: KubeCon London 2025 (KubeCon EU) showed a cloud-native ecosystem shifting from fragmentation to unification of policy, security, observability, and artifact management. Wasm is moving from hype to real-world use, OPA is expanding into FinOps, and signing everything (with SBOMs, attestations, and metadata) is becoming standard. Artifact registries are evolving fast, becoming unified platforms for governance, provenance, and automation across the software supply chain.

There’s something unmistakably electric about being at KubeCon in person. Maybe it’s the hallway chats, the animated late-night debates (helped along by the thump of House of Kube), or the shared momentum in the air – this year felt like a shift in the literal sense. Cloud-native isn’t just evolving; it’s maturing, solidifying, and meeting the pace of a world increasingly hungry for scale and simplicity.

, held at ExCeL London from April 1 to 4, brought together thousands of practitioners to explore the state of Kubernetes and the cloud-native stack. Several clear themes emerged across keynotes, breakout sessions, and late-night conversations.

 and cost optimization, and the ongoing reinvention of 

. Below, we’ve curated the significant highlights, with talk titles, speakers, and links to recordings and resources, plus our take on what they mean for the road ahead.

The conference vibe was exuberant and technically charged. CNCF celebrated its tenth anniversary of Kubernetes with a look forward: how to keep bridging cloud-native innovation with real-world production needs. The 

 introduced a fun twist on professional development: the 

 designation (and yes, now we want them too, at Cloudsmith).

This new CNCF program recognizes attendees completing 

all 13 CNCF certifications plus the LFCS Linux admin exam

, showcasing their cloud-native mastery. If you saw folks wearing unique Kubestronaut beanies or jackets, now you know why. The challenging economic climate also underscored a focus on 

: many hallway conversations compared notes on balancing cloud costs and complexity with on-prem solutions, highlighting that sometimes on-prem isn’t worth the trade-offs in agility.

 ~12,000+ attendees, 229 sessions, and countless community meetups and parties (don’t worry, the famous 

 party returned for those who could snag an invite, sponsored again, of course, by Cloudsmith, along with our friends at Humanitec, Tailscale, Sysdig, and Chainguard). Read on for our curated highlights of sessions relevant; we’ve organized the recap into thematic sections for easy scanning.

The Rise of Wasm in Cloud‑Native Applications

: Wasm is no longer experimental — it’s powering plugins, policy engines, and serverless runtimes in real deployments. Tools like wasmCloud and Spin are leading the way.

 emerged as a star of the show, signaling that 2025 is the year Wasm goes from promise to production in cloud-native systems. A standout session was 

"Was I Right or Wasm I Wrong? A Review of the Wasm Ecosystem”

 by Taylor Thomas (Cosmonic) and David Justice (Microsoft). Both are co-chairs of the CNCF TAG Runtime Wasm working group, and their talk gave a whirlwind tour of how Wasm has evolved from a browser technology to a 

portability, sandboxed security, and fast startup

, making it ideal for cloud and edge deployments. Custom ABIs hampered early server-side Wasm experiments, but the new 

 1.0 on the horizon) unlocks true interoperability. The talk highlighted a parade of projects leveraging Wasm today:

 – a CNCF project enabling a cloud-native Wasm application runtime

 by Fermyon – a developer tool for serverless Wasm apps

 – a universal policy engine using Wasm modules for Kubernetes admission control

 – demonstrating pluggable cluster scheduling logic in Wasm

 – extending proxies with Wasm filters (e.g.,

 – an OSS library running sandboxed functions blazingly fast via hypervisor protection

– we’re experimenting with Wasm via OPA-based policy enforcement, a use case we’re watching closely as these technologies converge.

: Wasm is no longer niche; it’s becoming a 

 for extensibility in many systems. Thomas and Justice’s candid discussion of the new 

 (with its strengths and weaknesses) helped the audience grasp 

 and what’s coming next. Keep an eye out for 

 with async support and eventually a stable WASI 1.0 (perhaps 2026) that promises no breaking changes.

 of Wasm content for those hungry for more on Wasm. 

 (Cosmonic) dived into wasmCloud’s road to standards in a talk cheekily titled 

“Wasm Whiplash: wasmCloud's Wild Ride To Standards.”

 And if you blinked, you might have missed a 

 by Joonas Bergius on mixing WebAssembly into Linkerd service mesh (

“Meshin’ With WebAssembly: Taking Linkerd Beyond Containers,”

 10 minutes of intriguing mashup). All these point to WebAssembly’s growing momentum: expect Wasm components powering plugins, microservices, and cloud functions in your architecture soon.

: Security was the dominant theme at KubeCon 2025. Signing, provenance, and secure-by-default registries were front and center. Tools like TUF, Notary, ORAS, and Kyverno are key to verifying that every artifact in your cluster is trusted.

 throughout KubeCon 2025. Nearly every keynote and many sessions hammered on safeguarding the software supply chain and production clusters. Multiple talks provided 

hands-on insights into tools and practices

 for artifact integrity, provenance, and vulnerability management.

“TUF-en Up Your Software Supply Chain”

 by Marina Moore (Edera) and Kairo de Araujo (Eclipse Foundation). This talk focused on 

, a CNCF graduate project aimed at secure software distribution (familiar to many via its use in PyPI, Docker Content Trust, and other systems). Moore and de Araujo highlighted how to distribute container images 

 their SBOMs and attestations in a tamper-evident way. They explained TUF’s core design (multi-signature trust, freshness checks, repository consistency guarantees, etc.) to ensure images and metadata remain current and unmodified in transit.

 for end-to-end verification, illustrating how an image’s SBOM and security attestations could be 

 as part of a secure CI/CD pipeline. The key takeaway is that 

As one of our team noted, the specifics of which signing framework you use (TUF, Cosign, Notary v2, etc.) may matter less than 

 and every organization must be proactive in defense.

Where and how you store signed artifacts matters, especially as OCI 1.1 enables registries to store and reference metadata like SBOMs and signatures reliably. Cloudsmith (like others in the ecosystem) is exploring how to surface this metadata securely and natively inside OCI workflows.

“Signed, Sealed, Delivered – Sign and Verify All the Things”

 by Jeremy Rickard (Microsoft). In this talk, Rickard tackled several scary scenarios (image tampering, unvetted YAML in prod, registry compromises) and then showed how to fight back using an arsenal of open-source tools. He wrote a story involving 

 to ensure every artifact in your cluster is trusted (

KubeCon + CloudNativeCon Europe 2025: Signed, Sealed, Delivered - Sign and Ver...

 – enabling OCI registry storage for arbitrary artifacts (not just container images, but also signatures, SBOMs, Helm charts, etc.)

 (v2) – signing artifacts and storing signature metadata in registries

 – GitOps operator (here, ensuring that only signed/approved configs make it to the cluster)

 – a policy engine that can validate images have known good signatures (at admission time)

Rickard walked through an end-to-end demo repository (promised on GitHub) showing how to set up 

production-grade signing and verification

. Attendees left with a clearer idea of how to put these pieces together to 

 were a common refrain across security talks this year.

Other security-related highlights included:

Project Lightning Talk: ORAS – Create and Distribute a Multi-platform Image with Security Posture

 by Feynman Zhou (Microsoft), covered a 5-minute demo of building a container image with SBOM and signing info as first-class OCI artifacts.

Project Lightning Talk: Protect your Kubernetes Clusters with Ratify and Attestations

 by Yi Zha (Microsoft) covered a quick introduction to

, a Kubernetes admission controller that checks image signatures/attestations before allowing deployments.

Project Lightning Talk: Notary – Securing Binary Artifacts with Fine-grained Control

 (also by Yi Zha), likely covering the latest on Notary v2 project status and its integration with tooling.

“Notary Project: The Key to Secure Software Supply Chain”

 by Joaquim Rocha and René Dudfield. A longer form talks about how Notary v2 is evolving as a cornerstone to securing artifacts in registries.

These trends emphasize why securing the registry is so important. Cloud-native platforms are expected to handle many formats, not just containers, but Helm charts, Wasm modules, and more, while maintaining integrity, provenance, and policy enforcement.

: Observability took center stage, pushing to unify metrics, logs, and traces via a standard query language and better tooling. Real-time insight is becoming essential for security, performance, and cost optimization.

Everyone at KubeCon seemed obsessed with observability, 

not just having data but also querying it more ingeniously

. The hot topic was breaking down silos between metrics, logs, traces, and other telemetry to derive end-to-end insights.

“From the Observability TAG: Designing a Common Query Language for Observability Data”

 (Netflix). Representing the CNCF TAG Observability, these speakers unveiled progress on a unified query language spec for observability (you could call it “SQL for observability”). The idea is to reduce the 

 engineers face when switching between different query syntaxes (PromQL, LogQL, etc.) across tools. Instead, why not have a 

 with extensions to query metrics, traces, logs, and profiles?

They discussed design principles and their research. The consensus is that 

 (with some “syntactic sugar” for pipes and time-series nuances) is a strong foundation. The Observability TAG’s Query Language workgroup is finalizing a spec in 2025, experimenting with pipelining syntax for more straightforward unknown data exploration. If this converges, we might soon write one query that joins data from Prometheus, Jaeger, and Loki in one go – unlocking 

. The excitement in the room was palpable; many see this as a needed evolution to make observability more accessible and powerful.

At KubeCon, visibility across your entire software supply chain came through loud and clear, something we’ve been thinking a lot about at Cloudsmith. Real-time insight into artifact usage and distribution isn’t just a nice to have; it’s quickly becoming foundational to security, performance, and cost optimization.

Other observability updates included project-specific sessions like the 

 sharing the latest on OTel’s roadmap) and deep dives on newer observability tools. eBPF continued to show its strengths in cloud-native troubleshooting. For example, 

 (an eBPF toolkit) was featured in a contrib session on simplifying Kubernetes observability. Across the board, the message was that 

, another exciting update teased at KubeCon, with an upcoming release on April 23rd, 2025, offers a net new enhancement to Pod Generation. Until this point, pods had a metadata generation field to represent a specific desired state of a pod, but the field is currently unused on pods. With 

, users can allow the pod status to express which pod updates are reflected in the pod status for deeper, improved pod lifecycle visibility.

 Expect the lines between logs, metrics, and traces to blur. Tooling will likely unify, and you should keep an eye on emerging standards (perhaps start with the

 discussions). It also validates why many vendors (and projects) push 

Open Policy Agent (OPA) Everywhere – Even FinOps

Open Policy Agent remains central to security policy but is now expanding into cost optimization. If you’re already using Gatekeeper, adding custom FinOps policies is an easy next step — and increasingly a product expectation for cloud-native solutions.

 has been mainstream for security for a while (with 

 leading the charge), but KubeCon 2025 showed OPA branching into new domains. The 

 session by project maintainers (Charlie Egan of Styra, Anders Eknert, and others) drew a big crowd, which is impressive for a project that’s been around for years. OPA’s maintainers provided updates on the roadmap:

OPA’s core is stable. However, handy features like a long-awaited logical 

 are high on the wish list (and likely coming soon). These were celebrated since they’ll make writing policies much more ergonomic.

 and test streaming modes are being explored to speed up policy evaluation and CI feedback.

 (a Rego linter framework) saw significant improvements between v0.7 and v1.2, and the VSCode OPA plugin improved with new debugging capabilities.

The most buzzworthy angle was using OPA beyond security. 

“Beyond Security: Leveraging OPA for FinOps in Kubernetes.”

 The vast audience was a testament to FinOps being top-of-mind. The idea: 

if OPA can enforce policies for security, why not for cost optimization, too?

 Venkatesan showed how you can use OPA (with Gatekeeper) to 

Enforce that specific teams or namespaces use only cheaper instance types (e.g., 

 on every namespace or deployment (to avoid “shadow” spend).

 – e.g., disallow new deployments if the cluster is nearing a monthly spend cap (with override processes for exceptions).

, the CNCF incubating project for K8s cost monitoring (

), for real-time enforcement. For instance, OpenCost can feed metrics on namespace spend, and OPA can then take action if thresholds cross a line.

This “Shift Left for cost” mantra, or 

 concept, resonated strongly. Attendees walked away thinking about cost as another 

 for security policies, extending it with custom cost policies could be a low-hanging fruit to improve your cloud bills.

Sathish’s slides are attached to the schedule (link below). Also, check out 

’s official site; it’s now a CNCF Incubating project providing 

). Combining OpenCost dashboards with OPA enforcement could become a familiar pattern. The overarching message: 

 anymore; it’s a general policy engine that can encode business rules, compliance, and efficiency best practices in one place.

(On a related note, conversations at the OPA booth indicated a lot of interest in multi-cloud policy and using OPA for things like network policy validation and even 

. If there’s a rule to enforce, OPA is being considered. It was gratifying to hear that, given our focus on integrating it at Cloudsmith, it’s part of our Policy Engine.)

Cloud-Native Artifact Management & Beyond

Artifact registries are evolving to meet new expectations for provenance, automation, and cost efficiency. Talks focused on treating all artifacts as OCI-native, aligning with SLSA, and integrating retention and security as standard.

KubeCon wouldn’t be complete without looking at the ecosystem of tools managing our container images and artifacts. The ‘A’ in SLSA is Artifacts, where most of the conversation landed. Artifact registries are evolving from simple stores to platforms with broad capabilities that help enforce provenance, retention, and policy. A few other talks and announcements stood out:

 (the CNCF-hosted index of Helm charts, OLM operators, Wasm packages, and more) maintainers discussed improvements in discovering and trusting content. There was no major talk this time, but artifact discoverability remains critical as the hub grows with new package types (including Wasm modules).

: The move to treat everything (from Helm charts to SBOMs) as OCI artifacts stored in registries is gaining traction. Demos showed oras CLI pushing a multi-architecture image and its security posture in one go (

Azure at KubeCon Europe 2025 | London, UK - April 1-4 | Microsoft Community Hub

). This means your artifact management solution needs to handle more than just “docker images” – it’s now about 

. At Cloudsmith, we're seeing increased demand for this: attaching SBOMs and signatures as first-class citizens and treating all software supply chain components as OCI-native artifacts.

Supply Chain Levels for Software Artifacts (SLSA)

: While not explicitly in the notes, these underpin much of what was discussed. Several speakers indirectly referenced needing provenance metadata. If you haven’t looked at

 for signing, now’s the time – supply chain security is shifting from optional to mandatory.

: A recurring idea was “don’t store what you don’t need.” Observability and cost concerns drive thinking about artifact retention policies. Platforms (like artifact registries or storage) are adding more ingenious cleanup features – for example, auto-expiring images that are untagged or enforcing quotas per team. This wasn’t a specific talk, but multiple attendees mentioned it in the context of 

 We often hear this conversation, especially around retention policies and cost-aware storage.

Across the CNCF ecosystem, several solutions, from on-prem registries like Harbor to managed platforms like Cloudsmith, are evolving to meet the growing demands of artifact security and lifecycle management. The conversation has shifted from ‘Where do I store this?’ to ‘How do I secure, govern, and automate this across environments?’ The cloud-native ecosystem is moving toward giving teams 

 through policy, better data, or better automation. This bodes well for platform engineering teams tasked with providing golden paths that are both secure and efficient.

Beyond the sessions our attendees experienced, here are a few 

 that align with the themes and are worth checking out (we’ve cross-referenced titles and speakers with the official schedule for accuracy):

“Lessons Learned From Architecting the Highest-Scale Operational Systems in the World”

 A veteran building a global CDN shares how to design resilient platforms at scale. Touches on balancing vendor solutions vs. DIY and avoiding single points of failure. Great insights for platform engineers and SREs.

“Container Runtimes… on Lockdown: The Hidden Costs of Multi-Tenant Workloads”

 – Lewis Denham-Parry, ControlPlane (from the co-located Security Day). 

 If you care about container isolation trade-offs and sandboxing (gVisor, Firecracker, etc.), this talk delves into the 

 balance for multi-tenant Kubernetes. It aligns with artifact management in how you securely run those artifacts.

“A Practical Guide to Kubernetes Policy as Code”

 Bridget is always an engaging speaker, and she likely covered real-world tips on using tools like Kyverno or OPA for implementing policies. It is helpful for those looking to get started with governance in their clusters.

“SIG-Multicluster: Intro and Real-World Usage”

 As teams scale to multiple clusters and cloud regions, understanding Kubernetes multicluster APIs and patterns becomes essential. Artifact distribution (e.g., how images get to all clusters) and policy consistency are part of this story. The SIG’s update provides clues on the future of multi-cluster management.

Day Two Keynote Recap (CNCF blog) – featuring an interesting panel, 

“Mind the Gap: Bridging cloud-native innovation with real-world use cases.”

 – All keynotes and sessions were recorded and will be on

 within a few weeks. Check there for on-demand videos (e.g., search for talk titles or speakers).

Conclusion: Cloud Native’s Trajectory in 2025

KubeCon London 2025 reinforced that the cloud-native ecosystem is maturing but 

. Security is non-negotiable now – whether signing artifacts, enforcing policies, or adopting zero-trust principles, it’s clear that “shift left” and “shield right” are happening in tandem. At the same time, new frontiers like WebAssembly are expanding what 

 means, promising more portable and plugin-oriented architectures.

 is the next big challenge. As Kubernetes and its host of CNCF projects become the default platform for everything from web apps to machine learning, organizations are keen to ensure they’re not wasting resources (or money). Expect to see cost insights become as standard as monitoring dashboards.

Lastly, the vibe from KubeCon EU 2025 was one of 

: previously separate concerns (security, ops, dev experience, cost, compliance) are being addressed holistically. The “here’s a tool for X and another for Y” era paved the way for standards that integrate these needs. It’s an exciting time to be in the cloud-native community. If the discussions in London are any indication, the next year or two will bring even more alignment between diverse efforts, from 

Where is the cloud-native ecosystem heading?

 Based on this, KubeCon is moving toward a world where 

 is declarative and automated, from cost controls to security guardrails, and where platforms are flexible enough to incorporate innovations like Wasm seamlessly. In short, it’s heading to a place where operators and developers can work with unprecedented agility 

 control. If you can adapt to the new tools and paradigms (and earn your 

 badges along the way), you’ll be well-prepared for this future.

As a cloud-native company, we found the themes at KubeCon deeply aligned with where we see the ecosystem heading: security, developer experience, and cost awareness are converging to shape the next era of platform maturity. Alongside the OpenSSF and frameworks like SLSA and S2C2F, the next wave of platform maturity in the community will come from ecosystems that help unify those concerns through better metadata, compliance tooling, and visibility.

Want to chat more about these trends? Reach out to the team at Cloudsmith.

 The content above was constructed from the internal notes of the Cloudsmith engineering team attending various talks. It was cross-referenced with the official KubeCon EU 2025 schedule and related resources for accuracy and additional context. Key references include KubeCon session descriptions, CNCF announcements, and project documentation. See the official

 KubeCon EU 2025 schedule directory for more details on specific talks

Kubernetes 1.33 – What you need to know

Introducing Cloudsmith’s Advanced Observability Suite for Enterprise Artifact Management

SLSA: A Route to Tamper-Proof Builds and Secure Software Provenance

Native Signing Support In Cloudsmith Extended To Docker, NuGet, And Swift

Mastering Open Source Security: Your Guide to S2C2F

Secure and Compliant Software Delivery with Cloudsmith Policy Management

KubeCon London 2025 Recap: Cloud-Native Insights on Security, Wasm, and More

products lies in their architecture, design philosophy, and how they leverage cloud infrastructure. Let’s break down the key distinctions:

A Cloud Native product is specifically built for the cloud from the ground up. It is designed to fully utilize cloud computing capabilities such as scalability, elasticity, and high availability.

Microservices / Distributed Architecture:

 The application is often broken down into microservices and/or leverages Cloud-Provider managed services, with each service independently deployable, scalable, and manageable.

: They can automatically scale up or down based on demand, making them more efficient in handling fluctuating workloads. Also, the scaling can be more fine-grained, to specific parts of the service/platform

: Cloud-native applications are built to use cloud-specific databases (e.g., AWS Aurora Postgres, DynamoDB or Google Cloud Spanner etc) and services designed to take full advantage of cloud features. They are “Infrastructure Aware”.

: Cloud-native appliications typically support rapid development cycles, using CI/CD pipelines to automate deployments seamlessly with zero downtime. This means faster updates, releases, improvements and fixes.

Example: A cloud-native SaaS product like Netflix or Slack is architected specifically for dynamic cloud environments, offering high availability, multi-region support, and easy scaling.

A Cloud Hosted product is typically a legacy or traditional software application that was originally built for on-premise environments but has since been moved to the cloud. Instead of being designed with cloud-native principles, it's hosted on virtual machines or cloud infrastructure and usually does not fully leverage cloud-native features.

: These products are often built as large, single applications that run as an instance rather than being divided into smaller, scalable services.

: Rather than using containers or orchestration, these apps may be hosted on traditional virtual machines or cloud servers (e.g., AWS EC2 or Azure VMs).

: Cloud Hosted products may not scale as efficiently or dynamically as cloud-native products, requiring the entire instance to be scaled up or additional whole instances spun up and clustered/replicated, making them less responsive to real-time demand compared to cloud-native apps.

: These products often still rely on traditional infrastructure or databases (Like MySQL or Oracle), with those databases hosted in the cloud on a virtual machine.

An example could be older CRM systems like SAP or older ERP software moved to the cloud but without restructuring/re-architecting the core software to fully utilize cloud-native principles.

Optimized for containers, serverless, etc.

Relies on virtual machines or traditional instance-based setups.

Continuous integration and deployment. Frequent updates

Traditional deployment, Slower / less frequent updates.

Limited by original design, can be less responsive to changes.

In essence, "Cloud Native" means that an application is inherently designed to take full advantage of cloud computing, whereas "Cloud Hosted" applications are more of a legacy or traditional application that's been minimally adapted to run on cloud provider infrastructure. Cloudsmith is a true Cloud Native Artifact Management product.

It’s just not easy to take a traditional application and make it Cloud Native, it’s much less development effort just to host that application on a cloud provider’s infrastructure. To be truly Cloud Native requires Cloud technologies and services to have been considered when an application was architected. To do this with a traditional application that can be installed on a server on-prem or a VM in the Cloud is essentially a rewrite of the application, and that is a monumental effort for a vendor, especially when they have an installed base of users. Ultimately, it would be an entirely new product.

"Cloud Native" - Why it matters?

It’s a fairly common perception that a package repository is basically a file share or file storage, and perhaps for some of the most simple implementations, this is a reasonable analogy.

Cloudsmith blog

KubeCon London 2025 Recap: Cloud-Native Insights on Security, Wasm, and More

"Cloud Native" - Why it matters?

What happens when you upload a Package?

10 Awesome Benefits of Artifact Management and Why You Need It

2022 State of DevOps [On-demand Session]

How Do Mature DevOps Teams Manage Software Security? [On-demand Session]

SBOMs: The New Standard in Supply Chain Security [On-demand Session]

How to Analyze an SBOM

Understanding and Implementing a Software Bill of Materials

Continuous Software Pipelines: Why Enterprises Are Going Cloud-Native Dev Week Enterprise Open Talk

Package Management for Gaming Software Development

Cloud-Native Pipelines: Secure Software Delivery, Made Simple Dev Week Cloud Workshop Session