September 21, 2021

LWKD: Week Ending September 19, 2021

Last Week In Kubernetes Development - Week Ending Sept. 19, 2021

Developer News

Two security vulnerabilities were reported this week. CVE-2020-8561 allows webhook owners to hijack sessions if --profiling is on in the APIserver; disable profiling or lock down webhook permissions to avoid. CVE-2021-25741 permits users to bypass volume restrictions in VolumeSubpath to access files outside of designated directories; fixed in current update releases.

The kind/design tag is being retired in favor of kind/feature for most repositories. kind/design was created as a label for a Kubernetes feature workflow that has been replaced by the Enhancements process, and as such is mostly just confusing today. If your repo still actively uses kind/design, you must opt-in to keep it after Sept. 27.

Verónica López is now a full Release Manager in the release-engineering group.

WG K8s Infra should be SIG K8s Infra by the time you read this. On the other hand, WG Component Standard is being dissolved due to lack of participation. During its time, WG-CS created the Component Base repo which will be managed by SIG-Arch.

SIG Leads can now manage changes to their SIG's google groups.

The Prow team has added long-requested features to enable editing release notes and transfer issues between repos.

Release Schedule

Next Deadline: All Exceptions due Nov. 1

We are in the "feature development" phase of the release. As you hack on your features, consider if they are suitable for the Feature blog due Nov 2; more info from the Release Lead. 1.23-alpha2 is released for your testing enjoyment.

1.19.15, 1.20.11, 1.21.5, and 1.22.2 are out, including a Golang update.

Merges

• APIserver etcd client retries transient errors
• If a cluster has no zones, don't bother checking for topology
• New headless services with no selector default to Require Dual-Stack in 1.23
• Since Swap is now supported in beta, kubeadm warns but doesn't fail if nodes have swap
• Overhaul how pods with fixed UIDs restart; backported to 1.22 to fix regression
• Azure disks will migrate to CSI in 1.23
• Don't try to overwrite higher sysctl values when kube-proxy starts; fix ported from the K3S fork
• Allow events in the default namespace for backwards compatibility

Promotions

• More progress towards finalizers for Job tracking

Deprecated

• The alpine-bash and bazel-krte images are no longer in use, and the project will stop publishing them
• VolumeSubpath feature gate is removed as VS is now GA
• PID Limit feature gates removed as limits are GA
• EgressSelection type master is removed

Structured logging migration: proxy app, winuserspace

Version Updates

• golang to 1.16.8 in 1.21 and later
• python client 19.15 is available in alpha