GitOps stops working as clusters grow, so this post proposes flipping the model: don't store configs in git, derive them from git. It keeps GitOps' declarative core but changes what actually gets committed back, cutting drift and merge noise at scale.
Sidero Labs has stopped actively developing its Cluster API stack, marking the Talos bootstrap and control-plane providers plus Sidero Metal community-supported. READMEs now point users to Omni and the bare-metal infrastructure provider. Teams relying on CAPI for Talos provisioning should plan support and maintenance now.
Kubernetes CPU limits throttle pods even when the node has idle cores, capping CPU that is actually available. Robusta's Natan Yellin argues accurate CPU requests, not limits, guarantee reserved CPU and prevent starvation. The recommendation: drop limits, keep sharp requests.
Charity Majors says the window for AI skepticism has closed: she compares 2025's AI shift to cloud in 2010 and credits coding harnesses like Claude Code, not just models, for the leap. With non-deterministic systems everywhere, verification and observability are now the bottlenecks, demanding more engineering discipline, not less.
Escape's AI pentesting engine Cascade bypassed a production AI agent's prompt-injection guardrail on the second attempt, getting it to hand over its full system prompt: tool list, call rules, and session IDs. No clever payload, just a rephrased request that read as legitimate. Guardrails are social engineering targets, not technical boundaries.
CodeJourney is a new Rust CLI that audits any git repository for code quality, secrets, dangerous patterns, license compliance, and project health, then exports PDF, HTML, JSON, or Markdown reports. Built for third-party due diligence, it gives investors reproducible IP metrics instead of ad hoc codebase overviews.
The tflint-ruleset-opa plugin lets Terraform teams enforce Rego policies through TFLint with no policy bundles or opa exec wiring. This walkthrough covers setup, a sample policy denying local-exec provisioners, and dropping it into existing pre-commit workflows.
Violin v3.1.0 ships a Hermes benchmark that runs agentic pentests end-to-end and gates scores on verified FIND-NNN evidence via an evidence-gated scorer and AI judge. Also adds a redesigned bashlex AST scope parser to kill false positives, plus a 100% pass calibration baseline.
Minimal, an open-source project building hardened container images on Wolfi, now ships ~100 flavors including Python, Node, Nginx, Redis, and PostgreSQL. Every image is rebuilt from source every six hours, cosign-signed with an SPDX SBOM and SLSA Level 3 provenance, and scanned daily for CVEs. Pull from ghcr.io with no login or rate limits.
You’re caught up.
That was all 9 stories in the 16 August issue.