The missing piece for zero-touch Kubernetes upgrades isn't better tooling, but better signals.

Jason Deal from AWS argues that pod ready checks and PDBs need to be strong enough for automation to trust them. If those signals are unreliable, human intervention steps in. When they're solid, automation can roll nodes without anyone watching.

The next frontier: better primitives for stateful applications, which can't always be modeled by PDBs and need richer mechanisms to express what "healthy enough to evict" actually means.





Watch the full interview: https://ku.bz/1_-DTgLsg

This article sketches how to build a shared-memory fabric with RoCE v2 in Kubernetes, bypassing the CNI overlay with RDMA for tightly coupled workloads.
The author states upfront that it is untested design work, not benchmarked guidance.

More: https://ku.bz/jwTMnqRTL

This article explains how CNI connects Kubernetes pods, how ADD, DEL, and CHECK work, and how Flannel, Calico, and Cilium move traffic differently.

More: https://ku.bz/FDkSSqmvF

This week on Learn Kubernetes Weekly 205:

🚨 How Kubernetes Health Checks Brought Down a Payment Service
🏗️ The cluster that runs on our own metal: rebuilding survey processing on hybrid Kubernetes
⚡ The Fastest Redis Call Is the One You Never Make
🌐 CNI Deep Dive
🤔 Why did CPUs never have this problem?

Read it now: https://kube.today/issues/205

⭐️ This newsletter is brought to you by LearnKube — understand how Kubernetes works, and what to do when it breaks. Live training with 60% hands-on labs https://ku.bz/hypSbyc-V

"Point-in-time recovery is not a core database feature—it didn't make sense that we should experience downtime just to get it."

Ziv Yatzik tested multiple backup solutions for Patroni. The problem: they all required local disks that could fill up and crash the database. Every tool they tried was either buggy or architecturally fragile.

The lesson: your backup system shouldn't be a single point of failure.



Watch the full episode: https://ku.bz/Rg_sQYSmw

kubectl-config-doctor is a CLI plugin that detects broken, misconfigured, or unreachable kubeconfig setups—catching issues like duplicate contexts, invalid auth methods, missing files, or unreachable APIs.

More: https://ku.bz/Whfwxjb38

This article lays out an AI-assisted AWS DevSecOps pipeline on EKS, where Amazon Q reviews code, Inspector gates the image, DevOps Guru watches production and Step Functions decide when auto-remediation may run without a human.

More: https://ku.bz/LL-lCFNc0

DPF is a Kubernetes-native framework for provisioning and orchestrating NVIDIA BlueField-3 DPUs.

It abstracts DPU management and offloads networking and storage workloads from host servers to Linux-based arm64 DPUs using the DOCA software stack.

More: https://ku.bz/yzQLfQ3N6

If you're running I/O-intensive workloads, traditional block storage latency becomes a bottleneck.

Simplyblock CSI bypasses kernel I/O and leverages user-space SPDK over NVMe-oF to deliver bare-metal performance within Kubernetes.

More: https://ku.bz/tpz35thV_

CPU and memory usage need context before you change Kubernetes requests and limits.

Throttling, pressure, and runtime events help explain the usage graph. Looking at each replica separately shows differences that a workload average can hide.

We are releasing the Kubernetes Resource Review Mixin, an open-source Grafana dashboard with Prometheus recording rules.

You can use it to:

- See how each Pod's CPU and memory usage compares to its requests and limits.
- Inspect CPU throttling, CPU and memory pressure when PSI metrics are available, and OOM and restart activity.
- Review replicas and workload revisions separately, with p95, maxima, and resource differences in the tables.

The mixin is an extension of our book on rightsizing Kubernetes workloads, The Technical Guide to Kubernetes Rightsizing.

Clone it here: https://github.com/learnk8s/resource-review-mixin

This tutorial teaches how to build a Raspberry Pi K3s homelab by preparing nodes, enabling cgroups, configuring networking, joining agents, and deploying a Skaffold demo app.

More: https://ku.bz/dVBHR_Ztk

The kubelet pulls images one at a time by default. That means one large image can block everything behind it.

Jan Ludvik found that this was silently slowing down node startup. A single flag (serializeImagePulls=false) enables parallel pulls. You can also set maxParallelImagePulls to avoid overloading the node.

The biggest surprise? This is the default in every Kubernetes cluster, and most teams never change it.



Watch the full episode: https://ku.bz/B7TzKXyxf

LearnKube Day includes ten five-minute lightning talks from Kubernetes practitioners sharing practical lessons with the community.

Graziano Casto, Developer Advocate at Akuity, is one of the featured lightning-talk speakers at LearnKube Day Salt Lake City 2026.

The event brings together, lightning talks, YAML Games, and a community reception with a live DJ(our own Amin Astaneh).

Learn more: https://learnkube.com/learnkube-day-salt-lake-city-2026

This week on Learn Kubernetes Weekly 206:

🌐 DNS Is Weird Inside Kubernetes on AWS
⏳ TIL: Kubernetes ConfigMap Volume Mounts Are Eventually Consistent — Not Immediately Consistent
🚨 CVE-2025-69902: OS Command Injection in kubectl-mcp-tool
🐘 Building the Foundation for PostgreSQL Lifecycle Management in a DBaaS on Harvester
💰 We Cut Our Cassandra Bill From $30K to $10K a Month by Self-Hosting on Kubernetes

Read it now: https://kube.today/issues/206

⭐️ This issue is brought to you by Teleport — stop sharing credentials and give every engineer, service, and AI agent a login that expires automatically https://ku.bz/2tJxlTyDy

kubewall provides a simple and rich real time interface to manage and investigate your clusters.

More: https://ku.bz/qpjRJ28h4

kubectl-netshoot is a kubectl plugin that spins up a netshoot container in a pod or on a node, so you can debug cluster networking without adding any tools to your own images.

More: https://ku.bz/2N04Jyj70

KubeClaw is a production-grade Helm chart for running OpenClaw AI agents on Kubernetes with secure defaults, pinned images, default-deny egress via Blocky, digest-locked upgrades, and batteries-included observability.

More: https://ku.bz/CbKpPNvJq

"Kubernetes looked like a very complex beast. And I still think it's complex, but not as much as I used to think."

Thibault Martin started where most self-hosters do: Docker Compose. Kubernetes seemed like overkill — three servers for high availability, complex docs, too much for a home lab. But two problems changed his mind: his own incompetence (his words) and hardware failure. He's not an SRE, he's going to make mistakes, and his server sits in his living room where it can fail at any moment.

Kubernetes doesn't have to be enterprise-scale. It can be the safety net for a single person running services at home.



Watch the full episode: https://ku.bz/Xk5S7VqXz

Keel runs as a Kubernetes controller and automates deployment updates by monitoring image tags or Helm charts.

It triggers rolling updates in response to new images, using admission checks and configurable policies to enforce safe, continuous delivery.

More: https://ku.bz/3G6GZk0t8

This tutorial teaches how to migrate EKS from AWS VPC CNI and kube-proxy to Cilium using blue/green nodes, WireGuard encryption, and Hubble for observability.

More: https://ku.bz/sYGLb0l37