Alex Arnell, Principal Member of Technical Staff at Heroku, shares three Kubernetes tools he's actively monitoring from both production experience and personal interest.

He provides insights into the OpenTelemetry Operator, which Heroku uses extensively for managing collectors and auto-instrumentation, particularly highlighting the target allocator feature for dynamic collector configuration.

Alex also discusses SPIFFE and Spire for identity management, noting the quality of their Kubernetes implementation and certificate provisioning capabilities for workload identity verification. Finally, he covers KEDA (Kubernetes Event-Driven Autoscaler), explaining its appeal for platform-as-a-service providers due to its scale-to-zero capabilities and telemetry integrations, even though Heroku isn't currently using it in production.

Watch the full interview: https://ku.bz/Lsr8gltrH

Harsha Koushik, a Security Researcher and Technical Product Manager at Palo Alto Networks, explores the evolving landscape of cybersecurity attack surfaces.

He explains the shift from traditional perimeter-focused defenses to more sophisticated attackers' methods, such as targeting supply chains and transient dependencies.

Harsha emphasizes the critical need to sign artifacts, including image layers and libraries, to safeguard against these advanced threats.

Watch the full episode: https://ku.bz/n_sJ04xMY

This tool lets your Kubernetes cluster automatically issue TLS certificates for pods by handling PodCertificateRequest resources with a custom signer controller.

More: https://ku.bz/9l1Dq8skJ

Fabián walks through a real engineering investigation that started with a simple request: allowing cluster tenants to use third-party Kafka services. What seemed straightforward turned into a complex DNS resolution problem that required testing seven different approaches before a working solution was found.

You will learn:

- How to implement the final solution using node-local DNS and CoreDNS templating with practical details including ndots configuration and Kyverno automation
- Platform engineering evaluation criteria for assessing solutions based on maintainability, self-service capability, and evolvability in multi-tenant environments

Watch (or listen to) it here: https://ku.bz/NsBZ-FwcJ

🌟 This episode is sponsored by LearnKube — get started on your Kubernetes journey through comprehensive online, in-person or remote training.https://learnkube.com/training

With @Birthmarkb "Performance reviewer" Farrell

This article explains how to enforce security and compliance by validating Kubernetes resource configs using Open Policy Agent (OPA) and Rego policies, with deployment tips for Gatekeeper and sidecars.

More: https://ku.bz/nVYydLnDP

Ritesh Patel, Co-founder @ Nirmata, announces the recent launch of Nirmata's AI Platform Engineering Assistant.

He explains how platform engineering teams are currently overwhelmed by the need to master multiple new technologies, creating a significant productivity bottleneck. The AI assistant acts as a dedicated teammate that accelerates critical tasks in security, policy, and governance - areas that typically consume substantial time and expertise.

Watch the interview: https://ku.bz/8nkrRSG_Z

Read the announcement: https://ku.bz/8_yYZZMG4

This week on Learn Kubernetes Weekly 160:

🌐 Kubernetes Networking from Packets to Pods
⚙️ Seamless Istio Upgrades at Scale
🔍 How I find and fix Kubernetes Exit Codes and Misconfigurations for free
🔒 Kubernetes security fundamentals: networking
📊 A Step-by-Step Guide to Jaeger Tracing on Kubernetes

Read it now: https://kube.today/issues/160

⭐️ This issue is brought to you by vCluster Labs and Learnkube. To explore the architecture from hardware to runtime and understand why GPU scheduling is different, join the free webinar on GPU Sharing Mechanisms in Kubernetes https://ku.bz/8GzcKPzzF

This tool provides a Model Context Protocol (MCP) server for querying Kubernetes Audit Logs across cloud providers using AWS CloudWatch, GCP Logging, and Alibaba SLS.

More: https://ku.bz/Hm_CMFF66

This tutorial walks you through enabling, running, and monitoring IPv6 networking on Kubernetes clusters using Cilium

More: https://ku.bz/b6RFcGQjF

Kube No Trouble (kubent) is a tool to check whether you're using any deprecated APIs in your cluster and therefore should upgrade your workloads first, before upgrading your Kubernetes cluster.

More: https://ku.bz/zMyZdL3w6

This article explores why using Kubernetes namespaces alone is not a sufficient isolation or security boundary.

It shows common pitfalls and many attack paths that let a tenant escape isolation even if you only gave them access to a single namespace.

More: https://ku.bz/PCmRjmB57

Tetragon enables powerful real-time, eBPF-based security observability and runtime enforcement.

It is Kubernetes-aware and understands identities, allowing security event detection to be configured in relation to individual workloads.

More: https://ku.bz/WrhnVyd2p

This week on Learn Kubernetes Weekly 161:

🔥 Kubernetes Informers Are So Easy... To Misuse!
🎤 KubeCon 2025: Three Things This Year’s Conversations Told Me About Kubernetes Optimization
🛑 Importance of Graceful Shutdown in Kubernetes
🚪 Breaking Boundaries: Kubernetes Namespaces and Multi-tenancy
🎯 Centralizing Helm Charts: Moving Beyond Ingress with HTTPProxy

Read it now: https://kube.today/issues/161

⭐️ This newsletter is brought to you by StormForge by CloudBolt — ML-powered Kubernetes rightsizing that keeps clusters fast, efficient, and under control https://ku.bz/2CSC8dH38

kubelogin is a kubectl plugin for Kubernetes OpenID Connect (OIDC) authentication, also known as kubectl oidc-login.

More: https://ku.bz/tVhnrW9MG

This article explains how to remove permission checks from microservices and build a centralized authorization layer with Kong OSS and OpenFGA.

More: https://ku.bz/50Pf5hFcV

This open-source tool helps you manage authentication and access across servers, databases and Kubernetes clusters via API or CLI.

More: https://ku.bz/VYnDyMT1h

This article shows how to use the Kong OIDC plugin together with Keycloak to secure cluster services and HTTP routes at the API gateway level.

More: https://ku.bz/2Q103hfW1

This tool delivers real-time node/pod-level process, file and network visibility for Kubernetes and bare-metal environments, with rule-based alerts, dashboards and hybrid cloud support.

More: https://ku.bz/7lk94WvMv

This week on Learn Kubernetes Weekly 162:

🐍 Kubernetes Needs Its Python Moment
☁️ Migrating Kubernetes out of the Big Cloud Providers
📦 Kubernetes v1.34: DRA Consumable Capacity
🛠️ Managing APIs in Kubernetes with Kong Ingress Controller
🚑 Fixing Upstream Connect Errors (Docker, Kubernetes, Spring Boot & More)

Read it now: https://kube.today/issues/162

⭐️ This newsletter is brought to you by Depot — Speed up your Docker builds by up to 40x with Depot's cloud-based builders https://ku.bz/bnY9lr632

This article introduces ChaosRoom, a playful tool that helps engineers learn chaos engineering by running mini-games simulating faults and observing how systems respond.

More: https://ku.bz/2GlrYmTbT

This week's 6 best Kubernetes vacancies that focus on security are:

DevSecOps Engineer with OpenAI
💰 $364.5K to $490K a year
👨‍💻 Remote from the United States of America
→ https://ku.bz/NXd17JHfV

DevSecOps Engineer with Airwallex
💰 $200K to $300K a year
🏠🏃🏻‍♂️🌎 San Francisco, CA, USA
→ https://ku.bz/9V59yN3h9

Security Architect with Dexterity
💰 $200K to $300K a year
🏠 From the office in Redwood, CA, USA
→ https://ku.bz/-Tx02LFF4

DevSecOps Engineer with Corelight
💰 $221K to $268K a year
👨‍💻 Remote from North America.
→ https://ku.bz/_D5yTqnHk

👉 Browse 867 jobs on Kube Careers https://kube.careers