Dutch Cloud Native Day 2026: agents, sovereignty, and a good time in the hallway

On 30 October I went to Dutch Cloud Native Day at the Jaarbeurs in Utrecht. This year’s theme was “Cloud Native in the Age of AI”, and it was a very fun day: good talks, kind people, and a good time in the hallway. I take home mostly sovereignty, and the sight of a lot of people building their own platform to meet their own requirements, above all platforms that are flexible, developer-oriented and simple to use. This post covers the talks that stuck and the people I met between sessions.

Alex Kotliarskyi: what breaks when agentic software factories run on Kubernetes #

Alex’s talk was called “No token budget: what breaks when agentic software factories run on Kubernetes”. He described a system of many agents that run on a cloud native stack and talk to each other over NATS.

The more interesting part was what did not work. Steering each agent individually did not work. Specs did not work either. Custom interfaces fell short too. I liked that he said so plainly.

What did work is SPO, single problem optimization. You give the system one problem, let agents propose N solutions, and a grader picks the result. His line was “what we can measure we can optimize?” That gives a clear split between two kinds of goals. Finite objectives have an end, like solving a math problem or creating a feature. Infinite objectives never end, like keeping production green or optimising performance. A grader can serve both. For deployment it asks one question: is this version better than the baseline?

I write specs myself today, and I see that they are never perfect. SPO answers a problem I recognise, and I’m going to try it.

Entropy was the other theme. In this talk “slop” means code that agents produce that works but makes the codebase worse: it is duplicated, overly complex or not idiomatic. They measure complexity and duplicated lines so they can push both down. Alex called this part research. It is still open.

He closed with two lessons:

• The basics have the best return: isolated environments that bring everything they need, a fast feedback loop and usable core infrastructure.
• Fight entropy. Reduce the solution space, choose consistency over optimal solutions, and prune, because agents will only keep growing the system.

Laurent Sibilla: beyond the MVP #

Laurent told the story of how Cover Whale, an insurance company, grew its developer platform beyond the MVP. The New Stack has a written version. The story centres on project PV2. Its predecessor PV1 was an insurance platform built as a Laravel and PHP monolith, and technical debt kept piling up. PV2 started as an MVP with GitHub, Helm, OpenTofu, CI, a registry and CD. Helm was quick to set up but scaled badly. The MVP also ran on existing infrastructure, so it had no environment segregation, no dedicated platform cluster and no self-hosted observability.

Then the developers asked for NATS. The platform team pushed back. NATS was hard to adopt because of missing standards and unclear operation. But it mattered a lot to the developers, and if you refuse, they run it themselves. That turns into an operational nightmare, because when it breaks at night, who gets called out of bed?

The answer was to make NATS a first-class citizen. The platform team supports it as a golden path, and Laurent was explicit about the idea: golden paths, not golden cages. They built it as an operator with a CRD.

For the platform layer they used Kratix, made by Syntasso. Kratix writes to Git and Argo CD deploys from there, so Kratix never acts on services directly. That keeps it agnostic about what it manages. It also solved API aggregation across teams. The promise, which is the Kratix spec for a service, defines what is allowed with NATS: creating service users and assigning permissions.

Secrets were the catch. Kratix is GitOps-based, and that is not great for secrets. They used Sealed Secrets, where kubeseal encrypts the secret and the controller creates the Kubernetes Secret, and they solved it without leaving Kratix.

I recognise the shape of this story. A team picks the quick tool, the quick tool hits its limit, and a platform team has to turn a request into a supported path. The lesson I take from it: do that early.

Sovereignty: Orlin Vasilev and Aarno Aukia #

Sovereignty was the other thread, and two talks carried it.

Orlin Vasilev: whose yard are you building in? #

Orlin is an open source advocate at SAP and chairs the NeoNephos Foundation’s governing board. He opened with a treehouse. Building starts with where you build, and that means whose yard. So why put your stuff in someone else’s yard?

He backed it with a number from the European Commission: the EU depends on non-EU countries for more than 80% of its key digital products, services and infrastructure. He listed existing European efforts going back to GAIA-X in 2019. The NeoNephos Foundation is one of them, a Linux Foundation Europe project. He showed three of its projects:

• IronCore offers IaaS and bare metal through the Kubernetes API.
• Gardener manages Kubernetes clusters across infrastructures.
• Platform Mesh gives you multi-tenant control planes, with KRM as the common language between providers and consumers.

The EU has a Technological Sovereignty Package from June 2026. The NeoNephos community calls are open, and you can join through neonephos.org.

For numbers on the mood in the field, the Linux Foundation research 2026 State of Open Source Europe reports that 94% of respondents call digital sovereignty a strategic priority. The report is sponsored by NeoNephos.

Aarno Aukia: sovereignty as three tests #

Aarno is co-founder and partner at VSHN, a Swiss managed Kubernetes provider. His talk was the most inspiring one of the day for me.

He stated sovereignty as three tests, the same framing VSHN wrote up after Cloud Native Days Austria. Location: “Can you move where it runs without changing how developers consume it?” Operator: “Can you replace who runs it without replacing the technology?” Vendor: “Can you replace the software without rebuilding?” Those are questions you can answer with yes or no for a given system.

His answer is a neutral platform layer with one platform API. The demo was a production database in 10 lines. The manifest has no cloud, no region, no operator and no storage class. You ask for a database, and the platform decides the rest.

Then came the part that proved the point. VSHN changed the operator underneath that database, and the API users talk to stayed the same. Same API, new engine. VSHN is also replacing its own control plane.

His message was that “sovereignty is now measurable”. The talk set me thinking about what sovereignty actually means, and turning a vague word into concrete tests is what made it click.

Shorter notes #

Pini Reznik of re:cinq gave a keynote called “The AI Adoption Ladder: From First Licences to the Dark Factory”. One of his slides read “we accidentally built a software factory”. It is an AI-driven software factory: AI agents do the software work, and humans set the intent and validate the result. Their reference architecture has two planes. The intent plane makes the right plans, and the execution plane runs the work safely, in isolation.

The slide that stuck was about speed. Agents can produce work in hours that takes a human far longer to understand. That makes validation the bottleneck, so they ask for independent validation and managed context, and validation needs knowledge. Their phrase was “dark does not mean human-free”. It plays on the dark factory, a factory that runs with the lights off and no people on the floor. Even a fully automated software factory still needs humans. He co-wrote the book From Cloud Native to AI Native.

Dimitris Karakasilis of Spectro Cloud gave “AI broke your DevOps assumptions”. The talk covered supply chain security, vulnerabilities and patching: how AI changes the assumptions DevOps made about security, and how fast you can get fixes out. One of the countermeasures he showed is Kairos, a CNCF sandbox project that provides an immutable, distro-agnostic Linux with trusted boot, which they use at Spectro Cloud. He left us with a question to take home: how long does a critical kernel fix take to reach every machine? His summary was “the tools are ready, we need to use them and catch up”. I want to learn more about how to act on security concerns and vulnerabilities, and how to reduce supply chain risks.

The hallway #

A conference is half talks and half the space between them. I talked to a lot of people, and one conversation is worth writing down.

Craci is a startup building a CI runner with security in mind. Craci is a Helsinki company founded in 2025. It offers a managed runner that works with GitHub Actions, so you switch with runs-on: craci. It adds a package-aware proxy, an egress policy and SBOM export, with a focus on the EU Cyber Resilience Act. What caught my attention is that they use the CI runtime itself to check for vulnerabilities. I find it very promising: security checks in the place where your code already builds.

What I’m taking home #

Two things go on my list. The first is Kairos. I run Talos Linux today, as I explained in my Talos Linux post, and Kairos looks like an alternative. I want to learn more about it and how it compares, and about how to act on vulnerabilities and reduce supply chain risks.

The second is sovereignty in measurable terms. The European Commission’s Cloud Sovereignty Framework from October 2025 scores cloud services on eight sovereignty objectives. Each gets a SEAL level, from SEAL-0 for no sovereignty to SEAL-4 for full digital sovereignty. I want to understand how Aarno’s three tests of vendor, location and operator map onto those levels. That is next.