9 min read · 12 sources

Cloudflare just deleted 100 terabytes of RAM from one of the biggest in-memory caches on the internet, and the technique is the kind of thing every engineer running a hot key-value store should read. Kubernetes shipped its quarterly release on the same day, Grafana made shared saved queries generally available, and at least four vendors independently decided that the next platform problem isn’t writing code, it’s governing the agents that do.

At p99, per-instance resident memory on 1.1.1.1 fell from 9.3 GB to 5.3 GB after Cloudflare trimmed 533 bytes from every one of 250 billion cache entries.

Cloudflare cut 100 TB from 1.1.1.1 by shrinking the cache entry

Source: blog.cloudflare.com ↗

The headline number from Cloudflare’s Big Pineapple DNS post is the absolute: 100 terabytes of fleet memory recovered, the equivalent of the RAM in 130 13th-gen servers, freed without throwing away a single cache entry. The platform holds over 250 billion DNS records at any moment across 1.1.1.1, Gateway DNS, DNS Firewall, and AS112, so the per-byte arithmetic compounds hard.

Five successive changes drove the win. Per-entry footprint went from 953 bytes to 420 bytes, a 56% reduction. Cache insert throughput rose 43%, lookup latency fell 19%, and p99 resident memory per instance dropped from 9.3 GB to 5.3 GB. The team also publishes the actual struct shapes it used, so it’s worth reading the post for the bookkeeping, not just the headline.

Two things are worth flagging for engineers. First, the biggest gains came from removing type overhead in the CacheKey and CacheEntry structs, not from clever compression, which is a useful reminder that Go’s interface and slice headers add up at this scale. Second, EDNS Client Subnet-heavy locations benefit most, because they cache multiple answer variants per query, and the optimization collapses the variants down. The benchmark mix was 56% A, 25% AAAA, 19% TXT with 1–4 records each, and TXT sizes randomized 64–224 bytes, which is close enough to real traffic to be useful.

Kubernetes 1.37 "Garhwal" ships 67 enhancements

Source: kubernetes.io ↗

Kubernetes 1.37 is named after a Himalayan region in Uttarakhand, India, and the artwork leans into terraced fields, deodar forests, and Devanagari numerals. Skip past the branding and the numbers are the real story: 67 enhancements, 16 graduating to Stable, 23 to Beta, 27 entering Alpha, and one deprecation, on the standard 15-week cycle that ran from May 18 to August 26 with contributions from up to 212 companies and 1,754 individuals.

The two graduations engineers will notice: metrics.k8s.io finally went Stable after almost nine years in Beta, which is the kind of API debt that quietly haunts a lot of monitoring stacks, and KYAML, a safer YAML subset, is now the default. Memory QoS and concurrent watch object decoding are now on by default, and HorizontalPodAutoscaler scale-to-zero is in Beta, which is the first time the default HPA can actually hit zero replicas without a custom controller.

The full feature list is in the changelog, but for SREs the practical read is that the metrics pipeline is no longer API-beta, and any monitoring code that special-cased it can now be simplified.

Grafana 13.2 makes saved queries a first-class object

Source: grafana.com ↗

Grafana 13.2 turns shared saved queries into a general-availability feature in Grafana Cloud and Grafana Enterprise. Teams can now publish a library of reusable PromQL and SQL queries with titles, descriptions, tags, and variable mappings, browsable by data source, author, or text, and savable from dashboard panels, Explore, and annotation queries.

The operational pitch is the boring one, which is the right one: stop rewriting the same histogram_quantile query across 40 dashboards, and stop having the on-call engineer hand-curate their own panel because nobody could find the “right” version. RBAC and Terraform provisioning are in, so the library can be governed like any other resource, and the command palette surfaces queries without anyone needing to know which dashboard they live in.

A new View panel sidebar lets you explore busy panels without edit permissions, which closes a long-standing papercut for read-only viewers. Git Sync, the homepage, variable editing, and dashboard organization also got upgrades, but the saved queries change is the one that will quietly compound in team productivity.

Harness RT Agents put chaos testing on autopilot

Source: harness.io ↗

Harness’s RT Agents attach to your existing Harness CD pipelines and Kubernetes clusters, passively read deployment configs and manifests, and surface resilience risks without injecting faults. Once a risk is flagged, the agents generate and run the chaos experiment or load test, in Java, JavaScript, or Python, to confirm it.

The thing that actually matters here is the passive part. Most chaos engineering tools die on the altar of “who has time to write experiments,” and what Harness is selling is the boring alternative: continuous risk identification tied to the deploy pipeline, with a numerical Resilience Score so you can chart the metric over time. There’s a free plan, a new in-product Resilience Insights dashboard, and simplified Kubernetes onboarding that uses the cluster’s existing metadata rather than asking you to label everything twice.

If you’ve ever had a “we should really do chaos testing” ticket that nobody owns, this is what the vendor response to that ticket looks like in 2026.

Governance is the new bottleneck, and the vendors know it

Source: about.gitlab.com ↗

Three pieces in the same issue land on the same thesis from different angles: as code generation gets cheap, the hard part is trust, context, and governance around AI agents.

GitLab’s “When code is abundant” borrows Anthropic’s August 21 framing that “code is no longer the bottleneck” and ties it to its own June Transcend announcements: source control rebuilt for machine-scale concurrency, Orbit as a context graph, and governance primitives around agent identity, policy, approval, and audit. Stripe, Spotify, and Amplitude are named as production references.

Google Cloud’s State of AI Infrastructure report puts numbers on the sentiment: 79% of tech leaders cite security, governance, or operations as the biggest challenge to scaling inference, and 35% of senior IT decision makers flag insufficient security for multi-system access as a barrier to agentic deployment. New attack classes it names explicitly are tool poisoning and indirect prompt injection, and the recommended posture shift is from breach prevention to provenance verification across identity, network, and model layers. 69% of executives now rate a full-stack cloud platform as critical, and 80% prioritize data compliance.

Datadog’s Golden Paths for AI agents takes the platform-engineering lens and argues that Golden Paths, which used to be developer onboarding docs, now have to be machine-consumable contracts, with execution patterns chosen for the workload’s primary constraint (synchronous low-latency versus durable and asynchronous) and dispatch controls that an agent can call rather than a human can read. It cites Gartner’s 2026 Hype Cycle for Agentic AI formally recognizing agents as a user persona with their own “agent experience,” and builds the framework on Carnegie Mellon’s Attribute-Driven Design.

The throughline for people running internal platforms: stop building docs for humans to follow and start building APIs for agents to call, with the same RBAC, audit, and policy gates.

The AI factory on Kubernetes is really a GPU pooling problem

Source: cncf.io ↗

The CNCF post on building an AI factory on Kubernetes reframes the question. The factory isn’t one model or one cluster, it’s a shared GPU pool with multi-tenant isolation, and the metric that determines whether the capital spend pays off is utilization, not peak tokens per second.

The post walks through the problem with the standard nvidia.com/gpu: 1 device-plugin model, which pins whole accelerators even when a workload uses 10% of them, and contrasts it with Dynamic Resource Allocation, which went GA in Kubernetes 1.34 and lets the scheduler treat accelerators as rich devices with attributes, memory, and topology, though DRA itself doesn’t fractionate GPUs. The stack it points at is mostly CNCF: DRA for scheduling, HAMi for software GPU partitioning, vCluster for per-tenant control planes, KServe for inference, and OpenCost for chargeback. Network and storage isolation are increasingly getting pushed into DPUs like NVIDIA BlueField, off the host CPU.

It also cites SemiAnalysis’s ClusterMAX rubric, which rewards per-tenant Kubernetes clusters and DPU-based isolation and flags shared clusters as weak, which is the closest thing the industry has to a public scorecard for “are you doing this right.” If you’re buying GPUs in 2026, the post is essentially a checklist of which platform gaps to budget for.

Tailcat: netcat over Tailscale, no account required

Source: github.com ↗

Tailcat is Tailscale’s open-source netcat replacement that rides the company’s WireGuard data plane without using the Tailscale control plane. Two peers exchange a short connection token out of band, bootstrap through DERP relays using a default map at tailcat.dev/derpmap.json, and upgrade to direct peer-to-peer UDP when NAT hole-punching works.

It runs in userspace, so no root, no routing-table changes, no DNS changes. It can also tunnel TCP ports, SSH, SOCKS5, and exit-node access, which covers the usual “I need to get a packet from here to there right now” use cases. There’s an experimental WASM browser demo at tailscale.github.io/tailcat that talks to the CLI over DERP until WebRTC support lands.

The interesting bit is the absence: account-free, end-to-end WireGuard-encrypted tunnels for ad-hoc work, with the operational properties of nc and the security properties of the data plane that already secures half the industry’s tailnets. Install via go install github.com/tailscale/tailcat/cmd/tailcat@latest or the Nix flake.

Smaller ships: Archify, Garden Skills, and DigitalOcean v5

Source: github.com ↗

Archify is a Node.js tool that takes a codebase or a system description, has an agent produce a typed JSON IR, and deterministically compiles it to HTML or SVG. It supports Cursor, Claude Code, Codex CLI, and OpenCode, exports to self-contained HTML plus PNG, SVG, WebM, and 1200×630 share cards, and ships a Proof Lab of 11 checked-in scenarios plus snapshot comparison (Before, Delta, After) with exact added, removed, changed, moved, and rerouted facts. For teams that review architecture diagrams in pull requests, the deterministic compile plus diff is the actual feature.

Garden Skills is a curated set of production-ready agent skills for Claude Code, Cursor, Codex, and similar tools, installable via npx skills, the Claude Code plugin marketplace, a pinned v1.2.2 zip, manual copy, or git submodule. The standout skill is web-video-presentation, a Vite plus React plus TypeScript scaffold that turns scripts into 1920×1080 click-driven presentations with 23 themes and pluggable TTS supporting mmx-cli, OpenAI, ElevenLabs, edge-tts, Azure, Google Cloud, and macos-say. Five categories today: web video, design, image generation, local knowledge retrieval, and article editing.

DigitalOcean v5 Droplets ship on 5th Gen AMD EPYC with up to 30% higher per-core performance than the previous generation and early customers reporting 2x gains. For the first time, vCPU, memory, and storage can be selected independently with hourly pricing and a per-resource bill breakdown, with memory ratios from 2x to 8x per vCPU across Shared (s5) and General Purpose (g5) tiers. Available today in Memphis, Kansas City, Richmond, and Atlanta, usable standalone or in DigitalOcean Kubernetes node pools. Existing plans, prices, bundles, and monthly caps are unchanged, so adopting v5 doesn’t force a migration of anything you’ve already sized.