Related reading
Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions
Kubernetes v1.37 adds two alpha‑level storage hardening knobs: per‑volume `bindMountOptions` (e.g. noexec, nosuid, nodev) that affect the bind‑mount the runtime creates, and an `emptyDir` `mode` field to set Unix permission bits (including the sticky bit). Together they let you enforce least‑privilege policies on writable volumes without init‑containers or CSI tricks.
Kuberneteskubernetes.io8 minHN3Kubernetes v1.37: Pod-Level Resource Managers graduated to Beta
Kubernetes v1.37 adds Pod‑Level Resource Managers to beta (off by default). The feature lets Kubelet’s Topology, CPU, and Memory managers consume pod‑level `.spec.resources` to reserve exclusive NUMA‑aligned CPUs/memory for primary containers while sidecars share a pod‑isolated pool. A new PodResources gRPC API now reports `cpu_ids` and `memory` per pod. Enable via the `PodLevelResourceManagers`…
Kuberneteskubernetes.io2 minApp Hardening: One Obfuscation Pipeline Across Every Port
Codename One adds a cloud‑side hardening step that runs on the merged JAR before it is split into Android, iOS, JavaScript, and desktop binaries. It can rename symbols, encrypt string literals, and insert opaque‑predicate control‑flow guards at configurable levels (off → standard → aggressive → paranoid). The transforms are selective per platform to avoid breaking optimizers, and a mapping is kep…
CodeName Onecodenameone.com6 minKubernetes 1.37 Released: Stable Metrics API and Rootless Kubelet in Beta
Kubernetes 1.37 (Garhwal) ships GA Metrics API, beta rootless kubelet, GA resilient watchcache, GA pod certificates, and a suite of alpha/beta features (workload‑aware scheduling, pod checkpoint/restore, StatefulSet Recreate strategy). The release focuses on stability, security, and AI/ML cost‑optimisation.
InfoQinfoq.com2 minreleaseRunning OpenBao on Kubernetes with a CloudNativePG PostgreSQL backend
Step‑by‑step recipe to run OpenBao (Vault fork) on Kubernetes using CloudNativePG as a password‑less, TLS‑authenticated PostgreSQL storage backend. Shows how to spin up a Kind cluster with the cnpg‑playground, deploy a 3‑node CNPG cluster with synchronous quorum replication, configure DatabaseRole‑based client certificates, set up pg_hba rules, and initialize OpenBao’s schema via a one‑off Job.
