Kubernetes

2 posts

Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions kubernetes.io
Kubernetes v1.37 adds two alpha‑level storage hardening knobs: per‑volume `bindMountOptions` (e.g. noexec, nosuid, nodev) that affect the bind‑mount the runtime creates, and an `emptyDir` `mode` field to set Unix permission bits (including the sticky bit). Together they let you enforce least‑privilege policies on writable volumes without init‑containers or CSI tricks.
Kuberneteskubernetes.io5d8 minHN3
Kubernetes v1.37: Pod-Level Resource Managers graduated to Beta kubernetes.io
Kubernetes v1.37 adds Pod‑Level Resource Managers to beta (off by default). The feature lets Kubelet’s Topology, CPU, and Memory managers consume pod‑level `.spec.resources` to reserve exclusive NUMA‑aligned CPUs/memory for primary containers while sidecars share a pod‑isolated pool. A new PodResources gRPC API now reports `cpu_ids` and `memory` per pod. Enable via the `PodLevelResourceManagers`…
Kuberneteskubernetes.io6d2 min

Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissionskubernetes.io