Alireza Gharib Blog

In Kubernetes v1.31, we are excited to introduce a significant enhancement to CPU management capabilities: the distribute-cpus-across-cores option for the CPUManager static policy. This feature is currently in alpha and hidden by default, marking a strategic shift aimed at optimizing CPU utilization and improving system performance across multi-core processors. Understanding the feature Traditionally, Kubernetes’ CPUManager…

Historically, configuring the correct cgroup driver has been a pain point for users running new Kubernetes clusters. On Linux systems, there are two different cgroup drivers: cgroupfs and systemd. In the past, both the kubelet and CRI implementation (like CRI-O or containerd) needed to be configured to use the same cgroup driver, or else the…

In Kubernetes 1.31, by default kubectl now uses the WebSocket protocol instead of SPDY for streaming. This post describes what these changes mean for you and why these streaming APIs matter. Streaming APIs in Kubernetes In Kubernetes, specific endpoints that are exposed as an HTTP or RESTful interface are upgraded to streaming connections, which require…

This post describes Pod failure policy, which graduates to stable in Kubernetes 1.31, and how to use it in your Jobs. About Pod failure policy When you run workloads on Kubernetes, Pods might fail for a variety of reasons. Ideally, workloads like Jobs should be able to ignore transient, retriable failures and continue running to…

Arbitrary command execution through gitRepo volume Go to Source

VM images built with Image Builder with some providers use default credentials during builds Go to Source

VM images built with Image Builder and Proxmox provider use default credentials Go to Source

Ingress-nginx Annotation Validation Bypass Go to Source

Incorrect permissions on Windows containers logs Go to Source

azure-file-csi-driver discloses service account tokens in logs Go to Source