Field Signal · Curated Reading
The Engineering
Signal.
High-signal field notes, architecture teardowns, and engineering writing from 50 publications. A focused reading queue for becoming a stronger end-to-end engineer. Updated 19 Aug.
Kyverno is a platform primitive, not a security tool
Where does Kyverno live in your organization? I don’t mean which cluster! On which team’s slide deck does it show up? Whose budget line? For most companies I’ve talked to, the answer is security. Kyverno is...
Improving infrastructure efficiency for growing demand in the age of AI
As demand for AI continues to grow, so does the infrastructure needed to support it.
BGP Role model: tracking the adoption of RFC 9234
RFC 9234 lets routers reject route leaks on their own, using BGP Roles and the Only to Customer attribute. We measured who has deployed it, and found two Tier 1 networks unexpectedly stripping OTC.
Cloud Native platform sovereignty through multi-plane architecture
When people talk about cloud sovereignty, the conversation often starts with regions: where a workload runs and where its data is stored. But choosing a region is only part of the story. The architecture of the...
Consistency is the new latency: AI at the data layer
As AI agents move from chatbots to taking action, their reliability depends on the consistency of the data layer beneath them. This post examines how replication lag poisons an agent's context and shows how to match Amazon Aurora, Amazon DynamoDB, and Amazon Keyspaces replication models to each task...
Two ways to measure the cumulative impact of experiments
Summing individual wins overstates true impact. See two accurate methods, holdouts and Datadog’s Cumulative Impact, and how to choose between them.
Centralize human and agentic work with Datadog Work Management
Learn how Datadog Work Management helps you coordinate human and AI agent–driven work while preserving context, ownership, and activity across tools.
Trace AWS Lambda durable functions with Datadog
Trace AWS Lambda durable executions across invocations to investigate operations, retries, failures, waits, and function status in Datadog.
From OpenTofu to Argo CD: GitLab as your AWS control plane
Configuring cloud-based environments is complex, as it requires considering networking, subscriptions, services, and all the components that make up the underlying infrastructure. Manual setup is error-prone, inconsistent, and difficult to reproduce. This tutorial shows how to set up a fully automat...
Avoid the massive end-to-end tax of default full history clones
It's easy to think of git clone as a client-side operation, but the settings of this operation impact the server side and all networks in between. When you run a default full history clone, the server has to walk the entire history, build a pack file for it (that's what "counting objects" is actuall...
Welcome Falkey the Falco and Ky the Kyverno Pyrenees
If you have yet to meet Phippy, she’s a friendly PHP app exploring the cloud native world with her pals. Over the last decade, Phippy’s circle has grown to include eighteen friends, with the newest members...
Governance guidance for CNCF projects: Choosing the right structure for your project’s size and stage
Clear patterns have emerged from governance reviews across 72 CNCF projects, distinguishing between what the CNCF requires at each maturity level versus what the data recommends for long-term project health. This post captures those patterns as...
GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11
Open the source for the full engineering note.
Critical remote code execution in Serena, a popular MCP coding agent
Serena, one of the most widely used AI coding agents, ran attacker-supplied code the moment a developer opened a project. GitLab's Threat Research Group found a critical server-side template injection (GHSA-pp25-4cg4-qcr9, CVE pending) that executes arbitrary code in the Serena process. Anyone on se...
How Cloudflare detects MCP traffic and helps secure it
Cloudflare Gateway identifies MCP requests using protocol-level heuristics. Security teams can use that signal to find shadow MCP traffic, enforce Portal-only access for approved servers, and block direct connections on managed network paths.
Secure all your internal vibe-coded applications — in one click
Introducing Cloudflare Access for Workers. Attach an Access policy directly to a Worker and it applies everywhere that Worker runs — routes, custom domains, workers.dev, and previews — automatically.
Eleven minutes, zero humans: Building a self-healing Kubernetes upgrade pipeline on Kairos
Once upon a time, upgrading a Kubernetes control plane meant staying awake for it. SSH into every node. Run the upgrade by hand. Watch etcd health the whole time, hoping quorum holds through every reboot. This...
Serverless vehicle tracking at scale: Bosch L.OS on AWS
Learn how Bosch Mobility Platform Solutions built L.OS, a serverless vehicle tracking platform on AWS that unifies India's fragmented spot logistics market into a single real-time visibility layer using Amazon ECS, AWS Lambda, and Amazon MSK.
Data pipeline monitoring 101: Tracking health and performance across the data stack
Learn about monitoring the end-to-end health and performance of modern data pipelines.
Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal
Cloudflare's data shows a clear impact on Internet traffic from Iceland to Spain and Portugal, following the path of totality of the total solar eclipse that occurred on August 12, 2026.
Packer v1.16.0 brings verifiable provenance to machine images
Packer v1.16.0 adds native SLSA provenance generation and verification for machine images, along with new HCL2 features for provisioners and variables.
Track generative AI costs with Amazon Bedrock inference profiles
Learn how to track generative AI costs by department using Amazon Bedrock application inference profiles and AWS cost allocation tags. Create tagged profiles for each team and view per-department cost breakdowns in AWS Cost Explorer.
Recovery strategies to meet data residency requirements
Learn three strategies for achieving disaster recovery while meeting data residency requirements. Ranging from encryption-based controls on multi-Region replication to fully in-country architectures, these patterns help you balance recovery objectives with regulatory constraints.
Certificate Transparency Monitoring is now generally available
Cloudflare's Certificate Transparency Monitoring is now generally available. The biggest change: we no longer email you about certificates Cloudflare issued for your domain, so when an alert lands in your inbox, it's worth a look.
Lightweight Dragonfly Deployment: P2P Distribution Without the Database Stack
Dragonfly speeds up file and container image distribution using peer-to-peer (P2P) technology, but a standard installation deploys several components and dependencies. Beyond the Scheduler, Seed Client, and Client that move data, a traditional setup requires a...