7 min read · 12 sources

Kubernetes v1.37 is out, and the headline is Memory QoS finally hitting beta. If you have ever watched a latency-sensitive pod get throttled into oblivion while its neighbor hogs the node, this one is for you. The feature uses the cgroup v2 memory controller to give the kernel explicit guidance on how to treat container memory, which means the kubelet can now enforce memory throttling and memory pressure policies without you hand-rolling scripts. The default memoryThrottlingFactor has changed to null in this release to make sure upgrading your cluster does not suddenly start throttling workloads that were previously fine. For cluster operators, this is the kind of background change that quietly prevents a production incident six months from now.

Alibaba’s internal AI review assistant has identified millions of code defects across tens of thousands of developers over the past two years.

Kubernetes v1.37: Memory QoS Graduates to Beta

Memory QoS has been in the works for a while, and v1.37 is the release where it stops being an alpha experiment. On Linux nodes running cgroup v2, the feature uses the memory controller to give the kernel better guidance on how to treat container memory. Concretely, it lets the kubelet configure memory throttling and memory pressure behavior per pod, so you can keep latency-sensitive workloads snappy without needing a PhD in cgroup internals. The default kubelet configuration still does not enable memory throttling or memory pressure enforcement, so this is opt-in for now. But the fact that it is beta means the API is stable, and the project is committed to not breaking it in future releases. If you run stateful workloads with tight memory profiles, this is worth testing against your node stress scenarios sooner rather than later.

Cilium 1.20: Gateway API ExternalAuth, TCPRoute/UDPRoute, and IPv6 ENI

Cilium 1.20 is the second major release of the year, and it is a big one for platform teams looking to consolidate their networking stack. The headline features are Gateway API ExternalAuth support and the addition of TCPRoute and UDPRoute resources, which means you can now manage more of your north-south traffic through the same API you already use for the data plane. Authentication and authorization can be handled before a request even reaches the application, which simplifies the service mesh story considerably. There is also ENI IPAM support for IPv6, a per-pod option to disable source IP verification, and a new ClusterNetworkPolicy for admin-level guardrails. If you are still running Ingress NGINX, the argument for letting the CNI you already operate take over that traffic management is getting harder to ignore. Cilium is no longer just a networking plugin; it is becoming the control plane for your edge.

Cloudflare Gives You a Way to Block AI Crawlers Without Losing Search

The robots.txt arms race has been messy. Some of the largest organizations on the internet use mixed-use crawlers: a single bot that serves both search indexing and AI training. Refuse one, and you refuse the other. Cloudflare is announcing a new Disallow AI Training setting that lets you stay indexed for search while refusing to let that same crawler train on your content. This is a site-wide yes or no that is a bit blunt, but it is a start. The real problem is granularity: how much of your content appears in a summary matters as much as whether it appears at all. For now, the setting gives publishers a clean way to draw the line without breaking their search rankings. If you run a content site or a documentation portal, this is the first tool that actually respects the distinction between indexing and training.

Alibaba Open-Sources Its Internal AI Code Review Tool

Alibaba has open-sourced Open Code Review, the AI-powered code review CLI that has been running inside the company for the past two years. The tool has served tens of thousands of developers and identified millions of code defects, which is the kind of scale that makes your internal linter look like a toy. It reads Git diffs, sends changed files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision. The agent can read full file contents, search the codebase, and inspect other changed files for context, so it produces deep reviews rather than surface-level diff feedback. The hybrid architecture combines fast static analysis with LLM reasoning, which keeps the cost down while still catching the subtle stuff. If you have been holding off on AI code review because the tools feel like toys, this is worth a look.

OpenResearch: A Local-First Workspace for Research Agents

OpenResearch is a local-first workspace for research agents and autoresearch that turns coding agents into full-time investigators. Install the CLI on macOS or Linux, launch it, and you get parallel exploration: each research direction gets an independent agent session and an isolated git worktree. The platform can autonomously propose ideas, change code, launch experiments, and summarize findings, all while you stay in the loop. Users can run workspaces locally, over SSH, or on remote machines, which makes it flexible for teams that do not want their research data leaving their infrastructure. This is aimed at the growing crowd of engineers who treat AI agents as junior colleagues, but want them sandboxed and auditable rather than running wild in the cloud.

Infrastructure Identity for Platform Engineers

The old model of static credentials and network-based trust is dying, and infrastructure identity is the autopsy. It is a Zero Trust approach that assigns cryptographic identities to every entity - human, machine, workload, and AI agent - and replaces network trust with short-lived, just-in-time, identity-based access. Three forces are driving this: the shift to ephemeral infrastructure, the rise of autonomous agents that need scoped credentials, and the audit requirements that come with regulatory pressure. Platform teams can embed just-in-time, policy-driven access into developer workflows, which cuts down on standing privileges and gives you a clear audit trail. If you are still managing a vault full of long-lived secrets, this is the direction the industry is heading.

Let's Not Water Down the Terms Continuous Integration and Continuous Delivery

Octopus Deploy is pushing back on the industry’s tendency to dilute precise terms. Continuous Integration means merging all changes into a shared mainline at least daily, and Continuous Delivery means keeping the software in a state where it can be released to production at any moment. These are not vague aspirational phrases; they are well-documented practices with 26 years of history behind them. The author’s point is not semantic pedantry. When you call something CI/CD that is actually just “we run tests on a branch,” you set false expectations and make it harder to have honest conversations about what your pipeline actually does. If your team says it practices CD but you still have a release manager who clicks a button on Fridays, you are not doing CD.

How Cloud Native Goes AI Native

A salesperson writing code used to be the setup for a joke, but now no one is laughing. Tools like Cursor, Claude, Lovable, and Replit count their users in the millions, and a meaningful share of those users have never written a line of code by hand - and never will. A lot of the products vibe-coded into existence have real potential and creators who understand what the market needs. The problem is they cannot get to production. The CNCF argues that the cloud native ecosystem is the only viable path for these AI-generated applications to scale, secure, and observe. The infrastructure is the bottleneck, and that is exactly where platform engineers come in.

Databricks Announces Demand-Based State Repartitioning for Spark

Anyone running stateful Spark Structured Streaming queries in production eventually hits the same wall. You started with a modest data volume and accepted the default of 200 shuffle partitions. Then the business grew, traffic tripled, and the state store ballooned. Suddenly, those 200 partitions are the wrong size, and you are stuck rebalancing by hand or living with the skew. Databricks is announcing demand-based state repartitioning, which automatically adjusts the number of state partitions based on actual data volume and processing load. This is a fix for a problem that has been plaguing streaming engineers for years, and it is the kind of thing that makes you wonder why it took this long.

AWS DevOps Agent Goes GA

AWS has announced the general availability of its DevOps Agent, an AI assistant that reviews code changes and runs autonomous testing so you can ship to production with confidence. The agent is designed to integrate with your existing development workflow, catching issues before they hit the pipeline. AWS is positioning this as a way to reduce the toil of code review and testing, freeing engineers to focus on building. If you are already deep in the AWS ecosystem, this is another reason to stay there.

Quick Links

Source: aws.amazon.com ↗

• If you are building a platform that runs on AWS, the DevOps Agent is worth evaluating. AWS DevOps Agent
• New Relic Lens has hit general availability, letting you query external data sources like Snowflake, PostgreSQL, and Google Sheets with standard SQL from inside the New Relic UI. New Relic Lens GA
• GitLab is hosting Transcend, a virtual event on AI-native DevOps, on September 16. Register here