CNCF's Chris Aniszczyk on 10 Years of Cloud Native & AI Infrastructure

sbom-cve-check 1.4.0 released

sbom-cve-check 1.4.0 has been released, adding an OpenVEX exporter and improving Linux kernel CVE analysis and version parsing. The new openvex export type, contributed by Andrey Zhizhikin, generates OpenVEX v0.2.0 documents with VEX assessments, configurable via a new --export-author option. Kernel CVE handling now distinguishes mainline versions like 6.12 from stable versions like 6.12.34 to reduce false positives and negatives. Version parsing also gained support for formats like 0.9~rc5 and Ubuntu-style suffixes, and build metadata like 1.25.0+4f85853f64 is now ignored per semver rules. Install or upgrade with pip install --upgrade "sbom-cve-check[extra]".

Karpenter Enterprise for Azure AKS & NAP

Using Karpenter on AKS or NAP? Power it up to provision to app usage, not requests, with Cast AI’s Karpenter Enterprise Suit for Azure.

One flag, many guardrails: Making a platform safe enough to delegate

This post draws on a talk co-presented with Julien Semaan of Kubex at KubeCon + CloudNativeCon Europe 2026; GitOps Gone Wild: Hardening Delivery Pipelines for…

Distributed LLM Inference on Kubernetes with llm-d, Wasm, & TornadoVM

Edoardo Vacchi covers the evolving landscape of WebAssembly on the backend, running Java workloads on GPUs using TornadoVM, and optimizing distributed AI inference using llm-d and vLLM on Kubernetes.

A refreshed Network Policy Editor website and two new VS Code extensions

Meet the refreshed Network Policy Editor and two new VS Code plugins.

Kubernetes Multi-Tenancy, Layer by Layer: Isolation Proved by Being Refused

“” is published by Filipe Motta in ITNEXT.

5 Event Driven Architecture Problems (And How to Avoid Them)

Event-driven architecture (EDA) phổ biến nhưng tiềm nhiều thách thức trong production environment. Vấn đề truy xuất lỗi (tracing) trở nên phức tạp khi sự kiện (event) đi qua nhiều service khác nhau, đòi hỏi hệ thống phân tích log tập trung như ELK stack. Hàng đợi tin hỏi (dead letter queues) dễ bị đầy nếu không implement validation logic kỹ càng, dẫn đến mất dữ kiện quan trọng. Sự không nhất quán cuối cùng (eventual consistency) gây race condition khi nhiều consumer xử lý cùng event đồng thời. Các EDA system cần thiết kế event schema versioning và comprehensive testing framework với Contract Testing để đảm bảo reliability khi số lượng service tăng lên.

Bài viết này giúp lập trình viên nhận diện và giải quyết các vấn đề phổ biến trong kiến trúc hướng sự kiện như tracing, dead letter queues, tính nhất quán cuối cùng và testing.

Announcing the OpenTelemetry JavaScript SDK 3.0

OpenTelemetry JavaScript has released SDK 3.0 (stable v3.0.0 packages and experimental v0.300.0 packages) and API 1.10.0. Migration guide For a detailed description of breaking changes, see the OpenTelemetry JS SDK 3.x migration guide. What is JS SDK 3.x? JS SDK 3.x encompasses new releases of the @opentelemetry/* JavaScript packages published from the opentelemetry-js repository, except the API and semantic-conventions packages. The package versions for this new major will be >=3.0.0 for the stable and >=0.300.0 for the unstable packages. Details on the full list of packages can be found in the migration guide.