GitHub Spec Kit: give the AI agent a spec, not a vibe
Ask Claude, Codex, or Gemini to “build me an ERP with auth, billing, a dashboard, and a mobile app” and you’ll get something that half works and is architecturally cursed in ways you won’t notice until week three. The model isn’t bad at writing code. It’s bad at simultaneously inventing the product, the architecture, and the implementation order while also writing the code. GitHub’s Spec Kit exists to split those apart....
Kubernetes 1.37 (Garhwal): what's worth knowing
Kubernetes 1.37, codename Garhwal, shipped August 26, 2026 after a 15-week cycle. 67 enhancements: 16 graduating to Stable, 23 to Beta, 27 new in Alpha, one deprecation track. Full release notes here. The API surface itself tells a tighter story than the enhancement count does. I traced the actual version history of every API resource that changed in 1.37, back to 1.34, instead of trusting a changelog summary: .kv-wrap{margin:1.5rem 0;border:1px solid #e3e3e6;border-radius:10px;padding:2px;overflow-x:auto} ....
Kyverno threat model: the defaults that make enforcement optional
Fail open, by default Audit mode is not enforcement PolicyException: the quiet bypass Kyverno doesn’t watch its own namespace What Kyverno can never protect Sign and verify, not either Turning the admission controller into an SSRF probe Summary Kyverno released a threat model and hardening guide in April 2026, produced by the security consultancy ControlPlane in partnership with the CNCF and reviewed by Kyverno’s own maintainers (Jim Bugwadia and Shuting Zhao among them)....
Terraform to OpenTofu: is it worth migrating?
A reader sent me a question I’ve been getting more often lately: they’re running Terraform 1.5, S3 backend, no Terraform Cloud, no HCP. Is it worth moving to OpenTofu? Short answer: probably yes, and this setup happens to be close to the easiest case there is. Here’s why. The fork point matters OpenTofu forked from Terraform 1.5.x, the last version released under the MPL license before HashiCorp switched to BSL. So if you’re still on 1....
Kubernetes tools
This list is being updated on regular basis General info https://kubernetesreadme.com/ UI / Desktop Clients K9s — terminal UI for navigating clusters, resources, events, logs, and metrics https://k9scli.io/ Freelens — free and open-source IDE for Kubernetes (community fork of Lens, no account required) https://github.com/freelensapp/freelens Lens — full-featured Kubernetes desktop IDE with workload, metrics, and troubleshooting views https://k8slens.dev/ Headlamp — web-based Kubernetes UI, good for remote admin https://headlamp.dev/ Kubevious — maps cluster relationships and highlights configuration issues visually https://kubevious....
AWS Lambda MicroVMs: stateful sandboxes with full lifecycle control
AWS just shipped something that reframes what “serverless” can mean. Lambda MicroVMs are not Lambda Functions with a bigger timeout. They are a fundamentally different primitive: stateful, VM-level isolated environments with an explicit lifecycle you control. The key shift: instead of getting a recycled process for 15 minutes, you get a dedicated Firecracker microVM that lives up to 8 hours. You decide when it starts, suspends, resumes, and terminates. What Lambda MicroVMs actually are Regular Lambda Functions are stateless by design....
AI agents in practice: self-learning, knowledge bases, and why fewer agents is better
Building AI agents sounds fun until you actually build one. Then a different set of problems shows up — ones nobody writes about. Here is what I have learned running agent systems in production: self-improvement conflicts with git, most knowledge bases hit a wall sooner than expected, and adding more agents almost never helps. The self-improvement problem One of the selling points of agents like Hermes is that they can self-reflect and improve, updating their own rules based on experience....
Supply Chain Attacks in 2026: How to Harden Your Pipeline
npm min-release-age Use npm ci, not npm install Lock down npm with .npmrc Hardening GitHub Actions Summary In late March 2026, compromised axios builds briefly appeared on the npm registry (for example 1.14.1 and 0.30.4 on affected release lines). Attackers added a malicious dependency and used lifecycle scripts so a plain npm install could pull down far more than an HTTP client. This is a pattern seen before in registry incidents, not a bug in axios’ normal code....
Terraform at scale: GitOps tools and the long apply problem
If you’ve been using Terraform Cloud for a while, you’ve probably hit at least one of these: the pricing model changed and suddenly it’s expensive, applies take 10+ minutes, or the state files have grown into something nobody wants to touch. You’re not alone. This comes up a lot in Terraform discussions lately. This post covers the main tools people are using to solve these problems in 2025–2026, with a focus on two separate issues that often get conflated: GitOps orchestration (who triggers plans, who approves applies) and state management at scale (why applies are slow and what to do about it)....
urllib3 2.4.0 + Python 3.13 breaks SSL against Kubernetes: what you need to know
Bumped to Python 3.13 and suddenly your Kubernetes automation stopped working? Here’s the error you’re probably seeing: 1 2 3 4 5 urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='xxxx.gr7.us-east-1.eks.amazonaws.com', port=443): Max retries exceeded with url: /version/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1028)'))) Nothing changed on the cluster side. The problem is on your machine — specifically the combination of Python 3.13 and urllib3 2.4.0. Tracked in kubernetes-client/python#2394....