Operations | Monitoring | ITSM | DevOps | Cloud

Over the past year, I’ve spent a lot of time talking with engineering and platform teams about how they’re deploying AI agents. The conversations are changing. Six months ago, most were focused on getting agents into production. Now, increasingly, the question is how to secure them once they’re there. It’s a familiar transition. We’ve seen it with containers, Kubernetes, microservices, and cloud infrastructure.

We’re pleased to announce that Calico is supported on Red Hat OpenShift 5, the latest version of the industry’s leading hybrid cloud application platform powered by Kubernetes. Tested and validated to run on Red Hat OpenShift 5, Calico delivers high-performance networking and zero-trust network policy for containers, virtual machines on Red Hat OpenShift Virtualization, and AI workloads, with one consistent policy model across the cluster.

KubeCon + CloudNativeCon North America is in Salt Lake City this week, and Bindplane will be at booth 253. Come say hi! We have four talks and we're bringing a ton of cool updates with us. So many of you were eager to try Bindplane Agent while it was in early access. That changes today. Bindplane Agent is generally available. If you've built pipelines in Bindplane before, you know the drill. Pick a source, pick a destination, add processors in the right order, fill in the settings, roll it out.

Rails 8.1.4.1 is a security point release, and it’s a substantial one. It carries around a dozen CVE-level advisories spread across Action View, Action Pack, and Active Support. There are no feature changes to weigh and no behavior most apps need to plan around, which makes this the easy kind of upgrade to justify: bump it this week. (The fixes were also backported to the 8.0 and 7.x series, so you don’t have to be on 8.1 to get them.)

The Qovery agent skills now create a free local Kubernetes cluster in Docker when your organization has none, then deploy your project to it. One prompt in Claude Code, Cursor or OpenCode, no cloud account, no credit card. Measured: 4 min 43 s for the cluster, 2 min 40 s to build and deploy a GitHub repository. Romaric founded Qovery to make Kubernetes accessible to every engineering team. He writes about platform strategy, developer experience, and the future of cloud infrastructure.

Three CAs had very different bad weeks this fall. eMudhra lost a root and quit. GoDaddy had to replace 403,643 certificates over a policy document. TWCA revoked 82% of its certificates over serial numbers. TWCA and eMudhra both failed from a lack of randomness. eMudhra’s private keys had so little that anyone could compute them. TWCA’s CA certificates have serial numbers with 24 random bits where the rules require 64.