Cloudnews - Kubernetes

Streams | Posts

Boosting Kubernetes container runtime observability with OpenTelemetry

Authors: Sascha Grunert When speaking about observability in the cloud native space, then probably everyone will mention OpenTelemetry (OTEL) at some point in the conversation. That's great, because the community needs standards to rely on for developing all cluster components into the same direction. OpenTelemetry enables us to combine logs, metrics, traces and other contextual information (called baggage) into a single resource. Cluster administrators or software engineers can use this resource to get a viewport about what is going on in the cluster over a defined period of time.

Kubernetes

From: Kubernetes
registry.k8s.io: faster, cheaper and Generally Available (GA)

Authors: Adolfo García Veytia (Chainguard), Bob Killen (Google) Starting with Kubernetes 1.25, our container image registry has changed from k8s.gcr.io to registry.k8s.io. This new registry spreads the load across multiple Cloud Providers & Regions, functioning as a sort of content delivery network (CDN) for Kubernetes container images. This change reduces the project’s reliance on a single entity and provides a faster download experience for a large number of users. TL;DR: What you need to know about this change Container images for Kubernetes releases from 1.

Kubernetes

From: Kubernetes
Kubernetes Removals, Deprecations, and Major Changes in 1.26

Author: Frederico Muñoz (SAS) Change is an integral part of the Kubernetes life-cycle: as Kubernetes grows and matures, features may be deprecated, removed, or replaced with improvements for the health of the project. For Kubernetes v1.26 there are several planned: this article identifies and describes some of them, based on the information available at this mid-cycle point in the v1.26 release process, which is still ongoing and can introduce additional changes.

Kubernetes

From: Kubernetes
Live and let live with Kluctl and Server Side Apply

Author: Alexander Block This blog post was inspired by a previous Kubernetes blog post about Advanced Server Side Apply. The author of said blog post listed multiple benefits for applications and controllers when switching to server-side apply (from now on abbreviated with SSA). Especially the chapter about CI/CD systems motivated me to respond and write down my thoughts and experiences. These thoughts and experiences are the results of me working on Kluctl for the past 2 years.

Kubernetes

From: Kubernetes
Server Side Apply Is Great And You Should Be Using It

Author: Daniel Smith (Google) Server-side apply (SSA) has now been GA for a few releases, and I have found myself in a number of conversations, recommending that people / teams in various situations use it. So I’d like to write down some of those reasons. Obvious (and not-so-obvious) benefits of SSA A list of improvements / niceties you get from switching from various things to Server-side apply! Versus client-side-apply (that is, plain kubectl apply): The system gives you conflicts when you accidentally fight with another actor over the value of a field!

Kubernetes

From: Kubernetes
Current State: 2019 Third Party Security Audit of Kubernetes

Authors (in alphabetical order): Cailyn Edwards (Shopify), Pushkar Joglekar (VMware), Rey Lejano (SUSE) and Rory McCune (DataDog) We expect the brand new Third Party Security Audit of Kubernetes will be published later this month (Oct 2022). In preparation for that, let's look at the state of findings that were made public as part of the last third party security audit of 2019 that was based on Kubernetes v1.13.4. Motivation Craig Ingram has graciously attempted over the years to keep track of the status of the findings reported in the last audit in this issue: kubernetes/kubernetes#81146.

Kubernetes

From: Kubernetes
Introducing Kueue

Authors: Abdullah Gharaibeh (Google), Aldo Culquicondor (Google) Whether on-premises or in the cloud, clusters face real constraints for resource usage, quota, and cost management reasons. Regardless of the autoscalling capabilities, clusters have finite capacity. As a result, users want an easy way to fairly and efficiently share resources. In this article, we introduce Kueue, an open source job queueing controller designed to manage batch jobs as a single unit. Kueue leaves pod-level orchestration to existing stable components of Kubernetes.

Kubernetes

From: Kubernetes
Kubernetes 1.25: alpha support for running Pods with user namespaces

Authors: Rodrigo Campos (Microsoft), Giuseppe Scrivano (Red Hat) Kubernetes v1.25 introduces the support for user namespaces. This is a major improvement for running secure workloads in Kubernetes. Each pod will have access only to a limited subset of the available UIDs and GIDs on the system, thus adding a new security layer to protect from other pods running on the same system. How does it work? A process running on Linux can use up to 4294967296 different UIDs and GIDs.

Kubernetes

From: Kubernetes
Enforce CRD Immutability with CEL Transition Rules

Author: Alexander Zielenski (Google) Immutable fields can be found in a few places in the built-in Kubernetes types. For example, you can't change the .metadata.name of an object. Specific objects have fields where changes to existing objects are constrained; for example, the .spec.selector of a Deployment. Aside from simple immutability, there are other common design patterns such as lists which are append-only, or a map with mutable values and immutable keys.

Kubernetes

From: Kubernetes
Kubernetes 1.25: Kubernetes In-Tree to CSI Volume Migration Status Update

Author: Jiawei Wang (Google) The Kubernetes in-tree storage plugin to Container Storage Interface (CSI) migration infrastructure has already been beta since v1.17. CSI migration was introduced as alpha in Kubernetes v1.14. Since then, SIG Storage and other Kubernetes special interest groups are working to ensure feature stability and compatibility in preparation for CSI Migration feature to go GA. SIG Storage is excited to announce that the core CSI Migration feature is generally available in Kubernetes v1.

Kubernetes

From: Kubernetes
Kubernetes 1.25: CustomResourceDefinition Validation Rules Graduate to Beta

Authors: Joe Betz (Google), Cici Huang (Google), Kermit Alexander (Google) In Kubernetes 1.25, Validation rules for CustomResourceDefinitions (CRDs) have graduated to Beta! Validation rules make it possible to declare how custom resources are validated using the Common Expression Language (CEL). For example: apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition ... openAPIV3Schema: type: object properties: spec: type: object x-kubernetes-validations: - rule: "self.minReplicas <= self.replicas && self.replicas <= self.maxReplicas" message: "replicas should be in the range minReplicas.

Kubernetes

From: Kubernetes
Kubernetes 1.25: Use Secrets for Node-Driven Expansion of CSI Volumes

Author: Humble Chirammal (Red Hat), Louis Koo (deeproute.ai) Kubernetes v1.25, released earlier this month, introduced a new feature that lets your cluster expand storage volumes, even when access to those volumes requires a secret (for example: a credential for accessing a SAN fabric) to perform node expand operation. This new behavior is in alpha and you must enable a feature gate (CSINodeExpandSecret) to make use of it. You must also be using CSI storage; this change isn't relevant to storage drivers that are built in to Kubernetes.

Kubernetes

From: Kubernetes
Kubernetes 1.25: Local Storage Capacity Isolation Reaches GA

Author: Jing Xu (Google) Local ephemeral storage capacity isolation was introduced as a alpha feature in Kubernetes 1.7 and it went beta in 1.9. With Kubernetes 1.25 we are excited to announce general availability(GA) of this feature. Pods use ephemeral local storage for scratch space, caching, and logs. The lifetime of local ephemeral storage does not extend beyond the life of the individual pod. It is exposed to pods using the container’s writable layer, logs directory, and EmptyDir volumes.

Kubernetes

From: Kubernetes
Kubernetes 1.25: Two Features for Apps Rollouts Graduate to Stable

Authors: Ravi Gudimetla (Apple), Filip Křepinský (Red Hat), Maciej Szulik (Red Hat) This blog describes the two features namely minReadySeconds for StatefulSets and maxSurge for DaemonSets that SIG Apps is happy to graduate to stable in Kubernetes 1.25. Specifying minReadySeconds slows down a rollout of a StatefulSet, when using a RollingUpdate value in .spec.updateStrategy field, by waiting for each pod for a desired time. This time can be used for initializing the pod (e.

Kubernetes

From: Kubernetes
Kubernetes 1.25: PodHasNetwork Condition for Pods

Author: Deep Debroy (Apple) Kubernetes 1.25 introduces Alpha support for a new kubelet-managed pod condition in the status field of a pod: PodHasNetwork. The kubelet, for a worker node, will use the PodHasNetwork condition to accurately surface the initialization state of a pod from the perspective of pod sandbox creation and network configuration by a container runtime (typically in coordination with CNI plugins). The kubelet starts to pull container images and start individual containers (including init containers) after the status of the PodHasNetwork condition is set to "True".

Kubernetes

From: Kubernetes
Announcing the Auto-refreshing Official Kubernetes CVE Feed

Author: Pushkar Joglekar (VMware) A long-standing request from the Kubernetes community has been to have a programmatic way for end users to keep track of Kubernetes security issues (also called "CVEs", after the database that tracks public security issues across different products and vendors). Accompanying the release of Kubernetes v1.25, we are excited to announce availability of such a feed as an alpha feature. This blog will cover the background and scope of this new service.

Kubernetes

From: Kubernetes
Kubernetes 1.25: KMS V2 Improvements

Authors: Anish Ramasekar, Rita Zhang, Mo Khan, and Xander Grzywinski (Microsoft) With Kubernetes v1.25, SIG Auth is introducing a new v2alpha1 version of the Key Management Service (KMS) API. There are a lot of improvements in the works, and we're excited to be able to start down the path of a new and improved KMS! What is KMS? One of the first things to consider when securing a Kubernetes cluster is encrypting persisted API data at rest.

Kubernetes

From: Kubernetes
Kubernetes’s IPTables Chains Are Not API

Author: Dan Winship (Red Hat) Some Kubernetes components (such as kubelet and kube-proxy) create iptables chains and rules as part of their operation. These chains were never intended to be part of any Kubernetes API/ABI guarantees, but some external components nonetheless make use of some of them (in particular, using KUBE-MARK-MASQ to mark packets as needing to be masqueraded). As a part of the v1.25 release, SIG Network made this declaration explicit: that (with one exception), the iptables chains that Kubernetes creates are intended only for Kubernetes’s own internal use, and third-party components should not assume that Kubernetes will create any specific iptables chains, or that those chains will contain any specific rules if they do exist.

Kubernetes

From: Kubernetes
Introducing COSI: Object Storage Management using Kubernetes APIs

Authors: Sidhartha Mani (Minio, Inc) This article introduces the Container Object Storage Interface (COSI), a standard for provisioning and consuming object storage in Kubernetes. It is an alpha feature in Kubernetes v1.25. File and block storage are treated as first class citizens in the Kubernetes ecosystem via Container Storage Interface (CSI). Workloads using CSI volumes enjoy the benefits of portability across vendors and across Kubernetes clusters without the need to change application manifests.

Kubernetes

From: Kubernetes
Kubernetes 1.25: cgroup v2 graduates to GA

Authors:: David Porter (Google), Mrunal Patel (Red Hat) Kubernetes 1.25 brings cgroup v2 to GA (general availability), letting the kubelet use the latest container resource management capabilities. What are cgroups? Effective resource management is a critical aspect of Kubernetes. This involves managing the finite resources in your nodes, such as CPU, memory, and storage. cgroups are a Linux kernel capability that establish resource management functionality like limiting CPU usage or setting memory limits for running processes.

Kubernetes

From: Kubernetes
Kubernetes 1.25: CSI Inline Volumes have graduated to GA

Author: Jonathan Dobson (Red Hat) CSI Inline Volumes were introduced as an alpha feature in Kubernetes 1.15 and have been beta since 1.16. We are happy to announce that this feature has graduated to General Availability (GA) status in Kubernetes 1.25. CSI Inline Volumes are similar to other ephemeral volume types, such as configMap, downwardAPI and secret. The important difference is that the storage is provided by a CSI driver, which allows the use of ephemeral storage provided by third-party vendors.

Kubernetes

From: Kubernetes
Kubernetes v1.25: Pod Security Admission Controller in Stable

Authors: Tim Allclair (Google), Sam Stoelinga (Google) The release of Kubernetes v1.25 marks a major milestone for Kubernetes out-of-the-box pod security controls: Pod Security admission (PSA) graduated to stable, and Pod Security Policy (PSP) has been removed. PSP was deprecated in Kubernetes v1.21, and no longer functions in Kubernetes v1.25 and later. The Pod Security admission controller replaces PodSecurityPolicy, making it easier to enforce predefined Pod Security Standards by simply adding a label to a namespace.

Kubernetes

From: Kubernetes
PodSecurityPolicy: The Historical Context

Author: Mahé Tardy (Quarkslab) The PodSecurityPolicy (PSP) admission controller has been removed, as of Kubernetes v1.25. Its deprecation was announced and detailed in the blog post PodSecurityPolicy Deprecation: Past, Present, and Future, published for the Kubernetes v1.21 release. This article aims to provide historical context on the birth and evolution of PSP, explain why the feature never made it to stable, and show why it was removed and replaced by Pod Security admission control.

Kubernetes

From: Kubernetes
Kubernetes v1.25: Combiner

Authors: Kubernetes 1.25 Release Team Announcing the release of Kubernetes v1.25! This release includes a total of 40 enhancements. Fifteen of those enhancements are entering Alpha, ten are graduating to Beta, and thirteen are graduating to Stable. We also have two features being deprecated or removed. Release theme and logo Kubernetes 1.25: Combiner The theme for Kubernetes v1.25 is Combiner. The Kubernetes project itself is made up of many, many individual components that, when combined, take the form of the project you see today.

Kubernetes

From: Kubernetes
Spotlight on SIG Storage

Author: Frederico Muñoz (SAS) Since the very beginning of Kubernetes, the topic of persistent data and how to address the requirement of stateful applications has been an important topic. Support for stateless deployments was natural, present from the start, and garnered attention, becoming very well-known. Work on better support for stateful applications was also present from early on, with each release increasing the scope of what could be run on Kubernetes.

Kubernetes

From: Kubernetes