Zalando replaced shared edge routing for high-fan-out internal calls with an in-process load balancer that mirrors Skipper’s consistent-hash ring. They built a standalone JVM module for hash-parity routing, switched to a watch-based Kubernetes informer, and overhauled their CI/CD pipeline to safely roll out traffic ramps. The change cut latency spikes, reduced costs, and boosted deployment velocity.

Helmsniff is a Go CLI that scans rendered Kubernetes and Helm manifests and generates CSV or JSON reports of security misconfigurations. It flags issues like missing securityContexts, insecure HTTP URLs, hostNetwork usage, privileged containers and Docker socket mounts, and supports directory or stdin input, parallel execution, and standard Makefile targets.

Solo.io and Google teamed up to integrate Agent Substrate into kagent, enabling fast suspend/resume, scale-to-zero and secure sandboxing for AI agents on Kubernetes. It uses pre-provisioned worker pools, snapshots to storage, and lightweight isolation (gVisor or Firecracker) to cut boot times to milliseconds and minimize idle resource use.

This issue covers Cloudflare’s new real-time WAF rules, Anthropic’s Claude Fable and Mythos 5 models, and HashiCorp Boundary’s agent-aware access controls. It also highlights Microsoft Foundry’s model management, geo-distributed AI training with k0smos, plus tools like MemPalace, whichllm, a Rust Git rewrite, Kubernetes Inference Extension, and Cilium’s CI/CD hardening.

This guide explains how runtime security defends live Kubernetes workloads by monitoring system calls, network behavior, and file integrity. It shows why pre-deployment scans miss zero-day exploits and runtime threats like container escapes, lateral movement, and cryptomining. It then details how Cilium Tetragon uses eBPF in the Linux kernel for precise, real-time enforcement.