Netflix Technology Blog (Sep 25) — Closes the gap between cloud-provider identity (AWS IAM execution roles on managed compute) and first-class internal service identity (Metatron private PKI — short-lived X.509 + mTLS). Shown for Spark on EMR; design is general beyond Spark/EMR. Anchor: each Data Project maps 1:1 to a dedicated IAM role, sharded across accounts past tens-of-thousands role limits. Flow: control plane signs a claim (identity + role + scope); driver proves possession via pre-signed sts:GetCallerIdentity URL (AWS answers which role signed — workload cannot lie); Identity service corroborates provider statement with platform statement and issues scoped certs only at the intersection. Fan-out: executors inherit driver credentials over authenticated AES-GCM Spark RPC (avoids STS/attestation amplification). Renewal is a repeatable driver timer — not a one-shot bootstrap.

USENIX NSDI ’26 — Replaces uniform 2× dual-region capacity with tiered failover classes (Always-On / Active-Migrate / Restore-Later / Terminate) aligned to business criticality. Non-critical workloads oversubscribe critical services’ idle failover buffers at steady state; on rare full-peak regional failover, OMG orchestrates eviction → batch-cluster “burst” conversion → optional cloud burst. Safety stack: runtime fail-close dependency analysis over trillions of RPCs/week, static Go/Java error-propagation analysis, canary regression gate (~8k deploys/week). Impact: steady-state 2× → 1.3×, utilization ~20% → ~30%, ~1M CPU cores returned, 4,155 fail-close violations hardened, 99.97% trip availability through a documented 17-hour production failover. Scope: stateless microservices (~75% of cores); stateful deferred.