Allow loading remote contents and showing images to get the best out of this email.FAUN.dev's Kubernetes Weekly Newsletter
 
🔗 View in your browser.   |  ✍️ Publish on FAUN.dev   |  🦄 Become a sponsor
 
Allow loading remote contents and showing images to get the best out of this email.
Kaptain
 
#Kubernetes #Docker #DistributedSystems
 
 
🔍 Inside this Issue
 
 
Kubernetes leveled up and showed its weak spots: in-place Pod resizing and a new Node Readiness Controller land as a Kyverno CVE and the retirement of Ingress NGINX push hard calls on trust and traffic. Dive in for the details, plus how GKE's Inference Gateway squeezes latency for Vertex AI.

🚨 CVE-2026-22039: Kyverno Authorization Bypass
⚡ How GKE Inference Gateway improved latency for Vertex AI
📏 How Kubernetes Learned to Resize Pods Without Restarting Them
🩺 Introducing Node Readiness Controller
⚠️ Why Kubernetes is retiring Ingress NGINX

Patch fast, scale faster.

Thanks for reading!
FAUN.dev() Team
 
 
⭐ Patrons
 
faun.dev faun.dev
 
February Only: 20% off all FAUN.sensei() Courses
 
 
Most of us spend our time learning tools, frameworks, and patterns that sit several layers above the real system. That works until something changes. Then the gaps show up fast.

FAUN.sensei() is about closing those gaps. In addition to tools and technologies, the courses focus on fundamentals, mental models, and how systems actually behave underneath the abstractions.

If you've been meaning to step back and strengthen your foundations, February is a good moment to do it. Use the code SenseiFebruary to get 20% off all my courses throughout February.
 
 
👉 Spread the word and help developers find you by promoting your projects on FAUN. Get in touch for more information.
 
⭐ Sponsors
 
faun.dev faun.dev
 
Three Events. One Week. The Heart of SoCal Tech.
 
 
This March, Pasadena becomes a rare convergence point for security, open source, and DevOps practitioners. As a media partner, FAUN.dev() is proud to support three community-driven events that are deeply practitioner-focused and unapologetically real.

👉 SCALE anchors the week as North America's largest community-run open source conference, spanning 4 days of hands-on sessions across open source, cloud native, DevOps, and security.

👉DevOpsDayLA closes the loop with a focus on DevOps in an AI world, grounded in real stories from the uniquely diverse Southern California tech ecosystem.

👉SunSecCon brings together application, infrastructure, cloud, and corporate security professionals to break silos and focus on how defense actually works in practice.

What these events share is simple: they are built by practitioners, for practitioners. You don't just consume talks. You learn from real implementations, share hard-earned lessons, and connect with people facing the same constraints and trade-offs you are.

If you'll be anywhere near Southern California in early March, this is a week worth planning around.


If you care about how systems are really built, secured, and operated, you'll want to be there.
 
 
👉 Spread the word and help developers find you by promoting your projects on FAUN. Get in touch for more information.
 
🔗 Stories, Tutorials & Articles
 
kubernetes.io kubernetes.io
 
Introducing Node Readiness Controller
 
 
Kubernetes just dropped the Node Readiness Controller - a smarter way to track node health. It slaps taints on nodes based on custom signals, not just the plain old "Ready" status. The goal? Safer pod scheduling that actually reflects what’s going on under the hood.

It's powered by the NodeReadinessRule (NRR) API, which lets operators define custom rules tied to real infrastructure signals. Think of it as a DIY control panel for taints and node readiness.
 
 
medium.com medium.com
 
How Kubernetes Learned to Resize Pods Without Restarting Them
 
 
Kubernetes v1.35 introduces in-place Pod resizing, allowing dynamic adjustments to CPU and memory limits without restarting containers. This feature addresses the operational gap of vertical scaling in Kubernetes by maintaining the same Pod UID and workload identity during resizing. With this breakthrough, operators can now adjust resources on running Pods without the need for disruptive restarts, improving operational efficiency and flexibility in managing workloads.
 
 
thenewstack.io thenewstack.io
 
Why Kubernetes is retiring Ingress NGINX
 
 
The Kubernetes Steering Committee is pulling the plug on Ingress NGINX - official support ends March 2026. No more updates. No security patches. Gone.

Why? It's been coasting on fumes. One or two part-time maintainers couldn't keep up. The tech debt piled up. Now it's a security liability.

What's next: Time to switch. Ingress NGINX just can't scale anymore. Modern ingress controllers are the way forward.
 
 
minimus.io minimus.io
 
CVE-2026-22039: Kyverno Authorization Bypass
 
 
Kyverno - a CNCF policy engine for Kubernetes - just dropped a critical one: CVE-2026-22039. It lets limited-access users jump namespaces by hijacking Kyverno's cluster-wide ServiceAccount through crafty use of policy context variable substitution. Think privilege escalation without breaking a sweat. Isolation? Poof.

Bigger picture: This puts Kubernetes admission controllers back under the spotlight. They're powerful, sure. But that also makes them a shaky foundation for trust. Time to tighten RBAC and audit those policy validations like it actually matters.
 
 
cloud.google.com cloud.google.com
 
How GKE Inference Gateway improved latency for Vertex AI
 
 
Vertex AI now plays nice with GKE Inference Gateway, hooking into the Kubernetes Gateway API to manage serious generative AI workloads.

What’s new: load-aware and content-aware routing. It pulls from Prometheus metrics and leverages KV cache context to keep latency low and throughput high - exactly what high-volume inference demands.
 
 

👉 Got something to share? Create your FAUN Page and start publishing your blog posts, tools, and updates. Grow your audience, and get discovered by the developer community.

 
⚙️ Tools, Apps & Software
 
github.com github.com
 
Darkdragon14/docker-cloudflare-tunnel-sync
 
 
Automatically synchronize Cloudflare Tunnels and routes from Docker container labels.
 
 
github.com github.com
 
achetronic/kubernetes-mcp
 
 
Connect AI to Kubernetes: filtered responses, fine RBAC, safe to expose with OAuth 2.1
 
 
github.com github.com
 
vitobotta/hetzner-k3s
 
 
A CLI tool to install and manage Kubernetes clusters in Hetzner Cloud using the lightweight distribution k3s by Rancher.
 
 
github.com github.com
 
atilladeniz/Kubeli
 
 
A modern, native Kubernetes management desktop app for macOS & Windows. Multi-cluster support, real-time monitoring, AI assistant, terminal access, and more.
 
 
github.com github.com
 
microsoft/litebox
 
 
A security-focused library OS supporting kernel- and user-mode execution
 
 

👉 Spread the word and help developers find and follow your Open Source project by promoting it on FAUN. Get in touch for more information.

 
🤔 Did you know?
 
 
Did you know that Cilium can fully replace kube-proxy by handling Kubernetes Services directly in the Linux kernel with eBPF? Instead of walking large iptables rule sets, it relies on constant-time map lookups, keeping latency stable as Services and endpoints grow. Cilium also splits its datapath into small eBPF programs, which allows safe live updates without dropping packets, and can perform socket-level load balancing to avoid many NAT and conntrack edge cases.
 
 
🤖 Once, SenseiOne Said
 
 
"We used containers to make apps portable, then Kubernetes to learn portability ends at state. In distributed systems, autoscaling mostly relocates your bottleneck to the datastore you can’t scale the same way."
SenseiOne
 

(*) SenseiOne is FAUN.dev’s work-in-progress AI agent

 
⚡Growth Notes
 
 
Treat every Kubernetes object you touch as if someone else will have to emergency-debug it in a cold data center with a weak connection: get in the habit of curling the raw manifest from the API server and reading it top to bottom, including generated fields, defaults, and finalizers. That quiet practice of studying the full, live shape of resources trains you to see drift, controller behavior, and lifecycle details that most engineers only notice when production is already burning, building a deep mental model that quietly compounds over years.
 
Each week, we share a practical move to grow faster and work smarter
 
😂 Meme of the week
 
 
 
 
❤️ Thanks for reading
 
 
👋 Keep in touch and follow us on social media:
- 💼LinkedIn
- 📝Medium
- 🐦Twitter
- 👥Facebook
- 📰Reddit
- 📸Instagram

👌 Was this newsletter helpful?
We'd really appreciate it if you could forward it to your friends!

🙏 Never miss an issue!
To receive our future emails in your inbox, don't forget to add community@faun.dev to your contacts.

🤩 Want to sponsor our newsletter?
Reach out to us at sponsors@faun.dev and we'll get back to you as soon as possible.
 

Kaptain #515: How Kubernetes Learned to Resize Pods Without Restarting Them
Legend: ✅ = Editor's Choice / ♻️ = Old but Gold / ⭐ = Promoted / 🔰 = Beginner Friendly

You received this email because you are subscribed to FAUN.dev.
We (🐾) help developers (👣) learn and grow by keeping them up with what matters.

You can manage your subscription options here (recommended) or use the old way here (legacy). If you have any problem, read this or reply to this email.