The Stack Observer
Cloud Native

SIG Storage Goes GA, Containerd Patches Five CVEs, and Schiphol Proves Kubernetes at Scale

•Stackxx•Cloud Native, Kubernetes

The Kubernetes ecosystem has delivered a packed news cycle over the past two weeks, with major feature graduations, security patches, and real-world enterprise deployments making headlines. For operators and platform engineers, the common thread is maturity: the core primitives are getting sharper, the surrounding tooling is getting safer, and large organizations are proving Kubernetes can satisfy both agility and compliance in regulated environments.

SIG Storage Ships a Trifecta of Production-Ready Features

Storage has long been Kubernetes’s hardest problem. While the orchestrator made stateless workloads trivial, keeping data persistent, portable, and performant across a distributed cluster has required years of careful interface design. This month, SIG Storage — the Special Interest Group responsible for volumes, snapshots, and the Container Storage Interface (CSI) — reached several long-awaited milestones.

VolumeGroupSnapshot graduated to general availability in Kubernetes v1.36. The feature enables crash-consistent, point-in-time snapshots across multiple PersistentVolumes simultaneously. For applications that span several disks — databases with separate data and log volumes, or multi-tenant SaaS platforms with sharded storage — this eliminates the race condition of snapshotting volumes individually. The entire group is frozen atomically, ensuring that a restore operation brings back a coherent picture rather than a collection of independently timed checkpoints.

Closely related, CSI Changed Block Tracking (CBT) moved to Beta in v1.36. CBT allows storage drivers to report only the blocks that have changed since the last snapshot, which makes incremental backups significantly faster and cheaper. For organizations running nightly backups of multi-terabyte PVCs, the bandwidth and time savings are substantial. CBT has been one of the most requested enterprise storage features since the early days of CSI, and its Beta status signals that the API surface is now stable enough for broader adoption.

Another milestone that slipped under the radar is the VolumeAttributesClass GA graduation in v1.34. This feature lets users modify storage characteristics — IOPS limits, throughput tiers, and vendor-specific performance knobs — without recreating the volume or taking the application offline. In practice, a platform team can scale a database’s storage performance up during a Black Friday surge and dial it back down afterward, all through standard Kubernetes API calls. It completes the picture of truly elastic infrastructure: just as CPU and memory are dynamically tunable, storage performance now is too.

SIG Storage co-chair Xing Yang also highlighted Volume Health as a feature to watch. Currently, volume problems are surfaced through ephemeral events that disappear after an hour. The Volume Health enhancement aims to expose persistent status conditions through the Kubernetes API, paving the way for automated remediation. If a volume degrades or a node fails permanently, the control plane should eventually be able to react without a human parsing event logs. In addition, Mutable PV Affinity — introduced in Alpha as of v1.35 — opens the door to migrating volumes across zones or even between storage backends, addressing one of the longest-standing operational limitations in the platform.

containerd and Helm Ship Security-Focused Patch Releases

On June 18, the containerd project released versions 2.3.2 and 2.2.5, both containing fixes for five CVEs. The vulnerabilities span checkpoint-restore robustness, user-database file handling, and image label propagation. There are also runtime fixes: a data race in Windows shim log reads and a container startup failure triggered by concurrent task RPC timeouts during slow container creation.

Because containerd is the default container runtime in virtually every Kubernetes distribution, these patches are relevant to nearly every cluster operator. If your node images or managed Kubernetes service track the 2.3.x or 2.2.x lines, scheduling an upgrade should be a near-term priority. The security advisories are published on GitHub and include reproducibility details for teams running their own vulnerability management programs.

The Helm project, meanwhile, shipped v4.2.2 on June 17. The release is a narrow patch that reverts a prior WaitForDelete change which had introduced race-condition failures during full test-suite runs. Helm v4 has been generally well-received for its cleaner internals and improved Go SDK, and the project remains on a predictable release cadence: patch releases monthly, minor releases quarterly. v4.3.0 and v3.22.0 are currently scheduled for September 2026.

AWS Tightens the Integration Between EKS Auto Mode and Istio Ambient Mesh

Amazon Web Services published a comprehensive technical guide this month demonstrating how Amazon EKS Auto Mode and Istio Ambient Mesh work together as a unified operational stack. EKS Auto Mode, which extends AWS management from the Kubernetes control plane down to the compute layer, automates node provisioning, scaling, patching, and OS hardening via a Bottlerocket-based immutable filesystem.

Istio Ambient Mesh removes the traditional sidecar proxy model by shifting Layer 4 security to a per-node ztunnel daemon written in Rust, and Layer 7 traffic management to optional waypoint proxies deployed as standard Kubernetes workloads. The AWS guide walks through a complete Terraform-based deployment: cluster creation, namespace labeling for ambient enrollment, mTLS encryption over HBONE tunnels, and Layer 7 authorization policies. For teams already on EKS who have been waiting for a simpler service-mesh operational model, the integration is production-ready and worth evaluating.

Schiphol Airport Proves Kubernetes Can Satisfy Sovereignty and Speed

One of the most compelling enterprise Kubernetes stories this month comes from Royal Schiphol Group, the operator of Amsterdam’s airport and several other global hubs. Speaking at the OpenShift Commons gathering in Amsterdam, Schiphol’s technology leadership detailed how Red Hat OpenShift and Red Hat Advanced Cluster Security for Kubernetes power a hybrid platform that must satisfy strict Dutch defense regulations while supporting 70 million annual passengers.

The constraints are severe: biometric and mission-critical data must remain on-premise, the airport processes roughly one petabyte of data daily from 4,000 cameras, and cyberattacks increased 120% last year. Schiphol’s solution is a private hybrid cloud built on Red Hat OpenShift for sensitive on-premise workloads, with Azure Red Hat OpenShift available for less regulated demand.

The operational results are striking. A platform team of seven engineers manages 1,800 deployments across 400 namespaces. Security scanning is shifted left: every external image is automatically vetted before it enters the internal registry. New team onboarding with full policy enforcement dropped from weeks to hours. The case study is a clear example of how managed Kubernetes, when paired with disciplined platform engineering, can meet both compliance and velocity in a high-stakes environment.

What This Means for Platform Teams

The through-line across all of this news is that Kubernetes is becoming less of a science project and more of a dependable substrate. Storage APIs are graduating to GA with real operational value. Security patches are arriving on predictable schedules. Cloud providers are tightening integrations that used to require manual assembly. And enterprises like Schiphol are demonstrating that the platform can handle sovereignty, scale, and security without trading away developer speed.

For operators, the practical checklist coming out of June looks like this:

  • If you run stateful workloads, evaluate VolumeGroupSnapshot and VolumeAttributesClass. Both are GA and supported by an increasing number of CSI drivers.
  • Check your containerd version. If you are on 2.3.x or 2.2.x, plan the June security patch cycle.
  • For AWS users, the EKS Auto Mode plus Istio Ambient Mesh combination is a credible alternative to self-managed node groups and sidecar-heavy service meshes.
  • For regulated industries, the Schiphol model — managed OpenShift with shift-left security and hybrid topology — is a useful reference architecture.

The Kubernetes project itself turns twelve this year. The headlines are no longer about whether the platform works; they are about how much sharper, safer, and more integrated it is becoming. That is exactly the kind of progress that makes platform engineering teams sleep better at night.

Sources