Kubernetes 1.27 - Whats Coming?

Kubernetes 1.27 is just around the corner, and it's packed with thrilling new features that I am excited to share with you!

Now, I know you're all eager to hear about my absolute favorite part of this release: Work on the Dynamic Resource Allocation and Admission Control! But hold up. We've already covered these groundbreaking innovations in our 1.26 video, so make sure you don't miss out and head over to check that out pronto!

User-Namespaces

We're about to dive into an exhilarating alpha feature: User namespaces for stateless pods! Now, I know it might sound a tad abstract, so let's break it down with an example that'll make you go "Aha!"

Picture this: the users inside your container share the same Linux user namespace as your host operating system. This comes in super handy when mounting files – user PID 1000 in the container can access files that user PID 1000 can on the host OS.

But wait, what happens when you want to grant the user in your container elevated permissions, like root? Uh-oh! Now we're talking about the root user on the host machine.

Fear not, though! Standard process containerization is usually enough to keep things secure. But let's consider a what-if scenario: someone breaks out of the container. If they're root in the container, that spells trouble for your host system!

But worry no more! With Kubernetes 1.27, you can now configure your pod to have its very own user namespace! That means even if someone managed to escape, they can't exploit the host user's permissions. And the best part? It's super easy to set up! First, ensure your pod is stateless (only mounting configmaps, secrets, or emptydirs). Then, simply set pod.spec.hostUsers to false (by default, it's true).

Voilà! Your pod now boasts its own unique user namespace, totally secure and detached from the host's user namespace. And guess what? No overlaps with other pods' user namespaces either! Talk about a game-changer!

In-place Update of Pod Resources

If you've ever felt the pain of adjusting resources for pods, you'll instantly grasp why this next one is so amazing. Pods will soon be able to update their resource requests and limits without needing to restart the containers. Yeah, you heard that right! This is an absolute game-changer for vertical pod scaling.

In the past, when you wanted to rescale an application's resources, you had no choice but to create an entirely new replica. And let's be honest, that was a drag, especially with vertical pod scalers. They constantly resized pod resource limits based on usage, so kubernetes would keep recreating the pod with different sizes until resource consumption settled down.

But those days are gone, my friends! Now, with the new container resize policy, you can choose between the existing Restart behavior and the fresh-out-of-the-oven RestartNotRequired functionality that keeps your pod up and running.

Just a heads-up, though: this incredible feature is still in alpha. But trust me, it's gonna be a total lifesaver once it's ready for prime time!

TimeZone Support For Cronjobs

Alright, brace yourselves for a seemingly tiny yet incredibly impactful feature that's going to revolutionize your cluster maintenance game: specifying the timezone of your cronjobs!

I know what you're thinking – it's such a small thing, right? But trust me, it makes a world of difference when you're encouraging developers to create their own cronjob specs. Now, they'll know exactly which timezone their cronjob will run in.

This nifty little feature will make life a breeze when dealing with workflows or systems that, let's face it, can be a real headache when they adopt daylight savings time.

So there you have it – simple, short, stable and downright awesome!

New Probe Functionality

Let's wrap up with a double dose of awesomeness with two lightning-fast and super cool changes to probes!

First up, we've got GRPC probes as a stable feature – and it's amazing! These probes query the Check method to figure out just how healthy your container is, making life so much easier.

But wait, there's more! Now, you can override the terminationGracePeriodSeconds of a container in the probes. What does that mean for you? Well, it means you can make a failing container terminate faster than a healthy one – talk about efficiency!

So, there you have it – two quick, cool, and game-changing updates to probes that you're going to love!

Wrapping Up

There are so many more fantastic features coming your way in Kubernetes 1.27, trust me. But don't worry, I've got your back – once a few of those insightful blog articles are out, I'll take a deep dive into some of the most talked-about new features. So, stay tuned and get ready for an exciting ride through the ever-evolving world of Kubernetes!