Cloud Native platform sovereignty through multi-plane architecture
When people talk about cloud sovereignty, the conversation often starts with regions: where a workload runs and where its data is stored. But choosing a region is only part of the story. The architecture of the…
Eleven minutes, zero humans: Building a self-healing Kubernetes upgrade pipeline on Kairos
Once upon a time, upgrading a Kubernetes control plane meant staying awake for it. SSH into every node. Run the upgrade by hand. Watch etcd health the whole time, hoping quorum holds through every reboot. This…
Flagship event returns November 9–12 with sessions on production AI, platform engineering and cloud native security Key Highlights SAN FRANCISCO, Aug. 7, 2026 – The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud…
Shadow AI in CI/CD: Threat-modeling the path from developer laptop to Kubernetes
Artificial intelligence is becoming part of daily software delivery, often before it becomes part of the security architecture. That gap has a name: Shadow AI. It is any AI tool, model, agent, extension, or integration used…
Multi-Cluster databases on Kubernetes: Architecture and deployment
Introduction Running a database on Kubernetes is well understood. Running one that survives a complete regional failure, a corrupted control plane, or a severed network requires a fault-resistant architecture. This post walks through how to build…
Impact Since completing the migration, Michelin has experienced no CNI-related failures or incidents across its fleet. For a platform team that previously spent significant time firefighting networking problems that they couldn’t even observe clearly, this has…
Securing CI/CD for an open source project, part 3: Credentials, verification, and what’s next
This is the third and final post in a series on how Cilium hardens its CI/CD pipeline. Part 1 covered access control and Part 2 covered dependency hardening. This post covers the last layer: keeping CI…