HCP Terraform Free Tier Ending: What Changes

HashiCorp announced the discontinuation of HCP Terraform Free tier effective March 31, 2026. Existing free users must transition to paid plans or find alternatives. This decision marks the second major shift following the 2023 BSL license transition, creating another inflection point in the Infrastructure as Code ecosystem.

Terraform vs OpenTofu: 2026 Status Comparison

As of March 2026, Terraform has reached version 1.14.x while OpenTofu stands at 1.9.x. The OpenTofu registry now mirrors over 2,000 providers, with 34% of infrastructure teams completing full migration from Terraform to OpenTofu, and 28% in partial migration.

OpenTofu Migration: Practical Steps

Step 1: Verify Compatibility

# Check current Terraform version
terraform version

# Install OpenTofu
brew install opentofu

# Or use official installation script
curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh | sh

# Verify installation
tofu version

Step 2: Migrate State File

# Navigate to your Terraform project
cd /path/to/terraform-project

# Initialize OpenTofu (automatically recognizes existing state)
tofu init

# Validate state - run plan only without changes
tofu plan

# After verification, update lock file
tofu init -upgrade

Tip: OpenTofu maintains full compatibility with Terraform state file format. Most projects complete migration with just tofu init.

Step 3: Transition CI/CD Pipeline

# GitHub Actions example: terraform → tofu transition
name: Infrastructure Deploy
on:
  push:
    branches: [main]
    paths: ['infra/**']

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: opentofu/setup-opentofu@v1
        with:
          tofu_version: 1.9.0
      - name: Init
        run: tofu init
        working-directory: infra/
      - name: Plan
        run: tofu plan -out=plan.tfplan
        working-directory: infra/
      - name: Apply
        if: github.ref == 'refs/heads/main'
        run: tofu apply plan.tfplan
        working-directory: infra/

Migration Considerations

Important: Some features introduced after Terraform 1.6 are supported in OpenTofu but may have subtle behavioral differences. Always run tofu plan in staging first to ensure no drift. Common issues: First, provider version pinning via .terraform.lock.hcl requires tofu init -upgrade after switching. Second, Sentinel policies need migration to OPA. Third, Terraform Cloud-exclusive features can be replaced with Spacelift or env0.

FAQ

Q: Can I reuse existing Terraform modules?

Yes, most Terraform modules work unchanged. The OpenTofu registry mirrors Terraform providers.

Q: Can I continue using Terraform?

Of course. BSL license doesn’t restrict direct use, but consider HCP Terraform costs.

Q: Is Terragrunt compatible?

Yes, Gruntwork announced official OpenTofu support. Set terraform_binary = "tofu" in terragrunt.hcl.

This article was originally published on ManoIT Tech Blog.

I Built a Free AI Background Remover Using Cloudflare Workers + D1

I spent my weekend building an AI background remover website, with both frontend and backend deployed on Cloudflare, costing almost nothing. Here’s my development journey and some lessons learned.

🌟 Project URL

https://zmjjkk.xyz

🔧 Tech Stack

• Frontend: Static HTML + JavaScript (Cloudflare Pages)
• Backend: Cloudflare Workers
• Database: Cloudflare D1
• AI Background Removal: Remove.bg API
• Payment: PayPal

🚀 Features

1. Free to Use: 3 free uses per day, no login required
2. Google Login: Cross-device sync after login
3. Credit Packs: Purchase credits via PayPal
4. Membership: Monthly/Yearly unlimited plans

💡 Key Highlights

1. Benefits of D1 Database

Previously I used localStorage, so users would lose their data when switching devices. After switching to D1, once a user logs in, their credits and membership sync across all devices.

-- User table structure
CREATE TABLE users (
  id INTEGER PRIMARY KEY,
  google_id TEXT UNIQUE,
  email TEXT,
  credits INTEGER DEFAULT 0,
  membership TEXT,
  membership_expire TEXT,
  total_used INTEGER DEFAULT 0
);

2. Interesting Uses of Workers

Workers aren’t just for APIs – they can also serve HTML pages directly. One Worker handles all routes:

// Home page
if (path === '/') {
  return new Response(HOME_PAGE, {
    headers: { 'Content-Type': 'text/html' }
  })
}

// Pricing page
if (path === '/pro') {
  return new Response(PRO_PAGE, {...})
}

// API endpoint
if (path === '/purchase' && method === 'POST') {
  return handlePurchase(request, env)
}

3. PayPal Integration Lessons

Sandbox and production have different API addresses, and sandbox testing sometimes has weird CORS issues. The final solution was to provide a manual payment confirmation as a fallback, in case the automatic flow fails after user pays.

📊 Cost Estimate

Currently with a few hundred visits per day, everything is within the free tier.

🔜 Future Plans

• [ ] Add more AI features (background replacement, resize)
• [ ] Batch processing support
• [ ] Open API for developers

🤔 Reflection

This project made me rethink Cloudflare’s product capabilities. The Workers + D1 + Pages combo is amazing for small to medium web applications – easy deployment, global CDN, and extremely low cost.

If you have similar ideas, try this stack! Feel free to ask questions in the comments!

Feel free to try https://zmjjkk.xyz and leave your feedback in the comments!

Difficulty Pattern Asked At LeetCode Link
Medium Two Pointers (Opposite Ends) Amazon, Google, Microsoft, Bloomberg, Apple leetcode.com/problems/container-with-most-water
📌 This is part of the Two Pointers series on Daily Dev Notes. If you haven’t read the Two Pointers pattern guide yet, start there — it will make this solution much easier to understand.
This problem has a sneaky quality to it.

When you first read it, it looks like a geometry problem. But once you see the right way to think about it, it becomes a clean, elegant Two Pointers problem that solves in a single pass.

The hard part is not the code — the code is just 10 lines. The hard part is building the intuition for why the Two Pointers approach is correct. That’s what this post focuses on.

Let’s go from scratch.

The Problem Statement
You are given an integer array height of length n. There are n vertical lines drawn such that the two endpoints of the i-th line are at (i, 0) and (i, height[i]).

Find two lines that together with the x-axis form a container that holds the most water. Return the maximum amount of water a container can store.

Note: You cannot slant the container.

Example

Example 1:
Input: height = [1, 8, 6, 2, 5, 4, 8, 3, 7]
Output: 49
Why: Lines at index 1 (height=8) and index 8 (height=7)
Width = 8 – 1 = 7
Height = min(8, 7) = 7
Area = 7 × 7 = 49

Example 2:
Input: height = [1, 1]
Output: 1
Why: Only two lines. Width=1, Height=min(1,1)=1, Area=1
Understanding the Area Formula
Before jumping into the solution, let’s make sure the area calculation is completely clear.

If you pick two lines at positions i and j (where i < j), the water they can hold is:

Example

Area = width × height
= (j – i) × min(height[i], height[j])

The height is min() of the two lines because water spills
over the shorter one — you can never fill above the shorter line.
💡 The area is always limited by the SHORTER line. This single observation is the entire key to understanding why the Two Pointers approach works.
Step 1 — Brute Force Approach
As always, let’s start with the obvious solution. Check every possible pair of lines and track the maximum area.

Brute Force

// Brute Force — O(n²) time, O(1) space
int maxArea(vector& height) {
int maxWater = 0;
int n = height.size();

for (int i = 0; i < n; i++) {
    for (int j = i + 1; j < n; j++) {
        int width  = j - i;
        int h      = min(height[i], height[j]);
        int area   = width * h;
        maxWater   = max(maxWater, area);
    }
}
return maxWater;

}
Metric Brute Force Impact
Time Complexity O(n²) Two nested loops — for n=10,000, that’s 100 million operations
Space Complexity O(1) Fine — no extra data structures
LeetCode Result TLE Fails on large test cases — Time Limit Exceeded
⚠️ The brute force is logically correct but too slow. For n = 100,000 lines, it would need 10 billion comparisons. We need O(n).
Step 2 — Building the Intuition
This is the most important section. Read it slowly.

Let’s start with two pointers — one at the leftmost line (index 0) and one at the rightmost line (index n-1). This gives us the maximum possible width.

Now we calculate the area. Then we ask: should we move the left pointer or the right pointer?

🤔 Here is the key question: if we move one pointer inward, the WIDTH always decreases. So for the area to possibly increase, the HEIGHT must increase. Which pointer should we move to give the HEIGHT a chance to increase?
The Proof — Why We Always Move the Shorter Line
Say the left line has height 3 and the right line has height 8. The current area is limited by height 3 (the shorter one).

What if we move the RIGHT pointer (height 8) inward?

Width decreases Always — we moved inward
New right line height Could be anything — but the area is STILL limited by left line (height 3)
Can area increase? NO — width went down, height is still capped at 3. Area can only stay same or decrease.
What if we move the LEFT pointer (height 3) inward?

Width decreases Always — we moved inward
New left line height Could be greater than 3 — this is our only chance for area to increase
Can area increase? YES — if the new left height is greater than 3, the effective height increases and might outweigh the width decrease
🔑 CONCLUSION: Always move the pointer pointing to the SHORTER line. Moving the taller line’s pointer can never increase the area. Moving the shorter line’s pointer is the only move that gives us a chance at a larger area.
This is the entire algorithm. Everything else — the code, the loop — is just implementing this one insight.

Step 3 — Full Dry Run
Let’s trace through Example 1 completely.

Dry Run

height = [1, 8, 6, 2, 5, 4, 8, 3, 7]
index = [0, 1, 2, 3, 4, 5, 6, 7, 8]
maxArea = 0
Step left right h[left] h[right] Width Height Area maxArea Move
1 0 8 1 7 8 1 8 8 left++ (1 < 7)
2 1 8 8 7 7 7 49 49 right– (8 > 7)
3 1 7 8 3 6 3 18 49 right– (8 > 3)
4 1 6 8 8 5 8 40 49 right– (tie → move right)
5 1 5 8 4 4 4 16 49 right– (8 > 4)
6 1 4 8 5 3 5 15 49 right– (8 > 5)
7 1 3 8 2 2 2 4 49 right– (8 > 2)
8 1 2 8 6 1 6 6 49 right– (8 > 6)
9 1 1 – – – – – 49 left >= right → STOP
✅ Maximum area = 49. Found at Step 2: lines at index 1 (height=8) and index 8 (height=7). Width=7, Height=7, Area=49.
Notice something important in Step 4: when both lines have the same height (both are 8), we can move either pointer — it doesn’t matter. Moving either one cannot increase the area since height stays capped at 8 and width decreases.

READ FULL ARTICLE: https://dailydevnotes.in/leetcode-11-container-with-most-water/

The Turning Point in 2023, Today’s Reality in 2026

In August 2023, HashiCorp’s decision to change Terraform’s license from MPL 2.0 to BSL (Business Source License) sent shockwaves through the open-source community. Immediately afterward, the Linux Foundation launched OpenTofu as a true open-source alternative. Fast forward to 2026, and the IaC landscape has fundamentally transformed.

Three Years of Divergence: Architecture, Philosophy, and Ecosystem

The three-year gap between 2023 and 2026 has created substantial technical divergence between Terraform and OpenTofu. Initially, they were nearly identical, but OpenTofu’s community-driven development model has produced distinct advantages.

Provider and Module Ecosystem

OpenTofu has become the standard in cloud-native infrastructure provisioning. The OpenTofu Registry now hosts over 8,000 providers and modules, compared to Terraform’s reduced ecosystem due to HashiCorp’s tighter governance. Importantly, OpenTofu maintains complete backward compatibility with existing Terraform modules—switching requires no code rewrites.

This compatibility stems from OpenTofu’s MPL 2.0 license maintaining the spirit of open source, attracting both individual contributors and enterprise participants. RedHat, Google, and Hugging Face have all migrated to OpenTofu by 2026, signaling enterprise acceptance.

State Management and Encryption

A critical distinction has emerged in state file handling. OpenTofu 1.8+ (released Q2 2026) introduces native state file encryption using AES-256, rendering HashiCorp Vault integration optional. State encryption now happens transparently during the plan/apply cycle.

State file structure also differs. OpenTofu stores additional provenance metadata—which modules/providers generated which resources—enabling more granular drift detection and root cause analysis of configuration mismatches.

Terraform’s state encryption still relies on external systems (Vault, S3 bucket encryption), creating additional operational complexity.

Drift Detection and Remediation

OpenTofu 1.9 (Q3 2026 roadmap) will introduce advanced drift detection capabilities using eBPF-based agent monitoring. This allows detection of out-of-band infrastructure changes without requiring full terraform plan cycles.

Terraform still relies on periodic terraform plan runs for drift identification—effective but resource-intensive in large-scale environments.

Migration Landscape 2026

The migration path from Terraform to OpenTofu has stabilized in 2026. Three key tools simplify transitions.

Terraform State Migration

OpenTofu includes built-in state migration from Terraform 1.5+. The process is straightforward:

terraform show -json | opentofu fmt -
opentofu import <resource_type>.<resource_name> <resource_id>

No state file rewrites or manual resource edits are required. Backward compatibility means existing modules and providers work unchanged.

Module Compatibility

The OpenTofu Module Registry maintains complete Terraform module compatibility through a compatibility layer. Existing Terraform Registry modules are automatically usable in OpenTofu without modification.

Variables and Locals

Variable and local variable definitions remain 100% compatible. Migration requires only pointing to OpenTofu instead of Terraform in your CI/CD pipelines.

When to Migrate: Decision Matrix

Migrate to OpenTofu If:

• You require transparent state encryption (native AES-256 support)
• Your team includes security-conscious practitioners needing encryption baseline standards
• You operate multi-cloud environments with inconsistent cloud provider capabilities
• You prefer community governance and want a vendor-neutral IaC standard
• Your organization prioritizes open-source principles in tooling

Stay with Terraform If:

• Your organization holds a substantial HashiCorp Cloud Platform (HCP) investment
• You require Terraform Cloud’s specific features (cost estimation, policy-as-code integration)
• Your enterprise agreements with HashiCorp provide specific support commitments
• Your team has deep expertise in Terraform-specific workflows
• You operate exclusively in AWS with terraform-aws-provider optimization dependency

Practical Migration Strategy

Phase 1: Pilot Project (2-4 weeks)

Select a non-critical module and perform full migration. Test plan/apply cycles with both tools. Document differences encountered.

Phase 2: Team Enablement (1-2 weeks)

Establish OpenTofu in your CI/CD pipeline alongside existing Terraform jobs. Run both for equivalent infrastructure in parallel, comparing results.

Phase 3: Gradual Rollout (4-8 weeks)

Migrate non-production environments first. Monitor for 2-4 weeks before production migration.

Phase 4: Production Migration (2-4 weeks)

Migrate production infrastructure using blue-green deployment for critical systems. Maintain rollback capability throughout.

Observability and Debugging

OpenTofu 1.8+ includes enhanced logging with structured output supporting OpenTelemetry. This contrasts with Terraform’s JSON logging, making debugging infrastructure changes more systematic.

OTEL_EXPORTER_OTLP_ENDPOINT=localhost:4317 opentofu plan

This integration with observability standards reflects OpenTofu’s maturity in production environments.

The 2026 Recommendation

By 2026, OpenTofu has moved beyond being merely a “Terraform alternative.” It has become the IaC standard for organizations prioritizing open-source principles, transparency, and vendor independence. The feature parity with Terraform is now complete, and OpenTofu has begun pulling ahead in areas like native encryption and observability.

For greenfield projects starting in 2026, OpenTofu is the default choice unless specific HashiCorp commitments mandate otherwise. For existing Terraform users, migration timing depends on encryption requirements and your cloud provider mix.

The question isn’t whether to consider OpenTofu, but when—and for most organizations, that time has arrived.

This article was originally published on ManoIT Tech Blog.

Kubernetes 1.33 Octarine — The Color of Magic

Kubernetes 1.33 shipped under the code name Octarine, “The Color of Magic.” This release includes 64 features total, with standout additions in pod resizing, user namespaces, and resource scheduling.

In-Place Pod Resize

Pod resizing without redeployment is now possible. Previously, changing CPU/memory requests required destroying and recreating pods. Kubernetes 1.33’s InPlacePodVerticalScaling feature enables dynamic adjustment.

User Namespaces

User namespace support isolates container UID/GID mappings from the host, improving security in multi-tenant clusters. This prevents privilege escalation through UID reuse.

This article was originally published on ManoIT Tech Blog.

I have 50 repos on GitHub. Almost all abandoned.

This is the first one I actually finished.

What I Built

WinOptima – A lightweight Windows optimizer
built with Python + Tkinter.

It does simple stuff:

• Cleans temporary files
• Disables unnecessary animations
• Gaming mode (stops background apps)
• Creates restore points before any changes

Why I Built It

My laptop is slow. CCleaner got bloated.
I figured I could build something simpler.

What I Learned

• Python subprocess module
• Tkinter GUI development
• Windows system commands
• PyInstaller for packaging
• The hardest part: actually finishing

The Code

GitHub: https://github.com/Leodas-code/Windows-Optimizer-Pack

I’d love honest feedback. Roast my code.
Tell me what I’m doing wrong.

I’m 15 and trying to learn.

Why ArgoCD 3.3 Deserves Your Attention

On February 28, 2026, ArgoCD 3.3 was released. Rather than major architectural changes, this release focused on filling long-needed gaps in production operations. The most significant change is the introduction of the PreDelete Hook. In GitOps workflows, deletion has always been a risky operation. When stateful applications are abruptly removed, data can be lost or dependent external systems lose service without notification. ArgoCD 3.3 elevates deletion to an explicit lifecycle stage.

PreDelete Hook: Deletion as a Lifecycle Stage

Traditional ArgoCD provided three hook stages: PreSync → Sync → PostSync. With PreDelete added in 3.3, the complete application lifecycle is now realized. When a deletion request arrives, the PreDelete Hook executes a designated Kubernetes Job before actual resource removal. Deletion proceeds only if this Job succeeds; failure blocks deletion entirely.

# PreDelete Hook example: Database backup before deletion
apiVersion: batch/v1
kind: Job
metadata:
  name: pre-delete-db-backup
  annotations:
    argocd.argoproj.io/hook: PreDelete
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 2
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: backup
          image: postgres:16-alpine
          command:
            - sh
            - -c
            - |
              echo "[PreDelete] Starting database backup..."
              pg_dump $DATABASE_URL > /backup/dump-$(date +%Y%m%d%H%M%S).sql
              aws s3 cp /backup/ s3://backups/pre-delete/ --recursive
              echo "[PreDelete] Backup complete, allowing deletion"
          envFrom:
            - secretRef:
                name: db-credentials

The key is a single annotation: argocd.argoproj.io/hook: PreDelete. Following the same pattern as existing PreSync/PostSync hooks, there’s virtually no learning curve.

Real-World Use Cases

ArgoCD 3.3 Key Improvements Summary

OIDC Background Token Refresh

When integrating with OIDC providers like Keycloak, sudden logouts during extended debugging or deployment monitoring are now resolved. ArgoCD 3.3 automatically refreshes OIDC tokens in the background before expiration, with configurable refresh thresholds.

Shallow Git Cloning

An opt-in feature for large monorepos or legacy projects to fetch only required commits instead of full Git history. Repository server fetch times can drop from minutes to seconds.

Granular Cluster Resource Control

AppProject’s clusterResourceWhitelist now extends beyond API groups and kinds to restrict individual resource names. Multi-tenant environments can now manage access to specific CRDs at the project level with fine-grained control.

Native KEDA Support

ScaledObject and ScaledJob pause/resume can now be controlled directly from the UI, with accurate health status displayed instead of the previous ‘Unknown’ state.

Upgrade Guide: 3.2 to 3.3

# 1. Check current ArgoCD version
argocd version

# 2. Update Helm chart
helm repo update
helm search repo argo/argo-cd --versions | head -5

# 3. Update values.yaml with new versions
# server.image.tag: v3.3.2
# repoServer.image.tag: v3.3.2
# controller.image.tag: v3.3.2

# 4. Upgrade in staging first
helm upgrade argocd argo/argo-cd -n argocd -f values-staging.yaml --version 7.8.0

# 5. Verify application status
argocd app list --output wide
argocd app get <app-name> --hard-refresh

Tip: PreDelete Hooks can be adopted incrementally. Start with new apps, test in staging, then deploy to production.

FAQ

Q: What happens if PreDelete Hook fails?

Deletion is blocked. After retrying up to backoffLimit, it remains pending. Check failure status in ArgoCD UI and manually resolve the issue.

Q: Can I use multiple hook types together?

Yes, all hooks operate independently. You can use PreSync, Sync, PostSync, and PreDelete hooks on the same application.

Q: Is Shallow Clone safe for all projects?

Recommended for most cases. Disable if using custom plugins that need full Git history.

This article was originally published on ManoIT Tech Blog.

Solomon Hykes’ Prophecy Becomes Reality

In 2019, Docker co-founder Solomon Hykes made a prescient statement: if WASM+WASI had existed in 2008, Docker wouldn’t have needed to be built. That prophecy moved closer to reality in 2026 with the standardization of WASI 0.3.0 and the SpinKube project.

WebAssembly (Wasm) was originally created to execute C/C++ code in browsers, but with the arrival of WASI (WebAssembly System Interface), it’s now seeing serious server-side adoption. As of 2026, Wasm is rapidly emerging as a container alternative in serverless, edge computing, and microservices domains.

WASI 0.3.0 — Completing the Component Model

WASI 0.3.0, released in early 2026, marks a decisive turning point for the WebAssembly ecosystem. While the previous version, WASI 0.2, defined the basic structure of the component model, 0.3 adds async I/O and streaming support—providing the final puzzle pieces needed for real server workloads.

The core of WASI is its capability-based security model. Unlike traditional Unix permission models, each Wasm module can only access resources through explicitly granted capability references. Access to file systems, network sockets, environment variables—all system interfaces are declaratively controlled.

This differs fundamentally from container security models. Containers inherently share the host kernel, requiring additional security layers like seccomp and AppArmor. Wasm modules, by contrast, default to a sandbox with no external resource access unless explicitly allowed.

Performance Comparison — The Impact of 50μs Cold Starts

Wasm’s most impressive characteristic is its cold-start performance. Comparing key metrics reveals the stark difference.

Cold-start times: Wasm serverless requires 5-50 microseconds, while container-based serverless requires 100-500 milliseconds—a 1,000 to 10,000x difference. Memory usage: WasmEdge runtime carries a footprint of approximately 2MB, smaller than minimal container images (Alpine-based at 5-10MB).

Binary size also differs significantly. Typical Wasm modules range from kilobytes to several megabytes, while even minimal container images span tens of megabytes. This lightweight profile becomes a decisive advantage in edge computing and serverless environments.

SpinKube — Kubernetes-Native Wasm

SpinKube is an open-source project for natively deploying and operating Wasm workloads in Kubernetes. It bridges Fermyon’s Spin framework with Kubernetes.

SpinKube comprises three core components. First, spin-operator manages the SpinApp custom resource. Developers define Wasm apps through YAML manifests, with spin-operator handling deployment and scaling. Second, containerd-shim-spin integrates with containerd through the Container Runtime Interface (CRI), allowing Wasm workloads and traditional containers to coexist on the same node. Third, runtime-class-manager automatically provisions appropriate Wasm runtimes to nodes.

A typical SpinApp manifest closely resembles existing Kubernetes Deployments. Specify the API version as core.spinoperator.dev/v1alpha1, set kind to SpinApp, and define image, replicas, and executor in the spec section. You can leverage existing Kubernetes knowledge directly—a major SpinKube advantage.

Comparing Three Wasm Runtimes

Three major server-side Wasm runtimes currently exist.

Wasmtime, developed by the Bytecode Alliance, features JIT compiler-based performance optimization. It uses the Cranelift code generator and implements WASI standards quickly. It has proven stability in production environments.

WasmEdge, a CNCF sandbox project, is optimized for edge computing with its approximately 2MB minimal memory footprint. It natively supports AI inference libraries like TensorFlow and accommodates a wide range of deployment environments from IoT devices to the cloud.

Wasmer supports multiple deployment modes including embedded and standalone. It offers a choice of compiler backends (LLVM, Cranelift, Singlepass) and operates a package registry through wasmer.io.

Workloads Where Wasm Fits—and Where It Doesn’t

Wasm is optimal for specific scenarios: stateless HTTP handlers, serverless functions requiring fast cold starts, request processing at CDN edges, and lightweight data transformation pipelines. Major cloud providers including AWS Lambda, Google Cloud Run, and Azure Functions are offering or preparing Wasm support.

Conversely, long-running batch jobs, large-scale relational databases, GPU-based AI training workloads, and services requiring complex state management remain better served by traditional containers or VMs.

The realistic 2026 strategy is coexistence. Within Kubernetes clusters, SpinKube enables you to operate Wasm and container workloads side by side, choosing the appropriate runtime for each workload’s characteristics.

Conclusion

WebAssembly isn’t replacing containers—it’s filling gaps containers couldn’t address. With WASI 0.3.0 standardization and SpinKube maturity, Kubernetes operators can now orchestrate containers and Wasm together in the same cluster. If you operate edge and serverless workloads, now is the time to evaluate Wasm.

This article was originally published on ManoIT Tech Blog.

Why CI/CD Pipelines Have Become Attackers’ Prime Target

The hottest software supply chain security issue in 2026 is attacks targeting CI/CD pipelines. As over 85% of modern application codebases consist of open-source dependencies, attackers have shifted from code review vulnerabilities to targeting build provenance.

CI/CD pipelines occupy the highest-privilege infrastructure layer, possessing source code access, cloud credentials, and production deployment authority. A successful breach gives attackers total supply chain control, maximizing attack ROI.

Major Supply Chain Attack Cases in 2026

GitHub Actions Tag Manipulation Attacks

In March 2026, attackers forcibly updated version tags of the Trivy GitHub Action, injecting malicious code. This attack exposed CI/CD secrets from affected pipelines. Trivy image tags 0.69.4, 0.69.5, and 0.69.6 on Docker Hub were also confirmed to contain information-stealing payloads.

The attack was attributed to TeamPCP, a cloud-native threat actor known for exploiting misconfigured Docker APIs and Kubernetes clusters.

Previously, the tj-actions/changed-files GitHub Action was compromised, exposing secrets from over 23,000 repositories. The attacker redirected version tags to malicious commits.

Jenkins Plugin Vulnerabilities’ Structural Risk

According to JetBrains’ March 2026 analysis, Jenkins experienced over 70 security vulnerabilities throughout 2025. Most were plugin-related, with many remaining unpatched in production environments even after fixes became available.

CVE-2025-31722, in particular, was a critical Remote Code Execution (RCE) vulnerability in the template engine. More concerning: over 45,000 Jenkins servers remain exposed to vulnerabilities from 2024.

The plugin-centric architecture presents clear structural problems: inconsistent security standards due to community maintenance, unresolved vulnerabilities in abandoned plugins, expanded attack surfaces from complex plugin interactions, and amplified damage scope from excessive privilege grants.

A New Defense Tool: Chainguard Actions

In response to these threats, Chainguard released Chainguard Actions in March 2026—a CI/CD security tool with a secure-by-default approach.

Chainguard Actions collects popular third-party CI/CD workflows and automatically evaluates them against comprehensive security rules. When issues are found, it auto-fixes them to provide secure versions. It continuously monitors upstream marketplace changes, automatically adjusting for security requirements.

The security approach comprises three core elements. First, it combines rule-based detection with AI to identify both known risk patterns and subtle vulnerabilities. Second, each security fix is recorded as a Git commit for audit trails. Third, when new security rules apply, it re-evaluates the entire catalog automatically.

Practical CI/CD Security Hardening Checklist

Immediately Applicable Measures

With GitHub Actions, pin actions to commit SHAs rather than tags (v1, v2). For example, use uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 instead of uses: actions/checkout@v4. This blocks tag manipulation attacks at the source.

Use OIDC-based short-lived credentials to reduce long-term secret exposure risk. AWS, GCP, and Azure all support GitHub Actions OIDC integration. Additionally, explicitly declare permissions in your workflows to enforce the principle of least privilege.

Jenkins Environment Security Hardening

Create a complete inventory of active plugins and verify each plugin’s last update date and maintenance status. Remove unused plugins immediately and seek replacements for abandoned plugins or maintain your own fork.

Subscribe to Jenkins security advisories and establish processes to apply critical security patches within 48 hours. If plugin management overhead becomes excessive or you’ve experienced security incidents, consider migrating to an integrated CI/CD platform (GitHub Actions, GitLab CI, or commercial solutions).

Supply Chain Security Governance

Adopt the SLSA (Supply chain Levels for Software Artifacts) framework to validate build provenance. Use Sigstore/cosign to sign container images and generate SBOM (Software Bill of Materials) for dependency transparency.

Apply the same code review rigor to CI/CD configuration files (.github/workflows, Jenkinsfile, etc.) as to application code. Automate dependency updates with Dependabot or Renovate, prioritizing security updates.

Conclusion

CI/CD pipeline security is no longer optional—it’s essential. 2026’s supply chain attacks are increasingly sophisticated, with defenses evolving through tools like Chainguard Actions. The key is consistently applying fundamentals—SHA pinning, least privilege, and continuous monitoring—throughout your CI/CD environment.

This article was originally published on ManoIT Tech Blog.

Kubernetes as the Operating System for AI Infrastructure

In March 2026, Microsoft made a powerful statement at KubeCon + CloudNativeCon Europe in Amsterdam. Kubernetes is no longer just the control plane for cloud-native apps—it’s becoming the fundamental operating platform for modern AI infrastructure. Let’s examine the key announcements that backed up this declaration.

DRA (Dynamic Resource Allocation) Achieves GA — Standardizing GPU Scheduling

One of the most important announcements at KubeCon was the General Availability (GA) graduation of DRA (Dynamic Resource Allocation). DRA replaces vendor-specific GPU scheduling approaches with a Kubernetes-native, declarative model.

Previously, static resource specifications like nvidia.com/gpu were the standard for GPU allocation. DRA transitions this to new abstractions: DeviceClass and ResourceClaim. Special hardware like GPUs, FPGAs, and network accelerators can now be requested dynamically and shared, with topology-aware placement enabling optimal scheduling based on physical proximity between GPUs and network interface cards (NICs).

Notably, DRANet achieves upstream compatibility with Azure RDMA NICs (Network Interface Cards), making GPU-to-NIC topology alignment possible even in high-performance hardware environments where this alignment directly impacts training performance. This represents a decisive step toward standardizing GPU placement across multi-cloud environments and reducing vendor lock-in.

In Kubernetes 1.36, Workload Aware Scheduling will integrate DRA support into the Workload API and strengthen integration with KubeRay, making it easier for developers to request and manage high-performance infrastructure for training and inference.

AI Runway — Deploy Models Without Knowing Kubernetes

AI Runway is a new open-source project from Microsoft that provides a unified API for Kubernetes-based inference workloads. It gives platform teams a standardized interface for centrally managing model deployments and adapting flexibly as serving technologies evolve.

AI Runway delivers four core capabilities. First, through its web interface, ML engineers and data scientists can deploy models without knowing Kubernetes. There’s no need to write YAML directly—just follow a guided workflow.

Second, it has a built-in HuggingFace model catalog for convenient model discovery and selection. Third, GPU memory compatibility metrics and real-time cost estimation enable immediate resource planning. Fourth, it supports multiple inference runtimes including NVIDIA Dynamo, KubeRay, llm-d, and KAITO, avoiding vendor lock-in.

This project is significant because it dramatically lowers the barrier to inference workloads. Previously, serving models required manually configuring Kubernetes Deployments, Services, and Ingress, plus manually managing GPU resource allocation. AI Runway abstracts this entire process, letting practitioners focus purely on model serving.

Cilium Strengthening — Sidecar-Free mTLS and eBPF-Based Security

Microsoft dramatically expanded its contributions to the Cilium project. The key announcement at KubeCon was native mTLS ztunnel support, which implements encrypted pod-to-pod communication using X.509 certificates and SPIRE-based management—without sidecar proxies.

Sidecar-free mTLS is particularly critical for AI clusters. Removing sidecar proxy CPU and memory overhead improves pod density and reduces memory pressure on GPU nodes. The eBPF-based data plane, operating closer to the kernel, also improves networking performance.

Additionally, Hubble metrics cardinality control, flow log aggregation, and two Cluster Mesh Cilium Feature Proposals for cross-cluster networking were merged. AKS now offers additional networking and security options including Meshless Istio for application routing, WireGuard encryption, and Cilium mTLS.

New CNCF Projects — HolmesGPT and Dalec

Two Microsoft-contributed projects joined the CNCF sandbox.

HolmesGPT is an AI-powered agentic troubleshooting tool. It combines telemetry data, inference engines, and operational runbooks to automatically diagnose issues in complex cloud-native systems. While traditional observability tools show what happened, HolmesGPT reasons about why it happened and suggests remediation.

Dalec defines declarative specifications for building system packages. It generates minimal container images while automatically including SBOM (Software Bill of Materials) and provenance attestations. Given that supply chain security has become a critical concern in 2026, baking security into the build phase itself is a timely approach.

AKS Platform Updates — Enhanced Operational Stability and Observability

Azure Kubernetes Service (AKS) announced major updates.

On the operations side, Blue-Green agent pool upgrades were introduced to reduce deployment risk through parallel validation. Agent pool rollback capabilities enable quick version and image recovery, and Prepared Image Specification improves node provisioning speed and consistency.

For observability, GPU performance and utilization metrics now integrate with managed Prometheus and Grafana. L3/L4 and L7 (HTTP, gRPC, Kafka) network visibility has been added, and dynamic container-level metrics collection through Kubernetes custom resources is now possible.

In multi-cluster environments, Azure Kubernetes Fleet Manager supports managed Cilium Cluster Mesh, unified service registries, and centralized configuration management. For storage, clusters can consume storage from shared Elastic SAN pools, reducing per-workload disk management overhead.

For developer experience, AKS Desktop has achieved GA status, providing local development environments with production-parity configuration.

Practical Implications

The impact of these announcements on real-world operations breaks down as follows.

If you operate GPU workloads, pay close attention to DRA GA. Migrating from static nvidia.com/gpu allocation to DeviceClass/ResourceClaim-based dynamic allocation can dramatically improve GPU utilization through topology-aware scheduling and resource sharing.

If there’s a significant gap between your ML and platform teams, evaluate AI Runway. ML engineers can deploy models without YAML, allowing you to rapidly build a self-service inference platform.

If sidecar overhead is a burden, it’s time to consider Cilium’s sidecar-free mTLS. The performance benefit of removing sidecars is especially pronounced in AI workloads where GPU node resources are precious.

Conclusion

Microsoft’s KubeCon 2026 announcements make one direction clear: Kubernetes is evolving into a single unified platform that orchestrates GPU scheduling, model serving, networking, security, observability, and lifecycle management for AI workloads. DRA GA standardizes GPU scheduling, AI Runway democratizes inference workloads, and Cilium simultaneously strengthens AI cluster security and performance. If you operate AI infrastructure, these three areas should be your first priorities.

This article was originally published on ManoIT Tech Blog.