By submitting this form, you agree to our 

Building trust from source to ship

Thousands of platform engineers and security experts are about to gather for KubeCon + CloudNativeCon Europe 2026, making it the year’s definitive cloud-native event. To help you cut through the noise of a packed agenda, we’ve identified the standout sessions you can’t afford to miss. Whether you're looking for high-level strategy or interactive workshops, here is our curated roadmap to ensure you get the most out of your time on the ground.

📍 RAI Amsterdam (Europaplein 24, 1078 GZ Amsterdam, Netherlands)
🗓️ March 24 - 26, 2026

 (Thales SIX GTS France) will dive into the messy reality of the Software Bill of Materials (SBOM). They plan to pull back the curtain on why current open-source and cloud-based tools (despite all their promises) frequently generate conflicting package lists and inconsistent vulnerability reports when tasked with scanning complex container images.

This talk is particularly electrifying for the security community because it tackles the compliance anxiety triggered by the EU’s Cyber Resilience Act (CRA). As the CRA shifts SBOMs from a nice-to-have transparency initiative to a legal necessity for software lifecycles, the industry is waking up to a major problem, which is inconsistent data. By dissecting the technical roots of these discrepancies, Bufalino and Blaise aren't just pointing out flaws, they will also be providing a roadmap for developers to ensure their tooling is actually CRA-compliant. For anyone navigating the shift toward a transparent and trustworthy software supply chain, this session offers the technical clarity needed to turn these metaphorical bombs into secure builds.

2. Modelpack: Standardising the packaging and distribution of AI/ML Models

, a Distinguished Architect at Red Hat, tackles one of the most pressing bottlenecks in modern infrastructure: the chaotic fragmentation of AI/ML integration within the cloud-native ecosystem. Block, a seasoned expert in helping organisations scale open-source solutions, will break down how the current wild west of competing formats and runtimes is actively stifling innovation. He will introduce 

, a CNCF Sandbox project designed to act as the universal translator for AI/ML artifacts, allowing them to finally speak the same language as established tools like Kubernetes, ORAS, and Harbor.

The security and DevOps communities are closely watching this session because it addresses the Day 2 operations nightmare of managing AI at scale. As AI moves from experimental notebooks to production-grade Kubernetes clusters, the lack of standardisation creates massive technical debt and security blind spots. Block’s exploration of ModelPack and emerging artifact standards offers a glimpse into a future where AI models are managed with the same consistency and rigour as container images. For anyone struggling to bridge the gap between data science and cloud-native engineering, this talk provides the blueprint for a unified, scalable, and manageable AI supply chain.

3. Kubernetes security at Shopify scale: Automating security across an infrastructure monrepo

In this session, Senior Infrastructure Security Engineers 

 will pull back the curtain on how one of the world’s largest e-commerce platforms secures its massive infrastructure monorepo. Drawing from their deep backgrounds in cloud defense and 5G network security, Wu and Garg will detail the high-stakes challenge of managing thousands of services where a single misconfiguration could impact millions of merchants. They will demonstrate how Shopify moved beyond manual checkbox security by building an automated pipeline that combines Semgrep for static analysis and Open Policy Agent (OPA) for real-time policy enforcement.

This talk is a must-attend for the security community because it provides a battle-tested blueprint for solving the velocity vs. security dilemma we’re all too familiar with. While many orgs struggle with friction between DevOps and Security teams, Shopify’s approach shows how to bake guardrails directly into the developer workflow without slowing down deployment. Attendees will gain rare insights into the so-called rough patches of scaling open-source security tools and leave with a practical framework for automating risk detection across complex, high-traffic Kubernetes environments.


4. To upstream or not? Why becoming the maintainer of your dependencies matters

, a Principal Software Engineer at Elastic and an OpenTelemetry code owner, dives into the strategic heart of modern software engineering. Markou moves beyond the typical 

 narrative to present a pragmatic, business-first case for active maintenance. By sharing a high-stakes story of an OTel component saved from the brink of deprecation, he demonstrates how moving from a passive consumer to an active contributor transformed a potential technical debt nightmare into a rapid-response tool for solving critical customer issues.

This talk is a vital wake-up call for the security and observability communities because it addresses the growing crisis of software supply chain sustainability. In an era where a single abandoned dependency can lead to massive security vulnerabilities or operational outages, Markou provides a concrete example to share with your manager on why upstreaming isn't just altruism, it also can be treated as sensible risk management. For teams building on CNCF projects, this session offers a masterclass in how staying present in the ecosystem pays dividends in architectural control, security posture, and long-term engineering velocity.


5. How to add a new language feature to OPA

Adding features to a widely adopted language like Rego involves more than just a simple pull request. In this lightning session, Apple's 

 explores the full-stack impact of introducing new syntax, from the initial parser modifications to updating the broader ecosystem of editor tools. Learn the specific engineering hurdles involved in upgrading a mature security project without disrupting the developer experience. At Cloudsmith, we’re huge fans of Open Policy Agent and Rego, so we can’t wait to hear what Charlie has in store for us.

6. Platform Engineering 2.0: Just-enough Kubernetes and AI-native DevOps

 and a seasoned authority on platform patterns, tackles the industry's growing complexity bloat. Drawing from 20 years of experience and the literal scars of re-architecting internal platforms at one of the world’s largest travel sites, Vohra argues that the future of infrastructure isn't about building more, it’s really about building just enough. She will break down how to transition from heavy, static systems to lean, right-sized architectures using k3s, Gateway API, and ambient mesh, while layering in AIOps via Kubeflow and Prometheus to transform raw automation into true system intelligence.

This talk is a critical touchstone for the DevOps and platform communities because it offers a pragmatic exit ramp from the scale at all costs mentality that leads to massive cloud waste and operational blindness. Vohra’s AI-native approach is a blueprint for creating self-optimising ecosystems that align infrastructure directly with business value. For engineering leaders and architects feeling the weight of over-engineered clusters, this session aims to be a masterclass in staying lean, staying smart, and evolving platforms to be adaptive rather than just additive.

7. AI Agents & Platform Engineering: Efficiency boost or new source of trouble?

In the blockbuster panel, an elite group of industry leaders from 

 converges to debate the most disruptive shift in DevOps history. Featuring heavyweights like from the industry, this vendor-neutral discussion moves past the hype to ask the hard questions: Can non-deterministic AI agents actually keep pace with AI-accelerated developers, or are we just inviting unpredictable trouble into our production clusters? The panel will tackle the minimum viable platform foundation required for AI success, the shifting cost implications of agents in production, and how to build human trust in systems that don't always behave the same way twice.

This session is arguably the must-see event for the modern platform engineer because it addresses the looming intelligence gap in infrastructure. As developers pump out code at record speeds, the platform team is traditionally treated as the bottleneck. This panel explores whether AI agents are the ultimate scaling solution or a new category of technical debt. By bringing together perspectives from global tech giants and international organisations, attendees will walk away with a high-level framework for defining golden metrics for AI effectiveness and a roadmap for navigating the transition from static automation to dynamic, agent-led collaboration.

8. In Falco’s nest: The evolution of cloud native runtime security

In the maintainer track session, Falco contributors 

 (Kong) provide a deep-dive update on the CNCF’s de facto standard for runtime threat detection. The core of their presentation focuses on the highly anticipated Falco Operator, a game-changer designed to automate the deployment and management of security sensors across massive, distributed clusters, effectively lowering the barrier to entry for enterprise-scale security.

For the security community, this talk is a vital look at the roadmap for high-throughput runtime defense. As cloud-native environments become more complex and data-heavy, traditional security tools often struggle with performance overhead; Rozzo and Lacuku will demonstrate the specific optimisations that allow Falco to maintain deep visibility without sacrificing system reliability. Beyond the code, this session also is a great opportunity to see how the Falco ecosystem is integrating with the broader CNCF landscape, offering attendees a first look at the features that will define Cloud Detection & Response (CDR) in the coming year.

9. What LLMs do, and don’t, know about securing Kubernetes

, explores the practical (and often perilous) intersection of Generative AI and cluster orchestration. McCune, a veteran KubeCon speaker and a foundational voice in container security, will present the results of his deep-dive research into whether Large Language Models (LLMs) can actually be trusted with the sensitive credentials. Rather than just discussing theory, Rory will aim to demonstrate how LLMs handle specific Kubernetes security tasks, revealing where they provide genuine architectural insight and where they tend to hallucinate dangerous misconfigurations that could leave an organisation exposed.

This talk is a critical reality check for the security community as AI-assisted DevOps moves from a trend to a standard operating procedure. McCune will break down how advanced techniques like improved prompting and 

 reasoning can significantly shift the safety of an LLM's output, while also highlighting the so-called no-go zones where human expertise remains non-negotiable. For security architects and engineers, this session provides a vital framework for auditing AI-generated IaC templates, ensuring that the speed of AI doesn't come at the cost of a catastrophic security breach.

10. Audit-ready Kubernetes: How Chase UK leveraged policy-as-code for continuous compliance

 and co-creator of Kyverno, provide a rare under the hood look at building a cloud platform within the high-stakes world of regulated retail banking. Goyal, who manages the end-to-end Kubernetes ecosystem for Chase UK, will detail how his team transformed a massive compliance undertaking into a streamlined, automated engine. By leveraging Kyverno, OpenReports, and Grafana, they successfully shifted security left, allowing their backend engineers to ship code at speed while maintaining a real-time policy-as-code safety net that satisfies stringent financial regulators.

This talk is a beacon for the security and compliance communities because it addresses the ultimate white whale of enterprise DevOps: reducing audit times from weeks to minutes. Bugwadia’s deep perspective as a Kubernetes 

 co-chair, combined with Goyal’s real-world production perspective from JP Morgan Chase, offers a definitive guide on how to empower security teams to write independent policies without bottlenecking development. For any platform team operating in a regulated sector (or simply running mission-critical workloads) this session provides a proven framework for turning compliance from a manual, fear-driven process into a better, more transparent, and scalable process.

Nigel Douglas

Head of Developer Relations

Catch lightning talks, hands-on demos, and prizes while learning how to secure every artifact in your supply chain.

Join Cloudsmith in Amsterdam at KubeCon Europe 2026

13 KubeCon Europe 2026 sessions not to miss

KubeCon + CloudNativeCon North America 2025 is almost here, bringing together thousands of developers, security leaders, and platform engineers, to explore the latest in cloud-native technology. With dozens of talks, workshops, and keynotes across multiple tracks, it can be tough to know where to focus your time. To help, we’ve curated a list of 

 covering security, AI, cloud-native innovation, and platform engineering - including some interactive, hands-on experiences.

Georgia World Congress Center, Atlanta, GA


1. Kong AI gateway & insomnia workshop: AI success through API heroics

 Embassy Suites by Hilton Atlanta at Centennial Olympic Park

 is hosting this hands-on workshop exploring how AI-driven APIs can streamline workflows and improve automation. Attendees will work with Kong’s API Gateway and Insomnia tools to see practical examples of AI integration in real-world projects. If you’re curious about how Kong secures its software supply chain while supporting modern development practices, check out their 

2. Project lightning talk: The same great OPA, only faster

 Building C | Level 3 | Georgia Ballroom 2

 performance, demonstrating how teams can implement faster, more efficient policy-as-code pipelines. Learn tips and tricks for maintaining security and compliance at scale, while reducing the friction often associated with enforcing policies in CI/CD pipelines.

3. Capture the Flag challenge: Defend the pipeline

 Hilton Garden Inn Atlanta Downtown | Atlantic Room - 2nd Floor

 where you’ll defend a CI/CD pipeline against realistic attack scenarios. Participants can test their skills against malicious packages, misconfigurations, and supply chain threats, all in a safe, gamified environment. This session is a great way to see security best practices in action and get hands-on experience defending a modern software pipeline.

4. Keynote: Supply chain reaction - a cautionary tale in K8s security

This keynote examines lessons learned from major supply chain attacks and highlights how Kubernetes environments can be hardened against similar risks. Security leaders and DevOps teams will gain actionable insights on improving artifact integrity, detecting threats early, and reducing downstream risk across CI/CD pipelines.

5. Keynote: Maximum acceleration - Cloud Native at the speed of AI

’s Joseph Sandoval explores how cloud-native architectures can be optimised for AI-driven workloads. The session covers practical strategies for designing infrastructure that can scale dynamically, accelerate development cycles, and maintain operational reliability while supporting AI initiatives across the enterprise.

6. Taming the complexity beast: Rethinking software architecture & deployment

This session brings together engineers from 

, and other organisations to share how they simplify complex architectures and streamline deployments. Learn practical approaches for reducing operational overhead, improving reliability, and supporting fast-moving development teams across multiple platforms.

7. Platform Engineering day zero: The origin story

’s Murriel McCabe shares a blueprint for building scalable platform engineering teams from scratch. Attendees will learn how to structure teams, select tooling, and define processes that maximise productivity and maintain developer velocity from day one.

8. Keynote: There’s nothing to fear about the EU’s new Cybersecurity Law

Linux Kernel maintainer Greg Kroah-Hartman explains the implications of the EU’s new cybersecurity legislation for open-source projects and enterprise security teams. This session is essential for anyone responsible for compliance or managing public and private codebases.

9. Turn up the heat: Driving cloud-native innovation into real-world impact

Learn from real-world examples of how organisations are accelerating innovation while maintaining secure, reliable cloud-native deployments. This session highlights strategies for balancing velocity with compliance, and how cloud-native principles can drive tangible business outcomes.

10. The hidden risks in AI/ML supply chains: How to secure your workloads

 Building B | Level 5 | Thomas Murphy Ballroom 1

 explores the emerging security challenges in AI/ML pipelines, including model provenance, dependency risks, and how malicious artifacts can propagate across environments. Attendees will get actionable guidance on securing AI workloads in production.

11. Cloud-native back to the future: The road ahead

 leaders discuss the evolution of cloud-native practices, including modern tooling, automation strategies, and architectural patterns that will define the next era of software delivery.

12. Ulysses: Odyssey through platform engineering

 takes attendees on a deep dive into platform engineering maturity, sharing lessons learned, best practices, and practical advice for building reliable developer experiences at scale.

13. Mapping the next phase: Updating the Cloud-Native maturity model for 2025

 explore how cloud-native maturity models are evolving in the AI era and what this means for teams designing future-ready infrastructure. This session is ideal for technical leads planning long-term

 at KubeCon + CloudNativeCon 2025! Gain insights from booth lightning talks, get hands-on with live demos, and swap ideas with engineers solving the same challenges you are. Our team will be on hand to demo our cloud-native artifact management platform, answer your questions, and share tips on securing your software supply chain, securely sourcing LLM models, and improving CI/CD pipeline processes. We can’t wait to connect with you in person and explore how Cloudsmith can help your teams move faster, stay secure, and embrace modern development practices.

Claire Speedy

Senior Marketing Manager

test

13 sessions not to miss at KubeCon and CloudNativeCon 2025

: KubeCon London 2025 (KubeCon EU) showed a cloud-native ecosystem shifting from fragmentation to unification of policy, security, observability, and artifact management. Wasm is moving from hype to real-world use, OPA is expanding into FinOps, and signing everything (with SBOMs, attestations, and metadata) is becoming standard. Artifact registries are evolving fast, becoming unified platforms for governance, provenance, and automation across the software supply chain.

There’s something unmistakably electric about being at KubeCon in person. Maybe it’s the hallway chats, the animated late-night debates (helped along by the thump of House of Kube), or the shared momentum in the air – this year felt like a shift in the literal sense. Cloud-native isn’t just evolving; it’s maturing, solidifying, and meeting the pace of a world increasingly hungry for scale and simplicity.

, held at ExCeL London from April 1 to 4, brought together thousands of practitioners to explore the state of Kubernetes and the cloud-native stack. Several clear themes emerged across keynotes, breakout sessions, and late-night conversations.

 and cost optimization, and the ongoing reinvention of 

. Below, we’ve curated the significant highlights, with talk titles, speakers, and links to recordings and resources, plus our take on what they mean for the road ahead.

The conference vibe was exuberant and technically charged. CNCF celebrated its tenth anniversary of Kubernetes with a look forward: how to keep bridging cloud-native innovation with real-world production needs. The 

 introduced a fun twist on professional development: the 

 designation (and yes, now we want them too, at Cloudsmith).

This new CNCF program recognizes attendees completing 

all 13 CNCF certifications plus the LFCS Linux admin exam

, showcasing their cloud-native mastery. If you saw folks wearing unique Kubestronaut beanies or jackets, now you know why. The challenging economic climate also underscored a focus on 

: many hallway conversations compared notes on balancing cloud costs and complexity with on-prem solutions, highlighting that sometimes on-prem isn’t worth the trade-offs in agility.

 ~12,000+ attendees, 229 sessions, and countless community meetups and parties (don’t worry, the famous 

 party returned for those who could snag an invite, sponsored again, of course, by Cloudsmith, along with our friends at Humanitec, Tailscale, Sysdig, and Chainguard). Read on for our curated highlights of sessions relevant; we’ve organized the recap into thematic sections for easy scanning.

The Rise of Wasm in Cloud‑Native Applications

: Wasm is no longer experimental — it’s powering plugins, policy engines, and serverless runtimes in real deployments. Tools like wasmCloud and Spin are leading the way.

 emerged as a star of the show, signaling that 2025 is the year Wasm goes from promise to production in cloud-native systems. A standout session was 

"Was I Right or Wasm I Wrong? A Review of the Wasm Ecosystem”

 by Taylor Thomas (Cosmonic) and David Justice (Microsoft). Both are co-chairs of the CNCF TAG Runtime Wasm working group, and their talk gave a whirlwind tour of how Wasm has evolved from a browser technology to a 

portability, sandboxed security, and fast startup

, making it ideal for cloud and edge deployments. Custom ABIs hampered early server-side Wasm experiments, but the new 

 1.0 on the horizon) unlocks true interoperability. The talk highlighted a parade of projects leveraging Wasm today:

 – a CNCF project enabling a cloud-native Wasm application runtime

 by Fermyon – a developer tool for serverless Wasm apps

 – a universal policy engine using Wasm modules for Kubernetes admission control

 – demonstrating pluggable cluster scheduling logic in Wasm

 – extending proxies with Wasm filters (e.g.,

 – an OSS library running sandboxed functions blazingly fast via hypervisor protection

– we’re experimenting with Wasm via OPA-based policy enforcement, a use case we’re watching closely as these technologies converge.

: Wasm is no longer niche; it’s becoming a 

 for extensibility in many systems. Thomas and Justice’s candid discussion of the new 

 (with its strengths and weaknesses) helped the audience grasp 

 and what’s coming next. Keep an eye out for 

 with async support and eventually a stable WASI 1.0 (perhaps 2026) that promises no breaking changes.

 of Wasm content for those hungry for more on Wasm. 

 (Cosmonic) dived into wasmCloud’s road to standards in a talk cheekily titled 

“Wasm Whiplash: wasmCloud's Wild Ride To Standards.”

 And if you blinked, you might have missed a 

 by Joonas Bergius on mixing WebAssembly into Linkerd service mesh (

“Meshin’ With WebAssembly: Taking Linkerd Beyond Containers,”

 10 minutes of intriguing mashup). All these point to WebAssembly’s growing momentum: expect Wasm components powering plugins, microservices, and cloud functions in your architecture soon.

: Security was the dominant theme at KubeCon 2025. Signing, provenance, and secure-by-default registries were front and center. Tools like TUF, Notary, ORAS, and Kyverno are key to verifying that every artifact in your cluster is trusted.

 throughout KubeCon 2025. Nearly every keynote and many sessions hammered on safeguarding the software supply chain and production clusters. Multiple talks provided 

hands-on insights into tools and practices

 for artifact integrity, provenance, and vulnerability management.

“TUF-en Up Your Software Supply Chain”

 by Marina Moore (Edera) and Kairo de Araujo (Eclipse Foundation). This talk focused on 

, a CNCF graduate project aimed at secure software distribution (familiar to many via its use in PyPI, Docker Content Trust, and other systems). Moore and de Araujo highlighted how to distribute container images 

 their SBOMs and attestations in a tamper-evident way. They explained TUF’s core design (multi-signature trust, freshness checks, repository consistency guarantees, etc.) to ensure images and metadata remain current and unmodified in transit.

 for end-to-end verification, illustrating how an image’s SBOM and security attestations could be 

 as part of a secure CI/CD pipeline. The key takeaway is that 

As one of our team noted, the specifics of which signing framework you use (TUF, Cosign, Notary v2, etc.) may matter less than 

 and every organization must be proactive in defense.

Where and how you store signed artifacts matters, especially as OCI 1.1 enables registries to store and reference metadata like SBOMs and signatures reliably. Cloudsmith (like others in the ecosystem) is exploring how to surface this metadata securely and natively inside OCI workflows.

“Signed, Sealed, Delivered – Sign and Verify All the Things”

 by Jeremy Rickard (Microsoft). In this talk, Rickard tackled several scary scenarios (image tampering, unvetted YAML in prod, registry compromises) and then showed how to fight back using an arsenal of open-source tools. He wrote a story involving 

 to ensure every artifact in your cluster is trusted (

KubeCon + CloudNativeCon Europe 2025: Signed, Sealed, Delivered - Sign and Ver...

 – enabling OCI registry storage for arbitrary artifacts (not just container images, but also signatures, SBOMs, Helm charts, etc.)

 (v2) – signing artifacts and storing signature metadata in registries

 – GitOps operator (here, ensuring that only signed/approved configs make it to the cluster)

 – a policy engine that can validate images have known good signatures (at admission time)

Rickard walked through an end-to-end demo repository (promised on GitHub) showing how to set up 

production-grade signing and verification

. Attendees left with a clearer idea of how to put these pieces together to 

 were a common refrain across security talks this year.

Other security-related highlights included:

Project Lightning Talk: ORAS – Create and Distribute a Multi-platform Image with Security Posture

 by Feynman Zhou (Microsoft), covered a 5-minute demo of building a container image with SBOM and signing info as first-class OCI artifacts.

Project Lightning Talk: Protect your Kubernetes Clusters with Ratify and Attestations

 by Yi Zha (Microsoft) covered a quick introduction to 

, a Kubernetes admission controller that checks image signatures/attestations before allowing deployments.

Project Lightning Talk: Notary – Securing Binary Artifacts with Fine-grained Control

 (also by Yi Zha), likely covering the latest on Notary v2 project status and its integration with tooling.

“Notary Project: The Key to Secure Software Supply Chain”

 by Joaquim Rocha and René Dudfield. A longer form talks about how Notary v2 is evolving as a cornerstone to securing artifacts in registries.

These trends emphasize why securing the registry is so important. Cloud-native platforms are expected to handle many formats, not just containers, but Helm charts, Wasm modules, and more, while maintaining integrity, provenance, and policy enforcement.

: Observability took center stage, pushing to unify metrics, logs, and traces via a standard query language and better tooling. Real-time insight is becoming essential for security, performance, and cost optimization.

Everyone at KubeCon seemed obsessed with observability, 

not just having data but also querying it more ingeniously

. The hot topic was breaking down silos between metrics, logs, traces, and other telemetry to derive end-to-end insights.

“From the Observability TAG: Designing a Common Query Language for Observability Data”

 (Netflix). Representing the CNCF TAG Observability, these speakers unveiled progress on a unified query language spec for observability (you could call it “SQL for observability”). The idea is to reduce the 

 engineers face when switching between different query syntaxes (PromQL, LogQL, etc.) across tools. Instead, why not have a 

 with extensions to query metrics, traces, logs, and profiles?

They discussed design principles and their research. The consensus is that 

 (with some “syntactic sugar” for pipes and time-series nuances) is a strong foundation. The Observability TAG’s Query Language workgroup is finalizing a spec in 2025, experimenting with pipelining syntax for more straightforward unknown data exploration. If this converges, we might soon write one query that joins data from Prometheus, Jaeger, and Loki in one go – unlocking 

. The excitement in the room was palpable; many see this as a needed evolution to make observability more accessible and powerful.

At KubeCon, visibility across your entire software supply chain came through loud and clear, something we’ve been thinking a lot about at Cloudsmith. Real-time insight into artifact usage and distribution isn’t just a nice to have; it’s quickly becoming foundational to security, performance, and cost optimization.

Other observability updates included project-specific sessions like the 

 sharing the latest on OTel’s roadmap) and deep dives on newer observability tools. eBPF continued to show its strengths in cloud-native troubleshooting. For example, 

 (an eBPF toolkit) was featured in a contrib session on simplifying Kubernetes observability. Across the board, the message was that 

, another exciting update teased at KubeCon, with an upcoming release on April 23rd, 2025, offers a net new enhancement to Pod Generation. Until this point, pods had a metadata generation field to represent a specific desired state of a pod, but the field is currently unused on pods. With 

, users can allow the pod status to express which pod updates are reflected in the pod status for deeper, improved pod lifecycle visibility.

 Expect the lines between logs, metrics, and traces to blur. Tooling will likely unify, and you should keep an eye on emerging standards (perhaps start with the 

 discussions). It also validates why many vendors (and projects) push 

Open Policy Agent (OPA) Everywhere – Even FinOps

Open Policy Agent remains central to security policy but is now expanding into cost optimization. If you’re already using Gatekeeper, adding custom FinOps policies is an easy next step — and increasingly a product expectation for cloud-native solutions.

 has been mainstream for security for a while (with 

 leading the charge), but KubeCon 2025 showed OPA branching into new domains. The 

 session by project maintainers (Charlie Egan of Styra, Anders Eknert, and others) drew a big crowd, which is impressive for a project that’s been around for years. OPA’s maintainers provided updates on the roadmap:

OPA’s core is stable. However, handy features like a long-awaited logical 

 are high on the wish list (and likely coming soon). These were celebrated since they’ll make writing policies much more ergonomic.

 and test streaming modes are being explored to speed up policy evaluation and CI feedback.

 (a Rego linter framework) saw significant improvements between v0.7 and v1.2, and the VSCode OPA plugin improved with new debugging capabilities.

The most buzzworthy angle was using OPA beyond security. 

“Beyond Security: Leveraging OPA for FinOps in Kubernetes.”

 The vast audience was a testament to FinOps being top-of-mind. The idea: 

if OPA can enforce policies for security, why not for cost optimization, too?

 Venkatesan showed how you can use OPA (with Gatekeeper) to 

Enforce that specific teams or namespaces use only cheaper instance types (e.g., 

 on every namespace or deployment (to avoid “shadow” spend).

 – e.g., disallow new deployments if the cluster is nearing a monthly spend cap (with override processes for exceptions).

, the CNCF incubating project for K8s cost monitoring (

), for real-time enforcement. For instance, OpenCost can feed metrics on namespace spend, and OPA can then take action if thresholds cross a line.

This “Shift Left for cost” mantra, or 

 concept, resonated strongly. Attendees walked away thinking about cost as another 

Cloudsmith Blog

13 KubeCon Europe 2026 sessions not to miss

13 sessions not to miss at KubeCon and CloudNativeCon 2025

KubeCon London 2025 Recap: Cloud-Native Insights on Security, Wasm, and More

Your Ultimate KubeCon Guide

Cloudsmith is headed to Salt Lake City for KubeCon North America 2024

Reflecting on ShipItCon 2024: High-performing teams need flow

6 Must-See DevOps Talks at PlatformCon 2024

That's a Wrap on KubeCon 2024!

Cloudsmith is headed to Paris for KubeCon Europe 2024

Cloudsmith Presents Unpacked: A Virtual Conference for DevOps Professionals and Engineering Leaders happening June 20, 2023

The Cloudsmith Team is Headed to AWS Summit in Paris April 4!

Visit Cloudsmith at KubeCon + CloudNativeCon in Amsterdam!