# containerd CRI Vulnerabilities, Datadog PostgreSQL HA on Kubernetes, AWS DevOps Agent with Datadog MCP Server, EKS Control Plane Egress, and Why Users Feel the Wait

Page: https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/containerd-cri-vulnerabilities-datadog-postgresql-ha-on-kubernetes-aws-devops-agent-with-datadog-mcp-server-eks-control-plane-egress-and-why-users-feel-the-wait
Text version: https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/containerd-cri-vulnerabilities-datadog-postgresql-ha-on-kubernetes-aws-devops-agent-with-datadog-mcp-server-eks-control-plane-egress-and-why-users-feel-the-wait.md
Podcast: [Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News](https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275)
Published: 2026-06-26T00:35:00+00:00
Episode link: https://rss.com/podcasts/ship-it-weekly/2944093
Audio file: https://content.rss.com/episodes/356364/2944093/ship-it-weekly/2026_06_26_00_26_15_c64731d1-b4be-4251-8036-6a089c3f66b1.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/episodes/containerd-cri-vulnerabilities-datadog-postgresql-ha-on-kubernetes-aws-devops-agent-with-datadog-mcp-server-eks-control-plane-egress-and-why-users-feel-the-wait
Duration seconds: 1164

## Resource

This week on Ship It Weekly : containerd disclosed a batch of CRI plugin vulnerabilities, Datadog tested PostgreSQL high availability on Kubernetes and found that failover is not useful if it cannot happen safely, AWS DevOps Agent and Datadog MCP Server moved AI incident response closer to real production workflows, and Amazon EKS added customer-routed control-plane egress. The bigger theme: the control plane keeps getting wider. Runtimes, databases, incident agents, API-server egress, credentials, the cloud console, and object metadata are all becoming part of the production blast radius. And when something breaks, users do not experience your architecture diagram. They experience waiting. In the lightning round, Brian covers GitHub self-service credential revocation for incident response, AWS Management Console Private Access without internet connectivity, Vercel Connect and short-lived agent credentials, and Amazon S3 annotations. Links containerd CRI plugin vulnerabilities / AWS security bulletin https://aws.amazon.com/security/security-bulletins/2026-046-aws/ Datadog: PostgreSQL high availability on Kubernetes https://www.datadoghq.com/blog/engineering/postgresql-ha-kubernetes/ AWS DevOps Agent and Datadog MCP Server https://aws.amazon.com/blogs/devops/production-ready-autonomous-incident-resolution-with-aws-devops-agent-now-ga-and-datadog-mcp-server/ Amazon EKS customer-routed control-plane egress https://aws.amazon.com/blogs/containers/amazon-eks-now-supports-control-plane-egress-through-your-vpc/ GitHub self-service credential revocation for incident response https://github.blog/changelog/2026-06-24-self-service-credential-revocation-for-incident-response/ AWS Management Console Private Access https://aws.amazon.com/about-aws/whats-new/2026/06/aws-management-co…

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/episodes/containerd-cri-vulnerabilities-datadog-postgresql-ha-on-kubernetes-aws-devops-agent-with-datadog-mcp-server-eks-control-plane-egress-and-why-users-feel-the-wait/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/containerd-cri-vulnerabilities-datadog-postgresql-ha-on-kubernetes-aws-devops-agent-with-datadog-mcp-server-eks-control-plane-egress-and-why-users-feel-the-wait.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.