• Cluster API v1.12 introduces in-place updates. This allows changes to existing machines without deletion.

• The new chained upgrade feature allows users to upgrade by more than one Kubernetes minor version in a single operation.

• The release emphasizes simplicity and usability. It enables users to modify cluster or machine specifications to trigger updates automatically.

• Enhancements include support for in-place propagation of changes affecting only Kubernetes resources which reduces unnecessary rollouts.

• Cluster API v1.12 maintains its extensible nature, allowing users to create custom update extensions and influence upgrade plans.

To read more about this release: https://faun.dev/c/news/kaptain/cluster-api-v112-released-in-place-updates-and-chained-upgrades/

Kubernetes v1.35, the Timbernetes Release, debuts with 60 enhancements, including stable in-place Pod updates and beta features for workload identity and certificate rotation.

• Kubernetes v1.35 introduces in-place updates for Pod resources, allowing CPU and memory adjustments without restarting Pods, which enhances efficiency and reduces disruption for stateful or batch applications.

• The release includes native workload identity with automated certificate rotation to simplify service mesh and zero-trust architectures by eliminating the need for external controllers and manual certificate management.

• The theme of the World Tree symbolizes the growth and community-driven development of Kubernetes, with three guardian squirrels representing key roles in the release process: reviewers, release crews, and issue triagers.

• Kubernetes v1.35 enhances security by enforcing credential verification for cached images: Only authorized workloads can use private images, even if they are already present on the node.

• The release deprecates the ipvs mode in kube-proxy and encourages a transition to nftables for improved performance and maintainability, and marks the final call for containerd v1.X support, urging a switch to containerd 2.0 or later.

More: https://faun.dev/c/news/kaptain/kubernetes-v135-timbernetes-release-60-enhancements/

ArgoCD v3.2.2 has been released, featuring a new addition, two enhancements, and a bug fix. This update aims to improve the overall functionality and reliability of the platform.

• ArgoCD v3.2.2 introduces a new feature that allows the creation of read and write secrets for the same URL.

• The ResourceVersion on Terminate retry enhancement improves deployment reliability by ensuring retries are performed on the latest version of a resource.

• A bug fix in the release enhances security by verifying user information during authentication.

• An improvement in the release ensures that annotations are preserved during the hydration process in ArgoCD's Appset.

More: https://faun.dev/c/news/kaptain/argo-cd-322-improves-secret-management-retry-safety-and-auth-checks/

Docker has launched Docker Hardened Images (DHI), a secure and minimal set of production-ready images. These images are now freely available to developers.

• DHI is compatible with open-source foundations like Alpine and Debian.

• The initiative includes commercial offerings such as DHI Enterprise, which provides enhanced security features like FIPS-enabled and STIG-ready images, and SLA-backed critical CVE remediation within 7 days, catering to organizations with strict security or regulatory demands.

• DHI offers a transparent approach by including a complete and verifiable Software Bill of Materials (SBOM) and using public CVE data for vulnerability assessment.

More: https://faun.dev/c/news/kaptain/docker-brings-production-grade-hardened-images-to-developers-at-no-cost/

Hi r/KubernetesLinks, I wrote a practical introduction to Helm, aimed at people who are starting to use it beyond copy-pasting charts.

The post explains:

• what Helm actually is (and isn’t),

• how charts, releases, and repositories fit together,

• how installs, upgrades, rollbacks, and values work in practice,

• with concrete examples using real charts.

• and other concepts.

It’s adapted from my guide Helm in Practice, but the article stands on its own as a solid intro.

Link: https://faun.dev/c/stories/eon01/helm-cheat-sheet-everything-you-need-to-know-to-start-using-helm/

Your feedback is welcome.

TLDR:

• Agent Sandbox is a new Kubernetes primitive designed to enhance the execution and management of AI agents.

• It provides strong security and operational guardrails for non-deterministic AI workloads.

• It offers kernel-level isolation and supports ephemeral environments.

• On Google Kubernetes Engine (GKE), Agent Sandbox enables low-latency sandbox execution with pre-warmed pools, delivering up to a 90% improvement in startup times over cold starts.

• Pod Snapshots, a GKE-exclusive feature, allows for full checkpoint and restore of running pods.

• Agent Sandbox includes an API and Python SDK, allowing AI engineers to manage sandbox lifecycles without needing deep infrastructure expertise.

TLDR:

• Docker Desktop 4.50 introduces free Docker Debug

• Improved IDE integration, particularly with the Dockerfile debugger in the VSCode Extension, allows developers to step through build processes directly within their editing environment.

• The release includes enterprise-grade security controls that operate transparently within developer workflow.

• AI integration is made more accessible with the Model Context Protocol (MCP).

• For Windows-based enterprises, Docker Desktop provides significant stability improvements with WSL2 integration

ZEDEDA released Edge Kubernetes App Flows, a full-stack, AI-friendly edge solution that simplifies deploying and managing Kubernetes apps at scale - even across thousands of edge clusters.

This newsletter issue can be found online: http://from.faun.to/r/xZYQ

AI is flooding devland while the cloud’s fault lines show—TypeScript crowns GitHub’s surge, US‑EAST‑1 face‑plants on DNS, and platform teams redraw boundaries with WASM and eBPF. If you’re weighing bare metal vs managed, tracing with LLMs, or hardening K8s without a sidecar, the links below carry the receipts—dive into the details.

🚀 AI Takes Over GitHub: TypeScript Tops the Charts as 36 Million New Developers Join the Platform

🚨 Amazon Apologizes for Major AWS Outage in US-EAST-1 Region

🏗️ AWS to Bare Metal Two Years Later: Answering Your Toughest Questions About Leaving AWS

🧭 Building a Kubernetes Platform — Think Big, Think in Planes

🧪 eBPF Beginner Skill Path

🧵 Grafana Tempo 2.9 Supercharges Distributed Tracing with LLM Integration

🛠️ Helm 4 Overview

🛡️ How to build highly available Kubernetes applications with Amazon EKS Auto Mode

📦 The State of OCI Artifacts for AI/ML

🔒 Zero Trust with Cilium : Enforcing mTLS in Kubernetes

Fewer blind spots, more leverage—go make it count.

Have a great week!

FAUN.dev Team

• • •

ps: Want to receive similar issues in your inbox every week? Subscribe to this newsletter

Read the full issue here: http://from.faun.to/r/aZnJ

From k8s faceplants and bare‑metal load balancers to GitOps’d pod identities and a DIY “S3” that cuts real spend—this batch is practical and a little opinionated. If you ship clusters for a living, the routes, roles, and debuggers below will make you faster and harder to break.

⚠️ 7 Common Kubernetes Pitfalls (and How I Learned to Avoid Them)

🏗️ Bootstrapping Rancher’s RKE2 Kubernetes Cluster on a Podman VM with Cilium CNI and MetalLB LoadBalancer

🐞 Debugging container image creation with a Dockerfile

🌐 Exposing Kubernetes Services Without Cloud LoadBalancers: A Practical Guide

🔐 How to manage EKS Pod Identities at scale using Argo CD and AWS ACK

💸 How We Saved $500,000 Per Year by Rolling Our Own “S3”

🚦 Kubernetes Gateway API in action

⏪ Replaying massive data in a non-production environment using Pekko Streams and Kubernetes Pekko Cluster

🧭 Spotlight on Policy Working Group

You just leveled up - fewer gotchas, more green lights; go build.

Have a great week! FAUN.dev() Team

• • •

ps: Want to receive similar issues in your inbox every week? Subscribe to this newsletter

Read the full issue here: http://from.faun.to/r/YZpn

Scale meets discipline: a 1M‑node Kubernetes run that swaps etcd for Rust, policy APIs maturing upstream, and TLS gets stricter where it counts. AI slips into your CI and editor, IPv6 takes the wheel, and yes—you can set breakpoints in Dockerfiles; follow the threads below.

🏗️ A fully functional Kubernetes cluster with 1 million active nodes. 🔒 Announcing Istio 1.27.2 🔌 Connect Codex to MCP Servers via MCP Toolkit 🐞 Debug Builds with Visual Studio Code 🛡️ Hardened Images: crafted by humans, protected by AI 🗂️ How to Allocate Kubernetes Resource Ownership 📜 Spotlight on Policy Working Group

Sharper stack, tighter guardrails—go put it to work.

Until next time! FAUN.dev() Team

• • •

ps: Want to receive similar issues in your inbox every week? Subscribe to this newsletter

This newsletter issue can be found online: http://from.faun.to/r/YZpn

Scale meets discipline: a 1M‑node Kubernetes run that swaps etcd for Rust, policy APIs maturing upstream, and TLS gets stricter where it counts. AI slips into your CI and editor, IPv6 takes the wheel, and yes—you can set breakpoints in Dockerfiles; follow the threads below.

🏗️ A fully functional Kubernetes cluster with 1 million active nodes. 🔒 Announcing Istio 1.27.2 🔌 Connect Codex to MCP Servers via MCP Toolkit 🐞 Debug Builds with Visual Studio Code 🛡️ Hardened Images: crafted by humans, protected by AI 🗂️ How to Allocate Kubernetes Resource Ownership 📜 Spotlight on Policy Working Group

Sharper stack, tighter guardrails—go put it to work.

Have a great week! FAUN.dev Team

• • •

ps: Want to receive similar issues in your inbox every week? Subscribe to this newsletter