https://www.robertasoliman.com/en/tech-radar Reviewed news on Kubernetes, cloud, AI, security and costs, each with the impact and a recommendation. en https://www.robertasoliman.com/en/tech-radar#radar-2026-11-06-aws-security-hub-now-provides-an-sbom-inventory-for-your-compute-resources https://www.robertasoliman.com/en/tech-radar#radar-2026-11-06-aws-security-hub-now-provides-an-sbom-inventory-for-your-compute-resources Fri, 06 Nov 2026 12:00:00 GMT security AWS Security Hub now provides a Software Bill of Materials (SBOM) inventory for packages and applications installed on EC2 instances, ECR container images, and Lambda functions. The inventory is built from SBOMs generated by Amazon Inspector and lists each package’s version, type, and the number of resources where it is installed. Teams can filter or group by package attributes, account, and Region, inspect a resource’s installed software, and query the inventory through the Security Hub API. The feature is included with Security Hub Essentials at no additional cost and populates automatically where Inspector is enabled. For teams already using Inspector, the inventory could make it easier to check package presence during triage. Coverage depends on which resources and Regions are integrated and whether Inspector is enabled. Check whether Inspector is enabled for relevant resources, then assess filters, grouping, and API queries in existing triage workflows. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/11/security-hub-sbom-inventory/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-getting-started-with-web-answer-on-amazon-bedrock-agentcore https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-getting-started-with-web-answer-on-amazon-bedrock-agentcore Fri, 06 Nov 2026 12:00:00 GMT ai Web Answer is generally available as a managed Amazon Bedrock AgentCore tool. An agent sends a natural-language question and receives a synthesized answer with citations through a tool call. AWS says the service plans searches, runs several in parallel, reads pages to check facts, and links claims to source URLs. Integration uses AgentCore Gateway, which authenticates calls with IAM or JWT and returns the result to the agent as an MCP tool. Domain filters can be configured; the tool also accepts publication-date-range and country filters. For agents that need current information, the integration could reduce the need to maintain a separate search, retrieval, synthesis, and citation pipeline. Suitability depends on source quality and validation for the intended use case. Test the tool with representative questions, check its citations, and configure domain filters where needed. Consider invocation costs and Gateway permissions before production integration. AWS Machine Learning: https://aws.amazon.com/blogs/machine-learning/getting-started-with-web-answer-on-amazon-bedrock-agentcore/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-what-s-new-with-grafana-variables-less-clutter-easier-reuse-across-dashboards-and-more https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-what-s-new-with-grafana-variables-less-clutter-easier-reuse-across-dashboards-and-more Fri, 06 Nov 2026 12:00:00 GMT cloud Grafana announced section-level variables for rows and tabs, which are generally available, and cross-dashboard variables, which are in public preview. Section variables apply to panels in that row or tab; resolution checks the nearest section first, followed by parent sections and then the dashboard. Cross-dashboard variables can have global or folder scope and must be selected in each dashboard’s settings. The definition is shared, while each dashboard keeps its own selected value. They can also be managed as API resources and provisioned with Terraform. For organizations with repeated controls, sharing could reduce duplicate maintenance. Public preview status and explicit dashboard opt-in call for care before standardizing their use. Try section-level variables to organize local controls. For cross-dashboard variables, assess the preview on noncritical dashboards and define scope, selection, and precedence clearly. Grafana: https://grafana.com/blog/whats-new-with-grafana-variables-less-clutter-easier-reuse-across-dashboards-and-more/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-semantic-aggregation-over-millions-of-rows-in-bigquery-with-ai-agg https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-semantic-aggregation-over-millions-of-rows-in-bigquery-with-ai-agg Fri, 06 Nov 2026 12:00:00 GMT ai Google Cloud describes AI.AGG, currently in preview, as a managed semantic aggregation function integrated into BigQuery GoogleSQL. The function applies natural-language instructions to groups of rows and recursively combines intermediate summaries until it produces an output for each SQL group. According to the post, BigQuery organizes batches and parallel inference and uses Vertex AI. The function accepts text and multimodal inputs; for images stored in Cloud Storage, the post cites BigQuery Object Tables and OBJ.GET_ACCESS_URL, without data movement or transcoding. It also warns that the recursive architecture can send Gemini more tokens than the source data contains. For analysis of large text datasets, the function could reduce the need to build external splitting and synthesis pipelines. Because it is in preview and processing can increase token usage, teams should assess cost and behavior before adoption. Run a pilot with explicit filters and limits, estimate usage with AI.COUNT_TOKENS, and check outputs on representative data before expanding queries. Google Cloud: https://cloud.google.com/blog/products/data-analytics/semantic-data-aggregation-with-bigquery-and-ai-agg/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-powering-open-infrastructure-for-autonomous-agents https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-powering-open-infrastructure-for-autonomous-agents Thu, 05 Nov 2026 12:00:00 GMT ai Google announced the donation of Agent Substrate, gVisor, and OpenRL to the CNCF after the projects entered the CNCF Sandbox. Agent Substrate has reached version 1.0 and is generally available on GKE. According to the description, it separates agent sessions and identities from execution capacity: idle sessions can be saved and resumed when activity returns. The post also says the project can run on Kubernetes clusters and uses OCI containers. gVisor provides isolation for untrusted code, while OpenRL orchestrates reinforcement-learning post-training workflows on Kubernetes. The donated projects are going through CNCF Sandbox onboarding; gVisor is on a path toward Incubation. For teams running agents with pauses between calls, separating sessions from active compute could help reduce resources held by idle workloads. Suitability depends on isolation requirements, architecture, and validation in the team’s own environment. If this pattern is on your roadmap, assess the architecture and security boundaries in a pilot; also confirm service availability and requirements for your intended environment. Google Cloud: https://cloud.google.com/blog/products/containers-kubernetes/open-infrastructure-for-autonomous-agents-comes-to-cncf/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-langgraph-1-2-20 https://www.robertasoliman.com/en/tech-radar#radar-2026-11-05-langgraph-1-2-20 Thu, 05 Nov 2026 12:00:00 GMT ai LangGraph version 1.2.20 includes a change that gives each interrupt() call within a task its own ID. It also adds a strict resume mode that rejects stale interrupt answers. The release notes additionally report a correction to the documentation reference shown for multiple-interrupt errors and development dependency updates. The feed does not detail how to configure the new mode or specify which applications need to change. The update is relevant to workflows that pause for a response and then resume execution, particularly when multiple interrupts or out-of-context answers are possible. In applications with interrupted and resumed workflows, individual IDs and rejection of stale answers could help prevent incorrect associations. The effect depends on how each application manages state and resumes. Review the release notes and test interruption and resumption paths before upgrading production applications; confirm that strict mode matches the intended behavior. Releases langchain-ai/langgraph: https://github.com/langchain-ai/langgraph/releases/tag/1.2.20 https://www.robertasoliman.com/en/tech-radar#radar-2026-11-04-amazon-ecs-managed-daemons-can-now-collect-json-file-logs-from-application-containers-on-amazon-ecs https://www.robertasoliman.com/en/tech-radar#radar-2026-11-04-amazon-ecs-managed-daemons-can-now-collect-json-file-logs-from-application-containers-on-amazon-ecs Thu, 05 Nov 2026 12:00:00 GMT cloud AWS added support for the json-file log driver in application containers on Amazon ECS Managed Instances and for log-driver volumes in Amazon ECS Managed Daemons. With these features, a managed daemon can read the files through a mounted volume without specifying host bind-mount paths or requiring root privileges. Logs are stored in directories associated with each container ID and retained until the container is removed. AWS says the setup can forward logs to a chosen destination and use the team’s observability agent. The feature is available in commercial AWS Regions where ECS Managed Instances and Managed Daemons are available, at no additional cost. File-based collection could make it easier to use observability agents that support the Docker json-file format. The change may require updates to task definitions and to log-retention and forwarding practices. Check agent compatibility and test the logConfiguration, volume, and mountPoints setup on a task before expanding the change. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/11/amazon-ecs-managed-instances-json-file-log-driver/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-04-alloydb-express-instant-scale-to-zero-postgresql-for-developers-and-coding-agents https://www.robertasoliman.com/en/tech-radar#radar-2026-11-04-alloydb-express-instant-scale-to-zero-postgresql-for-developers-and-coding-agents Wed, 04 Nov 2026 12:00:00 GMT cloud AlloyDB Express is a new AlloyDB for PostgreSQL offering aimed at developers and coding agents. According to the announcement, a database can be created in under two seconds, and the instance automatically pauses after 15 minutes without activity, resuming when a new query arrives. The service is in preview and includes a free tier. Google also says users can upgrade to AlloyDB with one click while keeping data, schemas, users, and connection strings. The offering includes vector, text, and hybrid search capabilities. For intermittent development and testing workloads, automatic pausing may reduce the time compute is active. The actual benefit depends on usage patterns and storage and query costs. If it fits the architecture, test it in a non-production environment and validate costs, security requirements, and resume behavior before adoption. Google Cloud: https://cloud.google.com/blog/products/databases/introducing-alloydb-express-for-rapid-testing-and-prototyping/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-04-see-the-agents-set-the-terms-new-visibility-and-control-for-personal-agents https://www.robertasoliman.com/en/tech-radar#radar-2026-11-04-see-the-agents-set-the-terms-new-visibility-and-control-for-personal-agents Wed, 04 Nov 2026 12:00:00 GMT security Cloudflare announced new traffic analytics and access controls for supported personal agents visiting websites. In Security Analytics, the Personal Assistants category lets teams filter this traffic; a new widget shows which agents visit a site and how many requests they send. Teams can also filter by agent to inspect requested paths, status codes, and source networks. In Security Settings, site owners can set an overall Agents policy and different policies for each supported agent: allow, block on pages with ads, or block. Existing Search and Training policies remain unchanged. These controls may help teams distinguish agent traffic and tailor access to site content and business models. Identification alone does not resolve every question about user context or reputation, which Cloudflare describes as future work. Review the analytics and per-agent rules before changing blocks; assess potential effects on legitimate customer journeys. Cloudflare: https://blog.cloudflare.com/personal-agents-visibility-control/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-04-openshell-on-kubernetes-a-guide-for-platform-engineers https://www.robertasoliman.com/en/tech-radar#radar-2026-11-04-openshell-on-kubernetes-a-guide-for-platform-engineers Wed, 04 Nov 2026 12:00:00 GMT kubernetes A CNCF guide presents OpenShell, a CNCF Sandbox project started by NVIDIA, as a runtime for running agents in Kubernetes sandboxes. It applies filesystem, process, network, and credential controls; outbound traffic is denied by default, and rules can consider the binary, host, port, and HTTP method. The Kubernetes backend uses the Agent Sandbox project's Sandbox resource and represents agents as familiar objects such as Pods, Services, PVCs, Secrets, and NetworkPolicies. The guide notes that sandboxes can currently be created through the Gateway API, not the Kubernetes API, and that one Supervisor Pod per agent may constrain scale in large environments. This model may give teams more control over agent actions and network requests than network rules alone provide. It also adds components and calls for evaluating cluster capacity and existing controls. Before a pilot, validate CNI NetworkPolicy enforcement, admission policies, and operational limits; account for the Gateway API limitation. CNCF: https://www.cncf.io/blog/2026/11/04/openshell-on-kubernetes-a-guide-for-platform-engineers/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-bridging-alloy-and-opentelemetry-the-otel-engine-is-now-in-public-preview https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-bridging-alloy-and-opentelemetry-the-otel-engine-is-now-in-public-preview Tue, 03 Nov 2026 12:00:00 GMT cloud Grafana has moved Alloy’s OpenTelemetry engine into Public Preview, alongside the default engine starting with Alloy v1.21.0. The engine runs standard OpenTelemetry Collector YAML configurations without translating them into Alloy syntax. The post also describes centrally managing configuration through Fleet Management, available since Alloy v1.19.0. The two engines can run side by side, but they cannot pass data directly to each other; communication between them goes over the network, usually via OTLP. For teams already maintaining Collector configurations, this option may make adopting Alloy easier without rewriting pipelines. Because the feature is in Public Preview, suitability depends on each environment’s stability and support requirements. Test configuration and deployment-tool compatibility in a controlled environment. Before using the engine in production, confirm the limitations and support status documented by Grafana. Grafana: https://grafana.com/blog/bridging-alloy-and-opentelemetry-the-otel-engine-is-now-in-public-preview/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-v3-3-19 https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-v3-3-19 Tue, 03 Nov 2026 12:00:00 GMT kubernetes Release v3.3.19 is the final release in the Argo CD v3.3 series. The notice states that, as of November 3, 2026, this version reached end of life and will no longer receive bug fixes or security updates. The project recommends upgrading to a supported version: v3.4.13, v3.5.7, or v3.6.0. The release also lists fixes for Rollouts, ApplicationSet, gRPC-web connections, operations blocked by sync windows, and Crossplane resource handling, among others. Organizations still running the v3.3 series will no longer receive fixes or security updates for it. An upgrade may require compatibility assessment and planning based on each installation’s configuration. Identify affected installations, review the upgrade documentation, and plan migration to one of the supported versions listed by the project. Validate the process in a test environment before applying it in production. Releases argoproj/argo-cd: https://github.com/argoproj/argo-cd/releases/tag/v3.3.19 https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-servicenow-on-behalf-of-token-exchange-with-bedrock-agentcore-gateway https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-servicenow-on-behalf-of-token-exchange-with-bedrock-agentcore-gateway Tue, 03 Nov 2026 12:00:00 GMT security AWS describes configuring AgentCore Gateway to exchange tokens through the on-behalf-of (OBO) flow with Microsoft Entra ID. In this pattern, an AI agent calls the ServiceNow REST API and the gateway exchanges the incoming token for one intended for the API, preserving the original user’s identity. The example uses an MCP server between the agent and ServiceNow. The post states that native OBO support requires a gateway created with MCP version 2025-11-25; gateways created with earlier versions cannot enable this native feature. Identity propagation may help maintain per-user access controls and audit trails in agent integrations with enterprise APIs. The configuration depends on Entra application registrations and permissions, as well as the OAuth integration in ServiceNow. Assess the pattern with least-privilege scopes, protected credentials, and per-user authorization tests. Confirm the required MCP version and validate identity mappings before exposing ServiceNow operations to the agent. AWS Machine Learning: https://aws.amazon.com/blogs/machine-learning/servicenow-on-behalf-of-token-exchange-with-bedrock-agentcore-gateway/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-deep-dive-auto-scaling-response-times-on-amazon-ecs https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-deep-dive-auto-scaling-response-times-on-amazon-ecs Tue, 03 Nov 2026 12:00:00 GMT cloud Amazon ECS can now publish CPU and memory utilization metrics at 20-second resolution for target tracking, alongside the default 60-second resolution. AWS also says it optimized the publishing path for these metrics. In benchmarks published by the company, time to trigger scale-out fell from 363 to 86 seconds, and the time from triggering scale-out to running new tasks fell from 386 to 109 seconds. These results come from AWS tests and are not a guarantee for every application. For services with traffic spikes, more frequent metrics may help scaling policies react sooner. If additional capacity arrives closer to rising demand, some teams may be able to reduce idle reserved capacity; outcomes depend on workload, task startup, and configuration. Check the feature’s availability and configuration for your service. Compare latency, failures, and idle capacity before and after in a representative test, without assuming the benchmarks will be reproduced in your environment. AWS Containers: https://aws.amazon.com/blogs/containers/deep-dive-auto-scaling-response-times-on-amazon-ecs/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-trace-linkage-connect-the-dots-between-your-app-traces-and-database-queries https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-trace-linkage-connect-the-dots-between-your-app-traces-and-database-queries Tue, 03 Nov 2026 12:00:00 GMT cloud Grafana announced general availability of trace linkage in Database Observability. The feature connects database spans in OpenTelemetry-instrumented application traces to query telemetry collected by Alloy. From query text in a span, users can open details such as execution samples, performance history, related schema, and an explain plan. Matching can use query text; with sqlcommenter and context propagation enabled, it can also associate trace and span IDs with a specific execution. Grafana says exact matching depends on Alloy capturing that execution and is not guaranteed. Teams investigating slow requests may reduce manual switching between traces and database telemetry, if the required data and attributes are available. Check whether spans include db.query.text or db.statement and whether Alloy collects query telemetry. Consider sqlcommenter for more precise matching, after assessing compatibility and possible effects on caches. Grafana: https://grafana.com/blog/trace-linkage-connect-the-dots-between-your-app-traces-and-database-queries/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-introducing-zero-wire-a-hub-for-investigating-critical-internet-vulnerabilities https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-introducing-zero-wire-a-hub-for-investigating-critical-internet-vulnerabilities Tue, 03 Nov 2026 12:00:00 GMT security Cloudflare introduced Zero Wire, a public vulnerability intelligence feed within Cloudflare Radar. Its briefings bring together plain-language explanations, teams that should investigate, recommended actions, and links to evidence and vendor guidance. The service focuses on critical vulnerabilities in internet-facing software and complements, rather than replaces, vendor advisories and vulnerability databases. Briefings distinguish severity, evidence of exploitation, available fixes, and information that remains unknown. They may also include a prompt to support a read-only assessment with an AI agent; using the prompt does not automatically scan or change systems. The format may help teams organize triage and identify owners, but it does not by itself determine whether an organization is vulnerable or compromised. Use briefings as a starting point; confirm affected versions and fixes in vendor advisories and assess each asset using your own evidence. Cloudflare: https://blog.cloudflare.com/zero-wire/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-openkruise-agents-v0-6-0-leaping-ahead-in-agent-sandbox-security-and-automation https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-openkruise-agents-v0-6-0-leaping-ahead-in-agent-sandbox-security-and-automation Tue, 03 Nov 2026 12:00:00 GMT kubernetes OpenKruise Agents v0.6.0, a release of a Kubernetes workload automation and orchestration project, adds L4 and L7 network access controls, token management, and credential injection from Kubernetes Secrets. The release also introduces SandboxUpdateOps, with CheckpointRestore and upgrades for paused instances; PoolAutoscaler for warm-pool capacity with watermarks and schedules; and automatic pause and resume, including wake-on-traffic. The project describes OpenKruise Agents as providing lifecycle management for Agent Sandboxes at scale. The post notes that traffic controls cover only gateway-routed traffic and recommends defense in depth. These functions may help teams operating agent sandboxes on Kubernetes, but policies and conditions that could bypass controls need assessment. Review traffic policies, credentials, and upgrade requirements in a test environment. Combine the controls with NetworkPolicy, host firewalls, or security groups as appropriate. CNCF: https://www.cncf.io/blog/2026/11/03/openkruise-agents-v0-6-0-leaping-ahead-in-agent-sandbox-security-and-automation/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-v2-1-317 https://www.robertasoliman.com/en/tech-radar#radar-2026-11-03-v2-1-317 Tue, 03 Nov 2026 12:00:00 GMT costs Claude Code release v2.1.317 adds the GET /v1/organizations/analytics/cost endpoint to the Claude apps gateway admin API. According to the description, the report retrieves past spend over a date range, with totals by developer, day, or identity provider (IdP) group. The release also adds a daily record of each developer’s IdP groups on gateways with admin enabled; those records are kept for the period set by admin.identity_retention_days and used to group the report. The update also adds provider and seat-type attributes to OpenTelemetry metrics, events, and spans. Organizations using the gateway may gain another way to analyze spend by period and group, depending on configuration and retained data. Review API access, identity retention settings, and whether the available groupings meet your spend-monitoring needs. Releases anthropics/claude-code: https://github.com/anthropics/claude-code/releases/tag/v2.1.317 https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-google-cloud-developer-plugin-now-available-in-antigravity-marketplace https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-google-cloud-developer-plugin-now-available-in-antigravity-marketplace Mon, 02 Nov 2026 12:00:00 GMT ai The google-cloud-developer plugin is available in the Antigravity Marketplace. Google says it connects agents to current official documentation, provides skills for Google Cloud tasks, and includes checks for gcloud commands. It also applies least-privilege IAM patterns and requests consent before enabling billable APIs or modifying infrastructure. The package includes a pre-authorized Developer Knowledge MCP server in Antigravity and can be installed through the Marketplace interface or the terminal. For teams using coding agents for cloud tasks, current documentation and command checks may help reduce syntax errors or outdated instructions. The described safeguards do not replace permission reviews or validation of proposed actions. Evaluate the plugin in a controlled workflow and review permissions, consent requests, and proposed changes before applying them. Google Cloud: https://cloud.google.com/blog/topics/developers-practitioners/google-cloud-developer-plugin-now-available-in-antigravity-marketplace/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-amazon-rds-now-supports-per-snapshot-billing https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-amazon-rds-now-supports-per-snapshot-billing Mon, 02 Nov 2026 12:00:00 GMT costs AWS announced individual billing for Amazon RDS snapshots. Previously, snapshot charges appeared aggregated by database instance in Cost and Usage reports and Cost Explorer. With the change, cost allocation tags on snapshots can be used to identify the cost of each one and track backup spending. The feature is enabled by default at no additional charge for snapshots across all Amazon RDS engines in AWS commercial Regions and AWS GovCloud (US) Regions. Per-snapshot visibility may make it easier to assign spending to teams, applications, or retention policies, provided tags are applied and maintained consistently. Review snapshot tags and check whether cost reports provide the level of detail needed for internal management. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/11/amazon-rds-per-snapshot-billing/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-instrumentation-hub-in-grafana-cloud-start-easier-stay-in-control https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-instrumentation-hub-in-grafana-cloud-start-easier-stay-in-control Mon, 02 Nov 2026 12:00:00 GMT cloud Grafana announced general availability of Instrumentation Hub in Grafana Cloud. The tool can discover resources in Kubernetes clusters and configure telemetry collection through the UI, an API, or AI agents. The new iteration adds selective OpenTelemetry SDK injection to complement eBPF instrumentation. The described installation uses a Helm command to deploy Alloy to the cluster. Grafana says collection can be adjusted by namespace and specific signals can be enabled or disabled. The feature is available to Grafana Cloud stacks with Kubernetes clusters running Linux. Selective instrumentation and signal collection may help teams expand visibility or control collection volume according to their environment’s needs and costs. Assess compatibility and operational effects before changing collection in production. Check the current Kubernetes Monitoring setup and test discovery and selective instrumentation in a controlled environment. Grafana: https://grafana.com/blog/instrumentation-hub-start-your-observability-journey-easier-and-still-stay-in-control/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-v3-5-7 https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-v3-5-7 Mon, 02 Nov 2026 12:00:00 GMT kubernetes Argo CD version 3.5.7 includes fixes across several components. Among them, the CLI now honors HTTP_PROXY, HTTPS_PROXY, and NO_PROXY for gRPC-web connections, and the controller can terminate an operation blocked by a sync window. The release also adjusts health checks for Crossplane resources and CRDs that are not yet established, and fixes handling of write credentials in repository settings. Container images are signed with cosign; the release says provenance is generated for images and CLI binaries that meet SLSA Level 3 specifications. The fixes may matter to installations using a proxy with the CLI or relying on the listed sync and health-evaluation behaviors. The release itself does not indicate urgency or a security fix. Compare the changelog items with your local configuration and follow the upgrade documentation before planning adoption. Releases argoproj/argo-cd: https://github.com/argoproj/argo-cd/releases/tag/v3.5.7 https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-the-rise-of-llmjacking-how-threat-actors-monetize-compromised-cloud-and-model-resources https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-the-rise-of-llmjacking-how-threat-actors-monetize-compromised-cloud-and-model-resources Mon, 02 Nov 2026 12:00:00 GMT security Google reports incidents investigated in 2026 in which attackers hijacked enterprise access to large language models. Observed entry paths included exposed LLM endpoints, stolen API keys, and compromised cloud identity credentials. After gaining access, attackers may create keys, enable model services, and use compute resources. The company also describes intermediaries that resell unauthorized access to models. In individual incidents, fraudulent charges exceeding $100,000 in a day were observed; some organizations accumulated up to $1 million before access was revoked. Organizations with exposed endpoints or broad credentials could face unauthorized use, unexpected costs, and compromise of other cloud resources. If your organization uses model APIs, review endpoint exposure, credential scope, and access controls, and monitor usage and charges. Google Cloud: https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/ https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-how-we-halved-dns-build-delay-and-cut-memory-use-by-85 https://www.robertasoliman.com/en/tech-radar#radar-2026-11-02-how-we-halved-dns-build-delay-and-cut-memory-use-by-85 Mon, 02 Nov 2026 12:00:00 GMT cloud Cloudflare describes changes to the pipeline that turns DNS zone updates into data for its authoritative servers. A planner now selects the smallest rebuild the company can prove safe, while a new scheduler combines work for the same zone. According to the post, setting changes no longer rebuild zones with tens of millions of records. Together, the changes reduced peak memory by 85% and allowed Cloudflare to halve the time between a DNS change and its data being written to Quicksilver, the company’s distributed storage system. The case may be relevant to teams processing large volumes of configuration changes: targeted rebuilds can reduce work and resource use, provided data correctness is maintained. If similar pipelines face memory limits or delays, assess whether changes can be identified and rebuilds narrowed while retaining safety checks. Cloudflare: https://blog.cloudflare.com/dns-targeted-zone-builds/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-amazon-bedrock-expands-api-support-and-introduces-cross-region-inferencing-for-openai-models-in-aws https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-amazon-bedrock-expands-api-support-and-introduces-cross-region-inferencing-for-openai-models-in-aws Sun, 01 Nov 2026 12:00:00 GMT ai AWS says the OpenAI GPT-5.6 Terra and Luna models are available on the bedrock-runtime endpoint in AWS GovCloud (US), with support for the Responses, Converse, and Chat Completions APIs. The announcement also adds Cross-Region Inference within the two US GovCloud Regions. According to the source, the feature routes requests across those Regions and is intended to provide higher throughput and redundancy without requiring customers to manage capacity across multiple Regions. AWS says model usage can be monitored through invocation logs and CloudWatch metrics, and appears in Cost Explorer and the CUR. For eligible workloads, the combination may simplify API access and cross-Region capacity management while keeping routing within US GovCloud, as described by AWS. Check model cards and requirements, and assess whether cross-Region inference meets your data, observability, and governance needs. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/bedrock-openai-runtime-govcloud/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-managing-amazon-bedrock-costs-end-to-end-a-playbook-for-finops-and-platform-teams https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-managing-amazon-bedrock-costs-end-to-end-a-playbook-for-finops-and-platform-teams Sat, 31 Oct 2026 12:00:00 GMT costs AWS describes a five-stage process for managing Amazon Bedrock spend: attribute costs, observe requests, enforce controls, optimize settings, and review results. The post notes that CUR 2.0 can record the IAM principal associated with inference calls, and that activated cost-allocation tags can appear in Cost Explorer. For workloads using a shared gateway, AWS recommends assigning sessions per user to restore individual visibility. The article also suggests logging requests to CloudWatch Logs or S3 and adding standardized metadata to identify an application, workflow, or tenant. Budgets, alerts, and hard blocks are presented as spending-control options. This model could help teams locate costs by identity and workload before optimizing models or prompts. Its usefulness depends on configuring attribution, logging, and metadata in the environment. If cost attribution is limited, consider starting with identity tags and consistent metadata; also validate logging, retention, and budget controls against internal policies. AWS Machine Learning: https://aws.amazon.com/blogs/machine-learning/managing-amazon-bedrock-costs-end-to-end-a-playbook-for-finops-and-platform-teams/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-preview-web-apps-live-as-your-coding-agent-builds-them-with-amazon-bedrock-agentcore-runtime https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-preview-web-apps-live-as-your-coding-agent-builds-them-with-amazon-bedrock-agentcore-runtime Sat, 31 Oct 2026 12:00:00 GMT ai AWS presents a workflow for viewing, in a browser, a web application modified by a coding agent inside an Amazon Bedrock AgentCore Runtime session. Each session receives an authenticated Session endpoint that forwards HTTP requests and WebSocket connections to permitted ports. The example keeps a Vite server running in the session, so saved changes appear in the browser without a manual refresh. Access requires authentication on each request and lasts only while the session exists. Configuring ports does not start servers, and the application must listen on 0.0.0.0. The post distinguishes this feature from a runtime endpoint and advises deploying applications intended for users to a hosting service rather than using a session preview. This workflow could shorten review cycles for agent-generated prototypes if a team already uses AgentCore and can meet the authentication and connectivity requirements. If testing the feature, limit exposed ports, verify IAM permissions or the JWT authorizer, and do not treat the temporary URL as production hosting. AWS Machine Learning: https://aws.amazon.com/blogs/machine-learning/preview-web-apps-live-as-your-coding-agent-builds-them-with-amazon-bedrock-agentcore-runtime/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-4-real-tracking-exploitation-and-patching-of-emudhra-s-weak-keys https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-4-real-tracking-exploitation-and-patching-of-emudhra-s-weak-keys Sat, 31 Oct 2026 12:00:00 GMT security Cloudflare published a follow-up about weak keys belonging to an eMudhra certificate authority. The company says it patched all its high-priority systems to reject the vulnerable keys and added logging to identify connection attempts involving associated certificates. Over about a week of monitoring, it reported approximately 22,000 handshake attempts with those keys. Cloudflare says it has not found evidence that the keys were used to intercept its connections so far, but it observed forged certificates created after the weakness was disclosed. The post also warns that some embedded browsers and traffic with bot signals still accepted the compromised chain; it cautions that the sample is skewed and not conclusive. The company recommends applying updates. The report underscores that outdated certificates and trust stores can leave clients exposed, but Cloudflare’s data does not establish the state of the wider internet. If your organization relies on embedded clients or browsers, check for available updates and follow vendor guidance to review trust in the affected chain. Cloudflare: https://blog.cloudflare.com/emudhra-patching/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-v2-1-314 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-30-v2-1-314 Fri, 30 Oct 2026 12:00:00 GMT security Claude Code version 2.1.314 includes a permission that makes Write, Edit, and NotebookEdit refuse paths outside working directories in every permission mode. The update also fixes the application of administrator-managed TLS trust settings in Claude Desktop and sandbox protections in resumed worktrees. Among other changes, Amazon Bedrock sessions can remove older images to compact long conversations, and Claude Code now lowers a model’s effort level when an administrator sets a limit. The release notes also list fixes involving sessions, authentication, MCP integration, and command execution. Write blocking could reduce accidental changes outside the authorized scope; protection depends on how working directories are defined. Assess the update and test permissions, sandboxing, and workflows in a representative environment before broad adoption. Releases anthropics/claude-code: https://github.com/anthropics/claude-code/releases/tag/v2.1.314 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-amazon-rds-for-oracle-and-sql-server-now-support-storage-autoscaling-on-additional-storage-volumes https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-amazon-rds-for-oracle-and-sql-server-now-support-storage-autoscaling-on-additional-storage-volumes Fri, 30 Oct 2026 12:00:00 GMT cloud Amazon RDS for SQL Server and Oracle now supports storage autoscaling on additional volumes. The feature monitors consumption and increases capacity when utilization approaches provisioned storage. Customers set a desired maximum limit for each additional volume; the capability supports both new and existing instances. The announcement states support for up to three additional volumes, with total storage capacity of up to 256 TiB, and availability in AWS commercial Regions and AWS GovCloud (US) Regions. According to AWS, autoscaling has no additional charge: customers pay for provisioned storage. It can be enabled through the AWS Management Console, AWS CLI, or Amazon RDS API. Automatic expansion could reduce the risk of running out of space and of overprovisioning, but the configured limit remains important for controlling capacity. Review volume settings and set maximum limits that fit expected growth and internal policies. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/amazon-rds-oracle-sqlserver-autoscaling-additional-storage-volumes https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-azure-cloud-hsm-hardware-audit-logging-verifiable-audit-trails-for-security-and-compliance https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-azure-cloud-hsm-hardware-audit-logging-verifiable-audit-trails-for-security-and-compliance Fri, 30 Oct 2026 12:00:00 GMT security Microsoft announced Hardware Audit Logging for Azure Cloud HSM. The feature collects records generated by the HSM itself for supported management operations and delivers events to Azure Monitor Log Analytics, allowing them to be incorporated into monitoring and security workflows, including Microsoft Sentinel. Records cover activities such as authentication, user and administrator management, policy changes, key lifecycle operations, and backup and restore. Customers can also access HSM-signed binary data, signatures, and certificates to verify the authenticity and integrity of audit batches. The HSM partition policy makes logging immutable. Availability is rolling out across Azure Cloud HSM public regions; the feature is automatically enabled for newly provisioned resources in regions where it is available. Hardware-originated evidence could strengthen investigations and audits, provided teams also configure retention, access, alerts, and log review. Confirm regional availability and plan integration, retention, and evidence validation within your control process. Azure: https://azure.microsoft.com/en-us/blog/azure-cloud-hsm-hardware-audit-logging-verifiable-audit-trails-for-security-and-compliance/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-building-intent-driven-ui-testing-with-amazon-nova-act https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-building-intent-driven-ui-testing-with-amazon-nova-act Thu, 29 Oct 2026 12:00:00 GMT ai Epsilon describes an internal platform that provides UI testing as a service to product teams. The solution combines natural-language instructions executed by Amazon Nova Act with managed browser sessions from Amazon Bedrock AgentCore Browser. It complements the company’s Playwright-based regression suite, which remains in use. The platform also records per-step results, screenshots, and reports, and lets teams consume the capability through a shared API. For organizations with multiple teams and applications, this model could reduce duplicated work maintaining browser infrastructure and integrations. It does not remove the need for deterministic tests or guarantee that natural-language instructions cover every case. If this matches your environment, assess a pilot alongside the existing suite, with human review of results and clearly scoped permissions. AWS Machine Learning: https://aws.amazon.com/blogs/machine-learning/building-intent-driven-ui-testing-with-amazon-nova-act/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-the-boundary-problem-in-agentic-ai-is-a-platform-problem https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-the-boundary-problem-in-agentic-ai-is-a-platform-problem Thu, 29 Oct 2026 12:00:00 GMT security CNCF argues that instructions given to an agent are not a sufficient boundary when its tools and credentials allow broader actions. The post proposes enforcing limits in infrastructure: verifiable identity, connection controls, declarative approval of tools, and authorization for each call. It also recommends preventing an agent’s own identity from changing the configurations that define its authority. For data, the post places enforcement in the system that stores it, using verified identity to authorize access. If agents can access sensitive systems or data, infrastructure controls could reduce reliance on probabilistic instruction-following. Implementation requires mapping existing identities, connections, tools, and permissions. Consider inventorying the capabilities granted to agents and checking whether authority changes require review outside the agent itself. CNCF: https://www.cncf.io/blog/2026/10/29/the-boundary-problem-in-agentic-ai-is-a-platform-problem/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-acm-now-supports-acme-for-public-certificates-in-aws-govcloud-us https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-acm-now-supports-acme-for-public-certificates-in-aws-govcloud-us Thu, 29 Oct 2026 12:00:00 GMT ai AWS says support for the ACME protocol in AWS Certificate Manager is available in the AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. The service provides a managed ACME endpoint that issues public TLS certificates from Amazon Trust Services. Compatible clients named include Certbot, cert-manager for Kubernetes, and acme.sh. AWS presents the integration as a standards-based way to automate public certificate issuance and renewal. The post connects the initiative to the expected 47-day certificate lifetimes by 2029. For GovCloud environments using compatible ACME clients, automation could reduce manual certificate issuance and renewal tasks. Adoption depends on certificate requirements, client configuration, and fit with the existing architecture. Check client compatibility and test automated issuance and renewal in a controlled environment before changing production processes. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/acm-acme-support-govcloud-us/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-accelerate-agentic-ai-with-nvidia-nemotron-models-on-amazon-eks-and-sagemaker-hyperpod-eks https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-accelerate-agentic-ai-with-nvidia-nemotron-models-on-amazon-eks-and-sagemaker-hyperpod-eks Thu, 29 Oct 2026 12:00:00 GMT ai AWS describes how to deploy the NVIDIA Nemotron 3.5 Super VL multimodal model on Amazon EKS, EKS Auto Mode, and SageMaker HyperPod EKS. The model has 120 billion parameters, with 12 billion activated per token, and accepts text, images, documents, and video as input, producing text. The post also details an architecture using vLLM and NVIDIA Dynamo and recommends measuring time to first token, inter-token latency, and throughput at different concurrency levels to plan capacity. The article reports validation on instances with B200 and H200 GPUs. For teams serving multimodal models, the pattern can inform inference testing on Kubernetes. GPU configuration and topology still need evaluation for each workload. Before adopting it, compare latency and throughput against the real workload and estimate required capacity. Also account for memory to hold the model’s full weights. AWS Machine Learning: https://aws.amazon.com/blogs/machine-learning/accelerate-agentic-ai-with-nvidia-nemotron-models-on-amazon-eks-and-sagemaker-hyperpod-eks/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-querying-databricks-apache-iceberg-tables-with-the-borderless-lakehouse https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-querying-databricks-apache-iceberg-tables-with-the-borderless-lakehouse Thu, 29 Oct 2026 12:00:00 GMT cloud Google Cloud describes an integration that lets BigQuery query Databricks-managed Apache Iceberg tables without copying the data. BigQuery reads files where they are stored, including Google Cloud Storage and, through federation, Amazon S3 and Azure Blob Storage. Changes become available after Lakehouse’s next scheduled metadata refresh, which can occur as often as every five minutes. The post also details BigQuery access controls, including row- and column-level security and dynamic data masking. Queries against storage in another cloud may incur data egress charges. The approach may reduce duplicate storage and copy pipelines, but it does not eliminate cross-cloud egress costs or the need for table maintenance. Assess refresh latency, federated permissions, and egress costs. Also plan for file compaction and removal of unreferenced data. Google Cloud: https://cloud.google.com/blog/products/data-analytics/querying-databricks-iceberg-tables-with-google-clouds-lakehouse/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-only-include-resource-detectors-you-need-by-building-your-own-collector https://www.robertasoliman.com/en/tech-radar#radar-2026-10-29-only-include-resource-detectors-you-need-by-building-your-own-collector Thu, 29 Oct 2026 12:00:00 GMT cloud The OpenTelemetry project describes how to assemble a custom Collector distribution with the OpenTelemetry Collector Builder (ocb). A YAML manifest selects the components to include in the binary, and the tool compiles the resulting distribution. The post notes that general-purpose distributions include components beyond those used by any one deployment, and that a custom distribution can also include custom components. It highlights a smaller binary and fewer dependencies as reasons to take this approach. For environments using only some available components, a smaller distribution may simplify delivery and dependency tracking. It also means taking responsibility for selecting, building, and updating the binary. Inventory the components actually in use and establish a process to review the manifest and update dependencies when needed. OpenTelemetry: https://opentelemetry.io/blog/2026/collector-with-less-dependencies/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-28-volcano-v1-16-released-namespacequeue-fairshare-and-a-broader-hypernode-ecosystem https://www.robertasoliman.com/en/tech-radar#radar-2026-10-28-volcano-v1-16-released-namespacequeue-fairshare-and-a-broader-hypernode-ecosystem Thu, 29 Oct 2026 12:00:00 GMT kubernetes Version 1.16.0 of the Volcano scheduler adds NamespaceQueue, the fairshare plugin, and a cache for unschedulable Jobs. NamespaceQueue lets teams organize queue hierarchies and quotas within authorized namespaces. Fairshare considers historical resource consumption among namespaces sharing a queue. The cache records why a Job could not be scheduled and can avoid repeated checks until a relevant condition changes. The release also expands support for the HyperNode ecosystem and supports Kubernetes 1.36. The post states that the cache and NamespaceQueue are disabled by default. These features may help multi-tenant clusters with pending queues or fairer sharing needs, but they change scheduling behavior and require operational validation. Test the new features with representative quotas and workloads; check compatibility and configuration before enabling them in production. CNCF: https://www.cncf.io/blog/2026/10/28/volcano-v1-16-released-namespacequeue-fairshare-and-a-broader-hypernode-ecosystem/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-28-evaluate-ai-models-for-observability-o11y-bench-joins-fireworks-specialized-intelligence-index-and-r https://www.robertasoliman.com/en/tech-radar#radar-2026-10-28-evaluate-ai-models-for-observability-o11y-bench-joins-fireworks-specialized-intelligence-index-and-r Wed, 28 Oct 2026 12:00:00 GMT cloud Grafana Labs’ open benchmark for observability and SRE tasks has joined Fireworks’ Specialized Intelligence Index and reached version 1.1. It covers 64 tasks across six areas, including queries for metrics, logs and traces, incident investigations, and dashboard editing. Version 1.1 checks outcomes and changes in the environment, and runs each task three times to measure consistency. Grafana also added Fireworks as an inference provider. Results from version 1.1 are not directly comparable with those from version 1.0. Teams comparing models for observability workflows can use the benchmark as an additional reference; benchmark results alone do not guarantee equivalent performance in a team’s environment. Compare the results with internal tasks and criteria, and note that version 1.1 establishes a new baseline. Grafana: https://grafana.com/blog/evaluate-ai-models-for-observability-o11y-bench-joins-fireworks-specialized-intelligence-index-and-reaches-v1-1/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-28-how-to-troubleshoot-gke-workloads-faster-with-vpc-flow-logs https://www.robertasoliman.com/en/tech-radar#radar-2026-10-28-how-to-troubleshoot-gke-workloads-faster-with-vpc-flow-logs Wed, 28 Oct 2026 12:00:00 GMT kubernetes In Google Cloud, VPC Flow Logs can record pod traffic flows with GKE metadata such as cluster, workload, namespace, service, node, and zone. This makes it possible to analyze communications by workload names instead of relying only on temporary IP addresses. Flow Analyzer can group and filter records by cluster, namespace, workload, pod, or service. Logs are sampled and cover traffic that passes through the VPC network; traffic blocked by a network policy does not reach this layer. To enable intranode traffic visibility on Standard clusters, operators must turn on the feature, which restarts control plane and node components and adds per-node overhead. Workload attribution may help investigate connectivity, service dependencies, and cross-zone traffic. Sampling limits the use of these records for precise per-connection accounting. Before enabling features in production, assess sampling and logging costs; test intranode visibility on a non-production cluster. Google Cloud: https://cloud.google.com/blog/products/containers-kubernetes/using-vpc-flow-logs-to-troubleshoot-gke-workloads/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-amazon-ecs-now-supports-gpu-sharing-with-nvidia-multi-process-service-mps https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-amazon-ecs-now-supports-gpu-sharing-with-nvidia-multi-process-service-mps Wed, 28 Oct 2026 12:00:00 GMT cloud Amazon ECS now supports running multiple tasks concurrently on one NVIDIA GPU using Multi-Process Service (MPS). You can define GPU memory per container and, optionally, a maximum share of GPU compute. The capability is available on ECS Managed Instances and ECS on Amazon EC2, in all AWS commercial and AWS GovCloud (US) Regions. For workloads that use only part of a GPU’s capacity, such as small-model inference and embedding generation, sharing may improve utilization and reduce infrastructure costs, according to AWS. Assess each workload’s memory and compute requirements before configuring sharing; test allocation and behavior with representative tasks. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/amazon-ecs-gpu-sharing-nvidia-mps/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-announcing-soci-indexed-images-for-faster-sagemaker-ai-jobs https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-announcing-soci-indexed-images-for-faster-sagemaker-ai-jobs Wed, 28 Oct 2026 12:00:00 GMT ai Amazon SageMaker AI Training and processing jobs now support Seekable OCI (SOCI)-indexed images. The service loads the files needed to start the container first, then fetches the rest in the background as the job runs. AWS says teams can use pre-indexed AWS Deep Learning Containers or add an index to their own image. If an image has no index, or lazy loading fails, the job uses the standard download. The job definition does not need to change to use an indexed image. The feature may reduce startup time and billable time spent without model progress, particularly when execution does not need the full image at startup. Results depend on how the application accesses image files. Measure the effect on your own jobs, including file-access overhead during the first epoch, before broader adoption. AWS Machine Learning: https://aws.amazon.com/blogs/machine-learning/announcing-soci-indexed-images-for-faster-sagemaker-ai-jobs/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-sagemaker-mlflow-apps-now-support-mlflow-3-16 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-sagemaker-mlflow-apps-now-support-mlflow-3-16 Wed, 28 Oct 2026 12:00:00 GMT cloud Amazon SageMaker AI MLflow Apps now support MLflow 3.16. The release brings a redesigned tracing experience, with adjustable row height, reorderable columns, and custom columns using trace tags or metadata. It also speeds up metric charts for experiments with large histories. New MLflow Apps use version 3.16 by default. Existing apps will be upgraded during an upcoming maintenance window, with no action required from users. The release is available in AWS Regions where MLflow Apps are offered. These features may make it easier to analyze and debug generative AI applications and agents, and to explore experiments with extensive data more quickly. Assess how the updated views fit current analysis workflows and monitor the maintenance window for existing apps. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/mflow-version-3-16/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-opentelemetry-transformation-language-reaches-v1 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-opentelemetry-transformation-language-reaches-v1 Wed, 28 Oct 2026 12:00:00 GMT cloud The OpenTelemetry Transformation Language (OTTL) has reached version 1. Starting with opentelemetry-collector-contrib v0.164.0, the language is stable for traces, metrics, and logs. According to the project, it meets the Collector’s stability criteria for testing, benchmarking, documentation, and telemetry. The milestone also includes a compatibility promise for the entire 1.x series: syntax and standard functions remain compatible for people writing OTTL statements, and the Go API remains compatible for those building components on the language. Stability may reduce uncertainty for teams maintaining telemetry transformations or custom components, but it does not mean an immediate Collector upgrade is necessary. Review dependencies and validate transformations and components in a test environment before adopting a Collector update. OpenTelemetry: https://opentelemetry.io/blog/2026/ottl-v1/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-agent-observability-faq-understand-the-value-of-monitoring-evaluating-and-improving-your-ai-agents https://www.robertasoliman.com/en/tech-radar#radar-2026-10-27-agent-observability-faq-understand-the-value-of-monitoring-evaluating-and-improving-your-ai-agents Wed, 28 Oct 2026 12:00:00 GMT cloud Agent Observability is available in Grafana Cloud. The feature brings together monitoring, evaluations, guards, and experiments for AI agents. Teams can track latency, errors, token usage, and costs, inspect conversations, and compare models and prompts. Experiments can also be used as CI/CD checks. The tool accepts spans that follow OpenTelemetry’s generative AI semantic conventions, without requiring the Agent Observability SDK. For coding agents, Grafana also offers an open-source local app that keeps sessions on the machine. Observability may help teams investigate failures, monitor costs, and assess agent changes before release. Capturing prompts, responses, and tool calls calls for careful privacy and access controls. Set data-handling and access policies, then assess which metrics, evaluations, and spans are needed for each use case. Grafana: https://grafana.com/blog/agent-observability-faq-understand-the-value-of-monitoring-evaluating-and-improving-your-ai-agents/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-23-v1-19-2 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-23-v1-19-2 Fri, 23 Oct 2026 12:00:00 GMT security Kyverno version 1.19.2 addresses 24 advisories published on GitHub: 9 Critical, 14 High, and 1 Moderate. Listed fixes include API path validation and namespace confinement, hardened image verification and attestations, cost limits for CEL expressions, and protection against script injection in workflows. The release recommends upgrading to v1.19.2 to receive the fixes. Details about affected versions are in the linked advisories; the feed does not specify them. For environments using Kyverno, the advisories make it relevant to review policies, configuration, and exposure to each issue before setting priorities. The release alone does not state which installations are affected. Check the linked advisories and compare affected versions with your installation. Plan an upgrade to v1.19.2 according to your environment’s testing and change processes. Releases kyverno/kyverno: https://github.com/kyverno/kyverno/releases/tag/v1.19.2 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-22-introducing-agent-compute-engine-and-expanded-agent-governance https://www.robertasoliman.com/en/tech-radar#radar-2026-10-22-introducing-agent-compute-engine-and-expanded-agent-governance Thu, 22 Oct 2026 12:00:00 GMT ai Google Cloud announced Agent Compute Engine, a hardware-isolated microVM execution service for agents that already powers Gemini and is expected to enter preview in the coming months. The company also introduced Agent Substrate, an open-source runtime for GKE, and expanded agent governance with capabilities such as identity, observability, and access policies across environments. For teams running agents, persistent microVMs and centralized controls could help structure isolation, auditing, and resource use. The managed service’s availability and suitability will depend on the preview. Map requirements for isolation, persistence, identity, and auditing. For Kubernetes environments, assess Agent Substrate alongside your control and portability needs; follow the preview before planning adoption of the managed service. Google Cloud: https://cloud.google.com/blog/topics/ai-infrastructure/introducing-agent-compute-engine-and-expanded-agent-governance/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-introducing-full-transaction-detection-for-cloudflare-waf https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-introducing-full-transaction-detection-for-cloudflare-waf Thu, 22 Oct 2026 12:00:00 GMT security Cloudflare WAF can now analyze an HTTP request alongside its corresponding response to identify signs of exploitation. Response rules can block origin content before it reaches the requester. Detection and rules are available on all plans, including Free; customers can create up to three custom response rules with log or block actions. Response-body inspection is not yet available. Correlating requests and responses could help distinguish suspicious attempts from evidence of successful exploitation. Blocking a response does not undo actions that have already occurred at the origin. Review detections and response rules in Security Events, and test policies in a controlled scope before blocking traffic. Keep in mind that the feature does not inspect response bodies. Cloudflare: https://blog.cloudflare.com/full-transaction-waf/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-22-filtering-and-reducing-ai-agent-telemetry-with-the-opentelemetry-collector https://www.robertasoliman.com/en/tech-radar#radar-2026-10-22-filtering-and-reducing-ai-agent-telemetry-with-the-opentelemetry-collector Thu, 22 Oct 2026 12:00:00 GMT cloud A CNCF article describes using the OpenTelemetry Collector to filter and transform Claude Code telemetry before sending it to a backend. Measures include removing tool content and redundant attributes, limiting error fields, and reducing metric dimensions. In the reported experiment, log bytes were roughly cut in half; the post also compares raw and optimized pipelines for logs, metrics, and traces. The approach could reduce stored volume and cardinality, but removing attributes may limit investigations. The reported results come from the tested setup and do not guarantee the same effect for other workloads. Identify which fields feed dashboards, alerts, and queries before filtering them. Test parallel pipelines and validate both the reduction and the retention of information needed for diagnosis. CNCF: https://www.cncf.io/blog/2026/10/22/filtering-and-reducing-ai-agent-telemetry-with-the-opentelemetry-collector/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-aws-transform-adds-storage-migration-assessments-for-amazon-s3-ebs-efs-and-fsx https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-aws-transform-adds-storage-migration-assessments-for-amazon-s3-ebs-efs-and-fsx Thu, 22 Oct 2026 12:00:00 GMT cloud AWS Transform can now assess on-premises storage inventories and recommend suitable AWS services across S3, EBS, EFS, and FSx. The tool sizes recommendations and projects costs for a total-cost-of-ownership business case. Supported inventory inputs include NetApp Digital Advisor exports and RVTools files, and teams can compare scenarios such as Single-AZ and Multi-AZ. The assessment may reduce manual inventory analysis and comparison work in migration projects. Its estimates depend on the supplied data and should be validated before architecture or budget decisions. Check inventory quality and coverage before using recommendations as the basis for sizing or cost estimates. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/transform-assess-s3-ebs-efs-fsx/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-v1-17-0 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-v1-17-0 Thu, 22 Oct 2026 12:00:00 GMT ai Terraform 1.17.0 adds the -minimal-refresh planning option, which refreshes only resources with proposed changes. The release also marks Terraform Policy as generally available: the -policies flags for plan, apply, and query no longer require an experimental build. Other changes include variables and locals in provider requirements and enhancements to query policies. Selective refresh may be useful in plans where only some resources have proposed changes. General availability lets teams evaluate policies without an experimental build; benefits depend on their workflows and policy practices. Test the new options in a controlled workflow and check that tools consuming JSON handle the new format_version field. Releases hashicorp/terraform: https://github.com/hashicorp/terraform/releases/tag/v1.17.0 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-bigquery-objectref-now-ga-build-multimodal-data-platforms-for-conversational-analytics-entirely-in-s https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-bigquery-objectref-now-ga-build-multimodal-data-platforms-for-conversational-analytics-entirely-in-s Thu, 22 Oct 2026 12:00:00 GMT ai Google Cloud announces general availability of ObjectRef and multimodal analytics in BigQuery. ObjectRef represents unstructured Cloud Storage files in BigQuery table columns alongside relational data. According to the post, teams can use SQL to combine these objects and structured context in queries with Gemini models. The GA release also includes end-user credential support, additional Cloud Storage metadata sources, and arrays of ObjectRefs. The approach may simplify pipelines that analyze images, audio, video, and documents without duplicating files in BigQuery. Its suitability depends on workload processing, authentication, and governance requirements. Validate permissions, metadata, and production requirements; the post recommends explicit connections for robust service-account-driven pipelines. Google Cloud: https://cloud.google.com/blog/products/data-analytics/analyze-unstructured-data-in-bigquery-with-objectref/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-zenteiq-scales-batch-inference-4x-with-gke-inference-gateway-powered-by-llm-d https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-zenteiq-scales-batch-inference-4x-with-gke-inference-gateway-powered-by-llm-d Thu, 22 Oct 2026 12:00:00 GMT kubernetes Startup ZenteiQ says it adopted GKE Inference Gateway, powered by the llm-d distributed inference framework, to address inference-routing bottlenecks in GKE clusters running vLLM. The company says the gateway uses queue and KV-cache signals to route requests. In its account, aggregate throughput rose from 16,964 to 69,114 tokens per second per 1,000 accelerators, while reported daily output grew from 1.47 billion to nearly 6 billion tokens. Queue- and prefix-aware routing may help batch inference workloads with shared requests and context. These results come from one specific deployment and do not guarantee similar performance elsewhere. Before adopting it, compare the current routing setup and test the solution against your environment’s traffic patterns, models, and metrics. Google Cloud: https://cloud.google.com/blog/products/containers-kubernetes/zenteiq-scales-physical-ai-inference-4x-with-gke-and-llm-d/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-cloudflare-deploys-protections-against-php2shell-vulnerability https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-cloudflare-deploys-protections-against-php2shell-vulnerability Thu, 22 Oct 2026 12:00:00 GMT security Cloudflare says it deployed WAF protections for the php2shell vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. The post says the flaws affect web servers running PHP 5.4 or later and may allow denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic. According to the company, protection is enabled by default for customers with WAF deployed, including Free plans. The WAF layer may reduce exposure to exploit traffic, but it does not fix a vulnerable PHP runtime. Cloudflare also recommends applying the PHP update and keeping the protection as an additional defense. Check the official PHP advisory to identify the applicable update for your environment; do not treat WAF protection as a replacement for updating the runtime. Cloudflare: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-before-you-evaluate-an-ai-sre-give-your-existing-agent-context https://www.robertasoliman.com/en/tech-radar#radar-2026-10-21-before-you-evaluate-an-ai-sre-give-your-existing-agent-context Wed, 21 Oct 2026 12:00:00 GMT ai A CNCF account describes a test comparing the same agent and model across 50 Kubernetes faults: one run used a shell and kubectl; the other used read-only MCP tools with information about current failures and recent changes. The agent produced 45 correct diagnoses with the shell and 46 with context. Correct diagnoses within two minutes were reported for 60% and 86% of faults, respectively. The test ran on a three-node Amazon EKS cluster and did not isolate which part of the context caused the difference. The results suggest that providing recent history and prioritized failures may shorten investigations, but they do not establish equivalent performance across other environments or agents. Compare options using the same model and read-only identity. Review permissions, restrict access to Secrets and exec, and log tool calls. CNCF: https://www.cncf.io/blog/2026/10/21/before-you-evaluate-an-ai-sre-give-your-existing-agent-context/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-20-announcing-amazon-ecs-gateway-a-managed-ingress-solution-for-your-ecs-services https://www.robertasoliman.com/en/tech-radar#radar-2026-10-20-announcing-amazon-ecs-gateway-a-managed-ingress-solution-for-your-ecs-services Wed, 21 Oct 2026 12:00:00 GMT cloud Amazon ECS Gateway is a new resource that provisions and manages Application Load Balancers and supporting resources in the customer’s account. Platform teams can define networking standards on a gateway and associate it with clusters; services that opt in inherit those standards. The feature supports host-based routing, assigns each service a unique DNS hostname, and lets up to 25 services share an ALB. ECS manages the lifecycle of the underlying infrastructure. AWS says it is available in commercial AWS Regions at no additional charge for the gateway; provisioned infrastructure is charged as usual. Centralized management may simplify adoption of ingress standards and load-balancer sharing, but the cost effect depends on the provisioned infrastructure and its usage. Check compatibility with existing networking standards and estimate underlying resource costs before moving services. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/announcing-amazon-ecs-gateway/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-20-8-emudhra-certificates-are-compromised-here-s-what-you-need-to-know https://www.robertasoliman.com/en/tech-radar#radar-2026-10-20-8-emudhra-certificates-are-compromised-here-s-what-you-need-to-know Wed, 21 Oct 2026 12:00:00 GMT security Cloudflare said it became aware that private keys associated with eight eMudhra intermediate certificates had been compromised. According to the company, the keys could enable the creation of forged certificates for domains and attempts to impersonate servers. Cloudflare said its review had not identified active exploitation of the issue on its services. It also reported updates to Cloudflare One Client, WARP, and Cloudflare Tunnel, along with mitigations across its CDN, Developer, and Zero Trust products. The company warns that customers may need to update their own dependencies, images, and trust configurations. Organizations relying on certificate validation may need to check each TLS path used by their applications; a browser test alone may not cover background services. Identify affected dependencies, apply relevant updates, and rebuild images where needed. Do not disable certificate verification to work around errors. Cloudflare: https://blog.cloudflare.com/emudhra-certificate-compromise/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-20-managed-rag-search-inside-the-sovereign-perimeter-gemini-on-gdc-enterprise-search https://www.robertasoliman.com/en/tech-radar#radar-2026-10-20-managed-rag-search-inside-the-sovereign-perimeter-gemini-on-gdc-enterprise-search Wed, 21 Oct 2026 12:00:00 GMT ai Google Cloud announced a preview of an enterprise RAG search experience on Google Distributed Cloud air-gapped. The offering is presented for sovereign and regulated organizations and processes prompts, responses, uploaded documents, and embeddings inside the customer’s physical perimeter, without a connection to the public internet or Google Cloud’s global infrastructure. Users can query, summarize, compare, and translate files; answers cite source documents, and conversations persist between sessions. The description lists support for text files, documents, spreadsheets, images, audio, and video, with access tied to identity-provider groups. The offering may suit use cases where data cannot leave an isolated environment, but its preview status calls for validating requirements, integration, and controls before production adoption. Check the preview scope, required file formats, and identity and access mapping; also validate the regulatory requirements that apply to your environment. Google Cloud: https://cloud.google.com/blog/topics/hybrid-cloud/managed-rag-search-inside-the-sovereign-perimeter-gemini-on-gdc-enterprise-search/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-20-amazon-dynamodb-global-tables-now-support-disassociating-replicas https://www.robertasoliman.com/en/tech-radar#radar-2026-10-20-amazon-dynamodb-global-tables-now-support-disassociating-replicas Tue, 20 Oct 2026 12:00:00 GMT cloud Amazon DynamoDB global tables now support disassociating a replica without deleting its table or data. AWS says replication to and from a Region can be stopped while the table continues to be used as a single-Region table. An account can also leave a shared multi-account global table and keep its table independently. The option is available for MREC global tables, which use multi-Region eventual consistency, in all AWS Regions, including cross-account configurations. Disassociation can be initiated through the console, AWS CLI, DynamoDB API, or CloudFormation. The option may make replication topology changes easier and allow local workloads to continue without creating a replacement table or copying data. Application dependencies should be considered before changing replication. Review data flows and regional consumers before disassociating a replica; confirm how the application will operate after replication stops. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/dynamodb-global-tables-disassociate/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-amazon-connect-customer-global-resiliency-now-provides-business-users-visibility-into-resiliency-rea https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-amazon-connect-customer-global-resiliency-now-provides-business-users-visibility-into-resiliency-rea Mon, 19 Oct 2026 12:00:00 GMT cloud Amazon Connect Customer Global Resiliency now offers a Global Resiliency page in the admin website. It brings together the overall readiness status for a Region switch and lists natively replicated resources, showing which are in sync, pending, or need action. The page also lets administrators fix some flagged items, such as associating a phone number or user with a traffic distribution group. The feature is available in AWS Regions where Global Resiliency is supported. A centralized view may make it easier to spot outstanding work before a Region switch. It does not, by itself, guarantee that every application component is ready for recovery. If this feature is part of your continuity strategy, review the page and confirm that listed resources are synchronized and correctly associated. Also validate the application recovery process. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/amazon-connect-global-resiliency-readiness-overview https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-cutting-our-inference-bill-by-68-by-being-obsessive-about-optimization https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-cutting-our-inference-bill-by-68-by-being-obsessive-about-optimization Mon, 19 Oct 2026 12:00:00 GMT costs Cloudflare describes optimizations to the AI code reviewer it uses internally. The company says the average cost per review fell to $0.77, 68% below the $2.43 average recorded during its two most expensive weeks before the changes. Median review time went from 4 minutes 9 seconds to 1 minute 32 seconds. Cloudflare attributes some savings to changes in the reviewer’s code and the rest to experiments with models and effort levels. Measures it reports include reducing unnecessary calls, reusing cached prefixes, and stopping canceled jobs. The case illustrates that inference costs can depend on agent design and context usage as well as model choice. Cloudflare’s results apply to its workload and do not predict equivalent gains elsewhere. If inference spending is rising, assess calls per task, repeated context, caching, and models in controlled tests, checking quality before rolling out changes more broadly. Cloudflare: https://blog.cloudflare.com/obsessive-inference-optimization/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-introducing-clairic-a-new-system-one-class-of-extraction-models https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-introducing-clairic-a-new-system-one-class-of-extraction-models Mon, 19 Oct 2026 12:00:00 GMT ai Cloudflare announced a preview of Clairic, an extraction model hosted on Workers AI as @cf/cloudflare/clairic. The company describes it as a model for extracting, computing, estimating, and forecasting values from unstructured inputs. According to the description, it returns typed data such as text, numbers, dates, durations, and lists, as well as estimates and forecasts with intervals. Answers include confidence indicators; when the model cannot find an answer, it can return null. Cloudflare says the model processes input in a single pass without generating output tokens, and says it intends to release the open weights in the future. The format may be useful in workflows that turn documents or messages into structured fields. Suitability, accuracy, and cost for each use case need to be measured with representative data; the description acknowledges that the model can make mistakes. If evaluating the model, test field types and confidence indicators on real cases, including missing data and ambiguous inputs. Define validation and human review according to risk. Cloudflare: https://blog.cloudflare.com/clairic-extraction-model/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-how-to-use-python-udf-logging-for-pipeline-observability https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-how-to-use-python-udf-logging-for-pipeline-observability Mon, 19 Oct 2026 12:00:00 GMT cloud Google Cloud announced a logging feature for Python user-defined functions (UDFs) in BigQuery. Developers can use Python’s standard logging library to send structured logs to Cloud Logging, without external plugins or custom connectors. The example captures row-level diagnostics during query execution, helping teams identify problematic records and handle validation failures without interrupting the entire workload. The demonstrated workflow combines logs, log-based metrics for alerts, and SQL queries in BigQuery to investigate records and recover them after fixing the source data. The feature may help data teams observe pipeline errors without ending a query because of invalid rows. Log volume and exposure of sensitive data still require attention. If enabling logging, test the behavior in a controlled session, limit logged data, and keep secrets or sensitive information out of logs. Consider sampling for high-volume workloads. Google Cloud: https://cloud.google.com/blog/products/data-analytics/python-udf-logging-for-pipeline-observability-in-bigquery/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-how-ai-workloads-are-reshaping-kubernetes-autoscaling https://www.robertasoliman.com/en/tech-radar#radar-2026-10-19-how-ai-workloads-are-reshaping-kubernetes-autoscaling Mon, 19 Oct 2026 12:00:00 GMT kubernetes A CNCF article examines how AI workloads and accelerators expose disagreements between the Kubernetes scheduler and autoscaler. A pod may remain pending even when capacity is available if the node type the autoscaler plans to add does not match what the scheduler can use. The article describes progress in Dynamic Resource Allocation (DRA), which lets workloads express structured hardware requirements, and mechanisms for requesting capacity for workload groups. It also notes that support varies by implementation. A public proposal in the SIG-Autoscaling community explores APIs to bring provisioning and placement closer together; it is not presented as a universally available feature. In clusters with accelerators, a mismatch between workload requirements and provisioned capacity can leave resources unused. Relevance depends on the autoscaler, provider, and configured Kubernetes features. If accelerator pods remain pending, check hardware requirements, topology, and scheduler-autoscaler compatibility before concluding that regional capacity is exhausted. Confirm which features your implementation supports. CNCF: https://www.cncf.io/blog/2026/10/19/how-ai-workloads-are-reshaping-kubernetes-autoscaling/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-continuous-accountability-for-verified-bots https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-continuous-accountability-for-verified-bots Sun, 18 Oct 2026 12:00:00 GMT security Cloudflare introduced a system to assess whether Verified bots continue to behave in line with website preferences. Initial signals include compliance with published instructions and responses to HTTP 429 replies, which ask clients to reduce their request rate. The company says it considers sustained patterns, rather than isolated incidents, to create an explainable trust band. The system is already used internally to assess Verified bots. Cloudflare says it plans to make it available to customers in the future, allowing them to choose the trust threshold used to decide how this traffic is handled. If made available, the assessment may provide additional context for automated-traffic policies. Verified identity alone does not guarantee that a bot will respect a site’s preferences or limits. Until public assessment is available, maintain your own bot policies and monitor HTTP 429 responses and published robots.txt rules. Treat a future trust band as a supplementary signal, not a replacement for existing controls. Cloudflare: https://blog.cloudflare.com/verified-bots-accountability/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-day-0-support-for-reflection-s-beam-on-google-cloud-5x-faster-perf-with-llm-d-and-nvidia-dynamo https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-day-0-support-for-reflection-s-beam-on-google-cloud-5x-faster-perf-with-llm-d-and-nvidia-dynamo Sun, 18 Oct 2026 12:00:00 GMT ai Google Cloud announced launch-day support and deployment recipes for Beam, Reflection’s open-weight model aimed at software engineering and long-running agent tasks. The company says the recipes use llm-d with vLLM or NVIDIA Dynamo with SGLang on AI Hypercomputer and NVIDIA AI infrastructure. The material describes KV-cache-aware routing, prefill and decode separation, and cache offloading to DRAM and local SSD. Reflection attributes up to five times higher performance and eight times lower latency to its Google Cloud deployment; the post notes that the compared configurations use different hardware and that each chart measures gains against a baseline on the same hardware. The recipes may provide a starting point for teams serving coding agents with long contexts. The reported results are benchmarks attributed to Reflection and should not be treated as guarantees for other workloads or configurations. Compare the recipes against your own baseline while controlling for hardware, workload, concurrency, and latency. Check deployment requirements and the published weights before estimating capacity or cost. Google Cloud: https://cloud.google.com/blog/topics/ai-infrastructure/day-0-support-with-5x-perf-for-reflection-beam-on-google-cloud/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-amazon-cloudwatch-log-centralization-now-available-in-aws-govcloud-and-additional-commercial-regions https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-amazon-cloudwatch-log-centralization-now-available-in-aws-govcloud-and-additional-commercial-regions Sun, 18 Oct 2026 12:00:00 GMT cloud Amazon CloudWatch log centralization is available in AWS GovCloud (US) and 13 additional commercial Regions. The feature copies logs from multiple AWS accounts and Regions to a destination account and integrates with AWS Organizations. Rules can cover an entire organization, specific organizational units, or selected accounts. Enriched system fields preserve source context. AWS says one centralized copy can be made at no charge; additional copies cost $0.05 per GB. For organizations with accounts distributed across these Regions, centralization may simplify monitoring consolidation. The cost of additional copies should be considered based on volume and configuration. Confirm availability in the required Region, define the rules’ scope, and estimate copy volume before enabling the feature. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/amazon-cloudwatch-centralization-region-expansion https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-aws-lambda-durable-functions-are-now-available-in-aws-govcloud-us-regions https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-aws-lambda-durable-functions-are-now-available-in-aws-govcloud-us-regions Sun, 18 Oct 2026 12:00:00 GMT ai AWS Lambda durable functions are available in the AWS GovCloud (US-West) and AWS GovCloud (US-East) Regions. The feature adds primitives such as step and wait to handlers, allowing them to checkpoint progress, recover executions after failures, and pause them without compute charges for on-demand functions. AWS describes their use in multi-step applications and AI workflows. They can be activated through the API, console, or SDK, and through infrastructure-as-code tools including CloudFormation, AWS SAM, and AWS CDK. Availability may allow regulated teams to consider this model for orchestrations in GovCloud. Suitability depends on compliance requirements, runtime, and review of the service’s pricing. Check regional availability, supported runtimes, and pricing details; then test checkpointing and recovery in a representative workflow. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/durablefunctions-govcloud/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-langgraph-1-2-16 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-16-langgraph-1-2-16 Sat, 17 Oct 2026 12:00:00 GMT ai Release 1.2.16 lists fixes to resumption behavior: it lets other tasks finish when a resume value is invalid, applies a resumed command’s update only once, and prevents a subgraph from rerunning tasks that have already finished. It also includes a change to save pending writes from a resumed exit run only once. The checkpoint-postgres package release 3.2.0 adds the prune function to PostgresSaver and AsyncPostgresSaver. The description does not mention security changes or identify versions affected by earlier issues. For teams using execution resumption or PostgreSQL checkpoints, these changes may reduce unexpected behavior in interrupted and resumed workflows. The benefit depends on whether these scenarios occur in the application. Review the changes and test resumption and persistence workflows in a non-production environment before updating dependencies. Releases langchain-ai/langgraph: https://github.com/langchain-ai/langgraph/releases/tag/1.2.16 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-15-amazon-dynamodb-streams-now-supports-timestamp-based-stream-processing https://www.robertasoliman.com/en/tech-radar#radar-2026-10-15-amazon-dynamodb-streams-now-supports-timestamp-based-stream-processing Thu, 15 Oct 2026 12:00:00 GMT cloud DynamoDB Streams now accepts a timestamp to start reading at the first record written at or after that time, using the AT_TIMESTAMP iterator. The feature can also be used with the Amazon Kinesis Client Library through the DynamoDB Streams adapter. It is available in AWS commercial, GovCloud (US), and China Regions. AWS says there is no additional charge for the feature beyond standard GetRecords request charges. This option may help teams resume after interruptions, replay data for debugging or auditing, and synchronize after a PITR restore. It also provides an alternative to rereading the entire retained stream or starting only with newly written records. Assess whether consumers can use AT_TIMESTAMP and test resumption against your stream’s retention and consistency requirements. AWS What's New: https://aws.amazon.com/amazon-dynamodb-streams-timestamp-processing https://www.robertasoliman.com/en/tech-radar#radar-2026-10-15-a-fully-programmable-secure-web-gateway https://www.robertasoliman.com/en/tech-radar#radar-2026-10-15-a-fully-programmable-secure-web-gateway Thu, 15 Oct 2026 12:00:00 GMT security Cloudflare announced an integration of Gateway and DLP with its edge computing platform. The Forward action, in public beta, sends HTTP traffic matched by a policy to a Worker, which can modify requests or responses or perform an asynchronous action. Custom Functions call a Worker during policy evaluation and return a value for use in rule conditions. The company says Custom Functions will be available before the end of the year; they are not part of the announced public beta for Forward. These extensions may enable custom logic in access decisions and traffic transformations, reducing the need for external components in some scenarios. Suitability depends on the organization’s policies, code, and operational controls. Assess the Forward beta in a controlled scope and review data handling, permissions, and Worker behavior before applying it to production traffic. Cloudflare: https://blog.cloudflare.com/programmable-gateway-dlp/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-15-temporal-serverless-workers-on-cloud-run-scale-workers-ahead-of-demand https://www.robertasoliman.com/en/tech-radar#radar-2026-10-15-temporal-serverless-workers-on-cloud-run-scale-workers-ahead-of-demand Thu, 15 Oct 2026 12:00:00 GMT ai In preview, Temporal Serverless Workers on Cloud Run lets teams deploy workers in pools that Temporal Cloud sizes according to work in task queues. When there is no work, the pool can scale to zero. Workers run in the customer’s project and network, under the customer’s service account; Temporal Cloud sets the instance count using permissions granted by the customer. The feature uses Temporal worker versioning to keep executions associated with the version on which they started. This model may reduce autoscaling and idle-capacity management for pull-based workloads such as agents, long-running workflows, and batch jobs. The launch is in preview, and Google says APIs and configuration may change. The stated lower price per vCPU-hour and GB-hour compares pools with instance-billed Cloud Run services; it does not establish total savings for an application. Test with a non-critical queue and validate permissions, versioning, instance limits, and scaling behavior before moving workloads. Google Cloud: https://cloud.google.com/blog/products/serverless/temporal-serverless-workers-on-cloud-run-worker-pools/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-14-v1-69-0-v0-163-0 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-14-v1-69-0-v0-163-0 Thu, 15 Oct 2026 12:00:00 GMT cloud The OpenTelemetry Collector v0.163.0 release lists a cmd/mdatagen fix that replaces a linear scan in recordDataPoint with an O(1) hash lookup. According to the changelog, this fixes an O(n²) cost per scrape when many data points belong to one resource. The release also fixes sending-queue deadlocks when blocked offers are cancelled with block_on_overflow enabled, and changes how oversized profiles or spans are dropped when splitting batches. The fix may matter to distributions and pipelines generating many data points per resource or using blocking sending queues. The feed does not specify which configurations or workloads are affected, so relevance should be confirmed in your environment. Review the changelog and test the update with representative configurations, monitoring CPU use, batch processing, and queue behavior. Releases open-telemetry/opentelemetry-collector: https://github.com/open-telemetry/opentelemetry-collector/releases/tag/v0.163.0 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-14-arc-region-switch-adds-four-new-capabilities https://www.robertasoliman.com/en/tech-radar#radar-2026-10-14-arc-region-switch-adds-four-new-capabilities Wed, 14 Oct 2026 12:00:00 GMT cloud Amazon Application Recovery Controller (ARC) Region switch has added Systems Manager Run Command and custom-action Lambda execution blocks with payloads. It can also check service-quota parity between primary and standby Regions and optionally wait for target group health after ECS or EC2 Auto Scaling actions. The quota check can automatically submit requests for quota increases. Waiting for target group health is optional. These changes may help teams make recovery plans more verifiable, including checks for permissions, target instances, quotas, and capacity ready to receive traffic. They do not, by themselves, guarantee a particular recovery time. If you use these plans, review the documentation for the new execution blocks and test plan evaluation and target group health conditions in your environment. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/region-switch-target-health-ssm-lambda/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-14-predictable-ai-spend-in-bigquery-introducing-cost-management-for-generative-ai-functions https://www.robertasoliman.com/en/tech-radar#radar-2026-10-14-predictable-ai-spend-in-bigquery-introducing-cost-management-for-generative-ai-functions Wed, 14 Oct 2026 12:00:00 GMT costs Google Cloud announced general availability of token-based cost management for BigQuery generative AI functions. Administrators can configure four daily quotas at project and user levels, summed globally across regions. They cover functions such as AI.GENERATE, AI.CLASSIFY, and AI.SCORE; embedding functions are not included. Limits can be adjusted in the console and managed through the API, gcloud, or Terraform. BigQuery can stop new model calls when a quota runs out during a query. Quotas may provide more targeted preventive control over AI consumption than general financial limits, but they require sizing and usage monitoring. A mid-query interruption can leave rows without generated values. If these functions are in use, assess per-user and per-project limits, estimate inputs with AI.COUNT_TOKENS, and monitor usage before expanding workloads. Google Cloud: https://cloud.google.com/blog/products/data-analytics/using-bigquerys-generative-ai-cost-management-features/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-14-v1-16-6 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-14-v1-16-6 Wed, 14 Oct 2026 12:00:00 GMT security Terraform version 1.16.6 fixes an issue in which terraform init could not find workspaces selected by key/value tags whose keys contained uppercase letters. The release also includes a note on preventing HTTP/2 resource exhaustion, identified as CVE-2026-78669. According to the note, exploitation would require a compromised, untrusted provider or module registry; the threat is considered outside Terraform Core’s security-guarantee perimeter. The available feed does not specify affected versions or further remediation conditions. The update may matter to teams relying on tag-selected workspaces or assessing exposure in their provider and module workflows. The note does not establish which earlier versions are affected. If your team uses these features, assess upgrading to 1.16.6 in testing and review registry trust and access controls; consult the official documentation for further details. Releases hashicorp/terraform: https://github.com/hashicorp/terraform/releases/tag/v1.16.6 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-13-amazon-ecs-adds-livetaskcount-and-removes-the-charge-for-runningtaskcount-metric https://www.robertasoliman.com/en/tech-radar#radar-2026-10-13-amazon-ecs-adds-livetaskcount-and-removes-the-charge-for-runningtaskcount-metric Tue, 13 Oct 2026 12:00:00 GMT costs AWS announced LiveTaskCount for Amazon ECS services at no additional charge and without requiring CloudWatch Container Insights opt-in. The metric counts tasks in ACTIVATING, RUNNING, and DEACTIVATING states, including during transitions to stopped. AWS also says RunningTaskCount in Container Insights no longer incurs a charge; the pricing change has applied since October 1, 2026. LiveTaskCount may provide a broader view for autoscaling policies and capacity planning. Because the metrics represent different task states, replacing one with the other without reviewing the criteria could change alerts or scaling decisions. Review dashboards, alarms, and scaling policies to confirm which task-count definition fits each use. The RunningTaskCount pricing change is automatic; no action is required to receive it. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/ecs-service-metrics/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-13-aws-agent-registry-now-supports-custom-metadata-for-registry-records https://www.robertasoliman.com/en/tech-radar#radar-2026-10-13-aws-agent-registry-now-supports-custom-metadata-for-registry-records Tue, 13 Oct 2026 12:00:00 GMT ai AWS Agent Registry now supports custom structured fields on records for agents, MCP servers, skills, gateways, and custom resources. Organizations can define one schema per registry, with shared attributes and resource-type-specific fields. Fields support text, URLs, Boolean values, or choices from an allowed list; the registry validates required fields and values when records are created or updated. Search results can also be filtered by metadata in the console, CLI, SDKs, and MCP endpoint. The feature is available in the AWS-listed regions: N. Virginia, Oregon, Sydney, Tokyo, and Ireland. These fields may support discovery and governance, but consistency depends on a useful schema and correctly populated values. Consider attributes such as team ownership, data classification, and review status; define owners and rules before expanding usage. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/aws-agent-registry-custom-metadata-registry-records https://www.robertasoliman.com/en/tech-radar#radar-2026-10-13-gemini-4-argon-available-on-google-cloud-built-to-help-solve-your-business-hardest-problems https://www.robertasoliman.com/en/tech-radar#radar-2026-10-13-gemini-4-argon-available-on-google-cloud-built-to-help-solve-your-business-hardest-problems Tue, 13 Oct 2026 12:00:00 GMT ai Google says Gemini 4 Argon is available in Gemini for business on web, desktop, and mobile. Developers can access it through the Gemini platform API under model ID gemini-4-argon, as well as Google AI Studio and Google Antigravity. The announced introductory price is $2 per million input tokens and $10 per million output tokens through November 30, 2026; afterward, the stated standard prices are $4 and $20, respectively. Cached input tokens are listed at a 95% discount during the introductory period. The model may be evaluated for multi-step enterprise tasks; teams should assess pricing and performance against their own usage profile. Pilot representative tasks and estimate consumption using the prices that apply to the period. Validate controls, quality, and the need for human review before automating decisions. Google Cloud: https://cloud.google.com/blog/products/ai-machine-learning/gemini-4-argon-available-on-google-cloud/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-13-13-1-8 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-13-13-1-8 Tue, 13 Oct 2026 12:00:00 GMT security The Grafana 13.1.8 release notes list fixes for CVE-2026-15577, CVE-2026-33374, CVE-2026-93294, and CVE-2026-95502. They also describe an alerting change to strip sensitive headers from OAuth2 cross-host redirects and a dashboard adjustment related to collection deletion. The description does not specify which products or versions are affected by the CVEs. For teams operating Grafana, this release is relevant to security and maintenance planning. The CVE list alone does not establish exposure, severity, or urgency for a particular installation. Review the full advisories and compare them with deployed versions before planning an update; also validate OAuth2 integrations and dashboards in a test environment. Releases grafana/grafana: https://github.com/grafana/grafana/releases/tag/v13.1.8 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-12-amazon-cloudfront-now-supports-aws-lambda-web-functions-as-an-origin https://www.robertasoliman.com/en/tech-radar#radar-2026-10-12-amazon-cloudfront-now-supports-aws-lambda-web-functions-as-an-origin Tue, 13 Oct 2026 12:00:00 GMT cloud AWS announced support for delivering applications built with Lambda Web Functions through the CloudFront global network. The description cites TLS termination at the edge, caching, custom domains with managed TLS certificates, and no required application-code changes. Origin Access Control (OAC) can restrict access to the function so that it is reachable only through CloudFront. AWS also says AWS WAF can be attached and that availability excludes the CloudFront China region. The option may simplify delivery for web applications based on Lambda Web Functions and centralize edge controls. The practical benefit depends on traffic patterns, security requirements, and the existing architecture. Review OAC, authentication, and WAF configuration for the application flow; validate behavior and caching before directing production traffic. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/cloudfront-lambda-web-functions-origin/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-12-agentic-data-science-with-the-data-agent-kit https://www.robertasoliman.com/en/tech-radar#radar-2026-10-12-agentic-data-science-with-the-data-agent-kit Tue, 13 Oct 2026 12:00:00 GMT ai Data Agent Kit is described as a plugin for coding agents or an extension for Visual Studio Code-based IDEs. It brings MCP tools and instructions for agents working with Google Cloud data services. In the published example, an agent helps ingest logs into BigQuery, create dbt transformations, train and run inference with a model, and generate an Airflow pipeline to execute the steps in sequence. The post expects the team to review and run the artifacts; this workflow is an example, not a guarantee of autonomous results. The approach may reduce tool switching in data engineering workflows. Since code and configuration are generated, human review remains important before running queries, notebooks, or pipelines. Test the kit in a non-critical workflow, review permissions and generated artifacts, and confirm how each step will run and be monitored. Google Cloud: https://cloud.google.com/blog/products/data-analytics/bringing-you-the-data-agent-kit/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-12-filter-reshape-and-redact-logs-before-export-with-transformers https://www.robertasoliman.com/en/tech-radar#radar-2026-10-12-filter-reshape-and-redact-logs-before-export-with-transformers Mon, 12 Oct 2026 12:00:00 GMT cloud Cloudflare made Logpush Transformers generally available and expanded Logpush to all self-serve plans. The feature lets teams define SQL queries to filter records, remove or rename fields, redact sensitive data, and reshape logs before export. Transformed output is delivered in NDJSON to compatible destinations. Teams can create and manage Transformers through the dashboard or API, and monitor successes, failures, processed volume, and duration in the Logpush health view. Filtering and transforming data before delivery may reduce processing and storage at destination systems and avoid a separate processing layer. Execution fails closed: if a transformation errors, the batch is not sent untransformed; persistently failing jobs may be automatically disabled. Review the filters and redaction rules needed for each dataset, then validate the output before attaching a Transformer to a production job. Cloudflare: https://blog.cloudflare.com/transformers-on-logpush/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-what-s-new-with-google-data-cloud https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-what-s-new-with-google-data-cloud Sun, 11 Oct 2026 12:00:00 GMT ai Google says Data Agent Kit is now generally available. The free collection brings together MCP tools and Google-authored skills to connect more than 15 Google Data Cloud services to coding agents, including VS Code, Antigravity, Cursor, Claude Code, and Codex. According to the source, developers and data practitioners can use the resources to inspect schemas, write queries, and build data pipelines in natural language directly from an IDE or CLI. The integration may make it easier for agents to access data tasks, but workplace use depends on the permissions and controls configured for connected services. Assess the kit in a limited workflow and review permissions and internal policies before connecting it to production data or services. Google Cloud: https://cloud.google.com/blog/products/data-analytics/whats-new-with-google-data-cloud/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-10-v1-15-0 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-10-v1-15-0 Sat, 10 Oct 2026 12:00:00 GMT kubernetes Karpenter version 1.15.0 includes the karpenter_pods_disrupted_total counter and new dimensions in disruption metrics, along with node-repair improvements, including reboot actions and replacement behavior in capacity-constrained scenarios. The release also changes labels on some metrics, with changes described as breaking, and includes performance adjustments and bug fixes. The new metrics may help teams track disruptions and repair decisions. Because some metric-label changes are breaking, existing dashboards, queries, and alerts may need review. The release does not, by itself, imply urgency or a security fix. Before upgrading, compare the release changes with your cluster configuration and test query and alert compatibility in an appropriate environment. Releases kubernetes-sigs/karpenter: https://github.com/kubernetes-sigs/karpenter/releases/tag/v1.15.0 https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-aws-security-hub-now-exports-findings-to-s3-in-csv-or-json-format https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-aws-security-hub-now-exports-findings-to-s3-in-csv-or-json-format Sat, 10 Oct 2026 12:00:00 GMT security AWS Security Hub supports on-demand exports of findings from console pages to an Amazon S3 bucket in the customer’s account. Exports are available as CSV or JSON in OCSF format and can be initiated from pages such as Threats, Exposure, Vulnerabilities, Posture Management, Sensitive Data, and All Findings. The feature is available in all AWS Regions where Security Hub is offered. Exporting findings may simplify their use in compliance reports, audit evidence, or external tools without requiring teams to maintain their own extraction pipeline. The announcement does not detail additional access or retention controls for exported files. Assess whether CSV or OCSF JSON fits existing workflows, and confirm that the destination bucket follows your organization’s access and retention controls. AWS What's New: https://aws.amazon.com/about-aws/whats-new/2026/10/security-hub-exports-s3-csv-json/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-introducing-clef-omni-with-full-multimodality-plus-a-faster-clef-and-a-cheaper-clef-flash https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-introducing-clef-omni-with-full-multimodality-plus-a-faster-clef-and-a-cheaper-clef-flash Sat, 10 Oct 2026 12:00:00 GMT ai Cloudflare released Clef-omni, an open-weight decision model that accepts audio, video, images, and text. The company also lowered the price of Clef-flash and said its hosted version now has a 24k-token context window, down from the previously advertised 64k; the Hugging Face weights were unchanged and were trained to support 256k tokens. Clef is faster in its hosted version, according to the announcement. Clef-omni may be worth evaluating for workflows that need to analyze more than one modality in a single call. The lower Clef-flash price comes with a smaller context window in the hosted version, which may affect long requests. Pricing and performance should be checked against the specific use case. Test quality, latency, context limits, and cost with representative data before replacing existing models or pipelines. Cloudflare: https://blog.cloudflare.com/clef-faster-cheaper-multimodal/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-modernizing-unstructured-data-workflows-alteryx-live-query-meets-google-cloud-bigquery https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-modernizing-unstructured-data-workflows-alteryx-live-query-meets-google-cloud-bigquery Sat, 10 Oct 2026 12:00:00 GMT ai The Alteryx One Live Query integration with Google Cloud BigQuery lets users build visual workflows in a browser to process documents and run transformations through SQL pushdown in BigQuery. In the example described, invoice PDFs stored in Cloud Storage are processed with Document AI or Gemini; extracted fields can be standardized, classified, and compared with historical BigQuery records to identify potential duplicates and exceptions. Results can be written back to BigQuery. This pattern may reduce data movement and manual steps in invoice processing while keeping transformation and reconciliation logic in the warehouse environment. The post describes a solution and its components but does not report independent results for other implementations. Validate extraction, reconciliation rules, permissions, and exception handling with representative documents before automating the operational workflow. Google Cloud: https://cloud.google.com/blog/products/data-analytics/modernize-unstructured-data-workloads-with-alteryx-and-bigquery/ https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-introducing-on-demand-cpu-and-memory-profiling-with-flamegraphs-for-workers-and-durable-objects https://www.robertasoliman.com/en/tech-radar#radar-2026-10-09-introducing-on-demand-cpu-and-memory-profiling-with-flamegraphs-for-workers-and-durable-objects Sat, 10 Oct 2026 12:00:00 GMT cloud Cloudflare now lets users request CPU or memory profiles for active Workers and Durable Objects. Capture can be started from the Workers Observability page or the CLI; results appear as interactive flamegraphs and can also be downloaded. Users can select different Worker versions. Capture observes production execution and requires sufficient traffic on the selected version; the announcement also recommends source maps for TypeScript projects to make function names easier to interpret. The feature may help identify functions associated with CPU use or memory allocations under real execution conditions. Because capture is on demand and depends on traffic, it may not record specific periods of abnormal behavior in low-traffic applications. Choose an active version with adequate traffic and enable source maps in TypeScript projects before analyzing profiles. Cloudflare: https://blog.cloudflare.com/workers-on-demand-profiling/ https://www.robertasoliman.com/en/tech-radar#kubernetes-1-34-eol https://www.robertasoliman.com/en/tech-radar#kubernetes-1-34-eol Sat, 10 Oct 2026 12:00:00 GMT kubernetes The Kubernetes project ends support for version 1.34 on 2026-10-27, after which it no longer receives security fixes. The project keeps the three most recent minor versions supported. Self-managed clusters on 1.34 stop getting upstream security patches. Managed services such as EKS, GKE and AKS follow their own support calendars, which may differ from the upstream date. Inventory the versions in use, check your provider's support calendar, review deprecated APIs and add-ons, and plan the upgrade in a controlled window with a defined rollback. Kubernetes releases: https://kubernetes.io/releases/