Authors: Anish Ramasekar, Rita Zhang, Mo Khan, and Xander Grzywinski (Microsoft) With Kubernetes v1.25, SIG Auth is introducing a new v2alpha1 version of the Key Management Service (KMS) API.There are a lot of improvements in the works, and we're excited to be able to start down the path of a new and improved KMS!

What is KMS?

One of the first things to consider when securing a Kubernetes cluster is encrypting persisted API data at rest.KMS provides an interface for a provider

Just published by Kubernetes: Read more

Author: Dan Winship (Red Hat) Some Kubernetes components (such as kubelet and kube-proxy) create iptables chains and rules as part of their operation.These chains were never intended to be part of any Kubernetes API/ABI guarantees, but some external components nonetheless make use of some of them (in particular, using KUBE-MARK-MASQ to mark packets as needing to be masqueraded). As a part of the v1.25 release, SIG Network made this declaration explicit:that (with one exception), the iptables chains that Kubernetes creates are intended only for Kubernetes’s own internal use, and third-party components

Just published by Kubernetes: Read more

Authors: Sidhartha Mani (Minio, Inc) This article introduces the Container Object Storage Interface (COSI), a standard for provisioning and consuming object storage in Kubernetes.It is an alpha feature in Kubernetes v1.25. File and block storage are treated as first class citizens in the Kubernetes ecosystem via Container Storage Interface (CSI).Workloads using CSI volumes enjoy the benefits of portability across vendors and across Kubernetes clusters without the need to change application manifests.An equivalent standard does not exist for Object storage.

Just published by Kubernetes: Read more

Authors::David Porter (Google), Mrunal Patel (Red Hat) Kubernetes 1.25 brings cgroup v2 to GA (general availability), letting the kubelet use the latest container resource management capabilities.

What are cgroups?

Effective resource management is a critical aspect of Kubernetes.This involves managing the finite resources in your nodes, such as CPU, memory, and storage. cgroups are a Linux kernel capability that establish resource management functionality like limiting CPU usage or setting memory limits for running processes. When you use the resource management capabilities in Kubernetes,

Just published by Kubernetes: Read more

Author: Jonathan Dobson (Red Hat) CSI Inline Volumes were introduced as an alpha feature in Kubernetes 1.15 and have been beta since 1.16.We are happy to announce that this feature has graduated to General Availability (GA) status in Kubernetes 1.25. CSI Inline Volumes are similar to other ephemeral volume types, such as configMap, downwardAPI and secret.The important difference is that the storage is provided by a CSI driver, which allows the use of ephemeral storage provided by third-party vendors.

Just published by Kubernetes: Read more