CI updates Git while Argo CD updates the cluster.

At WSC Sports, Elad Cohen separates delivery responsibilities: CI patches a values file, and Argo CD reconciles the cluster. Self-healing keeps Git as the declared state.

- Why CI and CD need separate roles
- How ApplicationSets create shadow deployments
- How AppProjects restrict team access
- Why shared Helm charts reduce one-offs

Watch: https://ku.bz/wX5H5Mjwv

This episode is sponsored by LearnKube. Download the free book, The Technical Guide to Kubernetes Rightsizing, to understand what Prometheus and Grafana cannot tell you about safely reducing requests and limits.

Hosted by Bart Farrell.

This week on Learn Kubernetes Weekly 197:

🎛️ Kubernetes Through Control Theory Glasses: HPA
🔭 Engineering End-to-End Observability for Kubernetes Workloads
🌋 Inside Volcano Controllers: Gang Scheduling, State Machines, and Real Kubernetes Logs
🍴 We forked Apache Stateful Functions for Flink 2.x — here's why
📉 Dagster on Kubernetes: When More Nodes Won't Save You

Read it now: https://kube.today/issues/197

⭐️ This newsletter is brought to you by LearnKube — master Kubernetes with hands-on training designed for engineers who want to learn the smart way https://ku.bz/hypSbyc-V

IPMan is a Kubernetes operator that automates IPSec VPN setup (via StrongSwan) so your workloads can securely connect across networks.

More: https://ku.bz/Stkf6J4qr

Kloak swaps placeholders for real secrets inside the kernel with eBPF, just before TLS encryption, so applications never hold credentials and need no sidecars or code changes.
Secrets can be pinned to specific hosts and ports.

More: https://ku.bz/2tGP1vSc3

Kubernetes is not difficult because there are too many commands.

It is difficult because networking, scheduling, deployments, storage, autoscaling, and security interact in ways that are hard to see.

Our live Advanced Kubernetes course connects those pieces into one practical mental model.

The next online course runs on 10, 11, 17, and 18 September.

- Four days of live instruction
- 60% hands-on labs
- Small classes
- Lifetime access to the material and private Slack

Joining individually?
https://learnkube.com/online-advanced-september-2026

Need several engineers to build the same baseline? We also deliver private training around your platform, workloads, and goals:
https://learnkube.com/corporate-training

Nginx Rift is a proof of concept for CVE-2026-42945, a heap buffer overflow in NGINX's rewrite module that allows unauthenticated remote code execution on servers using rewrite and set directives.
The README lists affected and fixed versions.

More: https://ku.bz/PQSlZ7Khl

🚀 We just published The Technical Guide to Kubernetes Rightsizing in the Age of AI.

The guide follows the complete rightsizing process, from collecting metrics to applying changes safely in production.

- It explains how requests and limits affect scheduling and Linux resource controls.
- It examines how application runtimes change CPU and memory behavior.
- It also shows how KRR and VPA turn historical data into recommendations.

The book also examines where AI can help: collecting evidence, explaining recommendations, drafting policy, and carrying approved changes across systems without breaking prod.

Thank you to Gulcan and @danielepolencic for the research, experiments, writing, and illustrations behind this book.

Download the complete guide for free:

https://learnkube.com/kubernetes-rightsizing

PII-Shield is a log sanitization sidecar that redacts personal data before logs ever leave the pod, using entropy scoring and custom regex rules.

More: https://ku.bz/8nJ7hSf5b

Introducing Kube Signals: the new KubeFM show that turns keynote trends into direct conversations with the speakers shaping them.

For episode one, Brian Teller sits down with Saiyam Pathak from vCluster after his KubeCon India keynote on AI factories. They examine why the GPU beneath the model is becoming a platform-engineering problem.

They discuss:

- Why whole-GPU allocation wastes capacity
- How DRA, HAMI, MIG, and MPS enable sharing
- What Kubernetes must learn to support AI factories

Watch the full episode: https://ku.bz/4QZDqrnf-

This episode is sponsored by LearnKube. Download the free book, The Technical Guide to Kubernetes Rightsizing, to understand what Prometheus and Grafana cannot tell you about safely reducing requests and limits.

This case study shows how to stabilize Harbor on VMware VKS by expanding storage, upgrading the Supervisor Service, and configuring Trivy scanning to receive vulnerability results.

More: https://ku.bz/cScZ7ZQ8d

Public and private registries solve different distribution problems.

Meg Sarros explains the split clearly: public registries optimize discoverability and broad access, while private registries prioritize governance, encryption, signing, and scanning for internal workloads.

The takeaway is not choosing one forever, but knowing where each model fits in your image supply chain.



Watch the full interview: https://ku.bz/k_r1B0Rwj

This week on Learn Kubernetes Weekly 198:

🏗️ Data Lakehouse: Infrastructure
🔭 What the Popularity of Emerging Tools Tells Us About Kubernetes' Future
⚡ Kafka on Kubernetes: Performance Lessons for Any Disk-Heavy Data Service
🌐 To Centralise or Not to Centralise: The Questions That Shaped the Kubernetes CODECO Federated Architecture
🚨 Your AI Just Deleted the Wrong Deployment. Now What?

Read it now: https://kube.today/issues/198

⭐️ This newsletter is brought to you by LearnKube — master Kubernetes with hands-on training designed for engineers who want to learn the smart way https://ku.bz/hypSbyc-V

Warden is a secure gateway that brokers connections between AI agents and enterprise systems by authenticating agent identity and injecting short-lived credentials at request time.

More: https://ku.bz/knyfjtYg7

What emerging Kubernetes tools are experts paying attention to right now?

Bart Farrell from KubeFM looks back across 100+ KubeFM conversations to surface the tools guests kept mentioning, including Karpenter, Dapr, Argo CD, Kagent, Agent Gateway, OpenTelemetry, KRO, KCP, KubeVirt, Kueue, Kyverno, Headlamp, KEDA, Crossplane, KServe, ACK, and more.

Amos explains how TLS certificate renewal failures became the first symptom of a complex networking issue when adding a home computer to his production Kubernetes cluster.

He walks through the cert-manager HTTP challenge process with Let's Encrypt validation and demonstrates how to use K9s for debugging to trace certificate renewal problems to specific nodes.

Watch the full episode: https://ku.bz/6Ll_7slr9

This case study shows how Cilium implements defense-in-depth supply chain security for open source CI/CD.

It covers access controls, dependency pinning, credential isolation, and cryptographic verification.

More: https://ku.bz/dB6Bj2sKw

Cordium runs isolated sandboxes on Kubernetes for developers and AI agents, and gives them secretless, identity-based access to SSH, databases and internal APIs.

More: https://ku.bz/Y8RNGkY16

Mac Chaffee explains why teams building custom orchestration systems often create dangerous security vulnerabilities without realizing it. He discusses how both Kubernetes and security are deeper fields than they appear, making it easy to fall into the trap of "not knowing what you don't know."

Mac emphasizes that you can't stumble your way into building a secure orchestration system - it requires deep expertise in both domains. While acknowledging that Kubernetes isn't the most secure system and doesn't solve all security problems, he points out that security experts continuously embed their expertise into Kubernetes enhancement proposals. This collective knowledge represents years of hard-won security insights that would be unwise to ignore when building from scratch.

Watch the full episode: https://ku.bz/9nFPmG85f

Running Java on Kubernetes? CPU and memory limits affect much more than scheduling.

A 4 GiB heap requires a container larger than 4 GiB. Fractional CPU limits can also change the processor count that HotSpot sees.

In our new article, you will learn:

- Why JVM heap size and container memory are different boundaries
- How CPU limits affect garbage collection, worker pools, and application performance
- Which JVM and container metrics to collect when validating resource settings under load

The article also includes practical experiments and an interactive configuration calculator.

Read: https://learnkube.com/java-jvm-kubernetes-requests-limits

Author: Gulcan!

This case study shows how debugging a kubectl 401 error on EKS revealed that a two-year-old static IAM credential file was shadowing a valid instance profile in the AWS credential chain.

More: https://ku.bz/Mxrqy_WJg