Get Your Coding Agents Off Your Laptops: Changing the Blast Radius of Agents

Michael Forrester gave a coding agent root SSH to his nine-node Kubernetes cluster. Six minutes in, it ran kubeadm reset -f on every node and bricked every Linux box, and every call was authorized. The public coding-agent escapes of 2026 share the pattern: config-file hooks, symlinks, a Docker socket, DNS tunneling. None broke a hypervisor; each went around the sandbox. This talk covers:

The forensic timeline of the deleted cluster
How the 2026 escapes repeat it
Why end-user devices are the wrong runtime for agents
Running agents on Kubernetes with agent-sandbox: which runtime stops what, and per-session identity
Guardrails enforced by infrastructure rather than by the tool

From Kueue to Volcano: A 1st time journey for GPU-based workloads

A camp-fire tale for K8s platform engineers tackling GPU workloads.

🪵 Honeymoon – Kueue powers our clusters. Single-GPU camera jobs sail through; dashboards glow green.

🔥 Plot Twist – LLM training lands. Each job wants eight GPUs together. Queues stall, messages erupt: “Why is nothing finishing?”

🔎 Detective Work – With plain kubectl and the default dashboard we find Kueue granting half the GPUs, pods wait forever, 40 % of GPU cards idle.

🧬 Evolution, not Re-write – We drop in Volcano, turn on gang scheduling, keep the same Job YAML, and the backlog melts.

🎒 Take-away Kit – A quick checklist to know when to stay on Kueue and when to switch, copy-paste PromQL to spot starvation, and a GitHub lab to repeat the migration on a weekend rig.

No vendor tools—just Kubernetes, YAML, and the journey from “it kind of works” to “it really works.”

From Resistance to Resilency: Three Case studies in successful adoption of Kubernetes

From Resistance to Resiliency: Overcoming Challenges in Kubernetes Adoption
Kubernetes adoption often faces resistance, skepticism, and roadblocks. Drawing on over a decade of experience as a DevOps and CNCF advocate, this session tackles the cultural, people, process, and technology challenges that hinder progress while highlighting Platform Engineering as a critical evolution. Three compelling case studies show how businesses turned initial resistance into enthusiastic adoption, making Kubernetes central to their deployment workflows. Gain concise insights on converting detractors and a clear roadmap to address the "24 Critical Concerns Every Kubernetes Engineer Must Solve Before Going Live in Production." Whether you're just starting or stuck on your Cloud Native journey, this talk delivers actionable strategies to transform team dynamics, streamline processes, and foster a Kubernetes-ready culture.

Governing MCP for a Workforce the Size of a City

A demo of one agent calling one tool over MCP takes a minute. Putting MCP in front of a workforce the size of a city takes far more. In this talk, Michael Forrester lays out what the ideal looks like:

What makes an MCP server fit to run at enterprise scale
Why a registry and a gateway come last
Session history, and what it reveals about who is calling what
Token use that grows faster than the value it delivers
Why agents belong on servers, not end-user devices He closes on the two levers that did the most for security, scale and adoption: one technical, one not. Those two are shared only in the room.

Coding Agents Belong on Servers, Not Laptops: CLI Agents as a Platform Service

In what world would we run a bad actor on an end-user device? Why do we let one of the most powerful hacking tools in the world run in the user's context, inside our security boundary?

Most enterprises control the server side of their coding agents, then run the agent itself on a laptop with little limit on its blast radius, and hope. In this talk, Michael Forrester covers CLI coding agents as a platform service: each in its own runtime and identity on Kubernetes, with explicit grants to explicit services, MCP servers included. Every session reports to OpenTelemetry, and its history shows how the work can improve.

Attendees will see:

Session telemetry
Which tool calls and MCP servers ran
Session history turned into what matters to the business

CNCF Bingo: Play, Learn, Win!!!!!!

Clearing the Runtime Confusion: Which Agent Runtime Is the GOAT?

You've probably heard that containers aren't the most secure boundary for an agent. You keep hearing about microVMs and gVisor, but microVMs cost the most and containers are the Kubernetes default. What do microVMs actually stop that containers don't?

In this session we run Claude Code in agent-sandbox on each runtime and replay the public coding-agent escapes of 2026/2027:

Config-file hooks (Cymulate)
Symlinks (Wiz GhostApproval)
A Docker socket and allowlisted git (Pillar Security)
DNS tunneling (AWS AgentCore)
Plus new ones that have arisen since Q4 of 2026

Patched kernel and runtime CVEs that go through the boundary instead of around it run alongside. A live scoreboard shows which runtime stopped, detected or missed each attack, first alone, then with Kyverno, Cilium FQDN egress and Falco added.

For platform and security engineers choosing a substrate for coding agents. Attendees leave with the harness, SandboxTemplates and raw results to rerun on their own clusters.

Burrito Crimes in These AI Times: Attack, Then Defend, an Agent on Kubernetes

How much trouble can an end user really cause with an AI-powered chatbot? What guardrails do you need before a customer touches an AI tool on your cluster?

In this tutorial, you get your very own burrito-ordering chatbot, powered by kagent, on a full internal developer platform. You work in a browser terminal, and your cluster has everything an operator could ever want.

That is, everything except guardrails.

Your first job is to misbehave. Can you coax the chatbot into exploring the file system? Can you implore it to deploy a malicious image? Can you sweet-talk your helpful burrito friend into leaking PII into its trace data?

After each successful attack, you enact the block. Some predate AI, like network policies, Kyverno admission policies, and runtime policies from Falco/KubeArmor. Others are AI-specific, like input and output scanning, classifier models, and tool allow-lists.

Come for the burrito crimes. Leave knowing how to secure a customer-facing AI tool on Kubernetes.

K8sGPT and the Rise of AI Agents: Preparing for the Future of Kubernetes Engineering

Discover how AI agents like K8sGPT are revolutionizing Kubernetes management and shaping the future of engineering. This session explores the profound impact of AI on the Kubernetes ecosystem and provides insights into thriving in an AI-centric world. Witness live demonstrations of K8sGPT diagnosing issues, triaging problems, and collaborating with human engineers, as well as a homegrown demo with K8s engineering using open-source LLMs. Learn why your k8s domain knowledge will help you adapt to AI-agented workflows, and unlock new considerations in Kubernetes engineering. Explore a viewpoint on the rise of AI agents and their implications for Kubernetes over the next 5-10 years.

MLOps from Scratch: Build a Complete Data-to-Deployment Pipeline Using CNCF Projects

The MLOps landscape is overwhelming: 180+ projects, dozens claiming to solve "AI on Kubernetes," and most teams cobbling together tools without clear understanding or architecture. Through teaching 100,000+ engineers in various courses on CNCF, DevOps, and Machine Learning, we've discovered a power combination of tools for MLOps that works.

The biggest questions platform and ML students ask us:
- "Which CNCF projects do we actually need for each MLOps stage?"
- "Where do we start and what projects/tools do we need"
- "How do we go from experiment to production safely?"

This hands-on tutorial is an CNCF-opinionated attempt to answer these questions with a battle-tested MLOps pipeline built from thousands of student deployments, lab failures, and validation against the latest CNCF project capabilities. Leave with working manifests and a working GitHub repository showcasing cutting-edge CNCF capabilities (Volcano v1.11, OpenCost Incubating, HAMi GPU virt )for your environment.

Kubernetes and its amazing friends : A CNCF Landscape Speed Run & Beginner Survival Guide

Welcome to 2025, where the CNCF landscape resembles a maze—50+ projects, endless YAML, and persistent Kubernetes myths. In this humorous and rapid-fire session, we'll speed-run the sprawling CNCF landscape, bust popular Kubernetes myths ("It solves everything!", "It's easy!", "Just put databases in K8s!"), and highlight real-world beginner pain points. We’ll tackle common "what do you mean?" moments—multi-tenancy troubles, GUI gaps, hidden OS needs, and the eternal upgrade treadmill. You'll learn practical survival tips to simplify your Kubernetes journey, and glimpse how AI is poised to automate our YAML woes away. Laugh, learn, and leave ready to navigate Kubernetes—at least until the robots take over!

Platform Intelligence Playbook: What 50,000 Devs Taught Us About AI-Augmented Operations on CNCF

Teaching 50K+ engineers platform engineering and AI operations reveals clear patterns: how to start with AI ops, where automation helps vs hurts, and what safeguards prevent disasters. Teams that succeed follow similar approaches, while failures cluster around predictable anti-patterns.
This session demonstrates a reference architecture leveraging breakthrough CNCF innovations from 2025: Kagent for Kubernetes-native AI agents, OpenCost for GPU cost tracking, and the observability stack (OpenTelemetry, Prometheus, Jaeger, Fluentd).
Watch as we build an AI agent ecosystem showing how observability agents correlate signals, cost agents prevent overruns, and remediation agents fix issues—all while maintaining human oversight through OPA/Kyverno policy enforcement. This isn't hype—it's honest assessment of what works in early production (troubleshooting, cost optimization) versus what's still maturing (autonomous operations). Leave with practical patterns from thousands of real deployments.

The Spec Is the Skill: Why CLAUDE.md and agents.md Are the New Architecture Artifacts

AI coding agents read constraint documents before they write code. Claude Code reads CLAUDE.md. Block's Goose reads agents.md. Both are now Linux Foundation projects under the Agentic AI Foundation. I ran Kubernetes infrastructure builds with progressively detailed spec files and measured the difference. A prompt with no spec produced scattered output needing constant human intervention. A structured spec with build phases, dependency maps, and completion gates produced significantly better results. This talk introduces spec authorship as a cloud native engineering practice. These files belong in your repo alongside ADRs, Helm values, and Kyverno policies. Five real spec files are Apache 2.0 on GitHub.

The AI-Enhanced Platform Engineer: A 34-Component CNCF IDP, Built by an Agent

Have you wondered what modern, AI-enhanced DevOps looks like in 2026? Building platforms with AI is the norm now, so let's do it together.
In this hands-on tutorial we build a 34-component, CNCF-based IDP live, on a Kubernetes cluster I provide. You bring your own agentic CLI. I demo Claude Code. I hand you the spec file and we go phase by phase, from Kubernetes to Argo and up through the full stack to the AI gateway. Whatever CLI you brought, the spec drives the result.
You walk away knowing what the modern AI DevOps and SRE role feels like in practice. You can drive an agentic CLI against a spec to stand up a CNCF platform and validate what it built instead of trusting it. You can see the higher-order work that opens up once the low-level toil is handled. And you leave with a clear picture of the skill set an engineer actually needs in 2026 and beyond.

The 90-Minute IDP: AI Ate My Implementation. Let's Build a Platform Together and Score What's Left.

I've already built this IDP end-to-end with Claude Code. ArgoCD, Kyverno, Falco, OpenTelemetry, Backstage — the whole stack, from an empty cluster to a production-grade platform. I know exactly where the AI crushes it, where it faceplants, and where it gets dangerously close to something brilliant before going sideways. It gets weird. It also produces something awesome.

Now I'm doing it again, live, in front of you.

In this workshop, I'll hand Claude Code a build spec with test-driven gates and let it rip through building a complete Internal Developer Platform in real time. We'll provide lightweight lab environments so you can build alongside me — just bring your own Claude Code access. Got your own cluster? Bring that too.
Here's what I've learned: AI didn't just speed up implementation. It ate most of it. The Terraform modules, the Helm values, the boilerplate YAML — Claude Code handles that faster than any human. But what's left is the hard stuff: integration between systems, sync wave ordering, architecture, business context, policy conflicts, and the judgment calls that turn a pile of tools into a platform. Every component (k8s, argocd, prometheus) gets scored on a live scorecard so you can see exactly what AI ate and what it choked on. Oh and we scorecard not just the installation, but hte integration and the platform usability as well.

The implementation layer is supposedly disappearing. Let's find out what replaces it.

Build a Platform, Unleash an Agent on it.... and Watch it Burn!

You get a Kubernetes cluster with an Internal Developer Platform already running: ArgoCD for GitOps, Kyverno for admission control, Falco for runtime detection, Prometheus for observability. You also get an AI agent that reaches its tools over MCP and holds scoped cluster access, and you drive it through a set of attacks. Deploy a non-compliant workload. It goes through, because nothing stops it yet. Turn on the guardrail and run it again. This time it gets rejected. Try to escalate privileges. Try to modify infrastructure outside Git. The controls already in place reject both. Then exfiltrate data through the agent's own response. It works, because none of the existing tools inspect what the agent says back. Turn on the agent-specific guardrail and the same attempt gets blocked. When we regroup, we map what happened. The 80% that existing LF/FOSS/CNCF tools already govern gets shut down the moment the right control is on. The 20% that gets through, the data leaving in the agent's response, stays open until agent-specific tooling closes it. You leave with a concrete governance map and the exact list of failure modes your own platform probably is not covering yet.

BurritoBot Said Let's Dance, the Platform Said No

In 2026, a developer asked a burrito chain's chatbot to reverse a linked list before ordering their meal. The bot delivered a solution, then asked what they wanted.

A user does not need to be malicious to embarrass an enterprise, just a little bit weird. The model will help, enthusiastically. But that burrito bot sits in a production cluster that someone (probably you) is responsible for, wired into real tools and data. More than reputation is at stake.

In this session we build a chatbot for a fictional burrito chain connected to an under-protected MCP server and deploy on a full IDP (internal developer platform). It starts wide open, and we let the audience hack it live.

We show you the relevant Kubernetes security layers you should already have. Then we turn on LLM-specific guardrails, like pre- and mid-inference prompt analysis. Finally we show good GenAI observability practices. By the end the chatbot is selling burritos. Nothing more.

Bring your weirdest off-topic question.

Governing MCP for a Workforce the Size of a City

Connecting one agent to one tool with MCP takes minutes. Rolling MCP out across a large engineering organization is a different job. Hundreds of servers stood up independently, credentials copied into clients, no inventory, and nowhere to say no. The protocol scales. The deployment is what fails.
This session covers deploying MCP as governed infrastructure. A registry as the source of truth for which servers exist, who owns them, and what an agent may discover. A gateway as the single path between agents and tools, where identity, authorization, rate limiting, and policy are enforced instead of rebuilt per server. An AI gateway as the governed route to inference, holding credentials centrally and running guards on the way in and out.
Then the rollout: phased rather than switch-flipped, the control plane managed through GitOps, admission control so an unsanctioned server cannot land, runtime detection for the tool-execution surface, and workload identity so the gateway knows which agent is calling.
We close on what breaks at fleet scale: the violations a gateway catches cleanly, the ones that slip past, version skew, and the paths agents find around the control plane.

What Does a Good Agent Look Like? Observing Claude Code in Production With OpenTelemetry

You feel faster with a coding agent. Feeling faster and being faster are not the same thing, and most teams cannot tell which one they are running. An agentic coding tool plans, calls tools and MCP servers, and edits your systems, and it emits all of it over OpenTelemetry. The production question is what that telemetry should tell you. Are your engineers more productive or just busier? Where does the spend go, and where does the agent stop earning it? What does good agent behavior look like for a given role, and what is the agent touching when no one is watching? This session works those questions through real agent telemetry: what an agent like Claude Code exposes over the OTel GenAI semantic conventions, which signals matter for productivity, cost, and security, and how much to keep before you are paying to store noise. Two organizations share what they collect on their own engineers and what they act on, then a live demo runs the same agent telemetry through an open CNCF stack, OpenTelemetry into Prometheus, Loki, Jaeger, and Grafana, and a commercial backend side by side, so you can decide what to operate yourself.

The Day Claude Code Deleted My Cluster: A Cautionary Tale About AI Guardrails

"You have full access to the pipeline. Do what you need to do."
Famous last words.
In this lightning talk, I'll share the hilarious (and horrifying) story of what happened when I gave Claude Code full pipeline access and stepped away for 30 seconds. When I came back it had not only completely wrecked the Kubernetes cluster but not even two troubleshooting systems sessions later it wrecked almost every network card in the set of Linux systems.
This is a story about nondeterministic systems, the illusion of AI understanding, and why "the AI knows what it's doing" is the most dangerous phrase in modern DevOps. I'll share the actual troubleshooting spiral that escalated from "let me help" to "I've destroyed your cluster and systems," and the guardrails I now enforce religiously.
5 minutes. 20 slides. And one very hilarious probably very blameful post-mortem with Claude Code afterwards. One very expensive lesson about trusting AI agents with infrastructure access even if it was just for a short while.
Come for the disaster. Stay for the wisdom.

AI Assisted Hands-On Learning - the Future of Education

In an era where Cloud Native skills are in high demand, traditional learning methods often fall short. This session explores the transformative power of AI-assisted hands-on learning in revolutionizing Cloud Native education. We'll delve into how interactive labs have enabled us at KodeKloud to effectively teach millions of students, equipping them with practical skills in Kubernetes, Docker, Ansible, and more. Discover how AI-driven interactive platforms are shaping the future of education by providing personalized, immersive, and scalable learning experiences. Join us to uncover best practices and innovative techniques that can elevate your approach to Cloud Native training, ensuring your learners are prepared for tomorrow's challenges.

Deploying Agents at Scale: What Enterprise Adoption Actually Looks Like

Most enterprise agent rollouts stall. Using a controlled trial (METR), telemetry from 22,000 developers (Faros), and my own platform teardowns, I'll show what the teams getting real value changed: how they restructured work, where they put guardrails, and what they measured. Real numbers, no decks. This talk is about what the minority who get compounding value did differently at the engineering layer — not the strategy layer. We'll go through the evidence honestly: METR's randomized controlled trial, where experienced developers were 19% slower with early-2025 AI while believing they were faster; DORA 2025's finding that AI is an amplifier of existing strengths and dysfunctions; Faros's telemetry across 22,000 developers showing throughput up and stability down at the same time; and the security data on what AI-generated code actually ships. I'll tell you which numbers are controlled studies, which are vendor telemetry, and which are forecasts, so you can check my work.

Then the concrete part: how the teams that succeeded restructured review and testing to absorb machine-speed output, where they put guardrails — infrastructure-layer controls the agent cannot bypass versus reasoning-layer controls that live in the same logic the agent reasons in — what they actually measured instead of "PRs merged," and which skills their engineers needed. You'll leave able to tell whether your own environment is ready to open the throttle, and what to fix first if it isn't.

The Levers That Significantly Move Agent Performance: Reasoning, Consistency, and Alignment

Everyone has an opinion about which model is best. Far fewer people can show, with production data, which levers change a coding agent's output. Drawing on OpenTelemetry data from real coding-agent sessions and on enterprise rollouts where consistency matters more than demos, this lightning talk works through the levers one at a time: context engineering, reasoning effort, permissions and hooks as behavioral rails, eval loops, and the narrow set of cases where model choice really matters. For each lever, attendees get what it costs, what it moves and how to measure it in their own environment.