RSS NOC Intelligence

<p>The Kubernetes project relies on transparency to empower cluster administrators and security researchers. One important way we do that is by publishing CVE records into the Common Vulnerabilities and Exposures database. As part of our ongoing effort to mature the official <a href="https://kubernetes.io/docs/reference/issues-security/official-cve-feed/index.json">Kubernetes CVE Feed</a>, we have identified some dis

<p>Kubernetes v1.37 promotes the <code>KubeletInUserNamespace</code> feature gate to beta. With this feature enabled, all of the node components (kubelet, CRI and OCI runtimes, CNI plugins, and kube-proxy) can run as a non-root user on the host, using a <a href="https://man7.org/linux/man-pages/man7/user_namespaces.7.html">Linux user namespace</a>. This technique is also known as <em>rootless mode</em>. The work star

<p>Memory is often the first hard limit a Kubernetes cluster hits. Nodes run out of RAM long before they run out of CPU, and the new wave of agentic AI workloads makes this worse. These workloads demand large memory footprints to start up and run untrusted code, then sit idle waiting for the next prompt. That idle but resident memory is expensive, and it caps how many pods a node can hold. This is where swap helps. K

<p>Kubernetes v1.36 introduces <a href="https://kubernetes.io/docs/concepts/resource-management/resource-managers/#pod-level-resource-managers">Pod-Level Resource Managers</a> as an alpha feature, bringing a more flexible and powerful resource management model to performance-sensitive workloads. This enhancement extends the kubelet's Topology, CPU, and Memory Managers to support pod-level resource specifications (<co

<p>If you've ever tried to enforce a security policy across a fleet of Kubernetes clusters, you've probably run into a frustrating chicken-and-egg problem. Your admission policies are API objects, which means they don't exist until someone creates them, and they can be deleted by anyone with the right permissions. There's always a window during cluster bootstrap where your policies aren't active yet, and there's no w

<p>Dynamic Resource Allocation (DRA) has fundamentally changed how platform administrators handle hardware accelerators and specialized resources in Kubernetes. In the v1.36 release, DRA continues to mature, bringing a wave of feature graduations, critical usability improvements, and new capabilities that extend the flexibility of DRA to native resources like memory and CPU, and support for ResourceClaims in PodGroup

<p>The <code>.spec.externalIPs</code> field for <a href="https://kubernetes.io/docs/concepts/services-networking/service/">Service</a> was an early attempt to provide cloud-load-balancer-like functionality for non-cloud clusters. Unfortunately, the API assumes that every user in the cluster is fully trusted, and in any situation where that is not the case, it enables various security exploits, as described in <a href

<p>Back in Kubernetes 1.28, we introduced the <code>Mixed Version Proxy (MVP)</code> as an Alpha feature (under the feature gate <code>UnknownVersionInteroperabilityProxy</code>) in a <a href="https://kubernetes.io/blog/2023/08/28/kubernetes-1-28-feature-mixed-version-proxy-alpha/">previous blog post</a>. The goal was simple but critical: make cluster upgrades safer by ensuring that requests for resources not yet kno

<p>In Kubernetes, resource allocation has historically been a static decision made during a Pod's initial scheduling and placement. With the graduation of the core <a href="https://kubernetes.io/blog/2025/12/19/kubernetes-v1-35-in-place-Pod-resize-ga/">in-Place Pod resize</a> feature to General Availability in v1.35, application developers and cluster operators gained the powerful ability to dynamically adjust CPU an

<p>With the release of Kubernetes v1.37, the <strong>Pod-Level Resource Managers</strong> feature has graduated to <strong>Beta</strong> status (disabled by default)!</p> <p>First introduced as an Alpha feature in <a href="https://kubernetes.io/blog/2026/05/01/kubernetes-v1-36-feature-pod-level-resource-managers-alpha/">Kubernetes v1.36</a>, this enhancement builds on <a href="https://kubernetes.io/blog/2025/09/22/ku

<p>Since its original implementation in the Linux kernel in 2018, <em>Pressure Stall Information</em> (PSI) has provided users with the high-fidelity signals needed to identify resource saturation before it becomes an outage. Unlike traditional utilization metrics, PSI tells the story of tasks stalled and time lost, all in nicely-packaged percentages of time across the CPU, memory, and I/O.</p> <p>With the recent rel

<p>The rising popularity of AI, Edge, and Telecommunications workloads on Kubernetes has led to new requirements for hardware management. We now need hardware specification beyond CPU time and memory allocations. This includes allocating GPUs, TPUs, network interfaces, and other hardware, sometimes after pod start and occasionally through time-sharing.</p> <p>Efficiently managing this specialized hardware is the miss

<p>Following the graduation of Pod-Level Resources to Beta in v1.34 and the General Availability (GA) of In-Place Pod Vertical Scaling in v1.35, the Kubernetes community is thrilled to announce that <strong>In-Place Pod-Level Resources Vertical Scaling has graduated to Beta in v1.36!</strong></p> <p>This feature is now enabled by default via the <code>InPlacePodLevelResourcesVerticalScaling</code> feature gate. It al

<p>In Kubernetes v1.36, <strong>Declarative Validation</strong> for Kubernetes native types has reached General Availability (GA).</p> <p>For users, this means more reliable, predictable, and better-documented APIs. By moving to a declarative model, the project also unlocks the future ability to publish validation rules via OpenAPI and integrate with ecosystem tools like Kubebuilder. For contributors and ecosystem de

<p>As Kubernetes clusters grow to tens of thousands of nodes, controllers that watch high-cardinality resources like Pods face a scaling wall. Every replica of a horizontally scaled controller receives the full stream of events from the API server, paying the CPU, memory, and network cost to deserialize everything, only to discard the objects it is not responsible for. Scaling out the controller does not reduce per-r

<p>AI/ML and batch workloads introduce unique scheduling challenges that go beyond simple Pod-by-Pod scheduling. In Kubernetes v1.35, we introduced the first tranche of <em>workload-aware scheduling</em> improvements, featuring the foundational Workload API alongside basic <em>gang scheduling</em> support built on a Pod-based framework, and an <em>opportunistic batching</em> feature to efficiently process identical P

<p>SIG-Etcd announces the availability of the <a href="https://github.com/etcd-io/etcd/releases/tag/v3.7.0-beta.0">first beta release of etcd v3.7.0</a>. This new version of the popular distributed database and key Kubernetes component includes the long-requested RangeStream feature, as well as a refactoring and cleanup of multiple legacy components and interfaces. v3.7 will deliver improved security, better operatio

<p>For many people, Kubernetes Dashboard was their first window into Kubernetes. It offered a simple visual way to see what was running in a cluster, inspect resources, and build confidence without relying on the command line. For years, it helped developers, students, and operators make sense of Kubernetes, and it served as an important onramp into the ecosystem.</p> <p>The Kubernetes Dashboard project has now been

<p><a href="https://headlamp.dev/">Headlamp</a> is an open-source, extensible Kubernetes SIG UI project designed to let you explore, manage, and debug cluster resources.</p> <p><a href="https://knative.dev/">Knative</a> brings serverless workloads to Kubernetes, handling traffic routing, autoscaling, and revision management so teams can deploy and iterate without fighting infrastructure. But operating Knative workloa

<p><a href="https://volcano.sh/">Volcano</a> is a cloud native batch scheduler for Kubernetes, built for high-performance computing, AI/ML, and other batch workloads.</p> <p><a href="https://headlamp.dev/">Headlamp</a> is an extensible Kubernetes web UI. With its plugin system, Headlamp can surface APIs and workflows beyond the built-in Kubernetes resources. The Volcano plugin brings core Volcano resources into Headl

<p><a href="https://headlamp.dev/">Headlamp</a> is an open-source, extensible Kubernetes SIG UI project designed to let you explore, manage, and debug cluster resources directly from a browser.</p> <p><a href="https://cluster-api.sigs.k8s.io">Cluster API (CAPI)</a> is a Kubernetes sub-project that brings declarative, Kubernetes-style APIs to cluster lifecycle management. It lets platform teams provision, upgrade, and

<p>AI has really changed the game around software development. More people are leveraging AI than ever to contribute patches to projects they use. To me, this is a good thing as more folks will contribute patches rather than fork or not fix them. The main problem is that AI has made generating code fast but there has been very little improvement in maintaining code bases. In this post, we will highlight the ways the

<p><em>This article is a mirror of the <a href="https://etcd.io/blog/2026/announcing-etcd-3.7/">original announcement</a></em></p> <p>Today, SIG etcd is releasing <a href="https://github.com/etcd-io/etcd/releases/tag/v3.7.0">etcd v3.7.0</a>, the latest minor release of the popular distributed key-value store and core Kubernetes component. v3.7 ships the long-requested RangeStream feature, delivers several other perfo

<h2 id="1-before-you-start-know-what-is-changing">1. Before you start: know what is changing<a class="td-heading-self-link" href="https://kubernetes.io/feed.xml#1-before-you-start-know-what-is-changing"></a></h2><p>Kubernetes Dashboard and Headlamp both show what is running in a cluster, but they work differently. When Headlamp runs on the desktop, it uses your existing kubeconfig to connect to one or more clusters a

<p>Kubernetes has quietly become the default platform for AI and machine learning. Whether you run notebook servers for data scientists, schedule distributed training jobs, tune hyperparameters, or orchestrate multi-step ML pipelines, those workloads increasingly land on a Kubernetes cluster. <a href="https://www.kubeflow.org/">Kubeflow</a> is one of the most popular ways to assemble that stack, and it does so the Ku

<p>Kubernetes ships with built-in awareness of CPU and memory, but most real-world scaling decisions depend on signals that live entirely outside that narrow window: how many messages are waiting in a queue, how long the last batch job took, how many active WebSocket connections a pod is holding. When the built-in metrics are not enough, a <em>metrics exporter</em> bridges that gap.</p> <p>This post walks through wri

<p>As we get closer to the release date for Kubernetes v1.37, the project develops and matures, features may be deprecated, removed, or replaced with better ones for the project's overall health. This blog outlines some of the planned changes for the Kubernetes v1.37 release that the release team feels you should be aware of for the continued maintenance of your Kubernetes environment and keeping up to date with the

<p><img alt="Gateway API logo" src="https://kubernetes.io/blog/2026/08/03/gateway-api-v1-6-release/gateway-api-logo.svg" /></p> <p>The Kubernetes SIG Network community is thrilled to share the release of <strong>Gateway API v1.6.0</strong>, which was released on June 30th of this year!</p> <p>Gateway API has become the standard for modern, role-oriented, and expressive service networking in Kubernetes. In previous re

<p>YAML has been the standard way to write Kubernetes manifests for years. Every example, tutorial, and configuration file you come across is written in it. The problem isn't that YAML is a bad format. It's that YAML gives you a lot of choices, and not all of them are equally good for writing Kubernetes manifests. Some features make files harder to read, some are easy to misuse and others can lead to surprising behav

<p>Kubernetes v1.37 promotes the <code>metrics.k8s.io</code> API to stable (<code>v1</code>). This API provides CPU and memory usage for nodes and Pods, and is the API behind commands such as <code>kubectl top</code> and resource-metrics-based autoscaling.</p> <p>For cluster operators and application developers, this graduation means that the API now has the stability guarantees associated with a Kubernetes stable AP

<p>Kubernetes brings a wealth of features that make it easy to run your production workloads securely and reliably. While aspects like scheduling, health checks and resource limits are probably at the front of your mind, one other important feature of Kubernetes is production identity — how your workload can authenticate to other systems in order to do its job.</p> <p>Up until now, the primary production identity mec

<p>I am excited that <em>storage version migration</em> (SVM) has graduated to General Availability (GA) in Kubernetes v1.37!</p> <p>After a number of releases of work and testing, the built-in StorageVersionMigration API (<code>storagemigration.k8s.io/v1</code>) and control plane controller are now fully stable and enabled by default across all v1.37 Kubernetes clusters.</p> <h2 id="the-problem-with-stale-storage-ve

<p>I am excited to announce that etcd RangeStream is graduating to beta in Kubernetes v1.37. Paired with etcd v3.7, it reduces the memory the API server and etcd need to read a large collection, and makes peak usage more predictable.</p> <h2 id="the-cost-of-large-reads">The cost of large reads<a class="td-heading-self-link" href="https://kubernetes.io/feed.xml#the-cost-of-large-reads"></a></h2><p>The API server serve

<p>Kubernetes v1.37 includes API support for horizontal autoscaling of workloads down to zero replicas. This feature is now Beta and enabled by default. A <a href="https://kubernetes.io/docs/concepts/workloads/autoscaling/horizontal-pod-autoscale/">HorizontalPodAutoscaler</a> (HPA) that uses a suitable <em>object metric</em> or <em>external metric</em> can now scale a workload to zero replicas, then bring it back whe

<p>Kubernetes 1.37 is here and <a href="https://kubernetes.io/docs/concepts/scheduling-eviction/dynamic-resource-allocation/">Dynamic Resource Allocation (DRA)</a> keeps pushing past where it started! This release brings DRA Extended Resource support to GA, a milestone the team has been building toward for three straight releases. Several more features graduate to Beta or GA. A fresh batch of alpha features rounds ou

<p>AI/ML and complex batch workloads continue to push the boundaries of Kubernetes scheduling. Following the foundational workload-centric enhancements introduced in previous releases, Kubernetes v1.37 delivers the next major milestone in the Workload-Aware Scheduling (WAS) journey. In this release, the core Workload and PodGroup APIs—enabling gang scheduling—along with Workload-Aware Preemption (WAP) and shared DRA

<p>I'm excited to announce that native histogram support for Kubernetes metrics is graduating to Beta and is enabled by default in Kubernetes v1.37!</p> <p><em>Native histograms</em> (previously introduced as Alpha in Kubernetes v1.36 under <a href="https://www.kubernetes.dev/resources/keps/5808/">KEP-5808</a>) bring high-resolution, low-cardinality observability to Kubernetes metrics. By adopting <a href="https://pr

<p>In Linux, <em>cgroups</em> (control groups) are a kernel feature used for managing system resources. Kubernetes uses cgroups to allocate resources like CPU and memory to containers, ensuring that applications run smoothly without interfering with each other. With the release of Kubernetes v1.31, support for v1 cgroup management moved into <a href="https://kubernetes.io/blog/2024/08/14/kubernetes-1-31-moving-cgroup

<p>You submit a <a href="https://kubernetes.io/docs/concepts/workloads/controllers/job/">Kubernetes Job</a> and wait for its Pods to appear. A minute passes. Then another. The Job is still suspended, there are no application logs, and there may not even be a Pod to inspect.</p> <p>In a cluster managed by <a href="https://kueue.sigs.k8s.io/">Kueue</a>, this can be completely normal. Kueue may still be deciding whether