The 13 KubeCon + CloudNativeCon North America 2026 sessions we recommend for platform, DevOps, and security teams cover software supply chain security, policy-as-code with OPA and Kyverno, packaging AI agents as OCI artifacts, and governing agentic workloads on Kubernetes. KubeCon North America 2026 runs November 9–12 at the Salt Palace Convention Center in Salt Lake City, Utah. All times below are MST.
| # | Session | Speakers | Date and time (MST) | Theme |
|---|---|---|---|---|
| 1 | Signed, Sealed, Denied: Attestation-Driven Admission with Kyverno + CEL at AT&T | Chad Swenson, Sagar Kundral | Nov 10, 12:20 PM | Security |
| 2 | KitOps: The Whole Kit for AI Agents | Gorkem Ercan | Nov 9, 2:15 PM | AI + ML |
| 3 | Mythos vs Maintainers: Drowning in the Vulnerability Tsunami | Fabian Kammel, John Kjell | Nov 10, 11:30 AM | Security |
| 4 | The Golden Path Doesn't Exist Yet: What Platform Teams Told Us About OpenSSF Tools | Katherine Druckman, Stacey Potter, Kadi McKean, Tabatha DiDomenico | Nov 9, 12:45 PM | Open Source SecurityCon |
| 5 | Rego Without Borders: Breaking Down Language Barriers for Security Policy | Philip Conrad | Nov 9, 2:08 PM | Open Policy Agent |
| 6 | Set the Terms for Your Agents and Let Your Humans Be Creative: How to Govern Code Nobody Reviewed | Thomas Schuetz, Dr. Constanze Roedig | Nov 9, 11:50 AM | Platform Engineering Day |
| 7 | I Packaged My Application in a Container Image, and Now What? | Aurélie Vache | Nov 10, 12:20 PM | Supply chain fundamentals |
| 8 | The Identity Crisis: Who is the AI Agent in Your Cluster? | Abdel Sghiouar | Nov 10, 10:26 AM | Keynote |
| 9 | End to End Software Development Lifecycle Hardening with AMPEL | Adolfo García Veytia | Nov 9, 9:10 AM | Open Source SecurityCon |
| 10 | Upstream First Security: Keeping Telco Infrastructure Secure at Cloud Native Scale | Jan Melen, Kashif Khan | Nov 9, 10:40 AM | Open Source SecurityCon |
| 11 | Creating VEX Documents at Scale: A Look into One Supplier's Process | Jeff Mendoza | Nov 9, 9:45 AM | Open Source SecurityCon |
| 12 | The Agent Did What? Reconstructing MCP Tool-Call Attacks | Jie Wu | Nov 9, 12:55 PM | Agentics Day |
| 13 | Platform Engineering after the AI Hype: Why IDPs Must Become Intent-Driven | Daniel Bryant | Nov 10, 12:20 PM | Platform Engineering |
With hundreds of sessions across four days, it can be hard to know where to start. We recommend stopping by Cloudsmith at Booth 175 to say hello, play a round of supply chain Jeopardy, and catch a lightning talk from our Head of Security.
As for the conference programming, here's our curated roadmap of the 13 talks we think will help you build with clarity, control, and confidence.
📍 Salt Palace Convention Center (100 S West Temple, Salt Lake City, UT 84101) 👋 Booth 175 🗓️ November 9–12, 2026
Your image is signed. But does its evidence meet your deployment requirements, and can you prove that to an auditor? Chad Swenson and Sagar Kundral will show how AT&T and Nirmata built platform-managed controls where GitHub Actions emits Sigstore-backed Artifact Attestations and Kyverno's ImageValidatingPolicy evaluates them at admission. Every decision is retained as audit evidence.
This is our top pick because it tackles a problem platform teams know well: internal builds and upstream images with different trust roots, living side by side. The talk covers mixed-source verification in Kyverno 1.19 and 1.20, plus patterns for exceptions and failure handling. If you want compliance that runs at machine speed instead of through spreadsheets, start here.
See the AT&T attestation session details
An AI agent consists of a model, prompts, skill files, MCP servers, and code spread across Git repos, object storage, and loose config files. In this lightning talk, Gorkem Ercan shows how KitOps, a CNCF Sandbox project, bundles all of it into one versioned, immutable OCI artifact called a ModelKit, signed with Cosign and pushed to any registry you already use.
When something breaks, the first question is always "what was actually running?" Treating agents as versioned artifacts gives AI the same provenance and governance teams already expect for container images and packages.
See the KitOps lightning talk details
LLMs are changing both sides of open source security. Attackers use them to scale campaigns against GitHub Actions misconfigurations and package ecosystems like PyPI and npm, while well-meaning researchers use them to file a flood of vulnerability reports. Fabian Kammel and John Kjell play out both roles, attacker and maintainer, using real examples from in-toto's Witness project.
The session moves from recon and disclosure to remediation and using AI to proactively secure the project. For anyone consuming open source at scale, it's a look at why the trust decisions you make about upstream packages matter more than ever.
See the Mythos vs Maintainers session details
The OpenSSF DevRel community asked platform teams a blunt question: what's standing between "this is a good idea" and "this is working for us"? Katherine Druckman, Stacey Potter, Kadi McKean and Tabatha DiDomenico report back on the real blockers, from SBOM accuracy and portability to air-gapped friction, and map them against Sigstore, Zarf, GUAC, and SLSA.
This panel addresses the gap between supply chain tooling and day-to-day adoption. Platform teams should expect to learn which tools solve which problems today.
See the OpenSSF golden path panel details
OPA usually runs as a sidecar. Philip Conrad will show how the Rego Intermediate Representation lets the compiler generate execution plans that other languages consume natively, so Rego-powered security policy can run inside Swift and Java applications too.
At Cloudsmith, teams write policy-as-code in Cloudsmith using OPA and Rego. Consistent policy across more runtimes means fewer gaps between what you intend and what you enforce.
See the Rego Without Borders lightning talk details
Anyone can generate an application in minutes, but deploying it safely remains a challenge. Thomas Schuetz and Dr. Constanze Roedig give platform owners a framework of "desired state" abstractions that let teams develop, deploy, and verify AI-generated code. Their live demos start with vibe-coded apps that violate SLSA, GDPR, and internal architecture decisions, then bring them into line.
This session treats AI-assisted coding as something to enable, not fear, and puts the guardrails in the platform rather than in a review queue. That's the same approach Cloudsmith takes toward governing the dependencies those apps pull in.
See the governing AI-generated code session details
You built your image and pushed it to a registry, but what comes next? Aurélie Vache walks step by step through signing images, generating an SBOM, checking for vulnerabilities and whether they're exploitable, and using attestations, with live demos you can repeat locally and in CI/CD.
This session looks to be one of the clearest on-ramps to software supply chain security on the schedule.
See the container image supply chain session details
Kubernetes was built for deterministic, stateless microservices with static identity boundaries. AI agents generate dynamic network calls, trigger external APIs, and run machine-generated code on the fly. In this keynote, Abdel Sghiouar asks a simple question with big consequences: when an agent calls a tool or a database, what identity does it present?
Identity is the foundation every other control builds on, from authorization to audit. This keynote sets up a theme you'll hear all week, and the emerging open source standards that aim to answer it.
See the Identity Crisis keynote details
Hardening a pipeline requires a lot of checking: who can run CI, how repositories are configured, commit signatures, build provenance, and vulnerabilities. There's a tool for each step, but stitching them together gets messy fast. Adolfo García Veytia introduces AMPEL, a supply chain policy engine that uses policy-as-code to evaluate each stage of the SDLC and block builds that don't meet the bar.
This is a hands-on session, so bring a laptop and a project. You'll map controls to frameworks like the OSPS Baseline and NIST SSDF.
When a CVE lands in a Go dependency under 5G infrastructure, waiting until next quarter isn't an option. Jan Melen and Kashif Khan share how they triage CVEs across a dependency tree spanning 15+ upstream repositories, why they always fix upstream first, and how they keep production within one minor version of the latest release.
They'll share info about time to fix and the real cost of backporting versus upgrading. This should be a grounded business case for treating dependency hygiene as a core engineering practice.
See the upstream-first security session details
What is a VEX, what goes into it, and when should you create one? In this lightning talk, Jeff Mendoza answers those questions through a case study of how Microsoft is preparing to automate VEX document creation, covering CSAF VEX required fields and OpenVEX.
With the EU Cyber Resilience Act (CRA) asking for VEX alongside SBOMs, and AI speeding up vulnerability discovery, VEX is how suppliers tell customers which vulnerabilities actually matter.
See the VEX at scale lightning talk details
An agent reads a web page with a hidden instruction, then uses Model Context Protocol (MCP) tools to retrieve data and send it outside your environment. Jie Wu reproduces the attack in a controlled demo, then rebuilds it step by step by joining MCP tool-call logs with cloud audit logs, using a minimal MCP audit proxy that emits OpenTelemetry spans to Jaeger.
This session shows how to build a repeatable method for turning an agent incident into a trace, and gives a clear sense of what those logs can and can't prove.
See the MCP tool-call attacks session details
For our final pick, Daniel Bryant looks at what comes after the first wave of platform engineering: templates, golden paths, and self-service APIs. Infrastructure requests now come from copilots and agents operating at machine speed, so platforms need capabilities that encode organizational policy, security, and operational knowledge for humans and AI alike.
See the intent-driven IDPs session details
Cloudsmith is a Gold sponsor at KubeCon North America 2026, and we're bringing plenty to keep you busy between sessions. Find us at Booth 175 in the Solutions Showcase.
The unofficial KubeCon after-party is back. On Wednesday, November 11, from 7:30 to 11:00 PM, join us at Keys on Main Dueling Pianos for AprèsKube, co-sponsored with Endor Labs, Echo, Tailscale, Sentry, and ClickHouse. Expect live music, good company, and plenty of conversation about everything you saw at KubeCon. Register for AprèsKube SLC before spots run out.
AI is changing how fast teams build and ship cloud-native software. We'll see you in Salt Lake City to talk about maintaining that speed with clarity, control, and confidence.
