proomt

Search

Search posts, papers, and topics

All posts

InfoQMostafa Radwan2 min readrelease notesintermediate

Kubernetes 1.37 Released: Stable Metrics API and Rootless Kubelet in Beta

Read on infoq.com

Summary

Kubernetes 1.37 (Garhwal) ships GA Metrics API, beta rootless kubelet, GA resilient watchcache, GA pod certificates, and a suite of alpha/beta features (workload‑aware scheduling, pod checkpoint/restore, StatefulSet Recreate strategy). The release focuses on stability, security, and AI/ML cost‑optimisation.

  • Metrics API (`metrics.k8s.io`) is now GA, enabling reliable `kubectl top`, HPA/VPA, and custom autoscaling pipelines.
  • Rootless kubelet (`KubeletInUserNamespace`) graduates to beta and is enabled by default, reducing attack surface by running the kubelet in a user namespace.
  • Resilient watchcache initialization is GA; the apiserver now throttles cache rebuilds (HTTP 429) to prevent etcd overload on restart.
  • Pod‑level certificate signing is GA, providing native mTLS between pods without external sidecars.

These changes tighten the control plane’s reliability (watchcache), harden node security (rootless kubelet), and simplify observability/autoscaling (Metrics API). For teams running AI/ML workloads, the combination of scale‑to‑zero and pod‑certificates reduces cloud spend and operational overhead.

6/10
observabilitysecuritykubernetesmetricsrootlessscheduling

Related reading

  1. Kubernetes v1.37: Pod-Level Resource Managers graduated to Beta

    Kubernetes v1.37 adds Pod‑Level Resource Managers to beta (off by default). The feature lets Kubelet’s Topology, CPU, and Memory managers consume pod‑level `.spec.resources` to reserve exclusive NUMA‑aligned CPUs/memory for primary containers while sidecars share a pod‑isolated pool. A new PodResources gRPC API now reports `cpu_ids` and `memory` per pod. Enable via the `PodLevelResourceManagers`…

    Kuberneteskubernetes.io2 min

  2. Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions

    Kubernetes v1.37 adds two alpha‑level storage hardening knobs: per‑volume `bindMountOptions` (e.g. noexec, nosuid, nodev) that affect the bind‑mount the runtime creates, and an `emptyDir` `mode` field to set Unix permission bits (including the sticky bit). Together they let you enforce least‑privilege policies on writable volumes without init‑containers or CSI tricks.

    Kuberneteskubernetes.io8 minHN3

  3. Kubernetes Multi-Cluster Project Karmada Reaches CNCF Graduation

    Karmada, a multi-cluster and multi-cloud Kubernetes orchestration project, has graduated to the highest maturity tier within the CNCF. It extends the standard Kubernetes API to manage workloads across diverse environments, enhancing multi-component scheduling for AI training jobs and promoting priority-based scheduling.

    InfoQinfoq.com3 minrelease

  4. Microsoft Open-Sources TauGrid to Simplify AI Workload Management on Kubernetes

    Microsoft open‑sourced TauGrid, a Helm‑installable platform that bundles Kueue, KubeRay and other components to schedule, monitor and checkpoint AI workloads on GPU‑enabled Kubernetes clusters. Engineers define jobs in a simple `tau.yaml`, and TauGrid handles queuing, health checks, and observability, simplifying AI workload management.

    InfoQinfoq.com2 min

  5. Monitor TAS and gang scheduling for AI training in Kubernetes

    Kubernetes’ default scheduler can’t satisfy AI training’s need for low‑latency GPU interconnects and simultaneous pod start‑up. The blog explains how the open‑source Kueue job queue adds topology‑aware placement (using node labels like `topology.kubernetes.io/rack`) and how the Coscheduling plugin adds a permit phase that only binds a gang of pods when the full set is ready, preventing idle GPU r…

    Datadogdatadoghq.com19 min