This project is a Kubernetes operator that implements a so-called health-check platform.

Canary checker is a monitoring tool that includes 35+ ready-to-use health checks for various Kubernetes workloads. It works as a K8s operator that has no dependencies and offers:

- checks for popular protocols (HTTP, DNS, ICMP, TCP), databases (SQL-based, MongoDB, Redis, Elasticsearch), infrastructure components (such as Kubernetes resources and EC2 instances), file systems (NFS, S3, SMB), and more;
- alert aggregation from Prometheus, AWS CloudWatch, and Dynatrace;
- integration testing support for JMeter, JUnit, K6, Newman and Playwright;
- Prometheus exporter replacement with custom metrics from the check’s results;
- built-in Web dashboard displaying existing checks and their stats.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 326 ⭐️

#tools #observability

Sharing our latest selection of interesting Kubernetes-related articles recently spotted online:

1. "ingress-nginx to Envoy Gateway migration on CNCF internal services cluster" by Koray Oksay, CNCF/Kubermatic.

CNCF hosts a Kubernetes cluster to run some services for internal purposes [..] The migration from ingress-nginx to Envoy Gateway required careful attention to: certificate ownership and cross-namespace access; cloud load balancer integration (NodePort, health checks, externalTrafficPolicy); backend TLS configuration for services requiring HTTPS upstream connections.

2. "Duolingo's Kubernetes Leap" by Franka Passing, Duolingo.

Previously, the 500-plus backend services that I mentioned at the beginning are running on AWS ECS. We have some workloads that are running on different infrastructure, but for the mass majority, they're on ECS. That's what I'm going to be focusing on. We're going to be moving from ECS to EKS.

3. "How does the Kubernetes controller manager work?" by Daniele Polencic, LearnKube.

When you delete a Pod in a Deployment, Kubernetes creates a replacement. But who creates it? It's not the API server. The API server stores resources and notifies watchers, but it doesn't decide what should run. It's not the scheduler either. The scheduler assigns Pods to nodes, but it doesn't create them. The answer is a controller: a loop that watches for changes in the cluster and takes action to move the current state closer to the desired state.

4. "From Kubernetes Dev Setup to Production: What Actually Changes" by Georg Schwarz.

Moving towards a production deployment changed the operating model. Delivery moved to GitOps, secrets moved to SOPS, object storage moved outside the cluster, database backups became restore-tested, identity flows were customized, and observability gave us a baseline for operating the application. This article is not about how to deploy an app to Kubernetes. It walks through what had to change after it already ran there.

5. "Securing CI/CD for an open source project: lessons from Cilium" by André Martins and Feroz Salam, Isovalent at Cisco.

Cilium runs in the kernel-level networking path of millions of Kubernetes pods. If our supply chain were compromised, the blast radius would not be small. Hardening the project against that scenario is something we work on continuously, and we wanted to write down what we actually do, in detail. Most of what follows isn't Cilium-specific: any open source project running CI/CD on GitHub Actions can apply these patterns. We've also called out where we still fall short, in case any of it makes a useful starting point for someone else.

6. "Kubernetes is migrating from SPDY to WebSockets" by Henrique Cavarsan.

How Kubernetes is replacing SPDY with WebSockets for kubectl exec, attach, cp, and port-forward. I maintain an app that builds on top of Kubernetes port forwarding, so I track KEP-4006 because the streaming protocol underneath keeps changing.

7. "Back up and restore your Amazon EKS cluster resources using Velero" by Sapeksh Madan and Shalabh Srivastava, AWS.

In this post, you’ll learn to back up and restore Amazon EKS cluster resources and persistent volume data using Velero. You’ll deploy a sample stateful application, back it up, and restore it to a different namespace within the same cluster. Along the way, you’ll configure least-privilege AWS Identity and Access Management (AWS IAM) roles using Amazon EKS Pod Identity and scope Velero’s Kubernetes permissions with a custom ClusterRole.

#articles

etcd 3.7.0-beta.0 arrived with RangeStream

Last week, the first beta release of etcd 3.7.0 was announced. Its main feature is RangeStream, which significantly improves the use case of large result sets by allowing clients to retrieve results in chunks. Another highlight is that etcd v3.7 is the first release to be fully based on v3store, as the remaining parts of v2store (deprecated since v3.4) have been finally removed.

#releases #databases

Multigres v0.1 Alpha

Yesterday, Supabase announced the first public version of its new project called Multigres. It aims to make Vitess available for PostgreSQL. Basically, it means it simplifies horizontal scaling for Postgres and provides high availability, pooling, backups, and sharding. The project is Open Source and available on GitHub.

You can try the first alpha version of Multigres by deploying its Kubernetes operator on AWS EKS following these instructions.

#news #releases #databases

Announcing our latest digest of the prominent software updates in the Cloud Native ecosystem!

1. Kyverno, a Kubernetes-native policy engine (a CNCF Graduated project), released 1.18, which added secure HTTP calls with blocklist/allowlist, namespaced image registry credentials, extended policy support in kyverno apply and kyverno test, success event filtering, and many other improvements.

2. NATS, the cloud- and edge-native messaging system (a CNCF Incubating project), released its server v2.14, which added feature flags in the server configuration. It also introduced fast-ingest batch publishing, repeating and cron-based message schedules, scheduled subject sampling and scheduled subject rollups, and an asynchronous stream state snapshots for replicated streams.

3. Freelens, an IDE for Kubernetes originated as a community-driven fork of Lens, was updated to v1.9.0. It is now capable to resize the Pods by patching their resources, wrap logs for better readability, work with OpenShift Prometheus provider, use HTTP POST requests for Prometheus, and exit remote shells gracefully.

4. OpenYurt, a platform extending Kubernetes for edge use cases (a CNCF Incubating project), released v1.7.0, which added image preheating for OTA (Over-The-Air) upgrades, local K8s-on-K8s deployments with a Kubernetes cluster on top of an existing OpenYurt cluster, label-driven YurtHub deployment, and Kubernetes v1.34 support.

5. Traefik, a HTTP reverse proxy and load balancer for Cloud Native apps, released v3.7.0, featuring the support for dozens of new annotations for Kubernetes Ingress-Nginx: limits for connections/RPM/RPS, proxy timeouts, buffering, redirects, canary, session-cookie-expires, custom headers and HTTP errors, enable-access-log, allowlist-source-range, global-auth and auth-signin, and many more. Other new features include stdio access logs, priority ordering for providers routing, support for adding middlewares on services, and a new encodedCharacters middleware.

6. Istio (a CNCF Graduated project) announced 1.30, introducing experimental support for agentgateway as a Gateway API implementation, support for TLSRoute termination and mixed mode, several improvements for the ambient mode, namespace-level traffic distribution annotation, DNS upstream timeout, DNS failover priority support, configurable port overrides for the network gateway service, and many other updates.

7. Crossplane (a CNCF Graduated project) made another quarterly release, v2.3.0, adding the actual composite reconciler to crossplane render, provider deletion protection, per-resource reconciliation control, an “all resources of that kind” selector for composition functions, and a new scale subresource for XRs.

#news #releases

Argo CD’s ApplicationSet got its UI

Yesterday, a long-awaited feature for the Argo community finally landed: Argo CD’s Application UI was extended with the ApplicationSets tab. Starting from v3.5, you get a view of ApplicationSet details, an updated resource tree visualisation, and even a preview of the expected changes.

Argo CD 3.5 RC is expected in a week (Jun 16), and its GA release will happen in two months (Aug 4).

#news #gitops #gui

Can luring random online attackers into your Kubernetes clusters be fun or even useful? At least, we have a tool to try it out with minimal effort.

Koney is a Kubernetes operator that implements so-called “deception policies” to discover and deter malicious users. Currently, it supports honeytokens as the only deception method by:

- creating fake “sensitive” files, such as /run/secrets/koney/service_token, in all selected Pods;
- monitoring the attempts to access them by collecting alerts from the Cilium’s Tetragon operator or via a smaller eBPF-powered file access monitoring tool (kivebpf);
- logging these events and, optionally, sending alerts to external systems (currently, it supports only Dynatrace).

Future project plans include adding other deceptive techniques (HTTP endpoints and payloads) and integrating the operator with Kyverno policies.

▶️ GitHub repo

Language: Go | License: AGPL 3.0 | 89 ⭐️

#tools #security

Sharing our latest selection of interesting Kubernetes-related articles recently spotted online:

1. "Kubernetes In Anger" by Samuel Vijaykumar Madireddy.

This guide is not for beginners. There’s a gap between knowing Kubernetes concepts (pods, deployments, services, kubectl) and actually being able to keep an EKS cluster healthy in production. [..] What you will find: what to do when pods are Pending and you don’t know why, how to tell if DNS is the problem or just a symptom, why your NLB keeps resetting connections, and how to collect evidence before the cluster auto-heals and destroys your ability to do an RCA.

2. "What kubectl debug doesn’t tell you: The silent evidence gap" by Shamsher Khan.

A kubectl debug session can contain the only direct observation of a failing system state. [..] Once the pod state changes, the Kubernetes API no longer exposes the termination context of that debug session. The exit code that encoded your finding, the duration of the session, which container you targeted — is not retained by the Kubernetes API after subsequent pod updates. Here is what that looks like, and what it means for your incident response workflow.

3. "Static web hosting on Kubernetes with OCI images as volumes" by Kowalski7cc.

Introduced in Kubernetes 1.31, promoted to beta in 1.33 and entered in stable with Kubernetes 1.36, we can use OCI images as volumes for containers. They are now a possible storage choice among Persistent Volume Claims, empty directory, pod metadata, Config Maps and Secrets. This option can take advantage of the existing tooling and CI/CD already present to deliver an archive containing any kind of data.

4. "Kubernetes Gateway API" by Roman Glushko.

We have covered a lot of ground here. We traced the evolution of Kubernetes ingress patterns from the early days of Kubernetes to the Gateway API era. Then we stopped at Gateway API and went deeper into the protocol itself. [..] Finally, we looked at available Gateway API implementations and how to think about picking one.

5. "Kyverno in Action: Policy-as-Code Admission Control for Kubernetes" by Sergei Olshanetski.

In this article, we’ll build a complete Kyverno demo on Minikube. We’ll start with an open cluster, layer on one policy at a time, and end with a hardened production baseline that includes Cosign image signature verification, automated tenant onboarding, and TTL-based cleanup. Every step runs on your laptop.

6. "The feedback loops behind Kubernetes" by Fatih Arslan, PlanetScale.

Before we look at a single line of Kubernetes, we're going to run a production database by hand and slowly let the feedback loop appear on its own. Then we'll map that loop to Kubernetes, with the pieces production needs: a store, watches, queues, retries, and more. At the end, we'll look at what one of these loops looks like in a real operator.

7. "Writing a Kubernetes Operator in the Age of AI" by Fernando Villalba, Numtide.

Six months into building a production Kubernetes operator for Multigres with AI, the code stopped being the hard part. Most of the effort went into design, hygiene, continuous improvement, and review. What I learned in 1,303 commits is that the best way to use AI is to build a factory floor of specialists you orchestrate yourself.

#articles

Upbound introduced Modelplane for AI inference

The company behind Crossplane, a CNCF project that graduated at the end of 2025, announced its new Open Source project called Modelplane. The CNCF's CTO already mentioned on LinkedIn that this project would be a great fit for CNCF.

Basically, Modelplane is a control plane for AI inference built on Crossplane, which allows you to run any model on any serving engine on any infrastructure. Here's its brief description from the official announcement:

Modelplane sits above your inference clusters and operates them as one inference platform, reconciling the whole fleet toward the state you declare. It does for the fleet what Kubernetes does for the cluster: platform teams and developers describe what they want as Kubernetes resources, and Modelplane composes the clusters, places the models, and exposes the endpoints to match.

Additional resources include the getting started documentation and the GitHub repo.

#news #tools #aiml

Minimus introduced free hardened container images

At the end of June, Minimus Community Edition was announced. This project made “hundreds of continuously built from source, near-zero CVE container images” freely available. There are images and Helm charts, all classified by the following categories: Apps, Base, Data, Dev, Infra, and Utils. Some of them feature validated FIPS, CIS, NIST SP 800-190, and STIG compliance. You can find the full catalog here.

#news #security

Our latest digest of the prominent software updates in the Cloud Native ecosystem:

1. Argo CD (a CNCF Graduated project) released its v3.5 RC, introducing several important features. They include a new ApplicationSet UI with built-in change previews, Impersonation workflows and Source Hydrator promoted to Beta, Helm 4 support, and mTLS support for repo-server. Currently, v3.5.0-rc1 and v3.5.0-rc2 are available, with the GA release scheduled for August.

2. Headlamp, a Kubernetes web UI developed by the Kubernetes SIG, released 0.43.0. It came with ClusterProfile discovery (alpha), a node upgrade visualisation panel, proxy auth support for middleware proxies, a Create Deployment form in the UI, a dedicated Job details view, RTL layout support, and several new localisations.

3. Podman, a tool for managing OCI containers and pods (a CNCF Sandbox project), reached v6.0.0. It significantly upgraded the network infrastructure (iptables → nftables; CNI networking → Netavark; slirp4netns → Pasta; experimental Pesto rootless port forwarding), improved VM experience in Podman Machine with easier operations across different providers and a new podman machine os update command, enhanced quadlet capabilities and the way configuration files are handled.

4. CloudNativePG, a platform designed to manage PostgreSQL in Kubernetes (a CNCF Sandbox project), released 1.30.0, featuring the DatabaseRole CRD for declarative role management as its main highlight. This release also added a Kubernetes Lease object for safe primary election, in-place major upgrades with Image Volume extensions, PgBouncer image management via Image Catalogs, SCRAM-SHA-256 password encoding, and several other improvements.

5. Dragonfly, which implements secure data distribution and acceleration powered by P2P (a CNCF Graduated project), announced v2.5.0. It introduced direct repository downloads from Hugging Face and ModelScope, a Kubernetes mutating admission webhook for automatic P2P capability injection in Dragonfly, a blocklist to disable specific downloads, comprehensive rate limiting, a new command-line tool (dfctl) to manage tasks in the client’s local storage, and many other updates.

6. Flux (a CNCF Graduated project) released 2.9 with a new CLI plugin system and the first two plugins (Mirror and Schema). It also included Server-Side Apply field ignore rules for fine-grained drift control, enhanced secrets decryption, support for Helm post-render strategies, CEL-based health check expressions, and many other new features. The latest release of Flux Operator added a dedicated workload dashboard and a full-featured Pod log viewer to the Flux Web UI.

7. cert-manager (a CNCF Graduated project) released v1.21.0 with experimental ACME Renewal Information (ARI) support, AWS IAM authentication for Vault, certificate renewal policies, support for Modern2026 PKCS#12 profile, Venafi OAuth token observability, runtimeClassName support, and various Gateway API and cainjector improvements.

#news #releases

William Rizzo, a CNCF Ambassador and Global Field CTO at Mirantis, announced his project, KubeSwift, which provides Kubernetes-native VM orchestration on Cloud Hypervisor.

Here’s the idea behind KubeSwift: “KubeSwift runs virtual machines as Kubernetes workloads. You define a VM with a custom resource; controllers reconcile it into a Pod; inside that Pod, swiftletd launches a hypervisor.” (Cloud Hypervisor, on which this project relies, is a VMM (Virtual Machine Monitor) for cloud workloads written in Rust.)

While still being in the pre-1.0 state, KubeSwift already supports disk boot from cloud images and direct kernel boot from OCI artifacts, Multus and OVN-Kubernetes for networking, exposing guest ports as Kubernetes Services, GPU passthrough, disk snapshots, offline and live migrations, managing fleets of identical VMs, swiftctl CLI tool for lifecycle management and operations, and many other features.

▶️ GitHub repo

Language: Go | License: AGPL 3.0 | 18 ⭐️

#news #tools

HAMi became a CNCF Incubating project

HAMi was originally known as k8s-vGPU-scheduler and today stands for Heterogeneous AI computing virtualisation Middleware. It enables slicing a physical GPU into units by memory/core/device count, enforcing hard runtime isolation, and scheduling Pods using binpack, spread, and topology-aware policies. You can learn more about this project from this overview.

HAMi joined the CNCF Sandbox in August, 2024. Two weeks ago, the CNCF TOC voted to promote it to the incubating level. This change was formally announced yesterday.

#news #cncfprojects

Buildpacks graduates, k8gb incubates

Following the CNCF TOC votes that happened over the last weekend, two CNCF projects were promoted to the next level:

1. Buildpacks, a set of specifications and tooling that transform application source code into container images that can run on any cloud, became a Graduated project. It was started by Pivotal and Heroku in January 2018, joined the CNCF Sandbox in October 2018, and became Incubated in November 2020. The companies that adopted Buildpacks include Bloomberg, Google, Microsoft, Red Hat, Salesforce, and VMware by Broadcom.

2. k8gb, a Kubernetes global balancer, became an Incubating project. It originated in Absa Group in 2019 and joined the CNCF Sandbox in March 2021. Current k8gb adopters include Eficode, Millennium bcp, and PagBank.

#news #cncfprojects

KubeSchool by Portainer

As Neil Cresswell, CEO of Portainer, said on Reddit, one of his engineers recently asked him to help better understand Kubernetes architecture and components. Answering this request, he decided to go bigger and launched KubeSchool.

It's an educational website featuring 15 chapters on Kubernetes basics for beginners. They cover the core ideas behind K8s, its main components, pluggable layers (CNI, CSI, CRDs, etc.), and production-ready recommendations.

#career #articles

Confidential Containers became a CNCF Incubating project

Another level up has just happened in the CNCF, with its TOC accepting moving Confidential Containers to the Incubating level. This project enables confidential computing by leveraging hardware-based TEEs (Trusted Execution Environments) to protect containers and data by encrypting data during computation.

Confidential Containers started in 2021 by Red Hat, Intel, IBM, and other companies. It was accepted into the CNCF Sandbox in March 2022. Today, this technology is used in IBM LinuxONE, Red Hat OpenShift, Kubermatic KubeOne, Alibaba Cloud, and several other solutions.

#news #cncfprojects #security

Kubeflow became a CNCF Graduated project

The summer series of CNCF level-ups keeps going, and Kubeflow has just joined the list of the organisation’s most mature (i.e. Graduated) projects. The CNCF Technical Oversight Committee (TOC) voted for this graduation last Friday.

Kubeflow is a machine learning toolkit for Kubernetes that serves as a foundation for K8s-based AI platforms. Its subprojects include Pipelines for end-to-end ML workflows, Trainer for distributed AI model training and LLM fine-tuning, Katib for AutoML, and a Kubernetes operator for Apache Spark.

Kubeflow originated in Google, with its first public announcement in 2017. It was accepted into the CNCF as an Incubating project in July 2023. Today, its adopters include Alibaba Cloud, AWS, Cisco, Huawei, IBM, NVIDIA, Red Hat, and Tencent.

#news #cncfprojects #aiml

OpenTelemetry got a one-command Linux setup

The OpenTelemetry Packaging SIG introduced a ready-to-use opentelemetry package for Linux distributions that installs the OpenTelemetry Injector together with the OpenTelemetry SDKs and auto-instrumentation packages for various programming languages (Java, .NET, Node.js, and Python).

It is now available as an APT repository (for Debian, Ubuntu, and derivatives) and a YUM repository (for Fedora, RHEL, and derivatives). Find more details in this announcement or read the full instructions on GitHub.

#news #observability