Staleness in controllers comes from an outdated view of the world inside of the controller cache. In order to provide a fast user experience, controllers typically maintain a local cache of the state of the cluster. This cache is populated by watching the Kubernetes API server for changes to objects that the controller cares about. When the controller needs to take action, it will first check its cache to see if it has the latest information. If it does not, it will then update its cache by watching the API server for changes to objects that the controller cares about. This process is known as
Kubernetes v1.36: Staleness Mitigation and Observability for Controllers…Start the API server with --admission-control-config-file pointing to your AdmissionConfiguration file. The full documentation is at Manifest-Based Admission Control , and you can follow KEP-5793 for ongoing progress…
…Because of this omission, controllers and users had no reliable way to verify whether the kubelet had actually processed the latest changes to a Pod's specification. This ambiguity was particularly problematic…
…This change empowers drivers to proactively influence the scheduling process, leading to improved throughput and more optimal scheduling decisions. The ResourceSlice controller toolkit automatically generates names that reflect the exact device ordering…
…This is not a commitment and the release content is subject to change. Faster SELinux labelling for volumes (GA) Kubernetes v1.36 makes the SELinux volume mounting improvement generally available. This change…
…an admission controller ( DenyServiceExternalIPs ) that can be enabled to do this. At the time, SIG Network felt that blocking the functionality by default was too large a breaking change to consider. However…
…Prevent unauthorized volume mode conversion during volume restore ( SIG Storage ) For Kubernetes v1.30, the control plane always prevents unauthorized changes to volume modes when restoring a snapshot into a PersistentVolume. As…
…This post offers my recommendations for good practices applicable to existing Kubernetes environments with minimal tooling changes: Least privilege with RBAC Short-lived, identity-bound credentials An SSH-style handshake model for…
…Together, these changes enable massive workloads with complex topologies to utilize DRA for scalable device management. Integration with the Job controller In Kubernetes v1.36, the Job controller can create and manage…
…You're still in control This feature doesn't take control away from cluster operators ("Chihiro"). In fact, they have explicit control over which Gateways can act as a default. A Gateway…
…If you could perform an action in Dashboard, you will find the same capability in Headlamp, with the same respect for access controls. Understanding relationships Where Headlamp begins to expand the experience…