Kubernetes v1.36: User Namespaces in Kubernetes are finally GA
… We'd like to thank everyone who contributed across SIG Node, the container runtimes, and the Linux kernel. …
… We'd like to thank everyone who contributed across SIG Node, the container runtimes, and the Linux kernel. …
… This long-awaited feature provides a critical layer of defense-in-depth by allowing the mapping of a container's root user to a non-privileged user on the host, ensuring that even if a process escapes the container, it possesses no administrative power over the underlying node. …
… In addition, administrators can enable node-to-pod PID isolation as an alpha feature by reserving a number of allocatable PIDs to user pods via node allocatable. …
… Other Updates Graduated to Stable Seccomp Kubelet client TLS certificate rotation Limit node access to API Redesign Event API Graduate Ingress to V1 CertificateSigningRequest API Building Kubelet without Docker Major Changes Node Topology Manager New Endpoint API Increase Kubernetes support window … …
… This enhanced PodTopologySpread by introducing two fields: nodeAffinityPolicy and nodeTaintsPolicy . These fields allow users to specify whether node affinity rules and node taints should be considered when calculating pod distribution across nodes. …
… Deprecation of status.nodeInfo.kubeProxyVersion field for Nodes KEP 4004 The .status.nodeInfo.kubeProxyVersion field of Nodes has been deprecated in Kubernetes v1.31, and will be removed in a later release. …
… Support for this feature in Windows nodes, called HostProcess containers , will now graduate to Stable , enabling access to host resources including network resources from privileged containers. …
… This make the scheduler aware of a Pod's volume's topology constraints, such as zone or node. …
… Software Supply Chain SLSA Level 1 Compliance in the Kubernetes Release Process Kubernetes releases now generate provenance attestation files describing the staging and release phases of the release process. …