KubeCon + CloudNativeCon Japan 2026
July 28–30, 2026 · Yokohama, Japan.
KubeCon + CloudNativeCon Japan 2026 brought adopters and technologists from the open source and cloud native communities to Yokohama. CNCF-hosted co-located events ran on July 28, followed by two days of keynotes, breakouts and the Solutions Showcase on July 29–30.
Speakers who shared their slides have them attached to their sessions in the schedule.
Sessions from end user organizations
The event published no end user track, so the sessions below are those whose speakers listed an organization that meets the CNCF End User definition as their company in the official schedule: an organization that uses cloud native technologies internally rather than selling or supporting them. They include CNCF End User members such as Adobe, Airbnb, Ant Group, Apple, Cybozu, Intuit and LY Corporation alongside adopters such as Atlassian, CyberAgent, Enpal, Hyundai AutoEver, Japan Airlines, Mercari, Netflix, NTT, Preferred Networks, Rakuten Mobile, Recruit, Reddit, Shopify, SoftBank, Sony Interactive Entertainment, Subaru and Synspective, plus researchers from Keio University, GIST and NYU and a student maintainer from BITS Pilani.
52 sessions, presented by speakers from organizations that meet the CNCF End User definition. All times are JST (UTC+9), local to Yokohama. Some sessions overlap; talks in the same time slot run concurrently.
Source: official Sessionize API · Verified October 31, 2026. Times, rooms, and speakers may change; check the live official schedule for updates. Mohammad Mikal Bin Amrul Halim Gan The rise of autonomous agents introduces a radically volatile workload profile: short-lived, heavy-compute pods that demand instant GPU/CPU access and vanish. In this keynote, we deconstruct a fundamental Infrastructure paradox: infinite agent demand versus strictly finite physical compute, space, and power. Using a simple trade-off curve as our focal point, we present an architectural vision to safely scale for the autonomous future. 1F | Main Hall Aya Igarashi As AI technology advances, a multi-tenant computing infrastructure has become essential for supporting diverse user workloads. Building a multi-tenant platform to handle various workloads, including AI and ML, relies heavily on Kubernetes' powerful extensibility and careful integration with CNCF ecosystem technologies. In this session, we will share the design philosophy behind our Kubernetes platform. We will provide a high-level overview of our platform's architecture and discuss how we leverage cloud-native projects to orchestrate complex workloads. Attendees will gain practical insights into building infrastructure that keeps pace with the evolving open-source landscape. 1F | Main Hall Ryoji Kobayashi Subaru is developing AI models in-house to further improve the recognition accuracy of next-generation EyeSight. As AI development activities expanded, the team faced several challenges, including large ML container images, manual deployment operations, and increasingly complex machine learning workflows. To address these challenges, Subaru built a Kubernetes-based AI model development platform using cloud native technologies such as Harbor, Envoy Gateway, MetalLB, Argo CD, Helm, and Argo Workflows. These improvements reduced container image pull time from approximately three hours to three minutes, enabled GitOps management for 25 application definitions, and automated machine learning workflows. In this session, Subaru will share how it used Kubernetes and CNCF technologies to address key challenges in AI model development and accelerate its development workflow. 1F | Main Hall Shota Yoshimura LY Corporation operates one of Japan’s largest private Kubernetes platforms, managing more than 1,300 clusters and 40,000+ nodes with only 15 platform engineers. This 3-minute keynote will share how LY uses Kubernetes custom resources and controllers to define infrastructure declaratively and automate cluster provisioning, scaling, upgrades, and recovery across OpenStack-based private infrastructure. Using the platform architecture diagram as the focal point, the talk will show how declarative automation reduced provisioning from weeks to hours, enabled zero-downtime operations, and turned Kubernetes into a self-service platform for product teams. 1F | Main Hall Jaewoo Choi Hyundai Motor Group runs its global platform on hCloud, its own in-house private cloud, and provides open source tooling for its CI/CD pipelines. A single Argo CD instance now manages 5,000+ Applications across 300+ Kubernetes clusters worldwide, growing by hundreds of new Applications every month, while a multi-region Harbor registry holds 60k+ artifacts across 5k+ repositories, replicated across 3 regions to balance data-residency regulation with performance. 1F | Main Hall Michael Crenshaw, Robin Lieb GitOps started with a simple idea: Git is the source of truth. But as the ecosystem matures, OCI is increasingly used to ship Kubernetes config, and the gaps are becoming hard to ignore. Git gives you history, blame, diffing, and PR-based review for free. OCI gives you content-addressable, distribution-ready, airgap-compatible artifacts. Yet the industry is replacing one with the other as though the properties of Git were incidental, not foundational. This talk introduces Kokumi, an experimental config delivery tool designed for an OCI-first world. Kokumi integrates with Helm and Kustomize to define per-environment config, renders OCI artifacts, and delivers them via Argo CD. This functionality is wrapped in a beautiful UI that feels like the future of Kubernetes deployment. What does the future of OCI-Ops look like? This talk won’t have all the answers. But it will offer a glimpse into the future and spark the audience’s imagination so that we can build that future together. 5F | 501 Kohei Sugihara, Toru Komatsu User Namespaces improve the security of multi-tenant Kubernetes by separating UID/GID between container and host. However, bringing them into production faces a big wall on providing ReadWriteMany (RWX) shared storage. With User Namespaces, volume mounts used on the ID-mapped mount in Linux, but its file system support depends on each filesystem implementation, so there is a case where we cannot apply it for existing remote filesystems. Our Kubernetes AI/ML platform has multiple storage systems already, and migrating all existing data to another supported filesystem was not a realistic option. Instead of replacing the storage layer, we chose to use NRI to adjust mount definitions at container startup, allowing both User Namespaces and RWX shared volume for existing storage environments. In this session, we will share the design decisions behind this approach, and practical lessons for introducing User Namespaces into a production Kubernetes platform with existing data assets. 4F | 414+415 Shingo Omura, Yiyang Zhan When self-hosting LLMs, adopting advanced inference technologies prematurely drastically increases deployment complexity. How should engineers evaluate these tools and determine the right time to introduce them?
Through a real-world case study, the speakers will share their journey of evolving a minimal vLLM architecture into a robust multi-tenant platform using Envoy AI Gateway and Athenz. They will highlight how establishing this foundation—enabling authentication, rate limiting, and crucial tenant-level usage statistics—is a vital use case for safely supporting multiple teams.
Building on this operational foundation, they will discuss their ongoing evaluation and incremental adoption of advanced optimizations like P/D disaggregation and intelligent routing using actual production bottlenecks.
Attendees will learn what each optimization improves, the operational trade-offs, and the optimal timing to introduce them with manageable complexity. 5F | 502 Liz Rice, Hiroki Hanada Cilium is now 10 years old, and has become the de-facto standard secure networking solution Kubernetes. This session gives updates on the latest developments in Cilium and showcases how its eBPF-powered stack is transforming and simplifying networking and runtime security in Kubernetes environments and beyond. You’ll hear from Cybozu about why they chose Cilium for efficient networking, L4 load balancing, and network policy, and learn how it supported their migration of services from VMs to Kubernetes on bare metal and enabled secure, scalable operation of their platform in production. You’ll also hear about community activities around the Cilium project and learn how to get involved, as the project moves into its second decade! 5F | 503 Kevin Dubois, Carlos Sanchez Despite our best efforts in testing software, software rollouts can still go wrong, and the process to roll back and find a fix can be painful and complex. Tools like Argo Rollouts provide a robust foundation to ease the pain, but with AI we can revolutionize the developer experience around it. This session shows how you can elevate your release process by: * Analyzing rollout failures using AI agents that connect to your cluster to gather logs and metrics.
* Employing intelligent, cloud based coding agents that can make code corrections based on the failure analysis and create automated PRs and timely notifications.
* Embracing Human-in-the-Loop oversight by allowing developers to review and course correct if needed. This strategic combination of Cloud Native tools leads to significantly reduced Mean Time To Recovery (MTTR) and a more resilient, productive developer experience. Join us to discover the future of seamless software delivery! 4F | 414+415 Nibir Bora, Matt Morrison This session presents case studies from two companies that independently arrived at the same conclusion: Cluster API as the declarative foundation for fleet-scale Kubernetes. One runs 100+ multi-tenant clusters with its entire stack running on Kubernetes. The other provisions isolated clusters per customer across SaaS, BYOC, and self-managed deployments. Both replaced days of manual toil with automated pipelines. Kubernetes was designed for a single cluster. But scale ceilings, blast radius, tenant isolation, compliance, and cloud migrations force real businesses into managing 100s of clusters. Most companies should not start here: this talk covers why. But some have no choice. Attendees will leave with:
- A decision framework for when multi-cluster is necessary versus premature.
- What forced scale-out and how it was solved at two companies.
- A tested pattern for managing 100s of Kubernetes clusters using Cluster API.
- When to build custom operators versus compose existing tools. 1F | Main Hall Rihito Bannai, Hidehito Yabuuchi As AI/ML workloads grow in importance on Kubernetes, evaluating schedulers at scale is critical yet costly. Running tens of thousands of real jobs across thousands of nodes is expensive, and training jobs can take days — making real-time evaluation impractical. Existing tools fall short: scheduler_perf is limited to micro-benchmarks, and kwok/kind still run in real time. We developed kube-scheduler-evaluator, an open-source framework with three key capabilities: Go-Based Scenarios: Define large-scale workloads programmatically using Go, not static YAML.
Virtual Time: Decouple simulation from wall-clock time — a multi-day cluster trace with thousands of GPU jobs can complete in seconds.
Flexible Execution: Run as a single binary with emulated controllers, or connect to kwok, kind, or a real cluster. Attendees will learn how to evaluate schedulers using kube-scheduler-evaluator and how to apply the results to accelerate scheduler development. 5F | 502 Upendra Gurugubelli, Masaya Arai When your Kubernetes deployments must avoid interrupting a live satellite link 500km above Earth, standard rollout strategies fall short. Synspective operates a constellation of SAR observation satellites where ground systems maintain stateful connections during passes. A deployment at the wrong moment risks losing contact with a satellite in orbit. Each satellite has different communication windows, and as the constellation scales toward 30+ satellites by 2030, manual coordination becomes impossible. This session presents how Synspective adopted cloud native practices across two mission-critical ground subsystems. First, how Argo CD replaced manual CIOps with declarative GitOps pipelines, delivering auditable, reproducible deployments across multiple environments. Second, how Argo Rollouts enables progressive delivery gated by real-time satellite pass schedules (AOS/LOS windows) from ground station APIs, ensuring releases never interrupt active communications. 3F | 315 Shota Yoshimura Many Kubernetes talks focus on scaling out to support growth, but large platforms also need safe ways to scale in. This is especially true for on-premises Kubernetes as a Service, where unused node capacity affects hardware procurement, rack capacity, and long-term operations. This talk shares how we built a custom controller to consolidate underutilized worker nodes safely across 1,300+ clusters and 40,000+ nodes. At this scale, underutilized nodes were no longer isolated inefficiencies but a meaningful capacity problem. We needed a more conservative model than a general-purpose autoscaler could provide, so the controller uses observed node usage, seven-day peak metrics, minimum replica guarantees, and machine-group-level safety checks before taking action. We will also cover safeguards including graceful shutdown expectations, DaemonSet termination ordering, and node deletion behavior designed to minimize user impact. 5F | 501 Yuta Nagai youki is a Rust-based OCI runtime and the only low-level container runtime within the CNCF ecosystem. It is invoked by Kubernetes and containerd to create and manage isolated Linux processes based on OCI bundles. While established runtimes like runc and crun are widely adopted, youki continues to evolve through active development and contributions. In this session, we will explore youki's architecture and its path toward the 1.0.0 release, with a primary focus on improving compatibility with runc as a key requirement for real-world adoption. Beyond this, we will highlight additional efforts, including integration with libkrun for VM-based container isolation and the implementation of seccomp support natively in Rust to remove the dependency on libseccomp. We will also share how youki collaborates with related CNCF projects in these areas. Attendees will leave with a clear understanding of youki's current state, its challenges, and how to get involved. 3F | 313+314 Ansuman Sahoo Initially created for local containers, Lima has since grown into a universal sandboxing tool for developers. In this talk, I will introduce Lima! What would you do if an AI coding assistant hallucinated and attempted to delete your local workspace? As AI agents become integrated into our daily workflows, running them locally on your host machine is becoming a security risk. You'll also learn about Lima's new support for GPU acceleration, MCP servers, and protective sync modes, and how you can safely run your AI agents entirely in a VM or connect to the VMs from the host. Come see how Lima is helping to make local container development and AI experimentation fast, easy, and safe! 3F | 313+314 Jinwang Mok, ChangHyeon Im Research labs face distinct challenges: heterogeneous hardware, stateful services, and student operators who learned Kubernetes on the job—accumulating legacy no one dares untangle. Our environment: four bare-metal clusters over 100GbE—a 2PB Rook-Ceph lake, a 22-GPU cluster (7 types incl. L40S, A100), edge devices—run by grad students. We call our unified multi-cluster target "ScaleX-POD". Migrating demands two hurdles: risk-free live migration and tenant isolation. First, extracting a management cluster from production while external tenants actively run—transferring ArgoCD ownership without orphaning pods or storage, dry-running via vcluster. We share what broke and what we would change. Second, Kyverno-enforced isolation: PSS Restricted, default-deny NetworkPolicies, namespace-scoped RBAC—containing blast radius during and after migration. Attendees gain failure lessons, migration trade-offs, and a PR-based workflow to reduce knowledge loss across operator transitions. 1F | Main Hall Katie Gamanji With Kubernetes established as the foundation of platform deployment, the cloud native ecosystem continued to evolve to meet the demands of the growing end user community. Today, the landscape stands at an inflection point, beyond containers, where AI is rapidly becoming an integral part of established and emerging projects. This talk examines the current state of the ecosystem through the lens of the AI shift. It explores the established patterns, governance models, and community structures that stabilized the cloud native landscape and are now becoming the blueprint for a mature open source AI landscape. The session takes a reverse engineering approach to understanding where the ecosystem is headed. The attendees will learn how core principles, such as openness, vendor neutrality, interoperability, and an open community, are becoming the driving forces behind this next wave of transformation and the shift towards AI. 1F | Main Hall Ho Kim, SangJoon Park The cloud-native world has long embraced separating compute from storage. But AI workloads are exposing a new bottleneck: the network itself. Vendors respond by preprocessing data to cut bandwidth, or integrating RDMA and specialized hardware for faster transfers. The first still saturates the network during preprocessing. The second trades openness for hardware lock-in. We took a third path: running user-defined WebAssembly code directly inside the storage cluster, as close to the NVMe devices as possible. Unlike SQL pushdown, computation is free-form. Unlike a compute cluster, data never leaves the storage nodes.
We will share how we used CSI and Gateway API on Kubernetes to expose this as a cloud-native, open-source capability.
Along with the dead ends we hit, the benchmarks we ran, and the security boundaries we have not yet crossed. The project is open source. We want the community to tell us what comes next! 4F | 414+415 Seungtae Moon Most predictive maintenance systems send alerts based on thresholds – notify when a sensor reading crosses a limit, then leave root-cause analysis and decision making to engineers. This session presents the architecture of a self-evolving AI Agent system designed for manufacture domain on a Kubernetes-based platform. Rather than building a single monolithic agent, the speaker shows three key design decisions: (1) a ReAct-based cognitive architecture with a modular skills engine, (2) a hierarchical multi-agent deep search architecture using a multi-perspective pattern with cross-reference synthesis, and (3) a self-evolving mechanism where the agent detect repeated interaction patterns via reflection and autonomously registers new skills. Attendees will leave with a concrete architecture for building AI Agent systems that run as cloud native microservices on Kubernetes – designed to be modular, observable, and extensible across any industrial domain. 5F | 502 Xu Wang, Yu Hu Now a days, the applications are moving to agentic. On the other hand, as the codes fetched or generated by agents can not be treated as trusted product and we should keep our confidential data and infra control plane untouchable by the agent directly. Based on existing (proved) Kubernetes infrastructure, we (kata container developers, ant open source team, and Japan AI team) build the sandbox services with agent-sandbox, Kata Containers, dragonfly, and pvm kernel virtualization driver, which make the service not only secure, but also secure enough. Live demo will be shown in this session. 1F | Main Hall Adam Phan At enterprise scale, rolling out internal AI Agents in production becomes a platform challenge that spans confidentiality, governance, review quality, and cost. This session examines how Sony Interactive Entertainment’s Engineering Enablement team took a code review AI Agent from early experimentation to production rollout across more than 400 internal PlayStation repositories. The talk explores the architectural and operational tradeoffs behind introducing AI-assisted reviews on a shared enterprise platform while protecting confidential code, satisfying security and compliance requirements, and scaling Kubernetes workloads to meet demand. It covers rollout and governance patterns, quality evaluation, cost control, and the operational boundaries between human judgment and AI-generated feedback. Attendees will leave with practical patterns for introducing and operating AI-assisted development workflows on a shared enterprise platform. 5F | 502 Ruslan Kadyrov As systems scale, data rarely disappears - only accumulates. For large-scale platforms, this creates a hidden but critical problem: unbounded data growth becomes a primary driver of infrastructure cost and migration risk. At Mercari, one of our core MySQL tables reached billions-scale records as the platform expanded. During our migration to a cloud-native distributed database (TiDB), we discovered that historical, inactive data - not live traffic - had become a significant factor influencing cost and migration complexity. This talk presents a real-world case study of designing and executing a large-scale data lifecycle management strategy, focusing on reducing the impact of dormant records that no longer contribute to active user workflows, while preserving full user-facing functionality and data accessibility. This session focuses on practical patterns for managing data growth in cloud-native environments and highlights why data lifecycle management must be part of any scalable platform strategy - not an afterthought. 4F | 414+415 Kevin Wang, Karena Angell, Faseela Kundattil, Mauricio "Salaboy" Salatino, Katie Gamanji For active contributors in the cloud-native ecosystem, the greatest challenge is often not code, but transitioning to a broader perspective: how to leverage influence to guide a project toward a healthier, sustainable community. True open-source leadership is never about power grabbing or acquiring titles; it is rooted in facilitating consensus and building a shared vision across a diverse, multi-vendor ecosystem.
In this panel, CNCF technical and community leaders will combine their macro-level perspectives with hands-on governance experience to deconstruct how to naturally establish technical influence by fostering consensus. Key topics to be covered:
- The Mindset Shift: Evolving from a tactical "issue solver" to a strategic community steward.
- Shared Vision: Transcending corporate interests for genuine, vendor-neutral consensus.
- Navigating Conflicts: Resolving technical disagreements to keep projects moving forward.
- Sustainability: Empowering others and building healthy mentorship pipelines. 1F | Main Hall Kensei Nakada, Yuki Iwai "Over the past year, SIG Scheduling has been redefining how Kubernetes approaches scheduling—moving from a Pod-centric model toward a holistic, Workload-aware architecture. This shift influences not only the scheduler internals, but also many external components which interact or integrate with kube-scheduler over a new set of APIs. In this session, we will walk through the major scheduling enhancements introduced in recent releases and explain how they fit into the broader Workload-Aware Scheduling initiative. We will also share updates from related sub-projects, including Kueue and the Descheduler. Finally, we will present what is on the agenda for the future releases, summarize community contributions and outline opportunities to help in shaping the future of Kubernetes scheduling." 5F | 503 Aoi Nishijima, Moeka Okamura, Kohei Yamamoto How can an enterprise developer start coding in 30 mins instead of 165 days? Platform Engineering is often idealized in greenfield environments, but large enterprises face a labyrinth of legacy processes. At JAL Digital, 4,000 engineers supporting 500 systems were bound by silos—requiring 15 departments and 40+ forms for environment setup, hitting a staggering 165-day lead time.
We share our journey of transforming this rigid organization through a true cultural shift focusing on three pillars: Mixed Teams to end "us vs. them" conflicts, Autonomy as Fuel by letting teams choose their own tech like Backstage to ignite passion, and Small Wins by targeting high-friction bottlenecks first to gain trust.
We will demonstrate an architecture that automates legacy approvals into a "one-click" experience. This story is for every engineer—especially the next generation—trapped in bureaucracy. Learn practical, human-centric steps to build a platform developers actually want to use. 3F | 315 Alolita Sharma, Ted Young Seven years after the unification of OpenTracing and OpenCensus, OpenTelemetry celebrates its CNCF graduation—having successfully conquered production security and scale, stabilized semantic conventions, and unified all four core data signals into a single interoperable fabric. As OpenTelemetry enters its next frontier, we are thrilled to unveil a new era of intelligent observability—propelling native support for Agentic AI, high-efficiency OTel-Arrow transport, continuous profiling, and smart, entity-driven sampling. Come celebrate and join in to build the next generation of open-source observability. 1F | Main Hall Ryota Yonekura PowerX operates more than 200 EV chargers around Japan, and keeping them running reliably is the single most critical challenge for our service. Managing software across a large number of edge devices while maintaining reliability has always been a major burden for our SRE team. In particular, achieving consistent operations in an environment where devices with limited resources are intermixed proved especially difficult.
In this keynote, we'll summarize the solution we put into practice to address these challenges: building a large-scale edge management system on top of Kubernetes. Why did we choose Kubernetes from among the many available options, and why did we then adopt k0s specifically? How did we design a hybrid cluster connecting the cloud (GKE) with the edge? How do we efficiently collect metrics from resource-constrained devices, and how do we switch between OpenTelemetry's push-based and pull-based approaches to ensure observability? 1F | Main Hall LeRenzo Malcom The Grid Is Becoming a Distributed System Energy systems face pressure from geopolitical shocks, electrification, extreme weather, and digital infrastructure. The grid needs more than new generation; it needs flexibility. Japan makes this challenge tangible. Its energy self-sufficiency rate is around 15%, while roughly 70% of electricity generation depends on fossil fuels. Yet Japan targets 40–50% renewable electricity by FY2040 as demand rises from data centers, semiconductor manufacturing, and electrification. As solar, batteries, EVs, and heat pumps spread, valuable grid resources are moving into homes and cities. Virtual Power Plants coordinate these devices as one software-defined energy asset, shifting demand, storing renewable energy, and improving resilience. This keynote explores why the grid behaves like a distributed system, and how cloud-native patterns can help operate it.
The next power plant may be one million homes, batteries, and EVs, coordinated by software. 1F | Main Hall Kazuki Sato As AI's appetite for compute keeps growing, a single urban data center hits a hard physical wall — not racks, but power and land. No amount of expansion at one site solves it. It's a challenge the whole world shares, and one that hits especially hard in Japan, where land is scarce. So instead of expanding one site, NTT DOCOMO BUSINESS distributed GPUs across Japan. Over a wide-area L2 network built on IOWN APN (All-Photonics Network) technology, we operate eight data centers — more than 2,000 km from Sapporo to Fukuoka — as a single Kubernetes cluster. But a fast network alone isn't enough. The real challenge is making that distributed capacity usable as one: multiple tenants in secure isolation, existing workloads running as-is, with the feel of a single site. We made that real with cloud native technologies — above all, KubeVirt. What matters most is who built it: engineers from Japan and Korea, brought together by open source. Because Kubernetes and KubeVirt gave us a shared language, NTT DOCOMO BUSINESS and SK Telecom could design as equals across a national border. Our takeaway: a challenge the whole world shares can be addressed on the common ground of CNCF, where companies and countries co-create a solution together. This one was built by engineers in Japan and Korea — and from here in Japan, we want to take this distributed architecture to a world facing the same wall. 1F | Main Hall Alolita Sharma What happens when “observability” meets industrial “IoT”?
In this session, we will dive into where OpenTelemetry can be used in IIoT environments. We will also cover how to use OTel’s flexible architecture to observe industrial equipment, inform preventative maintenance, and ensure quality control (QC).
Join in to learn about how to configure the OpenTelemetry Collector to handle industrial protocols (e.g., MQTT, OPC-UA) alongside standard OTLP (OpenTelemetry Protocol) to bridge “shop floor” data to cloud-native “top floor” pipelines. And learn to leverage OpenTelemetry metrics and traces for preventative maintenance and real-time QC alerting. 3F | 315 Marco De Vincenzi, Justin Cappos Software Bill of Materials (SBOM) adoption is accelerating, driven by regulatory mandates and high-profile supply chain incidents. However, a critical and underappreciated problem persists: SBOMs can be inaccurate. Traditional SBOM generation tools rely on static analysis or package manifests, approaches that routinely miss dynamically downloaded dependencies, build-time artifacts, and network-fetched components.
This talk introduces SBOMit, an OpenSSF project, a supply-chain security framework that solves the accuracy problem by generating SBOMs from in-toto attestations captured at build time. Rather than inferring what was used, SBOMit observes and records it, leveraging the witness tool to trace filesystem reads and writes, process execution, and outbound network connections during the actual build. Every dependency encountered during the build is captured and cryptographically authenticated. The resulting SBOM is not a best guess; it is a verified record of what was built. 3F | 313+314 Siddharth Vijay Running OpenSearch in a poker platform means no margin for error. Fraud detection can't wait. Player stats APIs can't lag. And the cluster doesn't care about your traffic spikes.
We operate OpenSearch under mixed workloads: high-volume writes from hand histories and gameplay events, aggregation-heavy fraud queries, and latency-sensitive reads serving live player statistics. Standard deployment advice doesn't survive this combination.
This talk is purely operational. We cover JVM heap sizing under write pressure, threadpool tuning for bulk ingestion and search isolation, shard sizing, rollover strategies, and capacity planning for uneven traffic — with the specific mitigations we applied after hitting queue saturation, GC pauses, and hot shards in production.
We also cover index lifecycle management, retention tradeoffs, and monitoring signals that matter when OpenSearch sits in your request path.
You'll leave with concrete operational guidance well beyond basic deployment patterns. 5F | 501 Aoi Takahashi, Junya Okabe While Kubernetes powers the world, its ""English-first"" nature can be a daunting barrier. SIG Docs bridges this gap through localization, but how do we keep these efforts sustainable? This session explores the Japanese team’s journey in cultivating one of the project's most active localization communities. Forget dry history lessons – we’re delivering a hands-on roadmap and examples for new contributors. You’ll walk away knowing exactly how to navigate the SIG Docs repository and land your first PR. We’ll also ""pull back the curtain"" on our real-world struggles: managing relentless upstream velocity, ensuring technical accuracy at scale, and the honest debates shaping our future workflow. Whether you’re a documentation veteran or a first-time contributor, you’ll learn how we built a localized ecosystem in Japan that empowers users worldwide. 4F | 414+415 Iris Grace Endozo, Farzad Vazirnia OpenTelemetry has become the industry standard for Observability: a single, vendor-neutral framework for metrics, traces and logs backed by CNCF. But adopting it is a different story when you already have a legacy but stable
observability platform that "works" from collection to pipeline processing to storage. At Atlassian, the Observability team ran statsd as a bespoke metrics pipeline for years: high-performance statsd servers collecting and aggregating metrics from around 100k hosts across 14 regions. It served the team well but the cracks were showing: UDP-only ingestion, no support for traces or logs and standards increasingly out of step with where the ecosystem was heading. This talk walks through why the team migrated to an OpenTelemetry Collector-based pipeline and landed everything in their metrics backend without downtime or data loss. It covers how they executed at scale and the strategy for full OTLP-native adoption and what it unlocks for unified Observability. 3F | 315 Kazuma Takeuchi, Joydeep Banerjee As large AI platforms scale across multiple clusters, static placement policies are reaching their limits. Decisions must reflect live conditions such as GPU utilization, power efficiency, and other operational metrics rather than fixed rules alone. In this talk, we introduce the Dynamic Scoring Framework, a new Add-on for Open Cluster Management that brings real-time telemetry into multi-cluster placement and policy decisions. Lightweight agents collect metrics from sources such as Prometheus, evaluate them through modular scoring APIs, and feed results into the central hub. This hybrid design balances distributed scoring and centralized control for scalable, flexible decision-making. Through an architecture deep dive and a demo of resource optimization with the framework, we show how score-based decisions improve resource efficiency in AI infrastructure. Attendees will learn score-based management patterns and how to apply them beyond AI workloads. 5F | 501 Lionel Jouin, Sunyanan Choochotkaew, Masaharu Kanda, Surya Seetharaman, Sara Qasmi Kubernetes multi-network support has been a long-standing challenge, the journey toward native multi-network capabilities has been complex and slow. But why? This panel brings together experts from diverse domains to discuss scenarios such as high-performance networking with advanced capabilities like RDMA for AI/ML, telco, and cloud gaming, network isolation for security, compliance, and multi-tenancy, VM connectivity and connectivity to on-premises infrastructure such as datacenter VLANs or EVPN fabrics. Together, they will examine the architectural challenges of integrating multiple networks into Kubernetes, recent upstream developments such as the DRA feature, and how communities such as SIG Network and WG Device Management are driving progress across the ecosystem. Join this interactive session to learn where multi-network support stands today, where it's heading, and to engage directly with upstream contributors and maintainers to share questions and real-world use cases. 5F | 502 Jeonghyun Kim, Reza Jelveh SNOW Corp. operates 1,000+ A100 GPUs serving 200 million users across three top-ranked GenAI applications (Snow, Epik, B612), handling 1,200+ AI workflows subject to extreme traffic volatility from viral AI trends. The core bottleneck was Kubernetes' native GPU scheduling, which treats GPUs as atomic resources — forcing a 2x over-provisioning penalty on Train-to-Inference pipelines with no reliable visibility into actual GPU saturation. This talk covers integrating HAMi for vGPU virtualization and extending KEDA with a custom Consumer Saturation metric for proactive autoscaling, hiding warm-up latency by scaling before traffic arrives. We’ll detail the implementation: scheduler config, Prometheus metrics, and multi-region scaling via Helm GitOps. Results: >50% GPU waste cut and 91% faster recovery during surges. You’ll get a production blueprint for efficient, shared GPU platforms. 1F | Main Hall Rohit Agrawal, Takeshi Yoneda Envoy powers Istio, Cilium Proxy, Envoy Gateway, and thousands of production deployments. But extending it is hard today. C++ filters mean maintaining a fork. WASM delivered sandbox overhead, limited extension points, and a stalling ecosystem. We built Dynamic Modules to fix this and are now using it at Databricks and Netflix. They let you write Envoy extensions as shared libraries in Go, Rust, or any language with a C ABI. Near-native performance, no sandbox, no rebuild. Both companies are replacing C++ forks and Wasm with native Rust, cutting tail latency and memory use while shipping features faster. As Envoy maintainers and co-authors, we cover how Go/Rust SDKs work across 12+ extension points including network filters, LB policies, and custom clusters. We'll have a live demo of a Rust TLS Transport Socket enabling kernel TLS (kTLS) which is impossible today with BoringSSL and what this means for Istio, Cilium, and Envoy Gateway users who need extensibility without C++ or WASM. 5F | 502 Yogeshwara Krishna Kota, Rutuj Waghare Modern Kubernetes workloads make it increasingly difficult to understand what is really happening at runtime. Traditional observability tools often miss critical low-level behaviours, especially across process execution.
In this talk, we present a kernel-level observability approach powered by Sauron eBPF that captures high-fidelity runtime signals directly from the Linux kernel. By tracking process lifecycle events, the system builds a unified, real-time view of workload behaviour.
On top of this telemetry, we introduce a Graph-AI analytics layer: data feed an AI engine that learns semantically meaningful node embeddings and models the process tree as a temporal graph. This allows the system to capture both node-level behaviour and inter-node temporal relationships, enabling the detection of anomalies that traditional approaches typically miss. 3F | 313+314 Walther Lee, Aleksandr Krivoshchekov Large applications will overload your monitoring system. In Kubernetes, every pod created has the side effect of adding new series to your metrics. Even a simple rollout and rollback triples your cardinality! While Prometheus and OTel have solutions like recording rules, stream aggregation, and sharding, all of them come with tradeoffs. At Reddit, we found these options insufficient until we decided to look at the problem from a different angle. We designed a stateless algorithm for collecting metrics, that doesn’t sacrifice accuracy or performance, and doesn’t spike cardinality as pods come and go. In production, it cut compute costs by 90%. This talk is an intuitive and visual look at the algorithm, the challenges and experiments. You’ll learn about why it works where current options don’t, and will leave with a solid grasp of how to implement it in any time-series database. 3F | 315 Yuto Hiraki, Yusuke Tanaka As AI Agent adoption grows, so does LLM usage and the cost of running it. A self-hosted LLM inference platform is one approach enterprises are exploring to regain control over costs, security, and governance. But it comes with a real challenge: teams have different use cases, access patterns, and security requirements. Some only need an API endpoint, while others need full administrative control. Traditional namespace isolation falls short of meeting both. At the same time, high GPU utilization is critical to keeping cost per token low. Shared yet isolated, at scale - how do you resolve that contradiction?
In this talk, we share practical insights from building an LLM inference platform on Kubernetes - covering tenant isolation, dynamic and granular GPU allocation, and the trade-offs in between. We'll show how we resolved that contradiction, with practical patterns. 1F | Main Hall LeRenzo Malcom Virtual Power Plants (VPPs) are reshaping the energy grid by turning thousands of distributed IoT devices—solar systems, batteries, EV chargers—into one coordinated, cloud-native asset. At Enpal, we operate one of Europe’s largest residential solar fleets and are building a next-generation VPP platform to orchestrate it. This talk explores what it really means to build a power plant in software—and why developing for IoT looks nothing like typical cloud app development. You’ll learn: 1. How the electrical grid works (with examples!) 2. How a Virtual Power Plant works—from household solar to market bidding 3. How Enpal’s IoT and cloud systems coordinate to optimize energy use and revenue in real time 4. What design patterns (Kubernetes, KubeEdge, Dapr, event streaming) make it possible to treat 100,000+ homes like a distributed cluster 5. How VPPs make money—through flexibility markets, load shifting, and price arbitrage 5F | 502 Yoshiki Fujikane Proving a new system matches the old one is the hardest part of legacy migration. Writing equivalence tests from scratch is slow and expensive. The fix is to repurpose what the live system already emits: capture request/response pairs as OTel trace spans and treat them as ground truth for testing the replacement. A PoC on a Java-to-Go migration confirmed this works. Four CRUD endpoints were instrumented; the spans drove E2E tests covering all four. OTel's standard conventions don't capture HTTP response bodies, so observability traces aren't automatically useful for testing. Custom attributes are required. The PoC also tested OBI (opentelemetry-ebpf-instrumentation), which traces without code changes. Basic coverage works. But adding custom attributes via eBPF is impractical, so OBI alone isn't enough for test-quality traces. You'll leave knowing when OTel traces are sufficient for migration testing, when they're not, and whether OBI closes the gap. 3F | 315 Ryota Hashimoto, Takahiro Kambara As cross-organizational data collaboration becomes central to modern computing, protecting sensitive data and proprietary code during joint processing is a growing challenge. Confidential Computing (CC), based on hardware-enforced Trusted Execution Environments (TEEs), enables data to be processed securely without being exposed. This session introduces "Multi-Party Confidential Computing (MPCC)," a concept where multiple data providers and application owners contribute their assets to a shared computation while keeping both data and applications confidential from one another. Rather than relying on access control or mutual trust, this model uses TEEs and file encryption to enforce runtime isolation between parties. The speakers will show how key mechanisms — attestation coordination across multiple TEEs, auditability after execution, and isolation from the underlying cloud — can be realized with open source technologies including Kata Containers and Confidential Containers. 3F | 313+314 Michał Woźniak, Yuki Iwai This session explores recent developments in the Kubernetes ecosystem designed to meet the growing demand for AI training and inference workloads. First, we survey the landscape of ecosystem projects, highlighting recent enhancements to the core Kubernetes Job API - the foundational building block for these initiatives - alongside the latest updates to JobSet. Second, we demonstrate Kueue’s capabilities as a robust AI/ML platform, showcasing how features like Multi-Cluster dispatching, Fair Sharing, and Topology-Aware Scheduling maximize hardware utilization across tenants. Finally, we detail our collaboration with SIG Scheduling on "Workload-Aware Scheduling," which aims to deeply integrate batch semantics into the core scheduler. 4F | 414+415 Naoki Oguchi, Hidetsugu Sugiyama, Michele Gazzetti, Jyothsna Deshpande, Kensuke Koda The CoHDI (Composable Hardware in Disaggregated Infrastructure) project enables the dynamic attachment and detachment of hardware resources, such as GPUs, in Kubernetes-based cloud native environments. Recently accepted as a CNCF Sandbox project, CoHDI marks an important step toward flexible and efficient infrastructure orchestration. This session introduces the paradigm established by CoHDI and its core value, including improved resource utilization and cross-vendor interoperability. It outlines CoHDI's internal architecture, focusing on three components: the Composable DRA Driver, Dynamic Device Scaler, and Composable Resource Operator. The talk explains Kubernetes integration and how CoHDI connects multi-vendor composable infrastructure into containerized platforms. Through real-world use cases such as on-demand GPU scaling, dynamic device reuse, and resource sharing in multi-tenant environments, it shows how CoHDI improves operational efficiency and concludes with future direction. 5F | 502 Kotaro Inoue, Tsuzuki Tsuchiya OpenTelemetry Collector is a flexible, vendor-neutral telemetry pipeline, but extensibility is still more operationally expensive than it should be. The contrib distribution offers many community components, yet some teams cannot adopt the full binary as-is because they require tighter control over included functionality and security posture. Building a smaller collector with only the necessary components is possible, but in practice, it often means maintaining a custom build pipeline just to support relatively small extensions. This talk explores an alternative model for dynamically customizing the OpenTelemetry Collector with WebAssembly. Instead of rebuilding and redistributing the entire collector binary for each change, custom receiver, processor, and exporter logic can be introduced in a more decoupled way. The session examines what this model enables, where it fits, where it falls short, and what trade-offs emerge around safety, portability, performance, and operations. 3F | 315 Jie Wu, Pulkit Garg Your container just got compromised. But Kubernetes is ephemeral by design: the pod restarts in 30 seconds, and when it does, the memory, processes, and ephemeral filesystem are gone. How do you investigate something that no longer exists? The cloud native ecosystem has gotten good at prevention and detection, but once an alert fires, actually figuring out what happened is still a gap. This session walks through a forensics pipeline we built from open source tools, with a live demo of a simulated attack. Falco detects suspicious activity, Falco Talon automatically captures syscalls and network traffic, and we analyze the evidence in StratoShark, a Wireshark-style tool for system calls. We'll also show how the Kubernetes Checkpoint API can freeze container runtime state for offline inspection. Attendees will walk away knowing how to set up automated evidence capture with Falco Talon, analyze captures in StratoShark, and trigger forensic checkpoints in their clusters. 3F | 313+314 Yifei Sun Airbnb migrated from AWS VPC CNI to Cilium across 150+ Kubernetes clusters to unlock eBPF-based capabilities like kube-proxy replacement and cluster-wide network policy. This talk shares lessons from that journey. While grounded in Airbnb’s experience, the patterns and lessons apply broadly to teams operating Kubernetes at scale. We cover pod lifecycle performance testing at scale, using AWS VPC CNI as a reference. We’ll dive into how differences in IPAM configuration, EC2 API interactions, and workload identity allocation introduce scalability bottlenecks, particularly under high-churn data and batch workloads (e.g., Spark). We also discuss rollout strategies across cluster, node, and pod levels, exploring the trade-offs of each. Finally, we’ll walk through practical solutions for challenges like dual-stack environments and circular dependencies during bootstrap. Attendees will leave with a safe, incremental rollout approach for large-scale Cilium adoption. 5F | 502 Kazuki Sato, Jian Li Cloud-native AI infrastructure faces a "physical wall" of power and land limits. To solve this, NTT and SKT built a "Nationwide GPU Fabric", merging a 1,000km+ high-speed L2 network (IOWN APN) with Kubernetes and KubeVirt to operate distributed DCs (Sapporo to Fukuoka) as a single cluster. We deep-dive into the architecture, performance, and future of GPU orchestration beyond a single DC. - Distributed vs. Traditional DCs: Achievable workloads and trade-offs across a 1,000km+ fabric from Sapporo to Fukuoka.
- Fabric-Aware Topology Alignment: We demonstrate how our solution maps long-haul IOWN APN constraints into KubeVirt VMs, maintaining high-performance GPU peer communication (NCCL) across 1,000km as a single, virtualized cluster.
- DRA Feature: We share KubeVirt’s static limits and the potential of DRA for dynamic orchestration. Attendees walk away with a concrete blueprint to shatter the "walls" of a single DC — a scalable solution for global urban AI infrastructure challenges. 5F | 503 Kota Kimura, Huabing (Robin) Zhao Envoy’s dynamic modules provide a high-performance way to extend HTTP processing, but turning that capability into a gateway feature introduces important questions around safety, API design, and operability. This talk shows how Envoy Gateway supports dynamic modules with Kubernetes-native APIs that separate infrastructure registration from policy-based attachment on Gateways and Routes. We explain how this maps to Envoy’s `dynamic_modules` HTTP filter and discuss the practical issues that make extensibility supportable in production, including filter ordering, invalid references, lifecycle behavior, and packaging. Using a real module composition approach as a case study, we compare bundled shared libraries with runtime-loaded plugins and highlight the tradeoffs for gateway and platform maintainers. 4F | 414+415Wednesday, July 29
Infinite Agents, Finite Kubernetes
Abstract
Building a Multi-Tenant AI Platform with the CNCF Ecosystem
Abstract
How Subaru Accelerated AI Model Development for Next-Generation EyeSight with Kubernetes
Abstract
From 5 to 1,300+ Clusters: Declarative Scaling for Private Kubernetes
Abstract
Out of the Box, at Multi-Region Scale: How Hyundai Scales Its Platform
Abstract
OCI is not Git: Rethinking the GitOps Source of Truth for a Kubernetes-Native World
Abstract
User Namespaces in Production: Enabling Root in Containers with RWX
Abstract
How to Evolve Your LLM Self-Hosting Platform: A Practical Guide to Adopting Advanced Optimizations
Abstract
A Decade of Cilium Around the World
Abstract
AIOps: (near) Zero-Touch Production Rollout Fixes
Abstract
Don't Start With 500 Clusters: Patterns in Scaling Multi-Cluster Kubernetes Using Cluster API
Abstract
kube-scheduler-evaluator: Evaluating Kubernetes Schedulers at Hyperscaler Scale in Seconds
Abstract
Ground Control to Cloud Native: Safe Deployments for a Growing SAR Satellite Constellation
Abstract
Scaling In Kubernetes Safely on On-Prem KaaS Across 1,300+ Clusters and 40,000+ Nodes
Abstract
Project Lightning Talk: youki: What's New and What's Next?
Abstract
Project Lightning Talk: Lima in 5 Minutes: From Containers to AI Sandboxing
Abstract
Towards Sustainable Multi-Cluster Management in Real-World Academic Infrastructure
Abstract
The State of Cloud Native: The Shift Towards AI
Abstract
Running Wasm Inside Your Storage Cluster with CSI and Gateway API
Abstract
Manufacturing Alerts to ReActive Agents: Self-Evolving AI Agents on K8S for Predictive Maintenance
Abstract
Sandbox for Agentic Application with Cloud Native Stack
Abstract
From Experiment to Enterprise: Scaling an AI Agent for Code Review
Abstract
Taming Billions of Rows: Data Lifecycle Management Lessons from a Cloud-Native Database Migration
Abstract
Beyond the Code: Fostering Shared Vision and Technical Leadership in CNCF Communities
Abstract
SIG Scheduling Update: Transition from Pod to Workload Scheduling
Abstract
From 165 Days to 30 Minutes: Breaking Enterprise Silos with Platform Engineering
Abstract
Thursday, July 30
OpenTelemetry Celebrates Graduation and the Next Era of Agentic Observability
Abstract
Large-Scale Edge Management with Kubernetes: The Tech Behind Stable Operation of 200 EV Chargers
Abstract
What is a Virtual Power Plant (VPP) ? : Green Tech and the Modernization of the Grid
Abstract
How CNCF Projects United Two Countries' Engineers to Solve AI's Power-and-Land Problem
Abstract
Standardizing Industrial IoT observability with OpenTelemetry
Abstract
SBOMit: Making SBOMs Accurate with Attestations
Abstract
Running OpenSearch at Scale in High-Traffic Gaming Systems
Abstract
Beyond Translation: The Journey of Building the Japanese Kubernetes SIG Docs Community
Abstract
From Statsd to OpenTelemetry: Atlassian's Metrics Platform Migration at Scale
Abstract
Score-Driven Multi-Cluster Management: An Evaluation Framework for Decision-Making
Abstract
Breaking the Single-Network Barrier: A Cross-Domain Look at Kubernetes Multi-Networking
Abstract
Shared GPU Scheduling & Proactive Autoscaling: A Production Blueprint for 1000+ GPUs
Abstract
Beyond Wasm: How Dynamic Modules Let You Extend Envoy Proxy in Go, Rust, or Any Language
Abstract
Runtime Security at Scale with eBPF: Hybrid Detection and Root Cause Analysis in CloudNative Systems
Abstract
Designing for High-cardinality Metrics
Abstract
Shared Yet Isolated at Scale: Building Multi-Tenant Inference Platform on Kubernetes
Abstract
What is a Virtual Power Plant (VPP) ? : Green Tech and the Modernization of the Grid
Abstract
Repurposing OpenTelemetry Traces as Test Data: Breaking the Cost Barrier in System Migration
Abstract
Sealed for All: Multi-Party Confidential Computing, No Trust
Abstract
WG-Batch Updates: What’s New and What Is Next?
Abstract
CoHDI: A CNCF Sandbox Project for Dynamic Hardware Composability in Kubernetes
Abstract
OTel meets Wasm: Rethinking OpenTelemetry Collector Extensibility
Abstract
Container Forensics for Kubernetes: Building an Evidence Pipeline with Open Source Tools
Abstract
The Road to Cilium: Migrating 150+ Kubernetes Clusters at Airbnb
Abstract
Beyond the DC Walls: Building a Nationwide GPU Fabric with KubeVirt and Wide-Area L2
Abstract
Dynamic Modules in Envoy Gateway: API Design, Safety, and Operability
Abstract
Event pages and schedules are maintained by the Linux Foundation.