"Why isn't cert rotation automated out of the box in your OS? Why do humans need to be involved at all?" Petty believes AI will soon help address these types of problems. Watch the full podcast for this and more ☞ www.buoyant.io/ai-kubernete...
Buoyant
@buoyant.io
Creators of Linkerd. The next generation of networking security and reliability for Kubernetes.
The ingress-nginx community project retired in March 2026. That means no more releases, no more patches, and no more security fixes. Check out our latest blog to learn about your options and how to smoothly migrate to a new controller alongside the old one: www.buoyant.io/blog/communi...
Community Ingress-Nginx Retired: Kubernetes Migration Guide & Best Practices
The ingress-nginx project is retired. Learn how to plan your migration, avoid unpatched vulnerabilities, and configure your ingress controller with Linkerd.
buoyant.io
Free O'Reilly book: 262 pages on running Linkerd in production. mTLS and cert rotation, policy, observability, multicluster, CNI vs. init containers, and debugging. Written by people who've built it. www.buoyant.io/download/lin...
Linkerd: Up & Running
A guide to operationalizing a Kubernetes-native service mesh. The O'Reilly book Linkerd: Up & Running is now available for download.
buoyant.io
Linkerd rotates workload certs every 24h automatically, but not the trust anchor (not Linkerd OSS). When it expires, nothing looks broken. Running proxies keep serving traffic. The next pod that restarts can't get a cert signed against a dead root and never comes up. www.buoyant.io/blog/a-guide...
Linkerd Trust Anchor Rotation Without Downtime
Rotate a trust anchor in the wrong order, and you cause the outage you were avoiding. The 4-step sequence uses cert-manager and trust-manager.
buoyant.io
gRPC pins to one pod over HTTP/2, so K8s' L4 load balancer can't spread load. We ran 700 benchmark tests, 2.5B requests, across 5 meshes to see who fixes it. At a severe 200ms delay: Linkerd's p99 held at 25ms baseline. Istio's climbed ~9x. www.buoyant.io/blog/benchma...
A FIPS-validated service mesh secures data in transit for every microservice in a cluster. No app code rewrites, no dependency updates. Sidecar proxies handle the mTLS instead. www.buoyant.io/blog/a-pract...
A 2026 Practical Guide to FIPS Compliance for Kubernetes Engineers
Simplify FIPS compliance for your K8s apps. This 2026 guide explains FIPS 140-3 requirements and how a service mesh automates secure encryption.
buoyant.io
Node CPU sat at 43%. One pod was throttled to 100% of its cgroup limit. Success rate never moved, so no alert fired, but frontend's p99 latency rose 47%. Node-level USE metrics missed it. RED metrics caught it on the first scrape. Full breakdown: www.buoyant.io/blog/the-sre...
The SRE Guide to Kubernetes Observability: RED vs. USE Methods
Learn the difference between RED and USE monitoring in Kubernetes. Linkerd emits RED metrics with no app changes; see a real incident where p99 rose 47%.
buoyant.io
New AI Kubernetes Show: @boredabdel.bsky.social (Google, KubeCon co-chair) covers what LLM inference on Kubernetes actually requires, from routing to autoscaling to agentic security www.buoyant.io/ai-kubernete...
S02 E05 - LLM Inference on Kubernetes: New Primitives, Real Challenges
Running LLM inference on Kubernetes requires new primitives for routing, autoscaling, and GPU scheduling. Here's what platform engineers need to know.
buoyant.io
Linkerd multicluster chaos test: scale east cluster to zero, watch what happens. Federated service: 33/33/33 → 50/50 across surviving clusters. Zero errors. No config changes. Flat-mirrored service: 503s. That's correct. You asked for east, east is gone. linkerd.io/2026/06/24/f...
Linkerd Multicluster: Federation, Mirroring on GKE
Linkerd multicluster supports 3 modes: federated, flat, and gateway. Wire all 3 across 3 GKE clusters, run a chaos test, and see automatic failover in action.
linkerd.io
Excited to announce Linkerd 2.20 with automated trust anchor rotation, Windows VM support, rate-limit-aware load balancing, and more! Read about this and all other updates ☞ www.buoyant.io/blog/bel-2-20-automated-trust-anchor-rotation-windows-vm-support-rate-limit-aware-load-balancing
Announcing Buoyant Enterprise for Linkerd 2.20: Automated trust anchor rotation, Windows VM support, rate-limit-aware load balancing, and more
Buoyant Enterprise for Linkerd 2.20 is here, with automated mTLS trust anchor rotation, Windows VM support, rate-limit-aware load balancing, and more.
buoyant.io
What happens when a pod gets evicted mid-inference? Blake Romano at Imagine Learning has been running multi-agent AI on Kubernetes for a year. Stateful connections, long-running inference, and work handoff when a node dies. The failure modes are real. www.buoyant.io/ai-kubernete...
S02 E04 - Running Multi-agent AI on Kubernetes: Lessons from Imagine Learning
In this episode of The AI Kubernetes Show, Blake Romano, Staff Software Engineer at Imagine Learning, walks through what it actually looks like to build and run AI agents on Kubernetes at scale.
buoyant.io
HTTP 200, grpc_status=14. The proxy flags the failure. Your OTel pipeline misses it. Linkerd gives every meshed pod response_total + latency histograms with zero code changes. mTLS identity on every counter. 1 Collector config to wire it in. www.buoyant.io/blog/otel-an...
OTel and Mesh-Derived Metrics: A 2026 Reference
Learn how to combine application-level metrics from OpenTelemetry with network-layer metrics derived from a Linkerd service mesh and how to integrate these two layers into a single backend pipeline.
buoyant.io
Join us for a hands-on Service Mesh Academy session covering migration paths from the community-created and now-retired ingress-nginx. www.buoyant.io/register/com...
Community ingress-nginx is retired. What are your ingress controller options now?
Ingress NGINX, the Kubernetes community controller that uses NGINX Open Source as its reverse proxy, has been one of the most widely deployed ways to get traffic into a cluster.
buoyant.io
Your AI agent has access to your databases. It also gets jailbroken in leet speak. Evaline Ju on guardrails, workload identity, and gateway enforcement for agent workloads on Kubernetes. New AI Kubernetes Show episode: www.buoyant.io/ai-kubernete...
"Connection refused" during a rolling deploy? That's the sidecar proxy dying before your app finishes draining. Kubernetes 1.33 native sidecars solve a whole class of problems. Linkerd Ambassador Blake Romano walks through the fix: linkerd.io/2026/05/18/t...
Why does EKS practically force every cluster to span multiple availability zones? Because hardware fails. A circuit breaker trips, and a rack vanishes. Worth reading before your next post-mortem: www.buoyant.io/blog/what-ar...
What Are Availability Zones? A Guide to Multi-AZ Kubernetes
One of the things that differentiates EKS, Amazon’s managed Kubernetes service, from its peers is its near insistence that clusters must always span multiple availability zones (AZs).
buoyant.io
"The platform investments we made for humans turned out to be indispensable for AI agents," said Scott Feinberg, AI and platform lead at Schonfeld.... Then Claude Code showed up needing the exact same thing. Tune into the full episode: www.buoyant.io/ai-kubernete...
S02 E02 - The AI-Native Workflow: How Schonfeld Used Kubernetes to Manage Explosive Code Volume
Learn how Schonfeld scaled their internal AI platform, SchonAI, using Kubernetes and established guardrails to manage AI agent code volume.
buoyant.io
How did we build a cloud native escape room in 6 weeks? Buoyant tech evangelist Flynn shares lessons learned from taming a fleet of AI agents in this @techstronggroup.bsky.social article. Learn more → techstrong.ai/techstrong-c...
Is a non-deterministic AI agent a threat to your production environment? The AI Kubernetes Show host @williammorgan.me chats with Michael Lieberman, co-founder of Kusari, about new threats to supply chain security. Watch the full podcast today: www.buoyant.io/ai-kubernete...
S02 E01 - One Dependency Away: Supply Chain Security in the Age of AI
Secure your Kubernetes environment. Learn why zero trust cybersecurity is the only defense against AI agents and non-deterministic agentic software in your supply chain.
buoyant.io