Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

Building a Scalable, Flexible, Cloud-Native GenAI Platform with Open Source Solutions

A fresh reference architecture built withEnvoy AI GatewayandKServebrings order to the GenAI chaos. One clean interface to route requests across internal and external LLMs—locked down with policies. It’s called aTwo-Tier Gateway Architecture. Think of it like a split-brain: external API traffic goes.. read more  

Building a Scalable, Flexible, Cloud-Native GenAI Platform with Open Source Solutions
Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

Container Logs in Kubernetes: How to View and Collect Them

This guide shows how to wrangle container logs in Kubernetes—usingkubectl, shell tools, structured logging, and the Kubernetes Dashboard. It covers the basics and dives into how to scale up log collection and make observability less painful across clusters... read more  

Container Logs in Kubernetes: How to View and Collect Them
Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

v1.34: DRA has graduated to GA

Kubernetes 1.34 turnsDynamic Resource Allocation (DRA)loose into General Availability—enabled by default. That cements native support for high-maintenance gear like GPUs, FPGAs, and any other quirky hardware your workloads need. The release also packs a fresh mix of alpha/beta features: tighter admi.. read more  

Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

v1.34: Service Account Token Integration for Image Pulls Graduates to Beta

Kubernetes v1.34 bumpsServiceAccount token integration for Kubelet Credential Providersto beta. That means image pulls can now ditch long-lived secrets for workload-scoped tokens. Cleaner, safer, and more locked down per ServiceAccount... read more  

Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

v1.34: Introducing CPU Manager Static Policy Option for Uncore Cache Alignment

Kubernetes 1.34 bumps theCPU Manager uncore-cache alignment policyto beta. It’s aimed at nodes withsplit uncore cache architectures. The policy groups all a container’s CPUs under the same uncore cache—cutting latency and easing contention for workloads that hate waiting. System shift:Kubernetes kee.. read more  

v1.34: Introducing CPU Manager Static Policy Option for Uncore Cache Alignment
Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

v1.34: PSI Metrics for Graduates to Beta

Kubernetes v1.34 bumpsPressure Stall Information (PSI) metricsto Beta. Now kubelets expose kernel-level resource pressure—CPU, memory, and I/O—through the Summary API and Prometheus. Instead of just tracking how much a resource gets used, PSI shows how often workloads get throttled or blocked. That .. read more  

Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

CNCF Elevates Metal3.io to Incubating Status for Bare-Metal Kubernetes

The CNCF just bumpedMetal3.ioup to incubating status. That’s a clear nod to rising demand forKubernetes-native bare-metal management. Metal3.io wires up physical servers as Kubernetes resources—no VMs in sight. It leans onIronicand theBare Metal Operatorto handle provisioning and lifecycle tasks lik.. read more  

Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

Scaling Kubernetes the Right Way: In-Depth Comparison of HPA, VPA, CA, Karpenter, and KEDA

A hands-on breakdown of Kubernetes autoscalers—HPA,VPA,Cluster Autoscaler,Karpenter, andKEDA—maps how each scales pods, nodes, and events. The hot pairing lately?Karpenterfor fast node spin-up, teamed withCloudPilot AIto wrangle Spot instances across 800+ compute types without melting costs... read more  

Scaling Kubernetes the Right Way: In-Depth Comparison of HPA, VPA, CA, Karpenter, and KEDA
Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

v1.34: Pod Replacement Policy for Jobs Goes GA

ThePod replacement policyin Kubernetes v1.34 just hit GA. Jobs can now hold off on spinning up new Pods until the old ones arefullygone. No more duplicates per index. No more blowing through quotas or stalling schedulers—big win for workloads like ML training. System shift:This rewires how Jobs hand.. read more  

Link
@faun shared a link, 8 months, 2 weeks ago
FAUN.dev()

Reduce Cloud Cross-Zone Data Transfer Costs with Kubernetes 1.33 trafficDistribution

Kubernetes 1.33 drops a new traffic policy that addszone-local routing. With it, kube-proxy now prefers endpoints in the same availability zone. Translation: less cross-AZ chatter, fewer surprise charges. On AWS, that can chop the usual $0.02/GB cross-AZ fee by up to 85%—especially in EKS clusters j.. read more  

Reduce Cloud Cross-Zone Data Transfer Costs with Kubernetes 1.33 trafficDistribution
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.