TLDR DevOps 2026-09-04

Buildkite, the pro-tool that hands you building blocks for CI orchestration and then gets out of the way.

Enough with constant downtime. No more band-aids or burden.

We provide programmable primitives you co-ordinate, running only what changes, across any cloud, any chip, your secrets, your infra.

Control without compromise. Build faster, more securely, more reliably, with the CI engineered for frontier scale, used by the teams setting the pace.

You deserve better CI. Start with our 30-day trial. Kick the tires →

Kubernetes v1.37 makes horizontal pod autoscaling to zero replicas a Beta feature, enabled by default. A HorizontalPodAutoscaler can now scale a workload all the way down to zero pods and bring it back up based on object or external metrics, without requiring an add-on or Alpha feature gate as previous versions did. The feature works for queue consumers and batch processors but requires at least one object or external metric, since CPU and memory metrics disappear once no pods are running. The first Alpha version shipped in Kubernetes v1.16, and SIG Autoscaling plans to collect operational feedback before considering a GA graduation.

An unauthorized BGP announcement diverted traffic for a Softaculous-owned /24 for roughly 33 hours, allowing the attacker to intercept requests and obtain valid Let's Encrypt certificates because ACME validation traffic was hijacked too. A small number of Virtualizor systems later downloaded a malicious update package, showing how routing attacks can cascade into software supply-chain compromise.

A Kubernetes engineer describes how to move a service out of the default namespace without downtime, using an ExternalName service as a DNS-level forwarding address. The approach lets dozens of dependent services keep calling the old cluster-internal DNS name while traffic silently routes to the new deployment, with no code changes required from other teams. A temporary policy exception handled the ingress side, allowing both the old and new ingress rules to coexist briefly while traffic was confirmed on the new deployment before the old one was removed.

Managed PostgreSQL services reduce the operational tax of self-hosting by transferring infrastructure, patching, backups, high availability, and platform security responsibilities to the provider. Self-managed PostgreSQL remains preferable when organizations need deep control, specialized configurations, unsupported extensions, or have mature platform engineering and operational capabilities.

KubeVirtBMC can be paired with Metal3, a CNCF incubating project, to provision KubeVirt virtual machines as if they were physical bare-metal servers. Metal3 uses OpenStack Ironic under the hood to handle hardware inspection, boot device control, and OS image writing via standard IPMI or Redfish interfaces. KubeVirtBMC creates virtual BMC endpoints for KubeVirt VMs, so Metal3 has no way to distinguish them from real hardware. This post walks through a full end-to-end setup that configures Redfish virtual media boot without PXE or DHCP and provisions a VM with a live ISO image.

Semantica is an open-source context and knowledge-graph layer for AI systems that turns enterprise data, agent decisions, and provenance into a structured, queryable graph. It supports deterministic reasoning with Datalog, SPARQL, Rete, and forward chaining, plus W3C PROV-O audit trails, SHACL/OWL ontology governance, conflict detection, and integrations with graph stores, vector databases, Databricks, Snowflake, LangChain, CrewAI, MCP, and other agent frameworks.

Magnitude is an open source inference server that runs AI models locally on your own hardware, with no internet connection required after setup. It profiles your machine, recommends models that fit your available memory, then downloads and runs them. The tool works with Pi, OpenCode, Hermes, OpenClaw, Codex, Claude Code, Oh My Pi, and Cline, and also supports custom GGUF models from Hugging Face.

Agent optimization reduces AI costs by optimizing model selection, deployment, caching, prompts, agent configurations, and observability at runtime. Microsoft Foundry combines these capabilities into a continuous optimization loop that measures cost per successful outcome while maintaining quality, latency, and reliability.

Cloudflare has prototyped a system called Cache Transcoding that compresses eligible cached assets using the Zstandard algorithm before writing them to disk, shrinking those assets to roughly one-third of their original size on average. The system targets compressible text content like HTML, JSON, CSS, and JavaScript, which made up 67.3% of requests in Cloudflare's traffic sample but arrived uncompressed about 71% of the time. Encoding happens once when an asset enters the cache, while the CPU cost of decoding is paid on every serve at approximately 1.56 nanoseconds per byte. In testing across 10 cache servers with more than a million requests, the architecture stayed within its CPU budget at zstd level 3 with a 4 kibibyte minimum object size.

Go's newer map implementation uses a Swiss Table design that groups entries in small blocks with compact control bytes, allowing many candidate slots to be checked before doing full key comparisons. SIMD can compare multiple control bytes at once on supported CPUs, while the layout and growth strategy improve cache locality and lookup performance.

HCP Vault Dedicated audit logs can reach Microsoft Sentinel through a Terraform-provisioned Azure pipeline using a generic HTTP sink, Azure Functions or Logic Apps, and Azure Monitor Logs Ingestion.

Cloud-native environments make periodic GRC checks obsolete because infrastructure and configurations change continuously.