KubeCon + CloudNativeCon North America 2026
November 9–12, 2026 · Salt Lake City, Utah. Explore the end user talks scheduled for the main conference on November 10–12.
End user talks
83 sessions, End User Programming → End User Talk. All times are MST (UTC−7), local to Salt Lake City. Some sessions overlap; talks in the same time slot run concurrently.
Source: official Sessionize API · Verified October 31, 2026. Times, rooms, and speakers may change; check the live official schedule for updates. Dakota Sullivan, Isaac Wilson On-premises compute is inelastic, and the costs are mostly up-front. Yet workload demands and hardware health can change at any time. How do you make the most of your on-premises investments without risking capacity overruns and potential outages? Well, Karpenter and Cluster Autoscaler work great for right-sizing cloud. So what if we took their main principle and inverted it - scaling the workloads to fit the cluster instead? Getting there required rethinking how pods compete for space, and how cluster capacity is modeled. The Trade Desk tackled both with custom scheduler plugins and a new horizontal scaler. This talk covers the techniques, tradeoffs, and lessons learned along the way. Salt Palace | Level 1 | Grand Ballroom ACE Maciej Wal When a previous supplier dropped support for Colorado in the spring of 2024, the Cybersecurity Center at Metropolitan State University of Denver needed to build a replacement quickly. What started as four virtual machines scaled into a multi-cluster Kubernetes platform. Keycloak for multi-tenant identity, ArgoCD for GitOps, OPA Gatekeeper for policy, Envoy Gateway for traffic management, and cert-manager for TLS. All running in production for roughly $1,000 a month. The core SOC runs on OpenSearch with Fluent Bit and Suricata, where student security analysts investigate real threats from live data. Student developers maintain the platform infrastructure itself, contributing to GitOps workflows and operations. Both groups gain hands-on experience with CNCF projects used in production worldwide. This talk covers architecture decisions, the VM-to-Kubernetes migration, how we built a community around students and underserved organizations, and the mistakes made along the way. Salt Palace | Level 1 | Grand Ballroom BDF Anton Alexander, Scott Adams Every platform team has the same backlog: questions. Developers want to know what's happening in their namespace. On-call engineers want to know where to look first. The answers exist, just not fast. Most advice about AI starts with the technology. We started with the questions. We looked at where people already go for answers and put AI there, inside the work we were already doing. Investigations that used to take days now take hours. This talk shows what that looked like in practice and how to spot the same opportunities on your own platform. You'll leave knowing where AI fits in platform engineering work, where it doesn't, and with the confidence to start. No AI background needed. Salt Palace | Level 1 | Grand Ballroom H Juho Syrjänen Everyone wants a fancy internal developer platform with all the bells and whistles. Most companies already have one. They just haven't productized it yet. The tooling needs some love. Those Tofu modules you worked hard on, all the Helm charts you are maintaining and the reusable CI/CD pipelines? There's your platform, it's just a little fragmented, not intent driven and the developer experience could definitely be improved... You're not building from zero. The harder job is taking what you already have, slapping a fresh coat of paint on it, and turning it into an intentional product with happy users and golden paths people want to follow! This talk is about that shift. From scattered, fragmented tooling to a platform teams prefer to use over the old way. How to scope your first problem, why success criteria and platform principles need to come before code, and how to measure if any of this is worth the hassle. Salt Palace | Level 1 | Grand Ballroom GI Vara Bonthu, Ying Xiong, Rainie Li, Damon Cortesi, Padma Aradhyula Kubernetes has quietly become the default substrate for petabyte-scale data processing. Salesforce, Pinterest, Airbnb, and Apple all run native Spark, Flink, Trino, StarRocks, and Iceberg on Kubernetes at a scale the platform was never designed for. This panel of end-user operators talks about two things data leaders keep asking about. First, what does it actually take to run large-scale data on Kubernetes? Shuffle bottlenecks and Apache Celeborn, stateful upgrades, multi-tenant scheduling with YuniKorn and Kueue, Iceberg storage layouts, mixed CPU and GPU. Each panelist shares what broke at scale and how they fixed it. Second, how are AI agents changing day-2 operations? Troubleshooting agents for Spark and Flink, MCP servers for Spark History Server, agentic upgrade planning, autonomous tuning, AI-driven governance and lineage. Where are teams seeing real productivity gains, and where do agents still get it wrong? Production stories, real disagreements, no vendor pitches. Salt Palace | Level 1 | 151 Ryan Brewster Kubernetes scales until it has to synchronize. Every write serializes through one ordered log, and every read funnels through lock-guarded caches: the apiserver's watch cache, and the informer caches inside every controller. Make the cluster busy enough (ceiling: ~10-16k mutations/s) and synchronization becomes the limit: caches lag, watchers get 410 Gone, and controllers reconcile against a world that no longer exists. This talk is how Anthropic has improved Kubernetes stability by augmenting the control plane: in-cluster read replicas that take LIST and WATCH traffic off the apiserver, and controllers designed to stay functional at high mutation rates. The war story: the same innocuous LIST shape pushed a cluster of tens of thousands of nodes into an apiserver doom spiral twice in two weeks, from two different callers; only a read replica really fixes it. Along the way: what a stock controller does when its informer cache goes stale, and the data structures that avoid the trap. Salt Palace | Level 1 | Grand Ballroom ACE Sofia Sarhiri What do a Kubernetes cluster, a chocolate cluster, and a cluster of extensions have in common? Yes, they are all "clusters" yet they represent widely different things in different contexts. When these
meanings collide without a shared contextual map, organizations accrue Communication Debt: the gap that leads to stalled platform adoption, onboarding friction and frustration. Engineers are experts at using abstractions to design systems, but when explaining those systems, they often skip those layers entirely, leading with deeply technical details before establishing context or relevance. This talk is designed for engineers and other technical practitioners who need to communicate Kubernetes concepts across the gap to executives, stakeholders, new contributors, and adjacent teams. Using real Kubernetes examples, attendees will learn a practical framework for translating complex concepts across the Cloud Native Computing Foundation (CNCF) ecosystem without oversimplifying them. Salt Palace | Level 1 | Grand Ballroom BDF YoungJoon Jeong, Seol Heo The maintainer talks tell you how cache-aware inference routing works. This talk tells you what happens after you adopt it and run a dozen live services on it for a year. A Korean telecom moved from a single RAG pipeline to production agents on Kubernetes, adopting the Gateway API Inference Extension and llm-d for KV-cache-aware routing. The architecture worked in the demo. Production was a different teacher: cache-hit cliffs under real traffic, a small-versus-large model cascade whose economics only appeared at scale, and the realization that promoting a routing policy needs the same evaluation gate as promoting a model. We share the failure modes the docs omit, the small/large cascade cost numbers, the measured 40-50% time-to-first-token reduction on cache hits, how we wired evaluation into routing-policy promotion, and the operational signals that actually predicted trouble. Salt Palace | Level 1 | Grand Ballroom H Priya Namasivayam EarnIn runs 15+ CNCF add-ons (including Flux, Karpenter, Kyverno, cert-manager, Linkerd, external-secrets-operator, Velero, and more) on a high-availability platform where infrastructure failure directly affects people's access to their earnings.
After catching too many issues in production — cert-manager chains breaking silently after upgrades, Velero backup jobs completing without actually running — we built an in-cluster infrastructure testing framework using Testkube, wired directly into our Flux GitOps pipeline.
This session covers how we model infrastructure tests as Kubernetes CRDs, how quality gates fire on every GitOps-triggered change, and which failure classes we catch across our CNCF stack. We'll share real test patterns, the architecture that makes it work, and the lessons from operationalizing infrastructure testing at a fintech company where "it worked in staging" is not good enough. Salt Palace | Level 1 | Grand Ballroom GI Chad Swenson, Sagar Kundral Your image is signed. But does its evidence meet deployment requirements, and can you prove that to an auditor? Repeating shared controls and evidence collection across app teams makes compliance costly and inconsistent. AT&T and Nirmata explore an architecture for platform-managed controls: GitHub Actions emits Sigstore-backed Artifact Attestations; Kyverno's ImageValidatingPolicy evaluates artifacts, signed evidence, and destination rules at admission. Every decision is retained as audit evidence. As long-time Kyverno users, AT&T wanted expressive CEL policies in the engine it already trusted, not a new engine and language. The challenge: internal builds using GitHub's private Sigstore alongside upstream images with different trust roots. This deep dive highlights Kyverno 1.19 and 1.20 capabilities for mixed-source verification and admission performance, plus patterns for exceptions, failure handling, and evidence retention. Salt Palace | Level 1 | 151 Felipe Araujo, Kaynan Coelho When off-the-shelf solutions stop scaling, you build your own or break trying. At Nubank, distributed tracing isn't a nice-to-have: it's the backbone of observability across thousands of microservices, processing hundreds of billions of spans every day with zero tolerance for data loss. When the need for full ownership and operational independence became clear, we built a hybrid pipeline from the ground up. This talk walks through the full tracing journey at Nubank, from instrumentation strategy to a production-grade pipeline operating at petabyte scale. We'll cover how the OpenTelemetry Collector serves as our ingestion backbone, the architectural decisions that made the system resilient, the failure modes we didn't anticipate, and the hard-learned trade-offs behind blending open-source tooling with purpose-built internal components. You'll leave with a realistic picture of what it takes to run distributed tracing at scale. Salt Palace | Level 1 | Grand Ballroom ACE Jeff Spahr Every mature codebase earns a backlog item that's too daunting to complete. For Kubeflow Pipelines it was the frontend: an aging Create React App on end-of-life packages with a dated Jest + Enzyme suite - attempted before, never finished. What changed was timing. An inflection point in AI coding agents made this kind of work - mechanical, well-specified, backed by tests - finally tractable: CRA to Vite, Enzyme to Vitest + Testing Library, React 16 to 19. But agents didn't do it alone, and neither did I. This talk is what a career in engineering still brings: spotting patterns, steering an agent with the right questions, knowing when it's confidently wrong, and earning the trust of a community of contributors and maintainers who shaped and reviewed the work. You'll leave knowing how to spot the work that fits this AI moment, and to do it in a way maintainers welcome. Salt Palace | Level 1 | Grand Ballroom BDF Christopher Maher Organizations in regulated industries need AI inference on infrastructure they control, but NVIDIA GPUs are expensive and scarce. Apple Silicon devices with large unified memory pools sit underutilized. This talk shows how we extended Kubernetes to schedule AI inference across heterogeneous GPU hardware, including Apple Silicon via Metal, using pluggable runtime backends. We cover a controller-runtime operator managing model lifecycle, multi-GPU layer sharding, and health probing across runtimes like llama.cpp for text generation and Moshi for speech-to-speech. Attendees learn patterns for reconciling inference workloads with CRDs, pre-flight memory validation for GPU nodes, Prometheus metrics via PodMonitors, and multi-runtime inference behind an OpenAI-compatible API. We share benchmarks comparing NVIDIA CUDA and Apple Silicon Metal and the operational tradeoffs of each. A practitioner talk from an enterprise platform engineering team deploying on-prem AI inference at scale. Salt Palace | Level 1 | Grand Ballroom H Dolis Sharma Kubernetes made infrastructure scalable, but not always cost-efficient.Organizations have adopted various resource optimization strategies to improve resource utilization and reduce overprovisioning. Some work well across a broad range of workloads, while others show limitations at scale.
With its GA graduation in Kubernetes 1.33, in-place pod resizing has become a new resource optimization capability for platform teams. Like any approach, it has its fit, limits, and ideal workloads. For some applications, it can be a game changer, improving utilization without disruption. For others, especially legacy applications, the journey is more complex and often requires alternatives.
In this session, Meghana from RBC and Dolis from Nirmata will share lessons from enterprise optimization efforts, focusing on in-place pod resizing. They will discuss where it works, where it falls short, common adoption challenges, and how to evaluate the right optimization strategy across workloads. Salt Palace | Level 1 | Grand Ballroom GI Justin O’Leary You locked down RBAC. You scoped your namespaces. You followed least privilege. But the attacker who just became your GCP Org admin? They never left their namespace. The call came from inside the cluster—through your own operator. I discovered confused deputy vulnerabilities (CWE-441) across Config Connector, ACK, ASO, and Crossplane. The pattern is universal: operators trust user-controlled CRD fields and act with elevated credentials. Your namespace user writes a manifest; the controller escalates them to cloud admin. You'll see:
- Demo: namespace user → GCP Org admin in 60 seconds
- Why audit logs blame the controller, not the attacker
- A 3-step pattern to audit any operator for confused deputy flaws
- Architectural fixes you can deploy immediately This research is also accepted at Black Hat USA 2026. This talk is Kubernetes-native: how operator architecture enables this flaw class and how to build controllers that fail closed. Salt Palace | Level 1 | 151 Muhammed Yunas Chirayath, Ajmal Ali kannu We introduced AI-assisted incident response into a large-scale financial services platform running on OpenShift and Kubernetes expecting faster resolutions and less engineer toil. Instead, we discovered the biggest bottleneck wasn't signal analysis—it was missing operational context. AI could detect CPU spikes and latency increases, but it couldn't know a deployment had occurred 20 minutes earlier, a service owner had changed, or an upstream dependency was degrading. That gap led to poor prioritization and engineers chasing the wrong signals during incidents. This session shares how we rebuilt incident response using OpenTelemetry, Argo CD, Prometheus, Grafana, and Backstage to combine telemetry, deployment intelligence, and service ownership into a single workflow. Attendees will learn practical patterns for building context-aware incident response on Kubernetes, reducing alert fatigue, and improving operational decision-making beyond prediction-based tooling. Salt Palace | Level 1 | Grand Ballroom ACE Taylor Thomas, Brooks Townsend We've been knee-deep in Kubernetes since the early days: maintaining Helm, building Krustlet, provisioning internal clusters with Cluster API, containerizing applications, the whole shebang. Eventually, we swore it off and worked on Wasm because we were tired of watching people hammer everything to fit into a Kubernetes-shaped hole. Now we find ourselves back in it again after learning that both extremes are traps: putting everything in Kubernetes and pretending it doesn’t exist. In this talk, we'll cover the red flags that signal you're using Kubernetes where you shouldn't, and where it actually shines. Then we’ll talk about the happy middle: cloud-native over Kubernetes-native. We’ll share our success stories and gotchas using CNCF projects both inside and outside of the Kubernetes space, including projects like wasmCloud, NATS, Cilium, and OPA. You’ll walk away with a concrete set of guidelines to help you find that middle ground in your own stack. Salt Palace | Level 1 | Grand Ballroom BDF Arunkumar Amaran Artificial Intelligence is reshaping retail by enabling a shift from traditional automation to autonomous decision-making systems. This talk explores how modern retail organizations leverage AI, real-time data pipelines, and cloud-native architectures to transform data into actionable intelligence. The session highlights the evolution from batch-based processing to event-driven systems, where AI models are integrated into operational workflows to support real-time decisions in areas such as pricing, supply chain, and customer analytics. It also discusses key architectural patterns, including streaming data platforms and intelligent automation frameworks. Through practical insights and real-world examples, the talk demonstrates how autonomous decisioning improves efficiency, scalability, and customer experience. It also addresses challenges related to data governance, observability, and responsible AI adoption, providing a roadmap for building future-ready retail systems. Salt Palace | Level 1 | Grand Ballroom H Regina Voloshin, Dag Bjerre Andersen After 10 years of Kubernetes, we are still asking the same question: is this resource healthy? Built-in resources are mostly predictable, but CRDs define status, conditions, phases and readiness differently. This creates Health Check Hell, where every tool must rediscover what “healthy” means. As a result, tools repeatedly reimplement health interpretation for the same resources, creating duplicated work for maintainers, confusing behavior for users and operational drift between tools that watch different status fields. The session explores why Kubernetes lacks a consistent health model for CRDs through real-world examples. It reviews existing approaches like Kstatus and explores potential solutions, such as reusable health libraries and ecosystem-wide compatibility standards. Attendees will leave with a deeper understanding of Kubernetes health semantics, the tradeoffs behind current approaches and emerging efforts to improve health interoperability across cloud native tooling. Salt Palace | Level 1 | Grand Ballroom GI Rohan Sood, Adrian Ng Over the last three months Verkada's incident-triage agent handled about 4,700 production alerts a month across nine Kubernetes clusters at $0.33 per investigation, with an 87.5% prompt-cache-read ratio and a 139-second median time-to-summary. The control plane runs in-cluster on every shard. No AI-for-SRE SaaS is in the path; inference is managed Claude Opus 5, state lives on managed KV. Three reversals shaped the system and each cut cost or restored reliability: pod-to-serverless ingress so chat deploys never drop alerts; per-pod to cross-cluster state on managed KV so a single investigation can span shards; single-shot to multi-turn under a 1-hour cache-TTL budget, where cost tracks investigation depth: about $0.27 for a five-call investigation and $1.29 past twenty-five. MCP is the boring substrate that made the rest tractable: per-cluster MCP servers for ArgoCD, Prometheus, and the observability stack, with cross-cluster fan-out through the serverless ingress, and per-channel Markdown system prompts that retune triage behavior without a code change. Salt Palace | Level 1 | 151 Vasudev Bongale, Swati Shridhar Nair Monitoring a Kubernetes platform with 2M+ containers exposes the limits of standard tools. Most setups track internal controller machinery, ignoring user friction. Teams outgrowing kube-state-metrics often build custom metrics focused on internal mechanics rather than user experience, producing noise instead of insight. Effective platform observability needs to measure the promises made to developers. This session designs an SLO framework unified across stateless and stateful workloads using a contract-driven model. Learn to distill thousands of data points into 3–4 critical metrics that drove our operations this past year. We track workload readiness alongside pod-lifecycle signals (init-container latency, image download waits, terminating stalls) to isolate infrastructure faults from user errors before a page fires. This continues KubeCon NA 2025 ("Making Application Rollouts Observable, Actionable, and Boring"), moving from rollout signals to platform-wide promises. Salt Palace | Level 1 | Grand Ballroom ACE Andrew Block, Mike Wilson As with many large organizations, cloud native adoption and use often begins in pockets. However, even as innovative patterns are developed and usage increases, some teams within the same organization can remain unaware. This was true at Adobe. While the public cloud platform team were building leadership internally and credibility in the cloud native community, Adobe’s private cloud teams were busy focusing on other efforts. When business needs shifted, it needed to move quickly to a cloud-first architecture. In this session, learn how a team managing traditional infrastructure rapidly pivoted their technology stack and approaches using solutions such as Kubernetes, Argo CD, and KubeVirt. We’ll highlight the traits that made their journey successful, including developing reusable assets, establishing strong partnerships, and community engagement. Beyond the technology, this talk shows how tough transformation challenges can be achieved with the right ingredients and approach. Salt Palace | Level 1 | Grand Ballroom BDF Ankit Goyal, Cong Gu The rise of AI agents is breaking traditional ML infrastructure. While human experimentation is measured in hours, agents researching new model architectures and running hyperparameter sweeps shrink this to minutes. When running 24/7, Kubernetes pod spin-up times and GPU bottlenecks hinder agentic velocity.
In this talk, we’ll explore how to build high-velocity agentic infrastructure using Kubernetes, Volcano, and HAMi. We’ll cover techniques including: - No-Gap GPU Execution: "Firepool", maintaining warm GPU pods for near-instant launches including zero gap job launches on GPUs.
- Secure Agentic Harness: A workflow based Sidecar pattern isolating untrusted AI logic from credentials.
- Fault-Tolerant Persistence: Mechanisms to recover state if an agent pod gets disrupted.
- Cross-Run Agent Memory: Shared context patterns injecting state across multiple agent runs. Attendees will leave with strategies to scale 24/7 agentic K8s workloads Salt Palace | Level 1 | Grand Ballroom H Kasper Borg Nissen, Juraci Paixão Kröhling, Joseph Sandoval, Jed Salazar, Alexa Griffith AI and agentic systems are becoming production workloads on cloud-native platforms, and the hard questions land with platform teams. How do agents identify themselves? What can they access? How fast can they act? What can they cost? How are their actions audited? What evidence does the platform need when something goes wrong? This panel brings together four perspectives that usually handle these separately: an end-user platform practitioner, an OpenTelemetry maintainer, a security practitioner, and an AI infrastructure engineer. Together they examine what shared infrastructure must guarantee as AI systems become governable workloads: identity for non-human callers, observability beyond human dashboards, policy and blast-radius controls, inference and routing demands, build-versus-buy, and accountability across application, model, and vendor. Attendees leave with a practical frame: what today's CNCF substrate can support, where standards emerge, and what platform teams must own. Salt Palace | Level 1 | Grand Ballroom GI Prathamesh Bhope Migrating a CNI plugin in production is one of the most high-risk operations in Kubernetes infra. At Walmart running hundreds of clusters across cloud and on-premises environments, the team faced route-drop failures in Flannel beyond 300 nodes, iptables rule explosion as services grew and etcd v2 incompatibility blocking upgrades. No published playbook existed for zero-downtime CNI replacement at that scale. This talk walks through the per-node hybrid migration strategy that enabled zero-downtime transitions from Canal to Cilium. Canal and Cilium coexist during transition with a hybrid tunneling mode maintaining full pod connectivity regardless of which CNI owns a given node. Result: 2.27x throughput improvement and 38% reduction in cross-node latency with no production incidents. Attendees leave with a reusable migration framework covering hybrid mode architecture, IPAM coordination, cloud provider pitfalls and a structured Cilium triage playbook for post-migration operations. Salt Palace | Level 1 | 151 Evelyn (Chungyu) Chen OTel's metricstransform docs say it's "not suitable for aggregating metrics from multiple sources (e.g. multiple nodes)" — yet mitigating Istio cardinality requires exactly that. On our 10k-pod, 374-node mesh, Istio emits 2M+ active series even off-peak; PromQL projects an ~86% cut (2.06M→280K) once per-pod identity is collapsed. We bypassed the constraint with a two-stage OTel architecture, in production:
- Stage 1 (DaemonSet): per-node OTTL stripping of pod-level identifiers to collapse series at the edge.
- Stage 2 (Gateway): cross-node aggregation bounding each service to the gateway replica count (≤50), not thousands of pods, using query-time sum() for autoscaling stability.
- Verification: a low-risk shadow pipeline validated against live traffic before cutover. Leave with a portable blueprint and hard-won pitfalls: groupbyattrs no-ops, gateway re-enrichment undoing Stage 1, autoscaling fan-out, and silent collector regressions. Salt Palace | Level 1 | Grand Ballroom ACE Tolga Tuncoglu, Herik Webb Most enterprise teams consume open source but don't prioritize earning community membership — leaving a huge opportunity on the table. This talk shares how an engineering leadership team at Capital One grew its Kubeflow Pipelines team from a single contributor to five recognized community members and two maintainers in just over a year. The speakers describe the journey from passive dependency on an open source project to full ownership of a business-critical legacy version — reducing critical vulnerability patch turnaround from 30–60 days to 3–5 days, shipping upstream features, improving testing and resilience, and maintaining engineering joy — all while getting ahead of the EU Cyber Resilience Act. Attendees will learn a practical framework for growing engineers from consumers to maintainers, how to make the business case for contribution time, metrics to track membership growth, and the connection between open source participation and upcoming regulatory requirements. Salt Palace | Level 1 | Grand Ballroom BDF Pablo Fredrikson As organizations race to integrate long-running AI agents into their platform engineering and continuous integration (CI/CD) pipelines, they open a new frontier of security vulnerabilities: identity leakage. What happens when an autonomous AI agent is given elevated API privileges and the patience to bypass human latency? This presentation dissects a real-world production incident where an autonomous coding agent bypassed branch protection rules and executed unauthorized force-merges directly into protected branches. Attendees will walk away with concrete architectures for securing AI platform integrations, establishing absolute identity isolation, and enforcing the principle of least privilege for autonomous internal tools. Salt Palace | Level 1 | Grand Ballroom H Tim Killian Once a GPU fleet outgrows a single Kubernetes cluster, optimizing its utilization becomes genuinely hard. At Snapchat, scarce GPUs serve a diverse mix of workloads: autoscaled latency-critical inference alongside batch training, Spark, and Ray across many clusters. Kubernetes' GPU ecosystem shines inside a cluster but stops at its edge: capacity sits idle in one cluster while work queues in another, or a low-priority job holds a GPU a critical service can't preempt on a separate cluster. Leveraging Virtual Kubelet, we built a virtualization layer that allows us to schedule workloads wherever capacity actually exists. Alongside our extension of Kueue that enforces priority across cluster boundaries, we built a platform that optimizes scarce compute across any number of Kubernetes clusters, regions, and even clouds. The result was nearly 2x average GPU utilization and $XX million saved annually, while availability and latency for critical workloads improved. Salt Palace | Level 1 | Grand Ballroom GI Zixuan Feng OSS communities are sounding the alarm that AI-generated contributions are flooding their projects. Much like a DDoS attack overwhelms a server with excessive requests until it goes offline, this flood can overwhelm maintainers and push projects to shut their doors. We call it AI-DDoS. Some projects are already responding defensively: closing bug bounties, moving to invitation-only models, or rejecting unsolicited pull requests. These responses may address the immediate symptoms, yet they risk closing the door to new contributors, upending their ecosystem. We analyzed over 2 million PRs and issues from 350,000+ contributors across 294 widely used repositories. Our findings show that AI-DDoS is a structural, ecosystem-wide pressure on the OSS contribution pipeline. From this evidence, we developed 11 practitioner-driven strategies that projects can use to manage AI-DDoS while balancing openness, maintainer capacity, and their stance toward AI-assisted contributions. Salt Palace | Level 1 | 151 Matt Dering, Long Nguyen Nearly 25 years after *Moneyball*, baseball analytics more resembles a high-performing tech org than a few analysts managing their own ad-hoc database. This level of sophistication introduces a major challenge: closing the gap between data scientists solving complex baseball problems and the resources they need to train and use their models, especially when there are a lot of existing critical workflows that run in disparate environments, or even on individual laptops. This session explores how a four-person platform team used a cloud-native stack—including **Docker, Kubernetes, Helm, and Knative**—to deploy statistical products that translate to on-field results. By meeting data scientists where they are and providing tools that grant freedom with minimal engineering overhead, the team manages the challenges of introducing tech into a specialized domain. It will also cover the wins that come with investing in a good platform, and the impact on products for coaches and decision makers Salt Palace | Level 1 | Grand Ballroom ACE Vijay Samuel, Jing Hu In past Kubecons, we have spoken about AI assisted explainers as a strategy to explain telemetry pillars such as traces and logs. Over the last year, we at eBay have worked towards furthering triage by explaining telemetry and reasoning on top of it. To be able to make troubleshooting with AI more promising, we have indexed on dashboards. Why dashboards? Dashboards contain relevant signals grouped together, they have descriptions and they are battle tested across debugging incidents and day to day operational analysis. Having the right signals to analyze is half the battle. The rest? * subagents that handle each telemetry pillar
* careful engineering of what is done programmatically and what is "reasoned" by LLMs
* tying multiple findings into hypothesis and root causes This talk, describes how we built AI assisted dashboard analyzers on top of data sitting in Prometheus and ClickHouse. Does this mean that AI can do it all? Not yet, but we are edging closer and closer. Salt Palace | Level 1 | Grand Ballroom BDF Cellan Hall, Jenny Vega, Karol Szuster At Isomorphic Labs, we run tens of thousands of concurrent ML workloads per cluster for drug discovery. Using Kueue for scheduling, we found that mixing bursty single-pod inference alongside heavy multi-node distributed training pushed our control plane over the edge. This talk breaks down a production outage where pending workloads triggered Kube-API webhook timeouts, causing a cascading control plane failure. We detail how we stabilised the cluster: mitigating head-of-line blocking by decoupling queues and tuning Kueue's Preemption Fair Sharing. We also explain the "cardinality problem" of integrating KEDA with Kueue, and how to build scheduler signal limiters to protect the API server from hyper-scale event storms. Attendees will learn actionable architectural guardrails to navigate volatile scaling, manage extreme concurrency, and safely colocate massive batch inference with distributed training. Salt Palace | Level 1 | Grand Ballroom H Qianru Lao, Lu Zhang LLM inference routing is a cloud-native systems problem: traffic must be steered across Kubernetes clusters, accelerator-backed serving engines, capacity limits, and geography cost while keeping the request path fast and observable. This session presents a generalized Inference Load Balancer (ILB) proxy/controller architecture for production model serving. A low-latency proxy applies routing weights and request-path signals, while a Kubernetes-operated controller computes and distributes source-cluster-to-engine weights from recent demand, engine capacity/performance profiles, replica state, and geography cost. We will cover the proxy/controller split, policy distribution, multi-cluster operation, load shedding, policy observability, and debugging patterns for adaptive inference routing. Attendees will leave with reusable Kubernetes patterns, not OpenAI-specific internals, product claims, or non-public metrics. Salt Palace | Level 1 | Grand Ballroom GI Alexander Kanevskiy, Sara Qasmi A compute node in modern cluster contains not only CPU and memory, but also GPUs, NICs and other specialized hardware. The overall performance of the workload nowadays comes not by the characteristics of the single device, but from combination of components and deep understanding on how they interact. This talk focused on zooming in into hardware topology, explaining what inside physical CPU package is, memory-controller behaviors and locality boundaries, anatomy of I/O hubs and how data flows between components and between devices. This will help to understand deeper about where potential bottlenecks are located for your workload, what are the costs for bandwidth and latencies for each data path and how to potentially mitigate them. The talk will cover new features and improvements in DRA, NRI and OCI interfaces that are focused on improving flexibility and manageability for devices, node allocatable resources, standard and derived attributes and low-level tuning parameters. Salt Palace | Level 1 | 151 Artur Beznosyuk, Hanhong Gao Building and running Kubernetes in production is a challenge; doing so in AWS GovCloud while hunting for a FedRAMP Moderate Authorization to Operate (ATO) is a multi-year marathon. In this talk, we trace our 3-year journey from an initial design to a fully authorized, compliant platform, pulling back the curtain on what it actually takes to survive federal audits without destroying developer velocity. We'll cover our initial design choices and the lessons learned when cloud-native assumptions collided with rigid federal regulations. Next, we will discuss the changes required to scale environment access to more engineers as we got our first customers. Finally, we will deep-dive into the two most critical operational hurdles of our journey:
- why standard CI/CD tools fell short, and how we engineered a dedicated deployment system to meet strict regulatory isolation and access controls.
- how we tackled the required patching and reporting mandates of FedRAMP for open-source software. Salt Palace | Level 1 | Grand Ballroom ACE Youmin Han, Zhuo Zhi At LinkedIn, some of our most critical Kubernetes platform services deploy multiple times a week, including infrastructure components that affect every pod and data-processing job in the cluster. Traditional canary tools based on traffic splitting don’t work well for these services because there is no user-facing L7 traffic to gradually shift.
In this talk, we’ll share how we built a Kubernetes-native canary pipeline to safely validate cluster-critical services before production rollout. By combining admission controls, isolated canary environments, GitOps workflows, and automated end-to-end validation, we reduced deployment verification from days of manual testing to under an hour.
Attendees will learn practical patterns for deploying infrastructure services safely at scale when traditional service-mesh canary approaches are not enough. Salt Palace | Level 1 | Grand Ballroom BDF Maciek Różacki, Jian Cheung At 50,000 nodes, component failure is a statistical certainty—but total control-plane collapse shouldn't be. When Anthropic and Google pushed GKE to these limits on production AI workloads, the real threat wasn't the initial faults; it was the catastrophic loss of graceful degradation. Default upstream mechanics frequently turned localized anomalies into cascading, fleet-wide stalls.
This talk explores six joint war stories where Kubernetes' built-in self-healing broke down: from a CNI startup probe that couldn't outlast its own informer sync, to an APF cost-misestimation that triggered master OOMs.
We will detail the exact failure modes, the joint debugging, and the upstream PRs that enforced blast-radius isolation. Finally, we’ll examine how these lessons drive forward-looking community work—like queue isolation and stateless controllers—ensuring Kubernetes handles massive scale gracefully without breaking. Salt Palace | Level 1 | Grand Ballroom H Drew Bowman 30% of merged PRs at Podium require no human author. They are opened and closed by autonomous coding agents. Podium built a Kubernetes-native agent orchestrator: each agent runs as an isolated pod, picks up a task, writes code, and tests its own changes against a real environment before opening a PR. Kubernetes handles the scheduling and isolation, letting hundreds of agents run concurrently without stepping on each other or the production system. The key insight: agent reliability is not about the model. It is about the feedback loop. Agents that can test against real systems catch their own bugs before a human ever sees the PR. Drew Bowman, Sr Eng Manager for SDLC at Podium, shares the architecture, the task taxonomy (what agents handle reliably vs. where they still fail), and what changes in an engineering org when 3 in 10 PRs no longer needs a human author. Salt Palace | Level 1 | Grand Ballroom GI Alexis Ngoga Kubernetes HPA scales on CPU and memory — but production incidents start in logs: connection-pool exhaustion, timeout storms, retry cascades. By the time the metric moves, the on-call is already paged.
This session walks through building an Agentic Autoscaler — a Go operator that reads the same signals SREs read (Prometheus metrics, Loki or Kafka log streams), routes them through a pluggable reasoning step (rule-based by default, optional Claude / OpenAI / Ollama), and emits an explainable scale decision that nests safely inside any existing HPA.
The case study is an API gateway under a timeout storm. HPA reacts late on CPU. The operator detects connection-pool-exhausted across three consecutive log windows and scales preemptively — then annotates Grafana: "Scaled due to timeout error rate exceeding threshold across 3 consecutive log windows."
You'll leave with concrete patterns for log+metric fusion, AI inside a control loop, and natural-language explainability for SREs. Salt Palace | Level 1 | Halls A-C, Halls 1-5 Dibyo Mukherjee Kubernetes control-plane changes are hard to validate before production. Scheduling policy, autoscaling, admission rules, custom controllers, and capacity-management logic can behave differently once many pods, nodes, and API objects interact. Running these scenarios against real staging clusters on every change is rarely practical because of time and cost. This poster presents a KWOK-based CI pattern for testing control-plane behavior without real kubelets or workloads. The workflow captures snapshots from production clusters, replays those objects into KWOK-backed simulation clusters, applies proposed changes, and verifies the resulting placement, scale-up/down, utilization, and failure-mode behavior. Attendees will see where KWOK simulation fits between unit tests and real-cluster validation, what regressions it can catch early, and where simulation boundaries remain. Salt Palace | Level 1 | Halls A-C, Halls 1-5 Juan Bernal At CVS Health, we have many engineers working to deliver the latest innovations in health services. In the DevEx organization, we understand that these engineers need feature flagging. We researched what was already available within DevEx and found that two types of solutions existed: expensive vendor-driven platforms and home-grown tooling with very limited feature sets. After examining these options, we looked to open source software and discovered OpenFeature, a vendor-agnostic API which would enable us to build a flexible, open source standardized platform to create and manage feature flags. We collaborated with the OpenFeature Project, to understand their plans for the future of their Feature Flagging ecosystem and also to understand how we can contribute back to the community and include what we’re building in that future. We're excited to share that we are bringing this effort to the open source community. We'd like to share it, and our journey of how we got here, with you. Salt Palace | Level 1 | Grand Ballroom ACE Darian DeFalco As agentic systems become more effective, human review becomes the next scaling bottleneck. This talk presents a Kubernetes-native model of earned autonomy, where authority expands through demonstrated performance rather than static permissions.
As agents generate more pull requests, they consume an increasingly scarce resource: human attention. The goal is to spend that attention deliberately, by auto-merging work where tests and a track record justify it, and reserving human review for cases that require judgment.
Borrowing from progressive delivery, agents begin in shadow mode, with their proposals graded against real outcomes, earning authority only after sustained success within narrowly defined classes of work. The pace of delegation is set by how reliably outcomes can be evaluated. Objective verifiable outcomes enable trust to build quickly, freeing up human judgement for evaluation where it is most needed. Salt Palace | Level 1 | Grand Ballroom BDF Omer Oz Pod startup latency directly impacts service responsiveness, autoscaling speed, and incident recovery on Kubernetes. Yet much of that latency is dominated by the image pull step; which is mostly hidden. Drawing on a real LinkedIn production case study — over 500K bare-metal hosts, 25M cores, and pod density averaging beyond 50 per host in our densest clusters — we’ll show how we cut the long tail of pod startup latency by 72% through reducing image pull latency by 72% at P99 and 75% at P50. We'll examine how container image pulls contribute to startup latency: taking a deep dive into the image pull path to identify bottlenecks and build a mental model, then covering the practical levers we have — compression, kubelet and containerd configuration, and P2P caching. Salt Palace | Level 1 | Grand Ballroom H Lucy Sweet, Sandeep Kanabar Come behind the scenes of how Kubernetes actually works! In this session, Lucy Sweet (Member of Technical Staff at Anthropic and Node Lifecycle WG co-Lead for the Kubernetes project) and Sandeep Kanabar (Lead Software Engineer at Gen) will take you on a live journey through setting up Kubernetes “The Hard Way”. No tools, no automation. We’ll peel back the layers of abstraction to reveal how the core components of Kubernetes interact to orchestrate workloads from small to planet scale. We’ll trace the lifecycle of a Pod from creation through to running container, and explain how often-overlooked components play a critical role in cluster operations. Through this live demonstration, attendees will gain a deep understanding of Kubernetes' internal mechanics, empowering them to troubleshoot more effectively, make informed architectural decisions, and unlock the true potential of Kubernetes in production environments. Salt Palace | Level 1 | Grand Ballroom GI Maxime Coquerel Kubernetes Secrets are everywhere: passwords, API keys, certificates, tokens, and cloud credentials. But they were never designed to be a full secrets management system. This talk explains where Kubernetes Secrets break down in real platforms: storage, mounts, environment variables, logs, GitOps workflows, RBAC, and multi-cluster replication. It also explores safer patterns, including external secrets operators, CSI secret stores, workload identity, short-lived credentials, vault-backed approaches, and secretless architectures. Attendees will learn when Kubernetes Secrets are acceptable, when they become risky, and how to design safer cloud native platforms without pretending that base64 is security. Hyatt Regency | Level 4 | Regency Ballroom CD Vinicius Krischke Most Kubernetes cost allocators distribute idle globally. Every team gets a share proportional to their requests. The result: a tax with no behavioral signal. Efficient teams pay the same idle premium as teams forcing oversized pods onto undersized instances. This 5-minute talk presents a production methodology in use at Nubank since 2025 that allocates idle per-instance. For each instance, the algorithm reads pod composition (requests, usage, purchase option, instance class) and attributes that machine's idle to its pods. Services that generate idle pay for it; services that pack well pay for less. The math is the incentive: no blame logic, no penalty rules. At Nubank's scale the law of large numbers does what hard-coded rules used to do badly. The five minutes show one instance-level allocation end-to-end, contrast it against the global approach, and name the design principle: attribute locally, let scale handle fairness. Hyatt Regency | Level 4 | Regency Ballroom CD Yashash Lokesh, Sri Harsha Yayi Intuit processes a massive, continuous stream of financial events across the QuickBooks ecosystem. Every transaction, payment, and update flows through pipelines that write to the databases customers' books depend on. The challenge is twofold: sustaining millions of events with the elasticity and cost-efficiency of a cloud-native system, while never compromising correctness. For financial data, an event processed out of order or counted twice becomes a wrong number in someone's books.
We'll walk through the architecture that does both, built on Numaflow, an open-source, Kubernetes-native streaming platform developed at Intuit. We'll cover how we scale horizontally to absorb millions of events, how per-entity ordering and exactly-once semantics keep updates correct under load, how we autoscale (including scale-to-zero) to control cost, and how distributed tracing follows a single event end to end. Attendees leave with patterns for high-throughput, correctness-critical pipelines. Salt Palace | Level 1 | Grand Ballroom ACE Yiqing Wang, Adam Buran Training large ML models on multi-cluster, multi-region GPU fleets is hard: GPUs sit idle on one cluster while jobs queue on another, quotas lack a global view, and datasets are repeatedly re-downloaded across regions. This end-user session shows how Roblox turns a heterogeneous fleet into one shared GPU pool using only CNCF projects. Kueue and MultiKueue provide a single submission point with cross-cluster RayJob dispatch, tiered per-team quotas (guaranteed, borrowing, opportunistic), priority preemption, and data-locality-aware routing with automatic fallback. Dragonfly, a CNCF graduated P2P system, caches datasets and checkpoints in-cluster, turning cross-region downloads into local peer reads. Together, they optimize where jobs run, who gets capacity, and how data arrives. Attendees leave with a reproducible blueprint, real operational failure modes, and lessons learned. Salt Palace | Level 1 | Grand Ballroom BDF Tom Ingleby, Rian Bogle Deploying Kubernetes onto mobile hardware like humanoid robots introduces severe physical risks. While GitOps tools can use "Sync Windows", applying an automated update or restarting a container while a heavy robot is moving can have real-world consequences.
To achieve true defense-in-depth, we implemented a custom Kubernetes Admission Controller directly on the edge cluster. Acting as an infrastructure-level gatekeeper, it intercepts all API requests and evaluates them against the robot's state. Regardless of GitOps schedules, modifications are safely blocked if the hardware is in a high-risk state.
This session explores a production architecture designed to bridge the gap between cloud-native infrastructure and live hardware We will detail how the admission webhook interfaces directly with the active robot, how it catches risks missed by static schedules, and the essential considerations of "break-glass" overrides to prevent lockout during edge cases Salt Palace | Level 1 | Grand Ballroom H Trevor Linton We gave a bedrock assistant the keys to 30 EKS clusters and the AWS and GitLab control planes behind them. Read only by default, write capable with reviews. We did it without a vector store, without RAG, and without a 200K token prompt. This talk is the engineering behind that claim. We will walk through some of the techniques behind it. A typed tool catalog the model plans against, server side projection that turns 40 MB of DescribeInstances into 800 bytes of data, an iterative plan loop with a hard token budget, and a consent layer that makes kubectl apply and git push safe to expose to a language model. Engineers will leave with a concrete pattern for letting an LLM operate a real fleet. One that scales with your control plane instead of your embeddings bill, and that fails closed when it matters. Example source code is open source so everyone can start their own journey. Salt Palace | Level 1 | Grand Ballroom GI Shriya Chaitanya Kamat Tarcar Multi-agent systems are entering production and the Linux foundation’s Agent2Agent (A2A) protocol is fast becoming the standard method for agents to find one another on kubernetes and call each other. However, the architecture hides a scaling wall. When agents connect peer-to-peer, connections grow quadratically. Four agents need six links, fifty agents over twelve hundred. At scale, this N-squared explosion becomes impossible to route, secure, observe and keep reliable. This talk will show why direct A2A traffic does not scale, and how routing it through an A2A-aware gateway such as agentgateway, built on top of the Kubernetes Gateway API, collapses the tangled mesh into a manageable hub with load balancing & visibility. By the end of the talk, attendees will leave with the connection math, the infrastructure pattern that solves the problem, and one rule: design the connectivity layer before scaling the agents,not after. Hyatt Regency | Level 4 | Regency Ballroom CD Oscar Castillo, Jeffry Hernández When a language model fails in production, the symptoms rarely show up in traditional dashboards. In this session, we explore what it really means to observe an inference system: which metrics actually matter and which ones can be misleading, how to correlate hardware behavior with model behavior, and how to build a unified view that goes from silicon all the way to the user response. We will talk about token latency, throughput, GPU saturation, and application traces. Salt Palace | Level 1 | Grand Ballroom ACE Sean Corcoran, Erin Walter As Kubernetes adoption scaled across PlayStation, our original namespace and RBAC workflow began to struggle to scale with the operational complexity. Merge conflicts, tightly coupled automation flows, and centralized ownership created friction for both platform teams and developers. In this session, we’ll share how we evolved from a DevOps-owned RBAC model to a Kubernetes-native platform capability built on CRDs. We’ll cover how decoupling namespace lifecycle management from RBAC intent enabled safer self-service access management, improved scalability across multi-cluster environments, and reduced operational bottlenecks. Attendees will leave with practical patterns for modeling RBAC as platform capabilities and applying platform engineering principles to Kubernetes access governance at scale. Salt Palace | Level 1 | Grand Ballroom BDF Sameer Marulkar Kubernetes upgrades have historically advanced one minor at a time: apiserver first, then controller-manager and scheduler. That creates two waves per minor. At LinkedIn’s scale, 300 clusters and roughly 300,000 nodes, each wave must pass through canary, regional ramps, soak, and blast-radius controls. A three-minor cadence therefore meant six fleet rollouts and more than 35 business days KEP-4330 changed the model: newer control-plane binaries can emulate older-minor behavior for feature gates, APIs, storage encoding, and validation, while rollback becomes config instead of binary reversal I investigated whether KEP-4330 could compress six waves into one. Upstream had documented the conservative stepwise path; source code review showed compatibility-version bounds w/o requiring intermediate hops. After removed-gate cleanup, /statusz checks, and canary validation, we promoted v1.31 to v1.34 fleet-wide in one wave under 6 business days [85% gain], with ramp, soak, and rollback intact Salt Palace | Level 1 | Grand Ballroom H Amy Chen, JJ Jordan GB200s and GB300s are here! Fragmentation is widening the gap between “I have GPU quota” and “my job is actually running.” NVLink domains, rack boundaries, and the physical layout of the data center now shape whether a large training job can start, where it lands, and how efficiently it runs. On modern GPU clusters, quota is no longer enough. Topology has become a scheduling requirement. Kueue’s Topology Aware Scheduling (TAS) brings that reality into Kubernetes. We will cover three things. First, how TAS works and the configuration choices that matter, including preferred versus required topologies and PodSet slices. Second, how topology-aware placement affects workload performance. Third, the production lessons that do not show up in the happy path: sticky scheduling, quota debugging, fragmentation, and node hot swaps. Attendees will leave understanding how topology-aware scheduling helps AI teams turn expensive GPU capacity into actual training progress. Salt Palace | Level 1 | Grand Ballroom GI Andrey Velichkevich Distributed AI training fails fast: if a single GPU pod in a multi-node job cannot schedule, accelerators sit idle or the workload fails with collective-op timeouts. To compensate, the ecosystem evolved many external schedulers, including Kueue, Volcano, and KAI, each forcing controllers to pick a side. Kubernetes 1.36 changes this. The new Workload and PodGroup APIs (KEP-4671) introduce scheduler-native primitives for gang-scheduling, topology-aware placement, and coordinated use of high-bandwidth interconnects such as IMEX. TrainJob, JobSet, and LeaderWorkerSet are converging on these APIs. This session covers Kubeflow Trainer’s adoption (KEP-3015): why TrainJob owns Workload composition and how its plugin architecture enables advanced scheduling features. Attendees will see a demo of multi-node fine-tuning on modern accelerators, how the Workload API unifies a fragmented ecosystem, and how to adopt it in their own controllers. Salt Palace | Level 1 | Grand Ballroom ACE Arthur Vardevanyan, Jennifer Weir At Ford, we manage a large-scale Kubernetes platform across hundreds of clusters using GitOps. We use Kustomize with an automated templating and scaffolding system — an advanced alternative to Helm that generates per-cluster overlays from declarative configs. Moving quickly at this scale requires CI that acts as an unbreakable safety net. Our Tekton-based pipeline validates every pull request end-to-end — building overlays, catching template drift, and running semantic validation beyond syntax checking. Between our team, community contributions, AI-generated code, and automated dependency PRs, this safety net is more critical than ever. Automation and AI produce plausible YAML that violates platform conventions or introduces drift no human reviewer would catch. Attendees will leave with a repeatable model for safety-net CI any platform team can adopt — regardless of tooling, cluster count, or org size — plus the lessons so you can skip the mistakes we made. Salt Palace | Level 1 | Grand Ballroom BDF David Porter, Evan Sheng, Ning Liao Training and serving frontier AI models pushes Kubernetes past its breaking point. At massive node scale, the sheer explosion of objects, Leases, Pods and Nodes can melt the API server, bottlenecks etcd, and hangs core controllers. Add the requirement of protecting multi-billion-dollar model weights from insider threats using strict enclaves, and traditional privileged K8s Nodes quickly become a liability. In this session, Google and Anthropic engineers reveal how we bypassed these limits by fundamentally rethinking K8s architecture. We will share a production tested approach that completely separates the control plane from the execution data plane, providing scalability and security. We abstract compute into "linked runners" and extend the CRI protocol, eliminating Kubelet overhead and bypassing traditional Node objects entirely. Join us to learn how to achieve dynamic multi-host topology scheduling and build a scalable, zero-trust environment for your most critical AI workloads. Salt Palace | Level 1 | Grand Ballroom H Carlos Sanchez Building secure and scalable agents at scale is hard. From multi-tenancy and noisy-neighbor risk to tool access and data boundaries, teams need more than a prompt and a container image—they need a deliberate execution model. At Adobe, we are running agents on the CNCF Agent Sandbox project: a sandboxed runtime for AI agents that manages their full lifecycle—provision, execute, observe, and tear down—while keeping workloads isolated from the rest of the platform. Sandboxes enforce resource limits, reduce blast radius, and give operators a consistent place to apply policy.
We have applied optimizations so that development teams can run agents without the need to understand the sandboxing mechanism or worry much about the increased complexity of single tenant agent execution. In this session we’ll share the problems we hit running agents for real customers, how Agent Sandbox addresses them, and what we’d do differently next time. Salt Palace | Level 1 | Grand Ballroom GI Michael Bolot, Zaira Shaikh Managing connections in a Kubernetes cluster can be tricky. This can get even more difficult when you are trying to manage connections for a fleet of Kubernetes clusters, each with users that require strict network isolation at the application level. In this talk, you will hear a case study in how GEICO Tech solved the problem of restricting network connections at scale by using Cilium Network Policies to form a broad network boundary and using Istio Authorization policies to provide zero trust networking at the application layer. It goes into detail on the issues that we encountered supporting many distinct workloads with unique networking needs and how we managed the tradeoffs between user flexibility and system performance, all while maintaining the overall security of the system. Salt Palace | Level 1 | Grand Ballroom ACE Pronnoy Goswami Kubernetes environments generate enormous telemetry volumes, yet most AI observability integrations treat logs and traces as raw text — producing hallucination-prone, unreliable incident responses. This session presents a production-validated four-layer architecture built on CNCF-native tooling: OpenTelemetry for signal collection, a Model Context Protocol (MCP) server as a typed semantic query layer, and AI-driven agents for proactive root-cause analysis. The speaker shares production lessons from running this architecture at petabyte scale across multi-region Kubernetes deployments at Workday. Attendees will understand why raw OTel pipelines fail with LLMs, how an MCP server exposes telemetry as structured, queryable context, and the cardinality and latency tradeoffs encountered in production. The session closes with a code walkthrough of a lightweight MCP server integrating with Prometheus or Mimir, and practical criteria for when agentic observability genuinely reduces MTTR. Salt Palace | Level 1 | Grand Ballroom BDF David Gohberg, Marek Pelka What do our 500 engineers and our AI coding agents have in common? They run on the same Kubernetes cluster. At monday.com, our engineering org grew 30-60% year over year. Per-developer cloud environments couldn't keep up. We moved 500+ engineers to one shared staging cluster with pod-level isolation, cutting setup from 30 minutes to 10 seconds and eliminating $450/month per-developer environment costs. Then we added AI agents. Running Cursor's self-hosted agents against the same cluster, we found that agents need exactly what developers need: real traffic, real env vars, real downstream dependencies. Not mocks. The isolation model that stopped human developers from colliding does the same for concurrent agents. In this talk, we share the infrastructure behind both and the core insight: developer environment problems and AI agent reliability problems are the same problem. Salt Palace | Level 1 | Grand Ballroom H Ali Aqel KEDA has supercharged Horizontal Pod Autoscaling with its support for 60+ scalers and ability to scale workloads to and from 0. With KEDA, Stripe runs one of the largest autoscaled fleets in the world. We have seen the great, the good, and the ugly. In this session, we go beyond how to autoscale with KEDA and discuss how we integrated and operate KEDA at Stripe while maintaining our 99.999+% SLA. Attendees will deep dive into:
Observability and Operability - Identifying and resolving issues within your autoscaling infrastructure.
Scalability and Abstraction - Scaling reliably from 100 to 2,000 ScaledObjects per cluster, and 10,000+ globally, with a delightful configuration experience.
Safety - Adding guardrails during CI/CD to safeguard against service degradation. Whether you run a small organization or support a large engineering team, you will leave this talk with learnings that will empower you to safely adopt autoscaling without sacrificing your reliability commitments. Salt Palace | Level 1 | Grand Ballroom GI Raj Bhensadadia, Prschita Prschita Last year at KubeCon, we showed how MCP and LLMs let you talk to your dashboards. The next step is agents that investigate incidents autonomously. An agent queries Prometheus, reads logs, and produces an RCA, but the metric it cites does not exist, the service dependency it assumes has no edge in the mesh, and the deploy it blames was in another namespace. The diagnosis looks expert and is fabricated. We call these observability hallucinations: agents inventing metrics, service relationships, or causal timelines. Unlike generic LLM hallucinations, these are detectable because ground truth exists in your infrastructure. Prometheus metadata knows every metric. Kubernetes discovery knows every service path. This talk presents three hallucination types: metric, topological, and temporal - with a detection architecture that validates claims. We will demo how MCP tool-call interception, evidence grounding, and a self-correction loop correct analysis before it reaches the on-call engineer. Salt Palace | Level 1 | 151 Zachary Schwartz, Yair Temkin At Coinbase we run hundreds of Kubernetes services in a multi-cluster, latency-sensitive financial-services environment, where every pod historically ran an auth-agent sidecar verifying an in-house S2S bearer token on every request. Over the past few years we've migrated to SPIFFE/SPIRE-issued identities, extended our ingress gateway to validate them at the edge, and used Istio AuthorizationPolicies to enforce explicit service-to-service access. We're now deleting that sidecar entirely, replacing per-pod JWT verification with ztunnel mTLS using SPIFFE X.509s, delivering over $500K/year in CPU savings, faster service calls, and a cleaner compliance posture. We'll share the architectural decisions, the rollout sequence across many clusters, the hardships and learnings, and where we're heading next with pod-to-pod mTLS. Whether you're considering SPIFFE for your workloads or weighing how to push identity into your mesh, this talk offers a peer's view of a real production migration. Salt Palace | Level 1 | Grand Ballroom ACE Aanchal Khandelwal, Brian Ugie Cloud provider bills show egress costs as a single line item-they don't say which tenant caused them. At Adobe, we answer that across 400K pods in 31K namespaces spanning 85+ multi-tenant Kubernetes clusters using Retina eBPF agents to capture pod-level flows at the kernel. Prometheus enriches them with node topology, and a CIDR-based classifier maps each destination IP to a cost category (Local, Internet, Peering, Transit Gateway, VPC Endpoint) with cross-AZ and cross-region modifiers that align to cloud provider billing.
The hard part is scaling Prometheus to handle high cardinality from per-flow metrics. We'll walk through our sharded deployment implementation-shard counts, memory limits, and query timeouts along the way.
This is not a victory lap. The pipeline runs in production but scaling remains open. We'll share our progress and invite community input.
Attendees leave with a replicable architecture, real cardinality data, and an honest view of what works and what doesn't. Salt Palace | Level 1 | Grand Ballroom BDF Wojciech Tyczyński, Robert Nishihara, Ricardo Rocha, Kaslin Fields, Decheng Dai For years, Kubernetes treated individual pods as scheduling units, complicating the execution of complex distributed systems. With the explosive growth of AI workloads, the ecosystem demands a smarter control plane.
In this panel, scheduling experts from Google, Anthropic, Anyscale and CERN will unpack the paradigm shift of Workload Aware Scheduling. By teaching core Kubernetes to natively understand higher-level application semantics, we are bridging the critical gap between the scheduler and higher-level frameworks. This upstream evolution is essential for optimizing resource sharing and performance in massive multi-tenant environments.
Our panelists will discuss how these foundational blocks enable a cohesive multi-layer scheduling stack. Furthermore, we will explore how this crucial first step unlocks the next frontiers of orchestration including seamless disruption management and tighter integration with infrastructure autoscaling. Salt Palace | Level 1 | Grand Ballroom H Michael Kinsley, Yuva Peavler Your AIML customers need more GPUs, your providers are at capacity, the C-Suite is demanding ROI, and inference is mission critical under constant cyber threat. We’re the platform infrastructure team at a regulated Fortune 100 insurance company, where we build and operate the Hybrid Cloud Fabric: multi-provider k8s and zero trust overlay on Istio, Cilium and SPIFFE/SPIRE. Our story covers dynamic shifting of GPU workloads between Azure and AWS, the rehoming of inference workloads onto OSS models, and running a global SPIRE deployment. Four nines isn't easy. We'll share where we came up short, alongside our pluggable SPIRE backend proposal (spiffe/spire#5993) and reference Cassandra implementation we’re running in prod and contributing back. Finally, meet our sharp edge: secure attestation on non-traditional hardware like DGX Spark. We’ll let you know how this lands. Walk away confident you can scale beyond the limitations of any single cloud. Salt Palace | Level 1 | Grand Ballroom GI Seth McCombs, Karim Alibhai DuckDB is one of the fastest analytical databases available today, but wasn't designed to run as a multi-tenant, cloud native service. At Greybeam, we’ve been running DuckDB in production since before v1.0, serving millions of queries while migrating large-scale customer workloads away from traditional data warehouses. There are tradeoffs when choosing an embedded single-node engine vs. a distributed database, and this talk will cover the challenges of building a DuckDB-based data platform on Kubernetes. Hear about the operational realities of running a stateful engine, such as NVMe provisioning and running performant data systems in environments without swap memory. We’ll then touch on what’s next, such as object-store-native architectures. Attendees will leave with practical lessons for running stateful workloads on Kubernetes, the tradeoffs of an embedded database, and patterns for building scalable data systems on top of modern open source infrastructure. Salt Palace | Level 1 | 151 Decheng Dai A TPU on the wrong torus coordinate is worthless. So is one GPU placed outside its NVLink island. For frontier training, where a pod lands matters as much as whether it lands at all. And they have to land as a gang: every pod in the job on contiguous hardware, or none at all. The default scheduler scores pods one at a time and has no vocabulary for "all 256 of these, on contiguous hardware, or none." This is Anthropic's account of building the scheduler that does and how we kept it fast as clusters grew toward GKE's 65K node limit. Part one is design: modeling interconnect topology as first-class scheduling domains, gang admission with graceful eviction, capacity allocation, and defragmentation. Part two is the performance story - the optimizations that brought average processing time to under 3ms per job: gating expensive affinity checks behind cheap predicates, efficient resource accounting, and caching infeasibility verdicts. Salt Palace | Level 1 | Grand Ballroom ACE Michael Rishi Forrester, Whitney Lee In 2026, a developer asked a burrito chain's chatbot to reverse a linked list before ordering their meal. The bot delivered a solution, then asked what they wanted.
A user does not need to be malicious to embarrass an enterprise, just a little bit weird. The model will help, enthusiastically. But that burrito bot sits in a production cluster that someone (probably you) is responsible for, wired into real tools and data. More than reputation is at stake.
In this session we build a chatbot for a fictional burrito chain connected to an under-protected MCP server and deploy on a full IDP (internal developer platform). It starts wide open, and we let the audience hack it live.
We show you the relevant Kubernetes security layers you should already have. Then we turn on LLM-specific guardrails, like pre- and mid-inference prompt analysis. Finally we show good GenAI observability practices. By the end the chatbot is selling burritos. Nothing more.
Bring your weirdest off-topic question. Salt Palace | Level 1 | Grand Ballroom BDF Robin Deaconu, Neb Jovanovic To power our company's mission to "solve all disease”, we built a massively scalable ML inference platform on Kubernetes by rejecting heavy industry-standard frameworks in favor of a minimalist worker-and-queue architecture. Reframing ML serving as a classic distributed computation problem rather than a unique paradigm allowed us to eliminate complex secondary ML schedulers and feature bloat. Instead, we composed native, scalable components anchored on the simplest primitives: a stateless worker pod and an asynchronous queue. This talk breaks down the mechanics of our "frameworkless" infrastructure. We will detail exactly how we deploy thousands of unique models as stateless pods, leveraging GCP Pub/Sub for asynchronous message routing, KEDA for true scale-to-zero autoscaling, and native K8s pod priority and preemption to guarantee real-time interactive research traffic over massive background batch workloads. Learn the concrete design principles behind building less to scale more. Salt Palace | Level 1 | Grand Ballroom H Ronak Nathani Most workload platforms force users to choose early: stateless or stateful. While useful labels, they are the wrong API boundary. Workloads don't live neatly in one bucket. Each has different attributes, which are independent concerns. Some need rolling updates. Others must coordinate with a shard manager before a pod can safely move. Some need persistent volumes for source-of-truth data, while others use them as cache. Users shouldn't need a new platform every time a dimension changes, nor should they care which cluster serves their compute needs. This talk shares how LinkedIn built a composable, natively multi-cluster API for both stateless & stateful workloads. Users express intent once: the platform places & rebalances replicas globally. Treating pod template, update strategy, persistence and placement as independent concerns allows us to abstract cluster boundaries, enables rainbow deployments, improves global efficiency, and preserves required workload guarantees. Salt Palace | Level 1 | Grand Ballroom GI Diana Zawadzki, Shijie Sheng Uber’s AI/ML Platform Team is relying on Cadence as part of their new Agent Executor Service, facilitating durable agentic workflow orchestration at scale.
Large Language Models (LLMs) have evolved from simple text prediction to autonomous agents capable of orchestrating complex tools. However, a critical gap exists in the current ecosystem: durable orchestration. Most agent SDKs are stateless by design, making them fragile in production environments where network partitions, long-running tasks, and system failures are inevitable. In this session, we explore a cloud-native architectural pattern to solve the “stateless agent” problem by using Cadence as a robust durability layer for agent orchestration. We will move beyond the “hello world” agent and demonstrate how to build production-ready systems that require: - Fault tolerance: Resuming complex reasoning chains after a process crash.
- Auditability: Maintaining a permanent, replayable record of agent decisions and tool executions.
- Long-running state: Managing agents that operate over days or weeks rather than seconds. We will provide a technical deep dive into integrating Cadence with popular frameworks like OpenAI, Google ADK, and Claude. We will also show how Cadence fits into the broader AI ecosystem, including Cadence AI Skills and AI-native coding tools like Claude Code, Cursor, Codex, and Hermes Agent, so developers can write their first Cadence-aware agent workflow in minutes. Attendees will walk away with a blueprint for durable agent orchestration: implementing automatic checkpointing and retries, recovering from failures instead of restarting, and ensuring their AI agents are as reliable as their microservices. Salt Palace | Level 1 | Grand Ballroom ACE Ashok Chandrasekar, Navjot Singh Moving agentic AI into production requires more than just additional compute; it necessitates a data-driven approach to capacity planning and performance tuning. At Shopify, we deploy fine-tuned open models with 250k token context windows to power complex, long-form multi-turn agentic conversations for products like Pulse and our GraphQL sub-agent. Serving these models at scale requires precise benchmarking to navigate the trade-offs between latency, throughput, and GPU parallelism. In this talk, we demonstrate how Kubernetes Inference Perf serves as the engine for Shopify's agentic benchmarking workflow. We will share a reusable blueprint for load-testing fine-tuned models under realistic workloads, right-sizing GPU capacity, and translating performance data into production-ready deployments. Attendees will leave with a reproducible framework for benchmarking and deploying their own open-models, ensuring predictable performance for the next generation of agentic applications. Salt Palace | Level 1 | Grand Ballroom BDF Fatih E. Nar, Andrew Hendrickson AI is moving into the operating core of communication networks: control loops, spectrum allocation, network slicing with QoS, and customer-issue automation, under regulatory watch on life-critical systems. Opaque models and unreproducible outputs do not meet regulatory legal bar. This session presents a deterministic governance pattern for AI-RAN, drawn from work with the FCC. We separate AI-for-Networks (internal optimization) from Networks-for-AI (multi-tenant hosting), and show how one hybrid-cloud platform carries both. The core is a five-stage pipeline: intent, retrieval, rule-bounded reasoning, synthesis, citation-validated output. Every output is reproducible and audit-traceable.
We map it onto a six-layer governance model using OPA or Kyverno for policy, OpenTelemetry and Kepler for energy telemetry, and GitOps for model, rule, and corpus lifecycle. We close with a maturity model and a measurement checklist that separates real AI-RAN energy savings from selective accounting. Salt Palace | Level 1 | Grand Ballroom H Eduardo Munari, Fabiano Amaral Internal developer platforms have a discovery problem: the capabilities are there, but engineers context-switch between tools to get things done. For non-engineers, it gets worse.
Vela is our answer: an agentic chat interface on top of Karavela, our Backstage-based IDP, turning platform capabilities into natural-language workflows for engineers, PMs, data analysts, and on-call responders who've never touched kubectl — all in a regulated financial company.
We'll share what we learned building the MCP Hub and how its design makes democratization safe: every tool call runs under the requesting user's permissions, with a full audit trail, no service-principal bypass.
We'll be honest about the hard parts: intent classification on ambiguous Portuguese, consent mechanics for write-on-behalf flows, and keeping long agentic tasks recoverable without burning unbounded LLM budget.
The goal isn't to replace platform engineers, it's to make platform knowledge accessible to everyone. Salt Palace | Level 1 | Grand Ballroom GI Jason Stryker Open-weight models are rapidly closing the capability gap with the frontier, the friction to run models independently has vanished, making it possible to accomplish more locally than ever before. This session details how to build commercial-grade AI infrastructure using consumer hardware and cloud-native tooling. Attendees will learn how to configure local GPU scheduling, securely source private datasets, and deploy containerized inference workloads on Kubernetes. The presentation explores deploying open-source inference engines like vLLM and llama.cpp, alongside fine-tuning tooling to run large language models on-premises. The key is to bring these datacenter-native workloads into your private infrastructure using the CNCF tooling we know and love. Salt Palace | Level 1 | 151 Damon Cortesi Over the past 2 years, Airbnb has been on a journey to migrate several million Spark jobs a week from Hadoop to Kubernetes. Operating this platform at scale has required continuous improvement, from tracking down Spark bugs that leak thousands of configmaps to backporting CRI-O patches on a surprisingly regular basis. The workload patterns of Spark push the boundaries of every involved system including node health, observability, networking, and all the way down to individual disk performance. In this talk, we'll step through each layer of the stack — what broke, what we patched, and the custom tooling we built when off-the-shelf solutions couldn't keep up. Salt Palace | Level 1 | Grand Ballroom ACE Soma Koltai, Ender Demirkaya As Cloudera Data Warehouse (CDW) workloads were adopted at scale in public and private cloud environments, our monolithic, stateful architecture hit a wall. Managing 40-minute provisioning cycles with a single-server executor meant that infrastructure instability often resulted in stalled workloads and inconsistent states. This session provides a technical deep dive into our migration to Cadence. We’ll discuss the development of the Lease API for distributed locking and how we utilized an intermediary Async Executor to transition to Cadence’s workflow/activity model without a complete rewrite.
The scope of this talk is narrowed to the practical implementation of fault tolerance: how we refactored long-running tasks to be fault tolerant with the help of Cadence. We will present a real-world case study where a severe memory leak and subsequent node rescheduling - which would have previously caused service disruptions - resulted in zero downtime for user workloads. Salt Palace | Level 1 | Grand Ballroom BDF Dibyo Mukherjee, Tushar More AI model gateways start simple: route requests to LLMs, centralize access, and log usage. The harder problem comes later - how does an organization turn single-team proxies into shared platform infrastructure without making model access slow, opaque, or developer-hostile. This case study traces the evolution of LLM access from users sharing long-lived tokens to a multi-tenant gateway platform serving 20+ teams and users managing 200+ models. Each stage came from a real use case: virtual keys and team-scoped access for isolation, self-service onboarding and discovery for velocity, and legal approval workflows for governance. As adoption scaled, the gateway grew beyond highly available model routing into cost governance: budgets, savings attribution, and cost-optimization intelligence.
Attendees will leave with a maturity model for AI gateways on Kubernetes: what belongs in the gateway, what belongs in platform automation, and which tradeoffs appear only after many teams depend on it. Salt Palace | Level 1 | Grand Ballroom H Trey Caliva, David Biel A dental cabinet manufacturer in Texas now runs their corporate website and systems on a globally distributed CDN, autoscaling serverless compute, and a managed NoSQL datastore. They have no engineers. They vibe-coded it. This story is only possible because of fifteen years of cloud-native work. Managed platforms are opinionated wrappers around primitives the CNCF community made boring: container orchestration, serverless compute, federated identity, managed observability. Vibe coding is the cloud-native community's success story, even if most of its users will never know we exist. In this talk, we will share what it took to get from prompt to production, what the cloud-native foundation gave us, and where it left edges that still required human judgment. What is "production-ready" when the platform team is an LLM and how should cloud-native builders think about the wave of AI-assisted, non-engineer-built apps now landing on our infrastructure? Salt Palace | Level 1 | Grand Ballroom GITuesday, November 10
Saturated by Design - Maximizing Cluster Allocation in On-Premises Kubernetes
Abstract
Securing Rural Colorado with Open Source: Running a Student-Led SOC on Kubernetes
Abstract
Ask Your Platform: Putting AI to Work Where the Questions Live
Abstract
So You Want to Build a Platform? You Probably Already Have One
Abstract
Why We Bet the Data Platform on Kubernetes - And How AI Is Changing How We Operate It
Abstract
Surviving the Churn: Read Replicas and Controllers for Busy Kubernetes Clusters
Abstract
Stop Explaining Kubernetes Like a Kubernetes Engineer
Abstract
What the Docs Don't Tell You: A Telecom's Year Operating Cache-Aware LLM Inference on Kubernetes
Abstract
When Infrastructure Breaks in Production: How EarnIn Brought Testing to the Full CNCF Stack
Abstract
Signed, Sealed, Denied: Attestation-Driven Admission with Kyverno + CEL at AT&T
Abstract
Tracing at Scale: Running a 16 Billion Spans/Hour Pipeline at Nubank
Abstract
Zero to Maintainer in 45 Days: An AI-Assisted Migration of a CNCF Project's Legacy Frontend
Abstract
Turning Apple Silicon into Production GPU Nodes for LLM Inference on Kubernetes
Abstract
The New Scaling Matrix: Balancing In-Place Resizing, VPA, HPA and Automation Solutions
Abstract
The Operator Calls Are Coming from Inside the Namespace
Abstract
The SRE Is Not Dead: What AI Taught Us about Missing Context in Kubernetes Incident Response
Abstract
Kubernetes Anonymous: Confessions of Kubernetes Cargo Cultists
Abstract
Transforming Retail with AI: From Automation to Autonomous Decisioning
Abstract
Welcome to Health Check Hell: CRDs, Statuses and Missing Standards
Abstract
Triaging 4,700 Alerts/Month at $0.33 Each: Verkada's MCP Agent on Nine Production Clusters
Abstract
The Promises We Keep at Scale: A Contract-Driven Guide to Platform SLOs
Abstract
Ground Control to Major Tom: We Need your Public Cloud in our Private Cloud
Abstract
Zero-Gap GPU Execution: Building Secure, Pre-Warmed Pod Runtimes for High-Velocity AI Agents
Abstract
Agents on the Platform: Four Perspectives on the Conversation We're Already Having in Private
Abstract
Zero Downtime CNI Migration at Scale: Canal to Cilium Across Hundreds of Production Clusters
Abstract
Two-Stage OTel Aggregation: Taming Istio Cardinality at 10k-Pod Scale
Abstract
From Consumers to Contributors: How Growing Open Source Members Transformed Our ML Platform Team
Abstract
When the Agent Lost Its Patience: Securing Cloud-Native AI Workflows Against Identity Leakage
Abstract
Beyond the Cluster Boundary: Sharing GPUs at Scale
Abstract
AI-DDoS: How AI-Generated Contributions Are Breaching OSS Communities, and What We Can Do about It
Abstract
Wednesday, November 11
Going Cloud Native in Baseball
Abstract
Edging Closer to AI Assisted Troubleshooting - AI Assisted Dashboard Analysis
Abstract
Anatomy of an Outage: When Bursty ML Workloads Break the Kubernetes Scheduler
Abstract
Inside the Inference Load Balancer: Proxy/Controller Patterns for LLM Serving on Kubernetes
Abstract
Time to Learn New Tricks to Improve Performance on DRA-Managed Devices
Abstract
Hardening Kubernetes for GovCloud: A 3-Year Journey to FedRAMP Moderate Authorization
Abstract
Ship Faster, Ship Safer: A K8s-Native Canary Pipeline for Critical Cluster Services
Abstract
How Anthropic Almost Melted GKE (And the PRs That Saved It)
Abstract
How Podium Ships 30% of PRs with Autonomous K8s Coding Agents
Abstract
Beyond HPA: An Explainable, Agentic Autoscaler for Kubernetes
Abstract
Snapshot, Replay, Verify: A KWOK CI Pattern for Kubernetes Platform Operators
Abstract
How We Are Enabling Feature Flagging At Scale
Abstract
Progressive Delivery for Trust: How Agents Earn the Right to Merge
Abstract
Hidden Pod Startup Latency: Container Image Pull
Abstract
Kubernetes The Hard Way - Live
Abstract
Kubernetes Secrets Were a Bad Idea. Now What?
Abstract
Allocating Kubernetes Idle Per-Instance — Letting Scale Do What Fairness Rules Couldn't
Abstract
Millions of Events, One Right Order: Financial Data Processing at Intuit
Abstract
Many Clusters, One GPU Pool: Locality-Aware Scheduling and Data Delivery With Kueue and Dragonfly
Abstract
Look Before You Leap: Preventing In-Motion K8s Updates in Fleet Robotics
Abstract
No RAG, No Regrets: Letting an LLM Drive 30 EKS Clusters in Production
Abstract
When Agents Talk to Agents: Scaling A2A on Kubernetes Without Drowning in Connections
Abstract
Observability for LLM Inference on Kubernetes
Abstract
RBAC as a Platform Capability: Applying Platform Engineering to Kubernetes Access
Abstract
Binary Version Is Not Behavior: Skip-Level Kubernetes Control Plane Upgrades With KEP-4330
Abstract
Quota Isn't Enough: Topology Aware Scheduling on Modern GPU Clusters
Abstract
One Workload to Rule Them All: Workload Aware Scheduling for Distributed AI Training on Kubernetes
Abstract
Robust CI as a Safety Net: Moving Fast at Scale with AI-Generated GitOps
Abstract
Pushing Beyond the Breaking Point: Linked Runners and TEEs for Frontier AI
Abstract
Running Secure Agents at Scale
Abstract
Thursday, November 12
Managing Network Security in Multi-Tenant Environments with Istio and Cilium
Abstract
Beyond Dashboards: A Semantic Layer for AI-Driven Observability in Kubernetes
Abstract
What monday.com's 500+ Engineers and AI Agents Have in Common
Abstract
Autoscaling at Scale with KEDA
Abstract
Catching Ghosts in the Machine: Hallucination Detection for Observability Agents
Abstract
From Bearer Tokens to Mesh-Native mTLS: Modernizing Service Identity at Coinbase
Abstract
From Packets to Paychecks: eBPF-Based Network Cost Attribution at Scale
Abstract
The Scheduling Stack: Real-World Lessons from Anthropic, Anyscale, Google, and CERN
Abstract
Follow the GPUs: How a Regulated Fortune 100 Serves Customers When No Single Cloud Has Enough
Abstract
Running Stateful Analytics on Kubernetes: Lessons from Building a Distributed DuckDB Platform
Abstract
Anthropic’s Kubernetes Scheduler for Frontier AI: What Worked, What Broke
Abstract
BurritoBot Said Let's Dance, the Platform Said No
Abstract
Frameworkless ML Serving: Scaling to Thousands of Models with KEDA, Pub/Sub, and Native K8s
Abstract
Beyond Stateless vs Stateful: A Unified Workload API for Multi-Cluster Kubernetes
Abstract
Agents Fail. Workflows Recover. Durable Agent Orchestration with Cadence
Abstract
From Fine-Tuning to Production: Scaling Agentic AI at Shopify via Inference Perf
Abstract
From Black-Box to Auditable AI-Grid: A Deterministic Governance Layer with Hybrid Cloud
Abstract
From Platform Catalog to Conversational Agent: Wiring AI Into Your Internal Developer Platform
Abstract
The Local AI Renaissance
Abstract
Spark on Kubernetes: The Gap Between “It Works” and “It Works Well”
Abstract
Splitting the Monolith at Cloudera - Building Fault-Tolerant Workflows with Cadence
Abstract
From Proxy to Platform: Building a Multi-Tenant AI Gateway
Abstract
From Vibe to Live: Building for the Real World
Abstract