Kaptain

Final days: The FAUN.sensei() launch discount expires soon. ⏳

Since we flipped the switch on FAUN.sensei(), the response has been incredible. It’s clear that many of you are ready to move beyond basic tutorials and learn from those who have already "lived the journey."

I’ve decided to keep the launch celebration going through the end of the year, but the clock is officially ticking. You have until December 31st to grab any (or all) of our inaugural courses at 25% off.

ℹ️ Use code SENSEI2525 at checkout.

The lineup has expanded! We’ve just added two new courses to the collection: a deep dive into the Helm ecosystem and a comprehensive guide to Generative AI. Here is the full list:

👉 Helm in Practice – Designing, Deploying, and Operating Kubernetes Applications at Scale

👉 Building with GitHub Copilot – Master the shift from coding to AI-assisted orchestration.

👉 Observability with Prometheus and Grafana – Hands-on guide to achieving true operational clarity.

👉 DevSecOps in Practice – How to actually operationalize security at scale.

👉 Cloud-Native Microservices With Kubernetes (2nd Edition) – The comprehensive blueprint for high-availability systems.

👉 Cloud Native CI/CD with GitLab – Streamlining the path from commit to production.

👉 End-to-End Kubernetes with Rancher, RKE2, K3s, Fleet, Longhorn, and NeuVector – The complete architectural journey to production.

👉 Generative AI For The Rest Of US – Your Future, Decoded

Remember, the SENSEI2525 code works as many times as you need, but it vanishes when the calendar turns to the new year.

See you on FAUN.sensei() !

— Aymen, Founder of FAUN.dev()

Kubernetes 1.35 lands with real vertical scaling, modular jobs, and a few tombstones—while the edges of the stack get sharper with kernel-level load sharing, Cilium gotchas, and Argo CD cleanups. If shaving latency, surviving upgrades, and making autoscalers less dumb is on your list, the details below will pay rent.

🎚️ 1.35: In-Place Pod Resize Graduates to Stable
⚡ 93% Faster Next.js in (your) Kubernetes
🧩 Argo CD 3.2.2 Improves Secret Management, Retry Safety, and Auth Checks
🧟‍♂️ Avoiding Zombie Cluster Members When Upgrading to etcd v3.6
🎙️ Brendan Burns: Lessons from Building Kubernetes and the Future of AI Infrastructure
🌲 Kubernetes v1.35 Timbernetes Release: 60 Enhancements
🛡️ Troubleshooting Cilium network policies: Four common pitfalls
🔌 Dapr Deployment Models
🧭 v1.35: Job Managed By Goes GA

Steal the patterns, dodge the footguns, and keep shipping.

See you in the next issue!
FAUN.dev() Team

Docker rolled out Docker Hardened Images (DHI), tight, secure base images baked with SBOMs, SLSA Level 3 provenance, and open CVE tracking.

There’s a free tier, plus enterprise flavors with FIPS/STIG hardening, and Extended Lifecycle Support (ELS) that stretches CVE patching up to five years after the distro calls it quits.

Kubernetes v1.35 just dropped with 60 new features, headlined by stable in-place Pod resource updates and beta workload identity built right in.

Gone: the Ingress NGINX controller, now deprecated. Going soon: cgroup v1. Added: Pod-level certs managed by kubelet.

ArgoCD v3.2.2 tightens the screws where it counts.

Now you get separate read/write secrets per URL, fine-grained access control without the hand-wringing. It cleans up ResourceVersion handling on terminations too, cutting down on stale retry noise. And yep, it keeps annotations intact during AppSet hydration.

Halodoc cut EC2 costs and shaved latency by leaning into two Kubernetes tricks:

In-place pod resizing (v1.33) lets them dial pod resources up or down on the fly, especially handy during off-peak hours.

Zone-aware routing via topology-aware hints keeps inter-service traffic close to home (same AZ), skipping extra hops.

A custom scheduler keeps those resource tweaks sticky, even when pods restart.

etcd v3.5.26 patches a nasty upgrade bug. It now syncs v3store from v2store to stop zombie nodes from corrupting clusters during the jump to v3.6.

The core issue: Older versions let stale store states bring removed members back from the dead.

In-Place Pod Resize hits GA in Kubernetes 1.35. You can now tweak CPU and memory on live pods without restarts. This is finally production-ready!

What’s new since beta? It now handles memory limit decreases, does prioritized resizes, and gives you better observability with fresh Kubelet metrics and Pod events.

Big shift: Vertical scaling just got real. Smooth enough for autoscalers, fast enough for low-latency apps.

Next.js brings advanced capabilities to developers out-of-the-box, but scaling it in your own environment can be challenging due to uneven load distribution and high latency. Watt addresses these issues by leveraging SO_REUSEPORT in the Linux kernel, resulting in significantly improved performance metrics compared to traditional scaling approaches on Kubernetes. The implemented solution, described in the post, eliminates some coordination overhead and improves load distribution and reliability for Node.js applications like Next.js running in containerized environments.

Dapr started as a humble Kubernetes sidecar. Now? It's a full-blown multi-mode runtime that runs wherever you need it, edge, VM, or serverless APIs.

Diagrid’s Catalyst takes that further. It wraps Dapr in a fully managed API layer that’s detached from your app’s lifecycle. No infra lock-in, just token-based HTTP access across any stack.

Cilium’s Day 2 playbook covers the real work: dialing in L7 policy controls, tuning Hubble observability, and wringing performance from BPF. It's how you keep big Kubernetes clusters sane.

The focus? Multi-tenant isolation, node-to-node encryption, and scaling cleanly with external etcd so the network doesn’t turn into guesswork.

In Kubernetes v1.35, spec.jobControllerManagedBy hits GA. That means full handoff of Job reconciliation to external controllers is now official.

It unlocks tricks like MultiKueue, where a single management cluster fires off Jobs to multiple worker clusters, without losing sight of what’s running where.

Big shift: Kubernetes steps back from owning the whole Job lifecycle. Scheduling and execution are finally split, clearing the way for smarter, more modular batch systems.

You've survived the on-call rotations, the hard work, and the marathons of 2025! It’s time for some better swag, so stop wearing boring shirts. Get yours from ByteVibe, where the gear actually represents our culture!

We're giving all our subscribers 25% off at ByteVibe, the home of "Rock 'n' Roll" dev gear.

Use code SUBSCR1B3R at checkout. Valid until Dec 31st!

Brendan Burns - co-founder of Kubernetes and Corporate VP for Azure Cloud Native and Management Platform at Microsoft - joins an interview for a wide-ranging conversation on the evolution of cloud-native systems, open source, and the future of AI infrastructure.

DHI definition files and catalog metadata

An easy-to-use dynamic service discovery, configuration and service management platform for building AI cloud native applications.

A fast, keyboard-driven TUI for debugging Kubernetes workloads

Awesome Kubernetes Architecture Diagrams

Did you know that Kubernetes split Service backends into EndpointSlices of up to 100 endpoints to fix scaling issues with large Services? Instead of rewriting and broadcasting one huge Endpoints object, a single Pod change now updates only one small slice, cutting watch traffic and control-plane load. More API objects ended up scaling better because the updates became smaller and cheaper.

"In Kubernetes, we declare the world idempotent and then rely on eventually consistent controllers to make it so. Containers restart fast, state recovers slow. Replicas fight downtime and amplify bugs."
— SenseiOne

Make a habit of tracing a request end to end in your cluster every single week. Pick one real user flow, follow it from ingress through service mesh, Deployment, Pod, container, logs, traces, to the backing datastore, and write down every assumption that turned out to be wrong. As you trace, capture where observability is missing, where failures would silently hurt users, and which configs you do not fully understand yet. Then fix exactly one small gap: add a metric, a log with context, dash-based alert, or a clear README note. With time, this quiet practice builds the rare skill of seeing a whole Kubernetes system clearly, while everyone else only knows the YAML they happen to touch.