Kubernetes Blog — BlogDrop

Kubernetes BlogMay 26, 20265 readmid

Reconciling the Past: Correcting Records for Unfixed Kubernetes CVEs

The Kubernetes Security Response Committee is updating several historical CVE records to accurately reflect that they remain unfixed due to inherent architectural design trade-offs. By removing incorrect 'fixed version' fields, the project aims to improve the fidelity of vulnerability scanners and ensure administrators correctly identify and mitigate these risks. These changes formalize the status of vulnerabilities like CVE-2020-8561 and CVE-2021-25740 as permanent architectural considerations.

AI summary

02

Kubernetes BlogMay 15, 20262 readmid

Kubernetes v1.36: New Metric for Route Sync in the Cloud Controller Manager

Kubernetes v1.36 introduces a new metric to track route synchronization within the Cloud Controller Manager, specifically designed to evaluate the watch-based route reconciliation feature. By comparing synchronization counts with and without the watch-based approach, operators can measure the reduction in unnecessary API calls to cloud providers in stable clusters.

AI summary

03

Kubernetes BlogMay 13, 202615 readsenior

Kubernetes v1.36: Advancing Workload-Aware Scheduling

Kubernetes v1.36 introduces an architectural evolution in workload-aware scheduling by decoupling the Workload API from the PodGroup API. This separation enables the Workload API to function as a static template while the PodGroup API manages runtime state, facilitating atomic scheduling and improved scalability.

AI summary

04

Kubernetes BlogMay 6, 20264 readsenior

Kubernetes v1.36: Server-Side Sharded List and Watch

Kubernetes v1.36 introduces server-side sharded list and watch, an alpha feature designed to improve scalability for controllers managing large clusters. By moving resource filtering to the API server, this mechanism reduces network bandwidth and CPU overhead caused by redundant event processing in horizontally scaled controller replicas.

AI summary

05

Kubernetes BlogMay 5, 20266 readmid

Kubernetes v1.36: Declarative Validation Graduates to GA

Kubernetes v1.36 has moved validation for native API types to a declarative model, replacing thousands of lines of handwritten Go code with an automated generator. The new framework utilizes +k8s marker tags in Go struct definitions to enforce constraints, improving API consistency, maintainability, and programmatic discoverability.

AI summary

06

Kubernetes BlogMay 4, 20266 readmid

Kubernetes v1.36: Admission Policies That Can't Be Deleted

Kubernetes v1.36 introduces manifest-based admission control to enforce security policies during cluster bootstrap and protect against unauthorized deletion. By loading admission policies directly from local files via the API server's configuration, this approach ensures critical security rules are active before the API server serves any requests.

AI summary