Zalando replaced shared edge routing for high-fan-out internal calls with an in-process load balancer that mirrors Skipper’s consistent-hash ring. They built a standalone JVM module for hash-parity routing, switched to a watch-based Kubernetes informer, and overhauled their CI/CD pipeline to safely roll out traffic ramps. The change cut latency spikes, reduced costs, and boosted deployment velocity.

• Replacing shared Skipper routing with an in-process client-side load balancer for internal fan-out calls eliminated latency spikes and noisy-neighbor ambiguity from shared infrastructure.
• The CSLB exactly replicates Skipper's consistent-hash ring (xxHash64, 100 virtual nodes) so both routers map product IDs identically, verified via unit tests and canary cache-hit parity.
• A Kubernetes informer with a two-second debounce coalesces pod churn into single ring updates, avoiding control-plane overload while keeping routing current.
• A refactored CI/CD pipeline cut build times from 21 to 12 minutes and removed 40+ manual steps, enabling faster iteration and safer traffic ramp-ups.

Helmsniff is a Go CLI that scans rendered Kubernetes and Helm manifests and generates CSV or JSON reports of security misconfigurations. It flags issues like missing securityContexts, insecure HTTP URLs, hostNetwork usage, privileged containers and Docker socket mounts, and supports directory or stdin input, parallel execution, and standard Makefile targets.

• Helmsniff scans rendered K8s/Helm YAML and outputs a CSV or JSON report flagging misconfigurations like privileged containers, missing resource limits, hostNetwork usage, and Docker socket mounts.
• It accepts input from a directory or stdin, letting you pipe `helm template` output directly in without temp files, and supports parallel scanning of multiple charts via GNU parallel.
• Each report row includes chart path and file path context, with checks marked 1 (violation) or 0 (safe), plus K8S_STATUS/HELM_STATUS boolean fields.
• Built in Go (requires 1.22+ and GNU Make), with a clean codebase split into cmd/main.go, config, parser, and scanner modules, backed by tests and an ARCHITECTURE.md documenting each check.

Solo.io and Google teamed up to integrate Agent Substrate into kagent, enabling fast suspend/resume, scale-to-zero and secure sandboxing for AI agents on Kubernetes. It uses pre-provisioned worker pools, snapshots to storage, and lightweight isolation (gVisor or Firecracker) to cut boot times to milliseconds and minimize idle resource use.

• kagent now integrates Google's Agent Substrate to suspend/resume/scale-to-zero AI agents on Kubernetes in 50-200ms instead of the seconds pods normally take to boot
• It works by pre-provisioning worker pools and snapshotting idle agent states to object storage (S3/GCS), then restoring them on demand
• A parallel control layer handles deploy/suspend/resume logic instead of routing everything through the Kubernetes API, avoiding overload
• Each agent instance can be sandboxed with gVisor, Firecracker, or Bubblewrap/Landlock/seccomp, with Solo.io's agentgateway enforcing egress control and credential injection at the network edge

This issue covers Cloudflare’s new real-time WAF rules, Anthropic’s Claude Fable and Mythos 5 models, and HashiCorp Boundary’s agent-aware access controls. It also highlights Microsoft Foundry’s model management, geo-distributed AI training with k0smos, plus tools like MemPalace, whichllm, a Rust Git rewrite, Kubernetes Inference Extension, and Cilium’s CI/CD hardening.

• Anthropic split Claude 5 into two tiers—Fable 5 for general use with a conservative safety layer, Mythos 5 with relaxed rails for vetted cyberdefense/life-sciences partners
• Mirantis and Logsight.ai used the open-source k0smos stack to pool Nvidia A100s in Quebec and AMD MI300Xs in Atlanta from Frankfurt, auto-scaling GPUs based on real-time electricity prices
• GitButler's Grit project rewrote Git in Rust using coding agents, passing 41,715 of 42,001 tests but burning 45 billion tokens and needing heavy human oversight
• MemPalace achieves 96.6% recall on LongMemEval by storing conversation memory as local text with no cloud calls

This guide explains how runtime security defends live Kubernetes workloads by monitoring system calls, network behavior, and file integrity. It shows why pre-deployment scans miss zero-day exploits and runtime threats like container escapes, lateral movement, and cryptomining. It then details how Cilium Tetragon uses eBPF in the Linux kernel for precise, real-time enforcement.

• Pre-deployment scans only catch known CVEs and miss zero-day kernel exploits or API-based code injection, so runtime monitoring of syscalls, network, and files is necessary to catch live attacks.
• Cilium Tetragon uses eBPF in the Linux kernel to enrich raw events with pod/namespace/deployment metadata (turning "PID 4052 ran bash" into "frontend pod in production ran bash") and can block or kill malicious processes in real time.
• Shared kernels and cgroups don't stop in-memory attacks or syscall abuse, and Kubernetes RBAC can't catch data-plane threats like lateral movement, cryptomining, or DNS-tunnel exfiltration.