, kubectl-compatible Lambda apiserver, and an ECS/ALB reconciler. A joke that works.
• kor - Yonah Dissen
  A Golang Tool to discover unused Kubernetes Resources.
• tine - amutable-systems
  Build packages, go/Rust projects, and OS images with buck2.
  (Sidenote: I'm excited to see what Amutable are coming out with. Hopefully we see more nice open source tooling coming from thrse smart folks 👀)
• nspawn - nspawn
  A wrapper around machinectl for easy-deployment of nspawn.org containers

🎤 Events and CFPs

Events

• 🇭🇺 KCD Budapest 2026 - 30th October → 4th November

CFPs

• 🇵🇱 ContainerDays | AI Context Warsaw - Deadline 15th December

💬 Social Post of the Month

🤷 Misc & Fun

• Inflight Simulator
  Fly to every country as a passenger. Completed flights collect country flags automatically, even while you’re away.

That's all for this month!
Thank you for reading! 💙

If you enjoyed this post, please spread the word and share with your friends.

~ Marcus 👋