Security

ingress-nginx is retired and its successor was cancelled before it shipped. A migration path to Gateway API that does not require a big-bang weekend.

Three weeks ago we called CVE scanners a layer-seven answer for teams who skipped the layer-one work. Then we shipped one. Here is why that is not a contradiction, and what a vulnerability finding has to become before it is worth anything.

A new name, a new engine, and the biggest release we have ever shipped: the Go rewrite, an AI that owns the incident loop, passkey security, European multi-cloud, and Ankra on your phone.

Half of all clusters are running an ingress controller that stopped receiving security patches in March. Meanwhile, teams debate service meshes. The five findings that show up in every real cluster security review, each with the incident that proves it and the fix.

Every GitOps rollout stalls on one question: where do the secrets go? A practical guide to SOPS and AGE encryption in Ankra, so credentials live in Git safely and AI-generated config never leaks a key.