Kubernetes
496 briefings in the desk
Kubernetes 1.26: Alpha API For Dynamic Resource Allocation
Dynamic resource allocation is a new API for requesting resources. It is a generalization of the persistent volumes API for generic resources, making it possible to: access the same resource instance in different pods and containers,…
Kubernetes 1.26: Windows HostProcess Containers Are Generally Available
The long-awaited day has arrived: HostProcess containers, the Windows equivalent to Linux privileged containers, has finally made it to GA in Kubernetes 1.26! What are HostProcess containers and why are they useful? Cluster operators are…
Kubernetes 1.26: We're now signing our binary release artifacts!
The Kubernetes Special Interest Group (SIG) Release is proud to announce that we are digitally signing all release artifacts, and that this aspect of Kubernetes has now reached beta. Signing artifacts provides end users a chance to verify…
Kubernetes v1.26: Electrifying
It's with immense joy that we announce the release of Kubernetes v1.26! This release includes a total of 37 enhancements: eleven of them are graduating to Stable, ten are graduating to Beta, and sixteen of them are entering Alpha. We also…
Forensic container checkpointing in Kubernetes
Forensic container checkpointing is based on Checkpoint/Restore In Userspace (CRIU) and allows the creation of stateful copies of a running container without the container knowing that it is being checkpointed. The copy of the container…
Finding suspicious syscalls with the seccomp notifier
Debugging software in production is one of the biggest challenges we have to face in our containerized environments. Being able to understand the impact of the available security options, especially when it comes to configuring our…
Boosting Kubernetes container runtime observability with OpenTelemetry
When speaking about observability in the cloud native space, then probably everyone will mention OpenTelemetry (OTEL) at some point in the conversation. That's great, because the community needs standards to rely on for developing all…
registry.k8s.io: faster, cheaper and Generally Available (GA)
Starting with Kubernetes 1.25, our container image registry has changed from k8s.gcr.io to registry.k8s.io. This new registry spreads the load across multiple Cloud Providers & Regions, functioning as a sort of content delivery network…
Kubernetes Removals, Deprecations, and Major Changes in 1.26
Change is an integral part of the Kubernetes life-cycle: as Kubernetes grows and matures, features may be deprecated, removed, or replaced with improvements for the health of the project. For Kubernetes v1.26 there are several planned:…
Live and let live with Kluctl and Server Side Apply
This blog post was inspired by a previous Kubernetes blog post about Advanced Server Side Apply. The author of said blog post listed multiple benefits for applications and controllers when switching to server-side apply (from now on…
Server Side Apply Is Great And You Should Be Using It
Server-side apply (SSA) has now been GA for a few releases, and I have found myself in a number of conversations, recommending that people / teams in various situations use it. So I’d like to write down some of those reasons. Obvious (and…
Current State: 2019 Third Party Security Audit of Kubernetes
We expect the brand new Third Party Security Audit of Kubernetes will be published later this month (Oct 2022). In preparation for that, let's look at the state of findings that were made public as part of the last third party security…
Introducing Kueue
Whether on-premises or in the cloud, clusters face real constraints for resource usage, quota, and cost management reasons. Regardless of the autoscalling capabilities, clusters have finite capacity. As a result, users want an easy way to…
Enforce CRD Immutability with CEL Transition Rules
Immutable fields can be found in a few places in the built-in Kubernetes types. For example, you can't change the .metadata.name of an object. Specific objects have fields where changes to existing objects are constrained; for example, the…
Kubernetes 1.25: Kubernetes In-Tree to CSI Volume Migration Status Update
The Kubernetes in-tree storage plugin to Container Storage Interface (CSI) migration infrastructure has already been beta since v1.17. CSI migration was introduced as alpha in Kubernetes v1.14. Since then, SIG Storage and other Kubernetes…
Kubernetes 1.25: CustomResourceDefinition Validation Rules Graduate to Beta
In Kubernetes 1.25, Validation rules for CustomResourceDefinitions (CRDs) have graduated to Beta! Validation rules make it possible to declare how custom resources are validated using the Common Expression Language (CEL). For example:…
Kubernetes 1.25: Use Secrets for Node-Driven Expansion of CSI Volumes
Kubernetes v1.25, released earlier this month, introduced a new feature that lets your cluster expand storage volumes, even when access to those volumes requires a secret (for example: a credential for accessing a SAN fabric) to perform…
Kubernetes 1.25: Local Storage Capacity Isolation Reaches GA
Local ephemeral storage capacity isolation was introduced as a alpha feature in Kubernetes 1.7 and it went beta in 1.9. With Kubernetes 1.25 we are excited to announce general availability(GA) of this feature. Pods use ephemeral local…
Kubernetes 1.25: Two Features for Apps Rollouts Graduate to Stable
This blog describes the two features namely minReadySeconds for StatefulSets and maxSurge for DaemonSets that SIG Apps is happy to graduate to stable in Kubernetes 1.25. Specifying minReadySeconds slows down a rollout of a StatefulSet,…
Kubernetes 1.25: PodHasNetwork Condition for Pods
Kubernetes 1.25 introduces Alpha support for a new kubelet-managed pod condition in the status field of a pod: PodHasNetwork. The kubelet, for a worker node, will use the PodHasNetwork condition to accurately surface the initialization…
Announcing the Auto-refreshing Official Kubernetes CVE Feed
A long-standing request from the Kubernetes community has been to have a programmatic way for end users to keep track of Kubernetes security issues (also called "CVEs", after the database that tracks public security issues across different…
Kubernetes 1.25: KMS V2 Improvements
With Kubernetes v1.25, SIG Auth is introducing a new v2alpha1 version of the Key Management Service (KMS) API. There are a lot of improvements in the works, and we're excited to be able to start down the path of a new and improved KMS!…
Kubernetes’s IPTables Chains Are Not API
Some Kubernetes components (such as kubelet and kube-proxy) create iptables chains and rules as part of their operation. These chains were never intended to be part of any Kubernetes API/ABI guarantees, but some external components…
Introducing COSI: Object Storage Management using Kubernetes APIs
This article introduces the Container Object Storage Interface (COSI), a standard for provisioning and consuming object storage in Kubernetes. It is an alpha feature in Kubernetes v1.25. File and block storage are treated as first class…