7 min read · 12 sources

Salesforce spent hours on its knees this week, and the postmortem is a textbook case of a login path becoming the single point of failure. Requests stalled on an internal login service, exhausted server resources, and took hundreds of instances down with severe delays, intermittent errors, and outright inaccessibility. A validated fix went out fleetwide, but some instances needed manual restarts and kept failing scheduled jobs afterward. If your architecture routes everything through one auth service, this is your reminder that it is also your outage boundary.

The more interesting news for people who actually run clusters is in Kubernetes v1.37, which graduates Pod-Level Resource Managers to Beta. This one quietly solves a problem that has been annoying latency-critical workloads for years: you no longer have to choose between dedicating physical cores to sidecars or giving up NUMA alignment. And if you are paying for coding agents, a new analysis suggests you might be overpaying by 5x based on which harness you picked. Details below.

Across 21 model-harness combinations on SWE-bench Lite and Terminal-Bench 2.0, harness choice changed cost by as much as 5x, and the model provider’s own harness was not consistently the most efficient option.

Kubernetes v1.37: Sidecars stop wasting your NUMA-aligned cores

Source: kubernetes.io ↗

Pod-Level Resource Managers graduated to Beta in v1.37, controlled by the PodLevelResourceManagers feature gate and disabled by default. The change lets the Kubelet’s Topology Manager, CPU Manager, and Memory Manager use pod-level resource declarations directly when deciding hardware placement.

Before this, operators faced a nasty trade-off: give sidecars their own dedicated physical cores and lose NUMA alignment for the primary container, or share cores and watch the sidecar steal cycles from the workload that actually matters. The Beta enables hybrid allocation models where primary containers get exclusive NUMA-aligned resources while sidecars share a pod-isolated pool. It also adds top-level cpu_ids and memory fields to PodResources responses via the v1 gRPC service, so monitoring tools can query pod-level assignments without double-counting.

If you run latency-critical workloads with sidecars, this is worth evaluating now. The feature is off by default, but the cost of not testing it is dedicating expensive physical cores to a log-forwarder that runs at 2% utilization.

HarnessTax: Your coding agent's harness is a 5x cost lever

Source: harnesstax.github.io ↗

Coding-agent harnesses - Claude Code, Codex CLI, Pi, and the rest - can hit similar task success rates while burning wildly different amounts of tokens and money. Across 21 model-harness combinations on SWE-bench Lite and Terminal-Bench 2.0, harness choice changed cost by as much as 5x. And the model provider’s own harness was not consistently the most efficient option for its own model.

The practical takeaway: if you are paying per token for agentic coding, the model is only half the bill. The harness determines how many tokens the agent burns on context, retries, and tool calls. Benchmark your actual workflow across a couple of harnesses before committing, because the default choice - whatever the model vendor ships - is not a safe assumption.

OpenBao and CloudNativePG: A fully open-source secrets stack

Source: cncf.io ↗

This CNCF walkthrough shows how to run OpenBao - the Linux Foundation’s open-source fork of HashiCorp Vault - on Kubernetes with a CloudNativePG PostgreSQL backend. It is a fully self-healing secrets management setup with zero vendor lock-in.

The architecture uses a three-instance CNPG cluster as OpenBao’s encrypted key-value store. All passwords are removed from connections: roles authenticate via TLS client certificates issued by DatabaseRole, enforced by explicit pg_hba rules. A schema-init job revokes default public permissions to lock the database down. CloudNativePG automatically renews client certificates every 90 days, but OpenBao needs a rolling restart to load the new files - a detail that will bite you in production if you do not automate it.

For a local test, cnpg-playground provisions a Kind cluster with six nodes, three of them tainted for Postgres. This stacks two CNCF projects into a secrets backend with synchronous replication and certificate authentication, no commercial license involved.

Salesforce's login service became its outage boundary

Source: theregister.com ↗

The global outage hit hundreds of instances for hours. Requests stalled on an internal login service and exhausted server resources, taking down services with severe delays, intermittent errors, and inaccessibility. The fix was deployed fleetwide, but some instances needed manual restarts and continued to see scheduled-job failures.

The Register’s roundup also notes Marvell pushing GlobalFoundries for wafer production, Huawei’s Ascend NPUs, Nvidia’s green energy initiatives, and a Spanish AI-aided cyber attack. Russian phishing campaigns are posing as Signal support, and Microsoft is patching on-prem SharePoint under zero-day attack. EQT is acquiring a majority stake in Acronis at a $3.5B+ valuation. Also: KDE turned 30, Shopify acquired Tailwind, Switzerland is testing FOSS alternatives to Microsoft 365, and Canonical is shuttering legacy chat channels. A busy day behind the big headline.

Cloudflare gives Workers granular authorization

Source: blog.cloudflare.com ↗

Cloudflare now offers four new roles for Workers: Metadata Read-Only, Content Read-Only, Editor, and Admin. These let teammates or agents access specific Workers without broader account access - viewing observability data without source code, reading code without modifying, deploying changes without deleting, or full control over a single Worker.

The roles are available today for all customers, assignable to users or via scoped API tokens for agents. This is the least-privilege story that has been missing for agentic workflows: previously, giving an agent the ability to deploy meant giving it the keys to your entire account. Now you can let it touch exactly one Worker and nothing else.

Komodor's Agentic Operations Platform: SREs become agent managers

Source: cloudnativenow.com ↗

Komodor extended its AI SRE reach to let SREs deploy agentic AI workflows using its Agentic Operations Platform. It ships with over 50 out-of-the-box specialist agents, skills, integrations, and MCP servers, with templates for troubleshooting, AI consumption optimization, and CI/CD remediation.

Role-based policies define who can invoke agents and what credentials they use, with guardrails, audit trails, shadow-testing, and spending limits. The pitch is that SREs are becoming managers of agentic engineering workflows, and the change management problem is real: thousands of AI agents in production need the same governance as any other workload.

Cline and BrowserSkill: Two tools for the agentic workflow

Source: github.com ↗

Cline is an open-source coding agent spanning IDE, terminal, and desktop. It reads project structure, makes coordinated changes, monitors linter and compiler errors, and executes terminal commands with real-time output watching. All changes are tracked via checkpoints and diffs for review, and the CLI supports fully headless mode for CI/CD. The SDK lets you build custom agents and integrations.

BrowserSkill connects agents like Cursor, Claude Code, and Codex to a user’s already logged-in browser. Agents explicitly borrow open tabs and return them after tasks, reusing real login states without separate test accounts. It runs in a separate Agent Window to avoid interrupting the user, with built-in human-in-the-loop for captchas and confirmations. macOS, Linux, and Windows are supported; Firefox is planned.

Runtime security: Falco catches what posture misses

Source: webflow.sysdig.com ↗

This Sysdig intro makes the case for runtime security as the last line of defense. Posture management catches known vulnerabilities and misconfigurations, but it misses zero-days, privilege escalation attempts, and erratic behavior - the things that happen while a workload is executing.

Falco observes system activity and triggers alarms on suspicious behavior, including network connections and cloud account activity, with cloud-native context in alerts to identify sources and correlate attacks. The scenarios it catches - stolen credentials from malware, lateral movement through vulnerable containers - are exactly what compliance scanning will never see. If you only scan for known CVEs, you are flying blind against everything that is not in the database yet.

Automating Docker registries with Harness and Terraform

Source: harness.io ↗

This Harness tutorial walks through a three-stage pipeline that provisions a unique Docker virtual registry with Terraform, builds and pushes an image, then deploys to Kubernetes with rolling updates and automatic rollback. Each run generates a unique suffix (like df17fdaf) to avoid naming conflicts, and output variables and Harness expressions pass data between stages without hardcoding.

The value is eliminating manual registry provisioning and folding Infrastructure as Code directly into CI/CD. If you are still creating registries by hand in a console, this is the pattern to steal.

Datadog Launches: Instrumentation before you ship

Source: datadoghq.com ↗

Datadog’s Launches feature in Product Analytics connects launch planning, instrumentation, experimentation, and reporting in one workflow. The planning process moves through four steps - context, questions, tracking plan, and experiment - with Bits AI drafting each step. You can connect a Datadog Feature Flag to define measurement goals before release, and the tracking plan derives the events and properties needed to answer your questions, comparing against existing events to show gaps.

The payoff is avoiding days of post-launch debugging because nobody instrumented the feature before it went live.