Networking
114 briefings in the desk
Kubernetes’s IPTables Chains Are Not API
Some Kubernetes components (such as kubelet and kube-proxy) create iptables chains and rules as part of their operation. These chains were never intended to be part of any Kubernetes API/ABI guarantees, but some external components…
Introducing COSI: Object Storage Management using Kubernetes APIs
This article introduces the Container Object Storage Interface (COSI), a standard for provisioning and consuming object storage in Kubernetes. It is an alpha feature in Kubernetes v1.25. File and block storage are treated as first class…
Kubernetes 1.25: cgroup v2 graduates to GA
Kubernetes 1.25 brings cgroup v2 to GA (general availability), letting the kubelet use the latest container resource management capabilities. What are cgroups? Effective resource management is a critical aspect of Kubernetes. This involves…
Kubernetes Gateway API Graduates to Beta
We are excited to announce the v0.5.0 release of Gateway API. For the first time, several of our most important Gateway API resources are graduating to beta. Additionally, we are starting a new initiative to explore how Gateway API can be…
Increasing the security bar in Ingress-NGINX v1.2.0
The Ingress may be one of the most targeted components of Kubernetes. An Ingress typically defines an HTTP reverse proxy, exposed to the Internet, containing multiple websites, and with some privileged access to Kubernetes API (such as to…
Securing Admission Controllers
Admission control is a key part of Kubernetes security, alongside authentication and authorization. Webhook admission controllers are extensively used to help improve the security of Kubernetes clusters in a variety of ways including…
Kubernetes-in-Kubernetes and the WEDOS PXE bootable server farm
When you own two data centers, thousands of physical servers, virtual machines and hosting for hundreds of thousands sites, Kubernetes can actually simplify the management of all these things. As practice has shown, by using Kubernetes,…
Kubernetes 1.23: Dual-stack IPv4/IPv6 Networking Reaches GA
"When will Kubernetes have IPv6?" This question has been asked with increasing frequency ever since alpha support for IPv6 was first added in k8s v1.9. While Kubernetes has supported IPv6-only clusters since v1.18, migration from IPv4 to…
Kubernetes 1.23: The Next Frontier
We’re pleased to announce the release of Kubernetes 1.23, the last release of 2021! This release consists of 47 enhancements: 11 enhancements have graduated to stable, 17 enhancements are moving to beta, and 19 enhancements are entering…
Use KPNG to Write Specialized kube-proxiers
The post will show you how to create a specialized service kube-proxy style network proxier using Kubernetes Proxy NG kpng without interfering with the existing kube-proxy. The kpng project aims at renewing the the default Kubernetes…
How to Handle Data Duplication in Data-Heavy Kubernetes Environments
Why Duplicate Data? It’s convenient to create a copy of your application with a copy of its state for each team. For example, you might want a separate database copy to test some significant schema changes or develop other disruptive…
Introducing Single Pod Access Mode for PersistentVolumes
Last month's release of Kubernetes v1.22 introduced a new ReadWriteOncePod access mode for PersistentVolumes and PersistentVolumeClaims. With this alpha feature, Kubernetes allows you to restrict volume access to a single pod in the…
Alpha in v1.22: Windows HostProcess Containers
Kubernetes v1.22 introduced a new alpha feature for clusters that include Windows nodes: HostProcess containers. HostProcess containers aim to extend the Windows container model to enable a wider range of Kubernetes cluster management…
Updating NGINX-Ingress to use the stable Ingress API
With all Kubernetes APIs, there is a process to creating, maintaining, and ultimately deprecating them once they become GA. The networking.k8s.io API group is no different. The upcoming Kubernetes 1.22 release will remove several…
Kubernetes API and Feature Removals In 1.22: Here’s What You Need To Know
As the Kubernetes API evolves, APIs are periodically reorganized or upgraded. When APIs evolve, the old APIs they replace are deprecated, and eventually removed. See Kubernetes API removals to read more about Kubernetes' policy on removing…
Evolving Kubernetes networking with the Gateway API
The Ingress resource is one of the many Kubernetes success stories. It created a diverse ecosystem of Ingress controllers which were used across hundreds of thousands of clusters in a standardized and consistent way. This standardization…
Defining Network Policy Conformance for Container Network Interface (CNI) providers
Special thanks to Tim Hockin and Bowie Du (Google), Dan Winship and Antonio Ojea (Red Hat), Casey Davenport and Shaun Crampton (Tigera), and Abhishek Raut and Antonin Bas (VMware) for being supportive of this work, and working with us to…
Three Tenancy Models For Kubernetes
Kubernetes clusters are typically used by several teams in an organization. In other cases, Kubernetes may be used to deliver applications to end users requiring segmentation and isolation of resources across users from different…
Third Party Device Metrics Reaches GA
With Kubernetes 1.20, infrastructure teams who manage large scale Kubernetes clusters, are seeing the graduation of two exciting and long awaited features: The Pod Resources API (introduced in 1.13) is finally graduating to GA. This allows…
GSoC 2020 - Building operators for cluster addons
Introduction Google Summer of Code is a global program that is geared towards introducing students to open source. Students are matched with open-source organizations to work with them for three months during the summer. My name is…
Scaling Kubernetes Networking With EndpointSlices
EndpointSlices are an exciting new API that provides a scalable and extensible alternative to the Endpoints API. EndpointSlices track IP addresses, ports, readiness, and topology information for Pods backing a Service. In Kubernetes 1.19…
Ephemeral volumes with storage capacity tracking: EmptyDir on steroids
Some applications need additional storage but don't care whether that data is stored persistently across restarts. For example, caching services are often limited by memory size and can move infrequently used data into storage that is…
Introducing Hierarchical Namespaces
Safely hosting large numbers of users on a single Kubernetes cluster has always been a troublesome task. One key reason for this is that different organizations use Kubernetes in different ways, and so no one tenancy model is likely to…
Supporting the Evolving Ingress Specification in Kubernetes 1.18
Earlier this year, the Kubernetes team released Kubernetes 1.18, which extended Ingress. In this blog post, we’ll walk through what’s new in the new Ingress specification, what it means for your applications, and how to upgrade to an…