Tracked topic
With fine-grained kubelet authorization now GA, the Kubernetes community can begin recommending and eventually enforcing the use of specific subresources instead of nodes/proxy for monitoring and observability workloads. The urgency of this migration is underscored by research showing that nodes/proxy GET can be abused for unlogged remote code execution via the WebSocket protocol. This risk is present in the default RBAC configurations of dozens of widely deployed Helm charts. Over time, we expect: Ecosystem adoption: Monitoring tools like Prometheus, Datadog agents, and other DaemonSets can u
Kubernetes v1.36: Fine-Grained Kubelet API Authorization Graduates to GA… The release label must match the label selector configured on your Prometheus resource — kube-prometheus-stack is the default for a standard Helm install: apiVersion : monitoring.coreos.com/v1 kind : ServiceMonitor metadata : name : my-exporter namespace : monitoring labels : release : kube-prometh… …
… Prometheus metrics View live metrics from the Headlamp Prometheus plugin inline on Cluster API resource detail pages. …
… Prometheus metrics: monitor request rates, latency, and resource utilization When paired with the Prometheus plugin for Headlamp , the plugin renders request rate, latency, and resource utilization graphs on KService and Revision detail pages. …
… What this means in practice Consider a Prometheus node exporter or a monitoring DaemonSet that needs to scrape /metrics from the kubelet . …
… These changes provide a more reliable implementation while retaining safe rollout and rollback through the feature gate or Prometheus-side configuration for Prometheus 3.x users. …
… Possible future work includes Prometheus integration, richer scheduling insights, and more workflow-oriented visibility across Volcano workloads. …
… Once the OS prerequisites are met, you can start scraping the /metrics/cadvisor endpoint with your Prometheus-compatible monitoring solution or query the Summary API to collect and visualize the new PSI metrics. …
… Join Kubernetes, Prometheus, Envoy, CoreDNS, containerd, Fluentd, OpenTracing, gRPC, CNI, Jaeger, Notary, TUF, Vitess, NATS, Linkerd, Helm, Rook, Harbor, etcd, Open Policy Agent, CRI-O, and TiKV as the community gathers for four days to further the education and advancement of cloud native computin… …
… While classical Prometheus histograms relied on static, pre-defined buckets that often forced a compromise between data accuracy and memory usage, this update allows the control plane to export sparse histograms that dynamically adjust their resolution based on real-time data. …