Kaptain

Kubernetes leveled up and showed its weak spots: in-place Pod resizing and a new Node Readiness Controller land as a Kyverno CVE and the retirement of Ingress NGINX push hard calls on trust and traffic. Dive in for the details, plus how GKE's Inference Gateway squeezes latency for Vertex AI.

🚨 CVE-2026-22039: Kyverno Authorization Bypass
⚡ How GKE Inference Gateway improved latency for Vertex AI
📏 How Kubernetes Learned to Resize Pods Without Restarting Them
🩺 Introducing Node Readiness Controller
⚠️ Why Kubernetes is retiring Ingress NGINX

Patch fast, scale faster.

Thanks for reading!
FAUN.dev() Team

Most of us spend our time learning tools, frameworks, and patterns that sit several layers above the real system. That works until something changes. Then the gaps show up fast.

FAUN.sensei() is about closing those gaps. In addition to tools and technologies, the courses focus on fundamentals, mental models, and how systems actually behave underneath the abstractions.

If you've been meaning to step back and strengthen your foundations, February is a good moment to do it. Use the code SenseiFebruary to get 20% off all my courses throughout February.

This March, Pasadena becomes a rare convergence point for security, open source, and DevOps practitioners. As a media partner, FAUN.dev() is proud to support three community-driven events that are deeply practitioner-focused and unapologetically real.

👉 SCALE anchors the week as North America's largest community-run open source conference, spanning 4 days of hands-on sessions across open source, cloud native, DevOps, and security.

👉DevOpsDayLA closes the loop with a focus on DevOps in an AI world, grounded in real stories from the uniquely diverse Southern California tech ecosystem.

👉SunSecCon brings together application, infrastructure, cloud, and corporate security professionals to break silos and focus on how defense actually works in practice.

What these events share is simple: they are built by practitioners, for practitioners. You don't just consume talks. You learn from real implementations, share hard-earned lessons, and connect with people facing the same constraints and trade-offs you are.

If you'll be anywhere near Southern California in early March, this is a week worth planning around.

• Explore SCALE 23x: https://www.socallinuxexpo.org/scale/23x
• Join DevOpsDayLA 2026: https://devopsdays.org/events/2026-los-angeles/welcome/
• Learn more about SunSecCon: https://www.sunseccon.org/2026/

If you care about how systems are really built, secured, and operated, you'll want to be there.

Kubernetes just dropped the Node Readiness Controller - a smarter way to track node health. It slaps taints on nodes based on custom signals, not just the plain old "Ready" status. The goal? Safer pod scheduling that actually reflects what’s going on under the hood.

It's powered by the NodeReadinessRule (NRR) API, which lets operators define custom rules tied to real infrastructure signals. Think of it as a DIY control panel for taints and node readiness.

Kubernetes v1.35 introduces in-place Pod resizing, allowing dynamic adjustments to CPU and memory limits without restarting containers. This feature addresses the operational gap of vertical scaling in Kubernetes by maintaining the same Pod UID and workload identity during resizing. With this breakthrough, operators can now adjust resources on running Pods without the need for disruptive restarts, improving operational efficiency and flexibility in managing workloads.

The Kubernetes Steering Committee is pulling the plug on Ingress NGINX - official support ends March 2026. No more updates. No security patches. Gone.

Why? It's been coasting on fumes. One or two part-time maintainers couldn't keep up. The tech debt piled up. Now it's a security liability.

What's next: Time to switch. Ingress NGINX just can't scale anymore. Modern ingress controllers are the way forward.

Kyverno - a CNCF policy engine for Kubernetes - just dropped a critical one: CVE-2026-22039. It lets limited-access users jump namespaces by hijacking Kyverno's cluster-wide ServiceAccount through crafty use of policy context variable substitution. Think privilege escalation without breaking a sweat. Isolation? Poof.

Bigger picture: This puts Kubernetes admission controllers back under the spotlight. They're powerful, sure. But that also makes them a shaky foundation for trust. Time to tighten RBAC and audit those policy validations like it actually matters.

Vertex AI now plays nice with GKE Inference Gateway, hooking into the Kubernetes Gateway API to manage serious generative AI workloads.

What’s new: load-aware and content-aware routing. It pulls from Prometheus metrics and leverages KV cache context to keep latency low and throughput high - exactly what high-volume inference demands.

Automatically synchronize Cloudflare Tunnels and routes from Docker container labels.

Connect AI to Kubernetes: filtered responses, fine RBAC, safe to expose with OAuth 2.1

A CLI tool to install and manage Kubernetes clusters in Hetzner Cloud using the lightweight distribution k3s by Rancher.

A modern, native Kubernetes management desktop app for macOS & Windows. Multi-cluster support, real-time monitoring, AI assistant, terminal access, and more.

A security-focused library OS supporting kernel- and user-mode execution

Did you know that Cilium can fully replace kube-proxy by handling Kubernetes Services directly in the Linux kernel with eBPF? Instead of walking large iptables rule sets, it relies on constant-time map lookups, keeping latency stable as Services and endpoints grow. Cilium also splits its datapath into small eBPF programs, which allows safe live updates without dropping packets, and can perform socket-level load balancing to avoid many NAT and conntrack edge cases.

"We used containers to make apps portable, then Kubernetes to learn portability ends at state. In distributed systems, autoscaling mostly relocates your bottleneck to the datastore you can’t scale the same way."
SenseiOne

Treat every Kubernetes object you touch as if someone else will have to emergency-debug it in a cold data center with a weak connection: get in the habit of curling the raw manifest from the API server and reading it top to bottom, including generated fields, defaults, and finalizers. That quiet practice of studying the full, live shape of resources trains you to see drift, controller behavior, and lifecycle details that most engineers only notice when production is already burning, building a deep mental model that quietly compounds over years.