$ the-wire · showcase
CLUSTER TRUST BUNDLES GO GA, SCHEDULER GETS SMARTER ON PREEMPTION
By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology
![kubernetes-prow[bot]](https://avatars.githubusercontent.com/in/992787?v=4)
12 people shipped this
Kubernetes Publisher
@k8s-publishing-bot
2 cited
Jefftree
@Jefftree
1 cited
kubernetes-prow[bot]
@kubernetes-prow[bot]
1 cited
KevinTMtz
@KevinTMtz
1 cited
stlaz
@stlaz
1 cited
vshkrabkov
@vshkrabkov
1 cited
reruno
@reruno
1 cited
justinsb
@justinsb
1 cited
YahiaBadr
@YahiaBadr
zylxjtu
@zylxjtu
xing-yang
@xing-yang
furkatgofurov7
@furkatgofurov7
Kubernetes ships ClusterTrustBundles to stable while the scheduler learns to bind before it breaks things.
ClusterTrustBundles moves to GA and enabled by default [1], marking the end of a long stabilization cycle for certificate distribution at scale. Meanwhile, the scheduler is tightening its logic: post-filters are getting yanked from pod group cycles [2] and new integration tests verify binding happens before preemption kicks in [3], fixing a class of scheduling race conditions that hit gang policies hard. On the resource front, PodLevelResourceManagers metrics hit stable [4] with zero-memory container handling now baked in, giving operators real visibility into per-pod allocation. The API server is also getting stricter: MutatingAdmissionPolicy v1beta1 storage pins are being removed [5] to force migration to v1, and CRDs now warn when you try to use non-scalar items in sets [6], catching a footgun before it reaches production. In test infrastructure, kueue's periodic jobs are being right-sized based on actual metrics [7], agent-sandbox is generating Prow configs from source [8], and there's a fix for apiserver hanging on SIGTERM when hostname exceeds 63 bytes [9].
Action items
- → Review ClusterTrustBundles migration if you're not yet on GA (it's enabled by default in next release) kubernetes/kubernetes [plan]
- → Update any custom schedulers that depend on post-filters in pod group cycles kubernetes/kubernetes [plan]
- → Test gang scheduling policies against the new binding-first logic kubernetes/kubernetes [monitor]
- → Check CRD definitions for non-scalar set items and address warnings kubernetes/apiextensions-apiserver [monitor]
References
- [1] ClusterTrustBundles - GA ↗ kubernetes/kubernetes
- [2] Merge pull request #140412 from Argh4k/post-filters-out ↗ kubernetes/kubernetes
- [3] Integration test to verify the priority of binding over preemption for gang and basic scheduling ↗ kubernetes/kubernetes
- [4] [PodLevelResourceManagers] Metrics stability level & skip allocation for zero-memory containers ↗ kubernetes/kubernetes
- [5] apiserver: remove MutatingAdmissionPolicy v1beta1 storage version pin ↗ kubernetes/kubernetes
- [6] Merge pull request #140616 from jpbetz/crd-warn-non-scalar-set kubernetes/apiextensions-apiserver ↗
- [7] chore: resize kueue main periodic job cpu/memory requests, based on c… ↗ kubernetes/test-infra
- [8] agent-sandbox: generate prow jobs from the repo's dev/ci scripts ↗ kubernetes/test-infra
- [9] Merge pull request #140241 from camilamacedo86/fix-envtest kubernetes/component-helpers ↗
