# K8s Published articles for K8s. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Kubernetes Security Essentials: Consistent security posture management across your Kubernetes environments DevFeed: [Kubernetes Security Essentials: Consistent security posture management across your Kubernetes environments]() Original publisher: [Read original article]() Author: Michiel de Lepper Published: 2026-11-06T16:13:06Z Content type: release Language: en Sources: [Dynatrace news]() Topics: [Security](), [observability](), [dynatrace](), [Open Policy Agent]() Tags: [essentials](), [k8s](), [kubernetes](), [kubernetes-security](), [kubernetes-security-posture-management](), [posture-management](), [product-news](), [security](), [security-posture]() ### AI overview Kubernetes Security Essentials adds a default-on baseline to Dynatrace KSPM, checking supported monitored clusters for common misconfigurations without an additional node-level collector. It evaluates Kubernetes API objects already collected, including workload specifications, RBAC bindings, service accounts, namespaces, and network policies. Checks cover workload hardening, access control, isolation and exposure, and configuration hygiene. Findings link to Kubernetes observability data through Grail and Smartscape, helping teams investigate affected workloads and assess operational impact; Dynatrace Assist can provide remediation guidance, while DQL and Workflows support querying and routing findings. Distribution-specific benchmark profiles, available for platforms including EKS, AKS, and vanilla Kubernetes, can add deeper assessments; unlike Essentials, some require a node-level collector. The article says additional benchmark profiles and broader compliance mappings are under evaluation or development. ### Source excerpt Dynatrace Kubernetes Security Posture Management (KSPM) now includes Kubernetes Security Essentials: a default-on profile that checks supported monitored clusters for common security misconfigurations without requiring an additional node-level collector. It gives teams a consistent security baseline across supported Kubernetes distributions and versions, with findings connected to Kubernetes observability data to help prioritize action. Across supported [...] The post Kubernetes Security Essentials: Consistent security posture management across your Kubernetes environments appeared first on Dynatrace news. ## Groundcover automates Kubernetes sizing. Engineers set the bounds. DevFeed: [Groundcover automates Kubernetes sizing. Engineers set the bounds.]() Original publisher: [Read original article]() Author: Meredith Shubel Published: 2026-11-05T17:14:41Z Content type: news Language: en Sources: [Kubernetes Overview, News and Trends | The New Stack](), [The New Stack]() Topics: [Cloud Native Operations](), [kubectl](), [linkerd]() Tags: [agent](), [ai](), [automate](), [automated](), [automation](), [autonomous-infrastructure](), [autoscalers](), [balance](), [behavior](), [beta](), [capacity](), [challenge](), [change](), [cpu](), [deployments](), [finops](), [groundcover](), [infrastructure](), [k8s](), [kubernetes](), [memory](), [observability](), [post](), [sponsor-groundcover](), [sponsored](), [sponsored-post]() ### AI overview Groundcover's beta uses production telemetry from its eBPF sensor and Wand's optimization engine to recommend and continuously adjust CPU and memory requests for Kubernetes Deployments, weighing workload usage, traffic patterns, and node-level contention. Engineers can inspect recommendations and estimated savings before opting in; automation is off by default, and engineers set minimum and maximum request bounds. The beta changes requests, not limits, leaves HPA- or KEDA-managed resources unchanged, and uses in-place resizing where possible, with a rollout fallback. New Deployments remain in learning until enough data is available. It supports Deployments and sidecars, requires a supported sensor version, and is available at no additional cost to groundcover customers; other workload kinds are on the roadmap. Savings estimates use adjustable default list prices, and actual bill reductions depend on whether freed capacity reduces billed infrastructure. ### Source excerpt On Tuesday, groundcover launched Autonomous Infrastructure in beta to continuously adjust CPU and memory requests for Kubernetes (K8s) Deployments based The post Groundcover automates Kubernetes sizing. Engineers set the bounds. appeared first on The New Stack. ## One Signed Answer: SLSA Verification Summaries for registry.k8s.io Images DevFeed: [One Signed Answer: SLSA Verification Summaries for registry.k8s.io Images]() Original publisher: [Read original article]() Author: The Kubernetes Authors Published: 2026-10-28T00:00:00Z Content type: article Language: en Sources: [Kubernetes Contributors Blog]() Topics: [slsa levels](), [software artifact signing](), [container image compliance](), [container images](), [Container Image Building](), [CI/CD](), [reproducible builds]() Tags: [build](), [builder](), [clusters](), [container](), [container-images](), [identity](), [image](), [images](), [k8s](), [kubernetes](), [manifest](), [policy](), [promotion](), [provenance](), [pull-request](), [registry](), [repositories](), [repository](), [slsa](), [verification]() ### AI overview The Kubernetes image promoter now evaluates staging-image provenance against each project's policy in kubernetes/k8s.io, copies accepted attestations to registry.k8s.io, and publishes a signed SLSA verification summary (VSA) for each promoted image. Consumers can check the summary signer, verifier ID, result, and required build level with cosign and jq, or download it and run slsa-verifier with crane. Pin both signer and level: PASSED alone may mean only that promotion used a reviewed manifest, and an image without a policy can receive SLSA_BUILD_LEVEL_UNEVALUATED. SPO's v1.1.1 operator images, binaries, and Helm chart reach level 3; its bundle reaches only level 1 in that release, so a level 3 check fails. Projects need signed staging provenance, a manifest policy, and a test run. Cloud Build can provide level 1; level 3 requires provenance from an isolated GitHub workflow, then verification and attachment to the matching staging digest. Roll out policies in warn mode, test with kpromo cip, verify summaries, then use require to block violations. Summaries are created once at promotion, and most images promoted before October 2026 lack them; multi-architecture platform images need, ### Source excerpt The Kubernetes community has been signing its container images since v1.24, and the images that kpromo, the Kubernetes image promoter (rewritten earlier this year), copies to registry.k8s.io get a signature. A signature answers one question: did this image go through the official promotion process? It does not answer the more interesting one: how was this image built, and from which source? Projects can attach signed SLSA provenance to their images to answer that. But to check it yourself, you have to know who builds each image, which identity signs its provenance, which builder it claims and which repository it comes from, for every project you pull from. That is a lot to ask, and in practice few people do it. Since October 2026, the image promoter does this work for you, once, at promotion time, and publishes the answer as a signed SLSA verification summary (VSA) for every image it promotes. In this blog post, I'd like to explain how it works, how you can verify it, and how your project can get its images verified at SLSA build level 1 or 3. How does it work? A project declares a provenance policy in its promoter manifest in kubernetes/k8s.io: who may sign its build attestations, which builders it trusts and at which level, and which source repositories its images come from. When a reviewed pull request promotes an image, the promoter evaluates the attestations of the staging image against that policy with the SLSA verifier, copies the accepted attestations to registry.k8s.io and writes the summary: flowchart LR build["Project build"] staging[("Staging registry")] policy["Provenance policy in kubernetes/k8s.io"] promoter["Image promoter"] prod[("registry.k8s.io")] users["Users and clusters"] build -- "image and signed provenance" --> staging staging --> promoter policy --> promoter promoter -- "image, attestations, verification summary" --> prod prod -- "verify one summary" --> users The summaries are signed by a dedicated identity, promoter-summaries@ ## Kubernetes cannot pull the specified container image DevFeed: [Kubernetes cannot pull the specified container image]() Original publisher: [Read original article]() Author: Devops Diaries Published: 2026-10-16T09:12:09Z Content type: article Language: en Sources: [DevOps.dev]() Topics: [Azure Kubernetes Service](), [container images](), [Docker Image]() Tags: [aks](), [azure](), [azure-kubernetes-service](), [cloud-computing](), [container](), [container-image](), [deployment](), [devops](), [image](), [k8s](), [kubernetes]() ### AI overview ImagePullBackOff means the kubelet on a Pod's node could not pull a required container image and is delaying before retrying; it signals a failed pull rather than identifying the root cause. A Pod can encounter it even if the node already has an image matching the requested tag: with imagePullPolicy set to Always, the kubelet attempts a pull anyway, so an unavailable image can still cause the error. The excerpt explains this mechanism but does not provide the promised list of causes or fixes. ### Source excerpt ImagePullBackOff is one of the most common Kubernetes deployment failures in Azure Kubernetes Service (AKS). It means the kubelet cannot... Continue reading on DevOps.dev " ## etcd Explained: The Brain Behind Kubernetes -- And Why Every DevOps Engineer Should Know It DevFeed: [etcd Explained: The Brain Behind Kubernetes -- And Why Every DevOps Engineer Should Know It]() Original publisher: [Read original article]() Author: DevOps voice Published: 2026-10-09T10:11:39Z Content type: article Language: en Sources: [DevOps.dev]() Topics: [etcd](), [DevOps]() Tags: [api-server](), [database](), [devops](), [devops-engineer](), [etcd](), [k8s](), [kubectl](), [kubernetes](), [kubernetes-cluster](), [pods]() ### AI overview The excerpt introduces etcd as where Kubernetes keeps track of cluster information, using a city analogy in which Pods are buildings. It frames etcd as a behind-the-scenes component alongside the API Server and kubectl, but does not provide details about how etcdctl works or how etcd is implemented. ### Source excerpt What is etcd, why does Kubernetes need it, and how does etcdctl actually work? Continue reading on DevOps.dev " ## A technical team manager reflects on finding his voice as a writer DevFeed: [A technical team manager reflects on finding his voice as a writer]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-10-08T20:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [Learning](), [Self-organizing Team]() Tags: [aws](), [blogging](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [don-t](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [manager](), [networking](), [oci](), [security](), [team]() ### AI overview A longtime blogger reflects on losing his writing voice after moving from a technical role to managing a highly technical team. He is reconsidering how to share what he learns as his work and priorities change. ### Source excerpt You might have noticed that it's been quiet here. I know that at least two people noticed, as they contacted me to ask, "Are you OK?" (Thank you to those who reached out.) I am OK. It's been quiet here because, for what is probably the first time since I starting blogging on this site over 21 years ago, I have lost my voice. What does that mean? Every writer has their own voice, their own style of writing that reflects them. It evolves naturally from who they are. It's not just their literary style, although literary style is part of it. A writer's voice encompasses why they write and how they write. While one writer's voice might be like another's, I believe each writer's voice is uniquely their own. It's like their appearance--two people can be similar, but each person's appearance is uniquely their own. From the beginning, this site was a way for me to document what I was learning and share that learning with others. That has always been its primary purpose. I didn't write to "get noticed," and I didn't write to become an "influencer" or a "content creator." I wrote to share knowledge and information. It wasn't too terribly long after I started writing that I realized I had accumulated enough knowledge to be somewhat authoritative in certain areas, and that realization helped me find my voice. I was a "technical expert," and that fueled my drive to share what I'd learned with others, to spare them from stepping in the same potholes that I'd stepped in along the way. This is the approach I followed for many years here. As I learned something, then my readers learned something too. Things are different now. Some time ago I moved from being a member of a highly technical team to being a manager of a highly technical team. I am not as deeply embedded in the technology on a day-to-day basis, and we all know the technology field moves quickly. I don't feel that I have the same depth of technical expertise I used to have, and thus I don't feel justified to speak from the ## K3s vs. K8s: When lightweight Kubernetes distros win (and when they don't) DevFeed: [K3s vs. K8s: When lightweight Kubernetes distros win (and when they don't)]() Original publisher: [Read original article]() Author: Peter Smails Published: 2026-10-02T13:00:00Z Content type: comparison Language: en Sources: [Kubernetes Overview, News and Trends | The New Stack](), [The New Stack]() Topics: [k3s](), [Kubernetes](), [CI/CD]() Tags: [architecture](), [attack-surface](), [ci-cd](), [cloud](), [complexity](), [container](), [containers](), [continuous-integration](), [control-plane](), [controller](), [ecosystem](), [edge-computing](), [it](), [k3s](), [k8s](), [kubernetes](), [post-contributed](), [sponsor-suse](), [sponsored-post-contributed](), [suse]() ### AI overview This comparison explains how K3s reduces Kubernetes resource use and operational overhead through a consolidated, lightweight distribution, while standard Kubernetes offers broader flexibility. It outlines use cases including edge deployments, developer environments and CI/CD, and describes situations where standard Kubernetes may be preferable, such as complex or regulated workloads. ### Source excerpt The Kubernetes ecosystem has a complexity problem, and most teams already know it. Standard Kubernetes (K8s) is extraordinarily powerful, but The post K3s vs. K8s: When lightweight Kubernetes distros win (and when they don't) appeared first on The New Stack. ## Kubernetes Pods Explained: A Simple Guide to Understanding Pods DevFeed: [Kubernetes Pods Explained: A Simple Guide to Understanding Pods]() Original publisher: [Read original article]() Author: DevOps voice Published: 2026-10-02T08:04:47Z Content type: article Language: en Sources: [DevOps.dev]() Topics: [kubectl]() Tags: [devops](), [devops-practice](), [docker](), [k8s](), [kubernetes](), [kubernetes-pods](), [pods]() ### AI overview The excerpt introduces the distinction that Kubernetes runs containers through Pods rather than directly, and frames understanding the relationship among containers, Pods, and nodes as a foundation for understanding Kubernetes. It does not provide the promised details about how Pods work, scale, or are created. ### Source excerpt What a Pod is, why Kubernetes uses it, how Pods scale, and how to create your first Pod Continue reading on DevOps.dev " ## Multi-region high availability for Kafka workloads with a single Stretch Cluster DevFeed: [Multi-region high availability for Kafka workloads with a single Stretch Cluster]() Original publisher: [Read original article]() Author: David Yu Published: 2026-08-11T00:00:00Z Content type: article Language: en Sources: [Redpanda]() Topics: [Apache Kafka](), [Kubernetes](), [Availability](), [Replication](), [Raft](), [Resilience](), [stream-processing]() Tags: [clusters](), [k8s](), [kafka](), [raft](), [release](), [replication](), [resilience](), [stream-processing]() ### AI overview Redpanda Operator 26.2 introduces generally available Stretch Clusters, allowing one logical Redpanda cluster to span multiple Kubernetes clusters and regions. The release provides synchronous replication with Raft-based automatic failover, safer broker rolling restarts, Redpanda Connect pipelines as Kubernetes resources, and Gateway API support for Redpanda Console. ### Source excerpt Redpanda Operator 26.2 brings GA Stretch Clusters for multi-region replication, Redpanda Connect pipelines as K8s resources, Gateway API support, and safer rolling restarts. ## Kubernetes Isn't New, But AI Makes It Scary Again DevFeed: [Kubernetes Isn't New, But AI Makes It Scary Again]() Original publisher: [Read original article]() Author: Andy Suderman Published: 2026-07-23T17:00:00Z Content type: opinion Language: en Sources: [Fairwinds]() Topics: [Kubernetes](), [Artificial Intelligence](), [AI Platform](), [cloud-infrastructure](), [Scalability](), [GPU](), [Inference](), [Data pipelines](), [Security]() Tags: [ai](), [artificial-intelligence](), [compute](), [general](), [gpu](), [guardrails](), [inference](), [infrastructure](), [k8s](), [kubernetes]() ### AI overview This opinion article argues that AI workloads are making Kubernetes adoption feel difficult again. It explains how GPUs, bursty traffic, scaling, data pipelines, workload placement, cost control, and security guardrails complicate production operations, while managed Kubernetes services can ease initial adoption. ### Source excerpt Kubernetes isn't brand new anymore. Yet, for many teams, adopting it still feels intimidating. Even if you've watched Kubernetes become the default foundation for production software and AI workloads, it can still feel like a big leap when you're the one making the call. ## Platform engineering tools you NEED to know in 2026 DevFeed: [Platform engineering tools you NEED to know in 2026]() Original publisher: [Read original article]() Author: Mallory Haigh Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Backstage](), [engineering-culture](), [Kubernetes](), [API](), [Orchestration]() Tags: [api](), [architecture](), [culture](), [developers](), [engineering](), [guide](), [how-to](), [k8s](), [kubernetes](), [platform](), [platform-engineering](), [tools]() ### AI overview A strategic guide to platform engineering tools in 2026, emphasizing adoption, developer workflows, culture, product thinking, and architectural principles over tool installation or vendor marketing. It introduces a three-tier platform architecture and discusses backend orchestration through a unifying API, with examples including Backstage and Kubernetes. ### Source excerpt Platform engineering tools you need for 2026, framed by adoption-first thinking, three-tier architecture, and the must-know stack from K8s to AI. ## Technology Short Take 197 DevFeed: [Technology Short Take 197]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-06-19T14:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [Network](), [Artificial Intelligence](), [code security](), [Vulnerabilities](), [cloud security](), [Amazon Web Services](), [Kubernetes]() Tags: [ai](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [code-security](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [open-source](), [security](), [technology](), [vulnerabilities]() ### AI overview A commentary roundup covering radical network redesign at AWS, quantum computing's implications for encryption, AI's effects on certifications and code security, AI agent exploits, open-source vulnerabilities, Kubernetes resources, cloud operations, the AI bubble, and AWS IAM guidance. ### Source excerpt Welcome to Technology Short Take 197! I've been traveling for business for the last week, so this Technology Short Take has a tad fewer links than I typically include. Even so, I still have links on radical new network designs, the impacts of AI on code security, things beginners get wrong about AWS IAM, and more! Let's get into the content. Networking This story about a radical network redesign at AWS--along with this accompanying arXiv paper--was intriguing to me. I'm not a networking expert, but designing networks with quasi-random connections between endpoints definitely flies in the face of the traditional wisdom. I do wonder, though, if this is the sort of technology that only makes sense for the hyperscalers, and not for the rest of us. Doug Dawson provides a quick update on current encryption standards and what he terms the "pending encryption crisis" presented by quantum computing. It would appear that AI is affecting even Cisco's well-known industry certifications, as outlined by Daniel Dib. Security CodeRabbit shared the results of an analysis of PRs to open source projects showing that AI-written code produces ~1.7x more issues. Along the same lines, Jens Wessling of Veracode indicates that 45% of all AI-generated code samples contained OWASP Top 10 security vulnerabilities. Anyone who didn't expect seemingly-dangerous AI agent security exploits to appear hasn't been paying attention. Enterprise AI tools don't appear exempt, either. The complex interdependencies of open source software projects once again means that a single critical vulnerability threatens a much larger number of projects and tools. Cloud Computing/Cloud Management This is an older post, but the author recently updated it--check out Marcus Noble's recommended resources for Kubernetes newbies. I am not yet sure about pulumi do (direct operations for any cloud resource; see the Pulumi blog post about it). On one hand, I can see the utility in situations where you "just need a quick" whatever ## The Best Managed Kubernetes Hosting in 2026 DevFeed: [The Best Managed Kubernetes Hosting in 2026]() Original publisher: [Read original article]() Author: Angelo Saraceno Published: 2026-05-26T00:00:00Z Content type: opinion Language: en Sources: [Railway]() Topics: [Amazon Elastic Kubernetes Service](), [hosting](), [Azure Kubernetes Service](), [Gke](), [Managed Services](), [Self-hosted](), [Digital Ocean](), [CI/CD]() Tags: [2026](), [cloud](), [cost](), [hosting](), [k8s](), [kubernetes](), [managed](), [managed-kubernetes](), [railway]() ### AI overview The article argues that Kubernetes suits teams with large service fleets and a platform team, compliance or multi-tenancy needs that require workloads in their own VPC, or specialized workloads such as GPU pools and custom operators. Managed services run the control plane, but teams still operate nodes, autoscaling, ingress, secrets, observability, networking, and policy. The ranking favors AWS EKS for AWS-native production workloads and Google GKE for a polished experience; GKE Autopilot reduces node operations through per-pod pricing but limits some workload flexibility. Azure AKS is positioned for Microsoft-aligned shops, while smaller providers trade ecosystem depth for accessibility, price, or regional strengths. Northflank offers a PaaS interface over Kubernetes, including BYOC, at the cost of another vendor layer. The article recommends weighing those operational costs against concrete requirements before choosing a provider. ### Source excerpt Most teams searching 'best managed Kubernetes' should be asking 'do I actually need Kubernetes.' An honest ranking, with the four cases where K8s is the right answer and the cost of running it when it isn't. ## Technology Short Take 196 DevFeed: [Technology Short Take 196]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-05-22T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [data centers](), [Network](), [Cybersecurity](), [Linux](), [Terraform](), [Artificial Intelligence](), [Ansible](), [Large Language Model](), [Cloud](), [cURL](), [npm]() Tags: [ai](), [ansible](), [article](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [curl](), [cybersecurity](), [data-center](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [llms](), [networking](), [npm](), [oci](), [security](), [technologies](), [terraform]() ### AI overview Technology Short Take 196 is a curated list of articles about data center technologies, covering networking, servers and hardware, security, cloud management, operating systems, and applications. Topics include Ansible and IPSet, WireGuard and Headscale, a compromised Bitwarden CLI package on NPM, curl vulnerabilities, Terraform, AWS MCP Server, AI-assisted infrastructure as code, llama.cpp on Apple Silicon, Chrome's local AI model installation, Linux 7.0 and PostgreSQL, and Linux desktop voice typing. ### Source excerpt Welcome to Technology Short Take 196! Just in time for the US Memorial Day holiday, I am back with another list of articles related to various data center technologies like networking, security, operating systems, and applications. You will find articles on VPNs, Linux local privilege escalation (LPE) vulnerabilities, browser quirks and workarounds, the death of Terraform (again), and so much more. Enjoy your weekend reading! Networking Andrew Ward shares an Ansible role to block abusive subnets using IPSet. From this article on switching to WireGuard from Tailscale, I learned about Headscale (an open source implementation of the Tailscale control plane). Servers/Hardware Doug Dawson looks at some innovations that continue to improve computing power. Doug's article includes a few items I hadn't yet heard of. Security Bitwarden confirmed a compromise of its CLI package on NPM. First, we had CopyFail. Now we have Dirty Frag and Fragnesia. Daniel Stenberg talks about how Mythos found a single vulnerability--yes, just one--in curl. I don't really have words for this...security incident? That doesn't seem like the correct way to describe such a massive oversight, especially when you realize it happened to a cybersecurity agency. "Oops" doesn't even begin to describe it. Cloud Computing/Cloud Management Graham Gilbert insists Terraform is dead. I wonder what sorts of things the AWS MCP Server will make possible? William Collins argues in favor of AI through IaC rather than instead of it. I enjoyed this article. Collins indicates that while authoring IaC using LLMs is working rather well, managing infrastructure using LLMs is another story entirely. If you're at all interested in the intersection of LLMs and IaC, I'd add this to your reading list. Operating Systems/Applications Eric Sloof looks at using llama.cpp to run your own local, private AI stack on Apple Silicon. Mat Duggan examines his descent from artist to mercenary as a result of finding LLMs more useful than he exp ## Technology Short Take 195 DevFeed: [Technology Short Take 195]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-05-08T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [Artificial Intelligence](), [Large Language Model](), [Security](), [API keys](), [Automation](), [Kubernetes](), [Network](), [Ollama](), [Local AI]() Tags: [ai](), [api-keys](), [article](), [aws](), [blog](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [llm](), [networking](), [oci](), [ollama](), [security]() ### AI overview Technology Short Take 195 is a curated roundup of technology articles and posts, with an unplanned emphasis on AI and large language models. It covers API-key storage, AI tools and assistants, AI workflow automation, AI-agent security, Kubernetes security, networking, Ollama and local LLM experiments, Terraform versus OpenTofu, and cloud management. ### Source excerpt Welcome to Technology Short Take #195! It wasn't planned this way, but it seems like this Tech Short Take is heavily slanted toward AI/LLM-related articles and posts. Topics like security concerns around improper storage of API keys, how developers are using AI tools, spyware getting installed with AI assistants, and how AI/LLMs might be creating barriers to entry for new IT profesionals are all on tap this time around. I hope this unintentional focus doesn't prevent you from finding something useful! Networking Ivan Pepelnjak takes readers through the process of generating partial devices configurations with netlab. It's an older blog post, but it checks out--have a look at this walkthrough of Containerlab and Netlab. (Hat tip to Ivan for the link. Also, bonus points if you understood the reference at the start of this paragraph.) Ah, MTU issues...they don't go away if you migrate to Kubernetes. Security Sean Gallagher and Omid Mirzaei from Cisco Talos discuss how threat actors are misusing AI workflow automation. Before this article on vulnerability triage, I'd never heard of "brocards." Kelby Ludwig reminds folks that you don't want long-lived keys. Davi Ottenheimer tackles the claims about risk from Anthropic's Mythos preview. (Hint: the words "missing", "failed", "fluffy bunny", and "FUD" are involved.) William Collins reminds readers that they still need to pay attention to where they're storing sensitive data like API keys. Copy Fail has been making the rounds on lots of articles and blogs. Clément Nussbaumer looks at Copy Fail from the perspective of going from unprivileged Pod to root on a Kubernetes Node. Here's another one on Copy Fail, this time looking at blocking Copy Fail with Tetragon. Security is an arms race, and trying to secure AI agents is no different. The latest round in the race is a Falco project called Prempti. Cloud Computing/Cloud Management It's a good thing I came across this article about why friends don't let friends use Ollama. I had in ## Technology Short Take 194 DevFeed: [Technology Short Take 194]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-04-17T13:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [data centers](), [Network](), [Cryptography](), [Security](), [Vulnerabilities](), [eBPF](), [Kubernetes](), [Claude Code](), [TLS (Transport Layer Security)](), [ChaCha]() Tags: [article](), [aws](), [blog](), [cilium](), [claude-code](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [critical-infrastructure](), [cryptography](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [security](), [vulnerabilities]() ### AI overview Technology Short Take 194 curates data center technology links covering Reticulum, IPv6 networking, security exploits and vulnerabilities, TLS and QUIC diagrams, Kubernetes security, Claude Code advisories, AWS emulation, and developer tools. ### Source excerpt This is Technology Short Take #194, the latest in my semi-regular series of posts sharing data center technology-related links and articles from around the web. What have I gathered for readers this time? Key topics in Tech Short Take 194 include a new cryptography-based network stack, a look at why folks are revolting against AI, and an in-depth comparison of microVM technologies. On to the content! Networking This is cool. Longtime reader Todd Smith pointed me to Reticulum, a new cryptography-based network stack. Todd also spent some time messing around with Reticulum and shared his findings in two blog posts: first, an initial/introductory post, followed by a post sharing his experience with some Reticulum experiments. Scott Hogg examines building an IPv6 training and testing lab. Security eBPF is taking hold in security exploits, like the tool named "BPFdoor" that is penetrating critical infrastructure networks. Paul Meyer discusses reproducing and mitigating BadAML, an ACPI-based attack vector that can be used to potentially gain access to confidential VMs. Meyer admits that the model in the article assumes the attacker has full control over the host, at which point I would assume "game over" and move on. This site provides not only an illustrated TLS 1.2 connection diagram, but also offers diagrams for QUIC, DTLS, and TLS 1.3 (see the links in the upper right corner). Rory McCune continues his series on unpatchable Kubernetes vulnerabilities. David Chisnall posted a scathing analysis of Mythos on Mastodon (hat tip to Bruce Davie for boosting it into my timeline), and shared a link to an advisory on critical command injection vulnerabilities in Claude Code. Cloud Computing/Cloud Management I recently found this alternative to LocalStack for AWS emulation. How to hide regions and services in the AWS console is a useful thing to know about. Operating Systems/Applications Chris Down breaks down the differences between zswap and zram. Micah Kepe introduces his new ## Technology Short Take 193 DevFeed: [Technology Short Take 193]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-04-03T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [data centers](), [Network](), [Security](), [GitHub Actions](), [GitOps](), [ingress-nginx](), [Docker](), [litellm](), [Large Language Model]() Tags: [aws](), [blog-post](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [github-actions](), [gitops](), [go](), [iac](), [ingress-nginx](), [k8s](), [kubernetes](), [linux](), [litellm](), [networking](), [oci](), [security](), [technology]() ### AI overview Technology Short Take 193 is a curated roundup of data center technology links covering networking, IPv4 address space, consumer-router regulation, servers and hardware, security incidents involving Trivy and software supply chains, Ingress-NGINX migration, GitOps, local LLMs, and infrastructure management. ### Source excerpt Welcome to Technology Short Take #193! I know it has only been a couple weeks since the last Tech Short Take, but I am guessing that readers won't really mind another one. Here is my latest collection of articles and posts about data center-related technologies. Enjoy! Networking Brian Linkletter shares his 2026 list of network simulators and emulators. (Hat tip to Ivan P. for the link.) Emmanuel Vitus brings to light a battle over IPv4 address space and the control of the regional internet registries. Doug Dawson discusses the recent FCC ban on consumer-grade routers and the potential impacts to industry and ISPs. Servers/Hardware RIP Mac Pro. I had a "classic Mac Pro" (2012 era) for a long time, and I loved that system. (I even ran Linux on it for a while.) It is a shame to see it go. I mentioned on social media (Mastodon/Bluesky) that I recently purchased all the hardware for a new PC build. It'll be part PC/part home server, as I look to expand the type and scope of services that I self-host. Don't be surprised if a few articles emerge out of this. Security Trivy's GitHub Actions were compromised by attackers, leading to the exposure of CI/CD secrets. This post on the Socket blog has more details, and Rose Security has a write-up that provides more details on how a typosquatted domain and a fake version tag were involved. At least one other software supply chain exploit has been tracked back to the Trivy compromise: the Python litellm module on PyPI steals credentials. The Docker side of the Trivy compromise is shared in detail in this Docker blog post. Cloud Computing/Cloud Management Looking for some help in migrating away from Ingress-NGINX? This announcement of Ingress2Gateway 1.0 might be just what you are seeking. The FluxCD team published a post discussing Morgan Stanley's "Stairway to GitOps" presentation, which describes the firm's five-year journey from push-based pipelines to a self-service GitOps platform. Although I am not an AI fanboy, I do recogni ## Talking About Pulumi and Network Automation DevFeed: [Talking About Pulumi and Network Automation]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-24T14:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [Infrastructure as code](), [Network](), [Automation](), [Python]() Tags: [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [network-automation](), [networking](), [oci](), [podcast](), [pulumi](), [python](), [security]() ### AI overview The article introduces a Network Automagic podcast episode about Pulumi, its infrastructure-as-code model using general-purpose programming languages, and its potential role in network automation. It specifically discusses using Pulumi with Python for network automation tasks. ### Source excerpt Heard about Pulumi, but aren't sure what it is? Maybe you know a little bit about Pulumi--like that it does infrastructure as code (IaC), but using general purpose programming languages--and you're wondering where it fits in a larger automation framework? Or maybe you're a network engineer just starting to dabble in network automation, and you're wondering if this Pulumi thing is something you should check out. If any of these apply to you, then the latest Network Automagic podcast episode is right up your alley. I recently had the opportunity to join Steinn Bjarnarson and Urs Baumann for an episode of Network Automagic. The focus of our discussion--although I will say we diverged a bit here and there--was on Pulumi, what it is, and whether it fits into a larger network automation framework. After all, if you can use general purpose programming languages like Python with Pulumi, why not just use Pulumi in a Python program that also does network automation stuff? All in all, recording the podcast with Steinn and Urs was great fun, and I hope that the final product ends up being helpful for folks. There's a variety of ways to listen in on the episode: Via the Network Automagic web site Via the Network Automagic channel on YouTube (here is a link to the specific episode) Via Spotify Via Apple Podcasts As you can see, there are plenty of options to listen (and a few that I didn't include--check the Network Automagic web site for more!). Thanks to Steinn and Urs for having me on the show! ## Technology Short Take 192 DevFeed: [Technology Short Take 192]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-20T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [data centers](), [Network](), [Security](), [iOS](), [Kubernetes](), [AWS Lambda](), [GrapheneOS](), [Web](), [Cloud]() Tags: [article](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [ios](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [privacy](), [security](), [technology]() ### AI overview Technology Short Take 192 is a curated roundup of links about data center technology. It covers autonomous network engineering with Claude, an iOS exploit kit, Kubernetes security and Gateway API support in AWS Load Balancer Controller, AWS Lambda containers, container security for autonomous agents, software migration, GrapheneOS hardware prospects, Windows 12 reporting, and Linux. ### Source excerpt Welcome to Technology Short Take #192! Who's interested in some links to data center technology-related articles and posts? If that's you, you're in the right place. Here's hoping you find something useful! Networking Interested in an autonomous network engineering agent powered by Claude? (Hat tip to Russ S. for sending this my way.) Security Google's Threat Intelligence Group recently published some details around Coruna, an iOS exploit kit targeting a range of iOS versions and equipped with a number of potential exploits. As an example of one of the challenges around "default" secuity settings, Rory McCune highlights the fact that MicroK8s does not enable role-based access control. Bryce Kerley explains Web PKI--the infrastructure that powers secure connections on the modern Web. Mike Masnick writes about the massive surveillance stack hiding inside the "age verification" checks. Cloud Computing/Cloud Management I've had this article on AWS Lambda for the containers developer sitting in my read queue since first publication in 2023. (Sorry, Massimo.) I finally got around to reading it--really reading it, not just skimming it--and I found it to be helpful in helping me get a better grasp on Lambda. The AWS Load Balancer Controller recently gained support for Kubernetes Gateway API. This allows Kubernetes administrators to use AWS ALBs or NLBs for Gateway resources, and eliminates annotation-based configuration in favor of Custom Resource Definitions (CRDs). Operating Systems/Applications While using containers is certainly a step forward in securing autonomous agents--such as what NanoClaw is doing--I don't think it's enough on its own. Helpful, yes, but there is still more to do. Am I wrong? Does Gentoo's migration from GitHub to Codeberg--obstensibly due to Microsoft's AI emphasis--signal a turning point? The recent announcement of a partnership between Motorola and GrapheneOS opens the possibility for the privacy-focused smartphone OS to arrive on new hardware platfor ## Distributed Python dataframes and machine learning with Livebook and Elixir DevFeed: [Distributed Python dataframes and machine learning with Livebook and Elixir]() Original publisher: [Read original article]() Author: José Valim Published: 2026-03-11T00:00:00Z Content type: release Language: en Sources: [Dashbit Blog]() Topics: [Elixir](), [Python](), [Artificial Intelligence](), [data-engineering](), [Machine learning](), [apache-arrow](), [Kubernetes]() Tags: [apache-arrow](), [distributed](), [elixir](), [fly-io](), [interoperability](), [k8s](), [livebook](), [machine-learning](), [python]() ### AI overview This release adds full Python integration to Livebook, including reproducible environments, Python and Elixir interoperability, zero-copy Apache Arrow data transfers, distributed execution, and deployment across Kubernetes clusters and Fly.io machines. ### Source excerpt Livebook now fully integrates with Python, from reproducible environments to distributed dataframes and machine learning. ## Using Mitmproxy to Observe kubectl Traffic DevFeed: [Using Mitmproxy to Observe kubectl Traffic]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-04T22:30:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [Kubernetes](), [kubectl](), [Linux](), [Ubuntu](), [Authentication](), [Network](), [macOS](), [Amazon Web Services]() Tags: [apt](), [authentication](), [aws](), [certificates](), [cilium](), [cli](), [cloud](), [cni](), [commands](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubectl](), [kubernetes](), [linux](), [macos](), [networking](), [oci](), [security](), [tutorial](), [ubuntu]() ### AI overview This tutorial explains how to use mitmproxy to observe traffic between kubectl and the Kubernetes API Server. It describes the tested Linux and Ubuntu environment, notes that the commands should work similarly on macOS, and discusses extracting client certificates from a Kubeconfig file for certificate-based authentication. ### Source excerpt When I first started learning Kubernetes, I had the idea that observing the network traffic between a client system using kubectl and the Kubernetes API Server would be a useful thing to do. The source of the idea is unclear; I am unsure why I thought this would be useful as a learning tool. Regardless, I continued on with learning Kubernetes and never really pursued this idea--until this week. I found it can be a useful troubleshooting technique, but I will leave it up to you to determine if it is a useful learning technique. In this post, I will show you how to observe kubectl traffic using mitmproxy. This technique is inspired by/informed by Ahmet Alp Balkan's similarly-named blog post from 2019. Unfortunately, I found the instructions there to be incomplete (most likely just due to the passage of time and continued evolution of the tools involved). I used the following tools and environments in my testing: The tests were conducted on a Linux system running Ubuntu 24.04.4. The commands should work similarly on macOS. Mitmproxy was installed from the Ubuntu repositories using apt. kubectl version 1.33.3 was used to communicate to a self-managed cluster on AWS (in other words, not Amazon EKS) running Kubernetes 1.32.9. The cluster was bootstrapped using kubeadm. I wouldn't expect any major/significant differences with other versions of kubectl or Kubernetes. I was using a client certificate to authenticate to Kubernetes. It's unclear to me how this might work--if it works at all--with alternate authentication mechanisms. Prepare Client Certificates Before you can start mitmproxy, you'll first need to extract the client certificates from the Kubeconfig file. A couple of ways exist to do this; a blog post of mine from 2022 contains what I believe is the easiest way. The method involves yq (to extract information from the Kubeconfig) and base64 (to decode the client certificate and client key). Refer to the linked blog post for full details. First, extract the client cer ## Running the Azure CLI in a Container DevFeed: [Running the Azure CLI in a Container]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-02T13:00:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [Azure](), [Docker](), [container](), [Command-line interface](), [Python](), [configuration]() Tags: [aws](), [azure](), [cilium](), [cli](), [cloud](), [cni](), [configuration](), [container](), [containers](), [cri-o](), [devops](), [docker](), [docker-container](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [python](), [security](), [ssh]() ### AI overview This article examines running the Azure CLI in a container. It finds that the standard Docker command works for an interactive shell, but using an alias from the current shell requires persisting Azure configuration and SSH keys. Running as root can also create files with root ownership, potentially requiring a custom image; the author therefore returns to using a Python virtual environment. ### Source excerpt Like perhaps some readers, I am quite particular about what gets installed on my systems. I try to keep my systems as "clean" as possible, doing my best to avoid tools that have an extensive list of dependencies that must be installed and updated. Where that isn't possible--such as with the Azure CLI, which has a massive number of Python modules that are required in order for the tool to function--I will use various isolation mechanisms. For the Azure CLI, that's typically been a Python virtual environment. Somewhat recently, though, I had an idea to try using a container. In this post, I'll share what worked and what did not work when trying to run the Azure CLI in a container. First, though, a disclaimer: I am not an Azure expert, nor am I a Python expert. I know enough to get by. If I share something here that's incorrect, please contact me and constructively show me my errors so that I can fix them. Before I started down this path, I was sure this would be a slam dunk. I mean, this is what containers are for, right? If you do some web searches for running the Azure CLI in a container, you'll find articles that give you this command line: docker run -it mcr.microsoft.com/azure-cli (Note that this assumes you are using Docker instead of something like Podman.) This does work, as long as you're willing to operate in an interactive shell in the container. I was looking for something a bit different: I wanted to create an alias for az that executed the container in my current shell instead of putting me into a separate shell inside the container. Something like this, for example: alias az="docker container run --rm mcr.microsoft.com/azure-cli az" I quickly found that you need to map in your Azure configuration directory from outside the container, or your configuration won't persist. (In theory you could remove the --rm parameter and keep the container around.) Now the docker command in your alias starts to look like this: docker container run --rm -v ${HOME}/.azure:/r ## Technology Short Take 191 DevFeed: [Technology Short Take 191]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-02-27T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [Network](), [Ansible](), [Security](), [Infrastructure as code](), [Artificial Intelligence](), [Large Language Model](), [container](), [VXLAN]() Tags: [ai](), [ansible](), [aws](), [blog](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [gre](), [iac](), [k8s](), [kubernetes](), [linux](), [llm](), [network-automation](), [networking](), [oci](), [security](), [vxlan]() ### AI overview Technology Short Take 191 is a curated collection of commentary and links covering networking, network automation, security, cloud management, containers, operating systems, applications, AI adoption, and software vulnerabilities. ### Source excerpt Welcome to Technology Short Take #191! This is my semi-regular collection of links related to technology disciplines, including networking, security, cloud computing, storage, and programming/development. I hope that I've managed to curate an interesting and useful set of links for readers. Enjoy! Networking I learned a new acronym from Ivan Pepelnjak in his article on "not so passive" OPSFv2 interfaces in Cisco IOS/XR: QDS (Quick and Dirty Solution). I am totally using that from now on. Via Ivan (hat tip to my colleague Russ for pointing me in this direction), I also learned that all is not well in network automation land with Ansible. Although some parts of it are apparently now resolved, this does raise questions about the viability of Ansible for network automation. Doug Dawson talks about the new Amazon Eero Signal, a cellular backup to a primary broadband connection for users using their Eero mesh systems. I agree with Doug--the pricing seems high to me. I generally like the Eero devices, although there have been times when I really could use a bit more control over the settings. Security The APNIC blog features a guest article discussing the use of tunneling protocols to infiltrate networks. The article specifically discusses Generic Routing Encapsulation (GRE) and Virtual Extensible LAN (VXLAN). It's worth a read if your network uses either of these technologies. Cloud Computing/Cloud Management Somewhere along the way I missed the CDK deprecation announcement. If I am not mistaken, this leaves Pulumi as the only cloud-independent IaC tool that lets you use a general purpose programming language. Managing dependencies between containers can be difficult at times; this blog post by Nicolas Fränkel introduced me to wait4x, a tool one can use to help simplify these types of situations. Operating Systems/Applications I appreciated reading Mitchell Hashimoto's AI adoption journey. I feel it does provide a more realistic approach to how someone in a role like his m ## Introducing AI Cyber Model Arena: A Real-World Benchmark for AI Agents in Cybersecurity DevFeed: [Introducing AI Cyber Model Arena: A Real-World Benchmark for AI Agents in Cybersecurity]() Original publisher: [Read original article]() Author: Alon Schindel Published: 2026-02-12T18:05:58Z Content type: article Language: en Sources: [Wiz]() Topics: [Benchmark](), [Cybersecurity](), [Artificial Intelligence](), [agent observability]() Tags: [ai](), [ai-agents](), [ai-models](), [benchmark](), [cyber](), [cybersecurity](), [k8s](), [research](), [security]() ### AI overview Wiz Research introduces the AI Cyber Model Arena, a benchmark suite of 257 real-world cybersecurity challenges covering zero-day discovery, CVE detection, API security, web security, and cloud security. It evaluates combinations of AI agents and models using programmatic, category-specific scoring in isolated Docker containers. ### Source excerpt Wiz Research's AI Cyber Model Arena benchmarks offensive AI security on 257 real-world challenges (zero-days, CVEs, API/web, and cloud across AWS/Azure/GCP/K8s) demonstrating what AI models and agents can really do [Next page]()