node-problem-detector 1.37.0 patches three CVEs

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

The same release swaps OpenCensus for OpenTelemetry; elsewhere kubelet drops two deprecated feature gates and CRD types find a new home.

1401 commits 812 PRs merged 8 releases 31 briefings covered

all kubernetes reviews →

← previous month kubernetes wire →

v1.37.0 kubernetes/node-problem-detector

by hakman

The release patches three CVEs and replaces OpenCensus with OpenTelemetry for metrics export; the release notes say Prometheus metric names are unchanged, so dashboards and recording rules keep working. It also adds a per-rule invoke_interval for custom plugin monitor rules and zswap metrics memory/zswap_bytes_used and memory/zswap_compression_efficiency.

HPA: compute resource utilization ratio without int64 overflow kubernetes/kubernetes

by KR-Ravindra

GetResourceUtilizationRatio summed per-pod metrics and requests as raw int64, multiplied by 100 and narrowed to int32, and all three steps wrapped silently near math.MaxInt64. The HPA now computes the ratio without that overflow, which matters if you push large requests or high-cardinality metric values through scale decisions.

cacher: stream watch cache snapshots without an item slice kubernetes/kubernetes

by p0lyn0mial

The cacher can now stream watch cache snapshots without materializing an item slice, the work that later carried Limit support and alignment fixes through the month. For big clusters it targets the memory spike on large List and watch initializations rather than request latency.

AEP-9970: per-VPA target percentiles kubernetes/autoscaler

by Sanil2108

AEP-9970 adds targetCPUPercentile and targetMemoryPercentile to ContainerResourcePolicy, extending AEP-8026's per-VPA configuration to percentile-based targets. If p95 CPU rather than the mean matches your workload, this is the knob you will be tuning.

Update the GCP provider to allow users to skip firewall actions kubernetes/cloud-provider-gcp

by barbacbd

A new ManageFirewallRules boolean lets clusters skip creation, deletion, and update of firewall rules entirely, for operators who manage them outside the provider. The input notes users may not want the provider touching them; flip it off and the provider stops reconciling.

add watch-list mode to request benchmark kubernetes/perf-tests

by p0lyn0mial

An optional HTTP WatchList benchmark mode measures WatchList latency while ruling out client-side typed-object decoding as a source of overhead. Useful if you are deciding whether WatchList cost comes from the wire or your own decoders.

Migrate 5,000-node scale tests to c4d-standard-96 kubernetes/test-infra

by Jefftree

All 5,000-node scale test control planes move from c4-standard-96 to c4d-standard-96, reverting an earlier experiment. Upstream notes severe run-to-run variance on c4-standard-96 from host processor differences in the cloud provider pool, so older scale results may not be comparable.

$ ls kubernetes/month/ # the briefings behind this review

Thu Oct 1 GCP provider learns to skip firewall rules, metis gets non-reusable CIDRs Fri Oct 2 Quantity becomes a value type, HPA overflow fixed Sat Oct 3 Watch cache streaming, kubectl kuberc fixes Sun Oct 4 Per-VPA target percentiles, WatchList benchmarks in the request path Mon Oct 5 Kubelet stops leaking unusable link-local nameservers into pods Tue Oct 6 Storage gets RV-aware, VPA matching gets a baseline Wed Oct 7 DRA deadlock fix lands, watch cache tightens List selectors Thu Oct 8 VPA gains a startup observation window, OCI autoscaling reads real ephemeral storage Fri Oct 9 Per-release EC2 scale jobs, kops bastion capacity fallbacks Sat Oct 10 client_golang 1.25.0 lands across four published components, scheduler validates pod group hierarchies Sun Oct 11 etcd 3.7 lands in perf-tests, watch cache gains Limit support Mon Oct 12 etcd benchmark fixed, promo-tools bump breaks the release build Tue Oct 13 Watch cache correctness work lands in apiserver Wed Oct 14 kubectl always uses WebSockets; node-problem-detector 1.37.0 patches three CVEs Thu Oct 15 Golangci-lint enforces deprecation notices, dbus pin dropped Fri Oct 16 Pod security admission webhook removed, release signing moves to sigstore-go Sat Oct 17 kops compares GCE firewall rules as sets, PSA drops its webhook Sun Oct 18 kops fixes kubeconfig reconcile, scheduler stops leaking nominated nodes Mon Oct 19 IPVS deprecation gets a migration guide, NLB gains an ALPN knob Tue Oct 20 Go 1.27.3 lands in kubernetes, addon-resizer ports to master Wed Oct 21 kops fixes bare-metal S3 uploads, cacher watch alignment lands Thu Oct 22 kubectl drops OpenAPI v2, client-go extracts from v3 Fri Oct 23 go-tpm-tools gets a CVE fix as git-sync stops leaking secrets Sat Oct 24 Kops exposes kubelet burst and fixes IPv6-only node registration Sun Oct 25 SystemdWatchdog gate retired as minikube's CI learns to survive capacity pressure Mon Oct 26 Two deprecated kubelet feature gates drop in 1.38 Tue Oct 27 DeepCopy revert lands, client-go leader election gets a recovery mode Wed Oct 28 CRD types move to k8s.io/apiextensions-api, grpc hits 1.85.0 Thu Oct 29 Kueue presubmits stop firing 51 jobs at a time Fri Oct 30 kops fixes kubelet status flooding, controller-manager deprecates raw Config builders Sat Oct 31 Scheduler narrows DRA queues, cloud-provider-aws takes two Go security fixes

all kubernetes reviews →

← previous month kubernetes wire →