Everything in Docker & Kubernetes
CNCF argues agents should propose system state, not receive production root
A CNCF Ambassador argues that agents should express changes as versioned system state and pass them through review, build and deployment controls instead of receiving unrestricted production root.
CNCF announces its 2026–2028 Ambassador cohort
CNCF accepted 58 new ambassadors for its 2026–2028 cohort, while 48 previous ambassadors stepped away.
ArgoCon previews the direction of Argo CD 4.0
CNCF previews ArgoCon North America 2026 and says the Argo community is beginning the visioning process for Argo CD 4.0. The event covers four distinct projects—Argo CD, Workflows, Rollouts, and Events—so learners can map each project to a delivery problem before treating the vision as a release.
Kubernetes 1.37 adds a native unused-PVC condition
Kubernetes 1.37 promotes PVC unused tracking to Beta, adding an Unused condition managed by the PVC protection controller.
Docker publishes Sandbox Kit Specification v3
Docker published an open-source Kit Specification v3 for packaging an agent’s runtime, tools, permissions, and network policy with its environment.
Docker introduces Cloud Sandboxes for long-running agents
Docker announced Cloud Sandboxes on 24 September: the same microVM isolation model as local Sandboxes, running on Docker-managed compute.
Alerting on under-replicated Deployments
Write an alerting rule comparing kube_state_metrics available vs desired replicas with for: 5m, Prometheus evaluates and fires to Alertmanager, which dedupes/routes/notifies.
PromQL for top 5 CPU-consuming pods
Apply rate() to the counter over 15m, sum by pod to combine containers, then wrap in topk(5); rate handles counter resets.
EFK centralized logging architecture
Fluentd runs as a DaemonSet collecting node container logs, parses and forwards to Elasticsearch for indexed storage, and Kibana queries and visualizes them.
Auto-discovering app pods for Prometheus scraping
Use kubernetes_sd_configs with role pod, relabel on pod annotations like prometheus.io/scrape to filter, and set path and port; with the Operator use a PodMonitor or ServiceMonitor.
kube-state-metrics versus node-exporter
Kube-state-metrics exposes API object state (deployment replicas, pod phase, restarts) from the control plane, while node-exporter exposes OS-level hardware metrics (CPU, memory, disk) per…
Viewing pod logs and durable log collection
Kubectl logs (with -c, --previous, -f) reads container stdout/stderr; because that storage is ephemeral, run a node-level logging agent as a DaemonSet shipping logs to a central store.
Multi-tenant isolation with a monitoring exception
Apply default-deny ingress per tenant namespace, allow same-namespace traffic, then add an ingress rule permitting the monitoring namespace via namespaceSelector on the metrics port.
Binding a ClusterRole with a RoleBinding
A RoleBinding referencing a ClusterRole grants those rules only within the binding's namespace; reuse built-in roles like view per-team without duplicating definitions.
Root and NET_ADMIN under Pod Security Standards
Set runAsUser 0 and capabilities add NET_ADMIN in the container securityContext; this is rejected by Restricted and Baseline, so the namespace must use the Privileged profile.
Write a frontend-to-backend NetworkPolicy
Set podSelector to app=backend, policyTypes Ingress, one ingress rule with from podSelector app=frontend and ports TCP 8080; the implicit deny handles the rest.
Namespace-scoped RBAC for a ServiceAccount
Create a Role in production granting create on deployments (apps group) and services (core group), then a RoleBinding tying that Role to the ServiceAccount.
Troubleshooting an RBAC forbidden error
Use kubectl auth can-i with --as impersonation to check the verb, inspect RoleBindings and ClusterRoleBindings, and read the role rules.
First NetworkPolicy flips a pod to default-deny
Once any policy selects a pod for a direction, that direction becomes default-deny and only explicitly allowed traffic passes; unselected pods stay open.
Role versus ClusterRole in RBAC
Role is namespaced, ClusterRole is cluster-wide and covers cluster-scoped resources, and you grant either via a RoleBinding (namespaced) or ClusterRoleBinding (cluster-wide) to a subject.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles