Tracked topic
DAEMON Tools is a software utility for mounting disk image files such as ISO and other optical media formats.
With fine-grained kubelet authorization now GA, the Kubernetes community can begin recommending and eventually enforcing the use of specific subresources instead of nodes/proxy for monitoring and observability workloads. The urgency of this migration is underscored by research showing that nodes/proxy GET can be abused for unlogged remote code execution via the WebSocket protocol. This risk is present in the default RBAC configurations of dozens of widely deployed Helm charts. Over time, we expect: Ecosystem adoption: Monitoring tools like Prometheus, Datadog agents, and other DaemonSets can u
Kubernetes v1.36: Fine-Grained Kubelet API Authorization Graduates to GA… If your CSI driver DaemonSet and CSIDriver object are in the same manifest or Helm chart, you need two separate updates. Deploy the new driver version with fallback logic first, wait for the DaemonSet rollout to complete, then update the CSIDriver spec to set serviceAccountTokenInSecrets: true . …
… Over time, we expect: Ecosystem adoption: Monitoring tools like Prometheus, Datadog agents, and other DaemonSets can update their default RBAC configurations to use nodes/metrics , nodes/stats , and nodes/pods instead of nodes/proxy . …
… Operators frequently struggle to ensure that specific DaemonSets or local services are healthy before a node enters the scheduling pool. …
… Applications or monitoring tools that directly calculate expected CPU weight values based on the previous formula may need updates to account for the new quadratic conversion. This is particularly relevant for: Custom resource management tools that predict CPU weight values. …
… From v1.36 onward, that path is closed for good, so any existing workloads depending on gitRepo will need to migrate to supported approaches such as init containers or external git-sync style tools. …
… Other Updates Graduated to Stable 💯 Taint Node by Condition Configurable Pod Process Namespace Sharing Schedule DaemonSet Pods by kube-scheduler Dynamic Maximum Volume Count Kubernetes CSI Topology Support Provide Environment Variables Expansion in SubPath Mount Defaulting of Custom Resources Move … …
… Administrators require mechanisms to ensure that user pods cannot induce PID exhaustion that prevents host daemons runtime, kubelet, etc from running. …
… Troubleshoot distroless containers by adding a new container with debugging tools, either in a new copy of the pod or using an ephemeral container. …
… Using Knative, PNC developed internal tools to automatically check new code and changes to existing code . …
… This prevents support tools, controllers, or node agents from using impersonation to gain broader access than they themselves are allowed, even if their impersonation RBAC is misconfigured. …
To show you the most relevant results, we’ve omitted some entries very similar to those already shown. Repeat the search with the omitted results included.