Tracking enterprise infrastructure's evolution in the AI era

In-Depth

KubeCon Day 3: Agentic AI, Kubeflow Graduation and SUSE's Open Infrastructure

• By Tom Fenton
• 11/13/2026

By Thursday morning at the Salt Palace Convention Center, the pace of KubeCon + CloudNativeCon North America 2026 showed in the length of the coffee lines. Yet the energy remained high during the final day's keynote.

Over the first two days of the conference, which I covered in my Day 1 report on autonomous agents and sandboxes and my Day 2 recap on operating at agent speed, the industry wrestled with the reality that AI agents behave nothing like human users. For the final day of keynotes and my afternoon vendor briefings, the conversation shifted from identifying those points to showing how the cloud-native stack is adapting to absorb them.

The Overarching Keynote Theme: Evolving the Foundation Without Breaking It
If the first two days of KubeCon were a wake-up call about how unpredictably autonomous agents behave, Day 3 focused on practical engineering. Across the morning keynotes, speakers kept coming back to a straightforward point: we don't need to throw out Kubernetes to run AI agents, nor can we treat it as a rigid, one-size-fits-all platform. Instead, platform teams are leaning on existing cloud-native building blocks, declarative APIs, tight sandboxing and fast rollbacks, while adapting the underlying layer for specialized AI accelerators, deterministic auditing and multimodal data pipelines. With the right guardrails and human oversight, the same infrastructure can safely handle autonomous workloads.

Keynote Kickoff: "Agency Speed" and Why Cloud Native Isn't Obsolete
CNCF Head of Projects Jeffrey Sica opened the morning by pushing back against the prevailing "doom and gloom" narrative that generative AI is about to render traditional software engineering obsolete.

He drew an interesting parallel between today's environment and that of SquareSoft in 1987, when the struggling Tokyo studio released what it expected to be its swan song game, Final Fantasy. Four decades, 16 mainline entries and roughly 100 spin-offs later, the franchise survived not by clinging to a single battle system or art style, but by continually reinventing its structure while preserving what mattered to its community. Sica argued that the cloud-native ecosystem is undergoing that exact kind of evolution.

Sica did not mince words about the daily challenges maintainers face right now, joking about the all-too-familiar experience of reviewing a 1,500-line, beautifully formatted pull request generated by an AI that completely misunderstood the codebase, which, as he put it, was "a total dumpster fire" submitted by someone who clearly did not read what they were pushing. Yet instead of locking the doors, CNCF maintainers have responded by writing explicit AI contribution policies that insist on a human in the loop ("draft and review, spec and build, not YOLO-solve.") That human backbone remains massive: Sica noted that 21 million developers now build with cloud-native technologies, backed by more than 50,000 human contributors across over 125 countries over the past year.

The technical urgency behind those guardrails comes down to a metric CNCF Executive Director Jonathan Bryce calls "agency speed," the number of autonomous machine actions an agent takes before a human steps in. Citing internal Anthropic data across 200,000 coding agent sessions, Sica noted that the average number of autonomous actions jumped from 10 to 21 in just six months, cutting human interactions by a third. Most legacy software falls apart when hammered by 21 consecutive autonomous requests, yet cloud-native architectures absorb this because they were designed from day one for unreliable machines on unreliable networks. Interestingly, Sica pointed out that LF Research data shows one-third of surveyed practitioners are growing their virtual machine footprints, turning back to technologies like KubeVirt and Kata Containers to sandbox untrusted AI agents.

Morning Keynote Highlights: Project Graduations and Hyperscale AI
The remainder of the morning lineup moved rapidly through major project milestones, hyperscale operational shifts and a crowd-pleasing live demo.

Kubeflow Officially Graduates: Andrey Velichkevich of the Kubeflow Steering Committee announced that Kubeflow has officially achieved CNCF Graduated status, backed by over 500 million downloads and nearly 9,000 contributors. Velichkevich framed Kubeflow as a unified, open-source AI platform built on simplicity, portability, scalability and composability, noting that its mission is to let data scientists run distributed workloads without becoming Kubernetes experts.

Representatives from NVIDIA's Run:ai team explained how they integrated Kubeflow's Training and MPI operators with the CNCF sandbox KAI Scheduler to handle topology-aware gang scheduling across GPU clusters, while AWS engineers highlighted the growth of the Kubeflow Spark Operator (now at over 120 public adopters) alongside a new Model Context Protocol (MCP) server for troubleshooting Spark jobs and a Semantic Operator that stores business metrics as Apache Iceberg tables so agents return deterministic answers.

Celebrating the Community Builders: Jorge Castro took the stage to present the 2026 CNCF Community Awards, reminding the room that behind 350,000 contributors across 190 countries are individuals doing the unglamorous work that keeps open source running.

I am going to try to list all the award winners, simply because they deserve all the credit they can git (pun intended).

Dylan Reimerink, Natali Vlatko and Jimmy Song earned the Lorem Ipsum award for documentation excellence. At the same time, Francisco Herrera, Saiyam Pathak, Joe Stringer, Steven Jin and Maciej Szulik received the Chop Wood, Carry Water award for essential behind-the-scenes project maintenance. Kubernetes networking and testing stalwart Antonio Ojea took home the Top Committer award, and Prometheus co-creator Julius Volz (alongside Rita Zhang) was honored with the Lifetime Achievement award for spending over a decade building foundational observability and security tooling.

After the awards, the keynotes turned to how companies were using Kubernetes and CNCF projects.

Scaling Multimodal Training and Cluster Lifecycle Management: Engineering leaders Kai Chen and Hao Jiang from Hark walked through how they run end-to-end multimodal computer-use agents across text, vision and audio using Ray, KubeRay and Kueue/MultiKueue to dynamically autoscale GPU and CPU workers across multiple clusters. It never ceases to amaze me how all these pieces fit together.

Shifting gears from AI to core cluster operations, Nutanix Cloud Native CTO Deepak Goel introduced CAREN (Cluster API Runtime Extensions), an open-source Go implementation of upstream Cluster API runtime extension hooks. Babu noted that managing tens or hundreds of clusters with ClusterClass eventually traps platform teams in fragile, error-prone YAML patches; CAREN replaces those patches with structured, reusable Go hooks for CNI and CSI lifecycle tasks, with Nutanix aiming to donate the project to the CNCF.

Heroku's Cloud-Native Reinvention and Petabyte-Scale AI Storage: Salesforce and Heroku engineering leaders Shiva Nimmagadda and Brandon Schoen took to the stage to discuss how Salesforce acts as "Customer Zero" for Heroku's next-generation architecture.

They highlighted that they run more than 20,000 internal applications built by both pro developers and citizen builders. By rebuilding Heroku atop three graduated CNCF projects -- Kubernetes, Cloud Native Buildpacks and OpenTelemetry -- they standardized container image creation so base OS patches can roll out across the fleet in seconds without developer rebuilds.

On the storage front, StepFun's Frank Li and Joe Zhou, Lead Developer Advocate at Juicedata Inc. (the company behind JuiceFS) detailed how StepFun eliminated metadata bottlenecks across data prep, checkpointing and inference for its multimodal models by combining Kubernetes, TiKV and JuiceFS. That architecture now supports more than 10,000 concurrent JuiceFS clients while cutting read amplification by roughly 71%.

Kubernetes as a Modular Kernel and Deterministic Agent Auditing: In a joint session titled "Kubernetes with Conviction," Google Engineering Director Jago MacLeod and Meta Production Engineer Shaun Hopper proposed that Kubernetes is evolving from a rigid, one-size-fits-all distribution into a lean, modular kernel. Through an internal operational model Google calls Engineering Frontier, Google takes a battle-tested GKE base and applies upstream patches, such as custom node upgrade exclusion tags and DaemonSet rollout controls built for Meta's massive AI clusters, in days rather than waiting four to eight months for a standard release cycle.

That same machinery enabled Google to ship Kubernetes 1.38 preview builds three months ahead of the December upstream release, alongside launching managed agents on the Gemini API running on Agent Substrate.

Microsoft's Josh Gavant followed, addressing a critical enterprise compliance headache: how to audit and reproduce non-deterministic agent runs once ephemeral compute disappears. He announced the open-sourcing of AgentSessions and AgentSuites. AgentSessions routes agent model calls through a host proxy into a hash-linked, append-only journal so teams can deterministically replay, audit or fork sessions without re-querying the LLM. AgentSuites is a portable JSON specification for packaging agent instructions, tools and evaluations.

Drone 2.0 Closes the Show: Solo.io Head of Open Source Lin Sun closed the keynotes with a follow-up to her Amsterdam demo, where a live stage drone flew properly but failed to stream video. This time, with a pilot at the controls, the drone captured live audience footage that triggered a five-agent workflow orchestrated across Agent Substrate, Kagent, Argo CD and Keycloak, with distributed traces captured in Jaeger. When an Agent Gateway token rate limit tripped mid-demo, Sun used a natural-language platform agent to open and merge a pull request raising the limit on the fly, generating a celebratory video of the audience "flying without limits." You can see the video she created in near real time at Lin Sun on GitHub.

SUSE on Open AI Infrastructure and Silicon Diverse Virtualization
After the keynotes wrapped up, I sat down with David Stauffer from SUSE to talk about how one of the original Linux and Kubernetes vendors is positioning itself amid the AI infrastructure boom and the ongoing fallout from Broadcom's acquisition of VMware.

BTW, my favorite photo of the event this year is the one of Dave and me; if you look carefully, you will see SUSE's mascot, "Geeko," photobombing the picture.

After the photo op, Dave stressed that SUSE's overarching pitch at KubeCon centered on SUSE Rancher Prime as an open infrastructure layer spanning hyperscalers, edge sites and on-premises "Private AI" environments where enterprises refuse to let sensitive data leave their own data centers.

On the hardware front, SUSE announced SUSE Linux Enterprise Server (SLES) for NVIDIA, delivering kernel-level optimizations pre-tested for NVIDIA Blackwell GPUs and the upcoming Vera Rubin architecture, alongside SUSE AI Factory and deep integration with RKE2 across neocloud deployments. I need to note how few distributions match SUSE's silicon breadth, spanning mainframes, x86 and ARM. Dave added that they are also working with an unprecedented wave of custom AI chip startups.

When I asked Dave about virtualization, he pointed to sharp momentum among shops rethinking their hypervisor strategy, with SUSE seeing dramatic growth. SUSE reported that adoption of Harvester (its open-source hyperconverged infrastructure platform built on KVM and KubeVirt) is growing between 80% and 100% year over year. Rather than swapping one proprietary vendor lock-in for another, enterprise IT teams are using the VMware disruption to unify their VM and container operations onto a single SUSE-backed cloud-native platform, eliminating traditional silos between virtualization admins and platform engineers. That convergence is paying unexpected dividends in the AI era, as SUSE now lets administrators manage both VMs and containers through a unified MCP interface and natural-language tooling, including an assistant named Liz in Rancher and a new open-source natural-language CLI, to query vulnerabilities like PHP-to-shell exploits and trigger automated remediations. To prevent AI-generated stacks from introducing unvetted dependencies, SUSE also expanded the SUSE Application Collection to include more than 1,000 verified, signed Python libraries alongside 150-plus enterprise applications, while donating runtime enforcement and vulnerability scanning components to CNCF's Kubewarden.

Final Thoughts on Day 3 and KubeCon Salt Lake City
As I stepped out of the Salt Palace at the conclusion of KubeCon + CloudNativeCon North America 2026 into a beautiful bluebird day, the overarching narrative of the entire three-day conference came into focus.

On Day 1, the community confronted the reality that autonomous agents require strict runtime isolation and sandboxing. On Day 2, platform teams grappled with the infrastructure strain and financial waste caused by workloads operating at "agent speed." By Day 3, we saw the architectural answers taking shape in production: Kubernetes acting as a customizable kernel, Kubeflow graduating as the standard AI control plane, deterministic journals making agent actions auditable and virtual machines making a pragmatic comeback as security boundaries for untrusted AI code.

For enterprise sysadmins and platform architects, the takeaway from Salt Lake City is practical: you don't need to rip and replace your cloud-native stack to support agentic AI. The same open-source building blocks, declarative workflows and disciplined security practices that brought stability to container orchestration over the past decade are proving to be the exact guardrails needed to keep autonomous agents--and the infrastructure underneath them--under control.

You can watch the full morning keynote broadcast, including Jeffrey Sica's opening remarks, Kubeflow's graduation and Lin Sun's live drone demo, in the KubeCon + CloudNativeCon North America 2026 Day 3 Keynote livestream for a closer look at the stage demonstrations.