5 ms·

Kubernetes 1.7: Security Hardening, Stateful Application Updates and Extensibility

127 points by clhodapp 9y ago

Perceptes 9y ago
Has the apt repo been updated? `apt-get install kubelet` is still giving me v1.6.6. I'm using `deb http://apt.kubernetes.io/ http://apt.kubernetes.io/ kubernetes-xenial main` as the apt source. Edit: I think it's a mistake. Reported here: https://github.com/kubernetes/release/issues/358 https://github.com/kubernetes/release/issues/358
djb_hackernews 9y ago
Does Kubernetes support adding "middleware" between it and docker? ie when it comes time to do a container start, it calls my custom plugin instead of docker directly? I read the docs about extensibility and it didn't seem so.
- gtirloni 9y ago
  You're probably interested in the Container Runtime Interface [0] 0 - http://blog.kubernetes.io/2016/12/container-runtime-interface-cri-in-kubernetes.html http://blog.kubernetes.io/2016/12/container-runtime-interfac...
- puzzle 9y ago
  What kind of plugins are you thinking of?
  - djb_hackernews 9y ago
    This is a very simple example. But we require setting the pid limit cgroup. Right now Kubernetes doesn't support this (again, just an example, there are a lot of things kubernetes doesn't support that we need beyond pid limits). So it'd be nice to be able to proxy the call to docker to inject our own config before hitting docker. It looks like CRI is exactly what we'd need, possibly maintaining our own fork of the docker shim? Trying to figure out if there is a way to put in arbitrary data in the config sent to the docker shim[0] [0] https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/cri/v1alpha1/runtime/api.pb.go https://github.com/kubernetes/kubernetes/blob/master/pkg/kub...
- davidopp_ 9y ago
  That idea was proposed here: https://github.com/kubernetes/features/issues/246 https://github.com/kubernetes/features/issues/246 ; there's a pretty thorough design doc linked to from the issue. The decision was made not to add it to the system for now (see the issue for discussion).
SjuulJanssen 9y ago
I just checked Google container engine. It's not available yet in the update list for GCE
- gtirloni 9y ago
  Kubernetes is a community project, not directly tied to GKE release dates [0] K8s 1.6 was released on March 28 and GKE made that version available on April 4. I would expect a similar wait time to 1.7. 0 - https://cloud.google.com/container-engine/release-notes#supported_kubernetes_versions https://cloud.google.com/container-engine/release-notes#supp...
  - timdorr 9y ago
    It may be a little more delayed because of the US 4th of July holiday: > There will be no release for the week of July 3rd, since this is a holiday in the US. The next release is planned for the week of July 10th.
philips 9y ago
Kubernetes is getting a number of extensibility features in this release. The net new one is "API Aggregation" which enables the addition/registration of API servers behind the primary API server. And there is sort of a toolkit for building these new API servers emerging[1]. The second major one is "third-party resources" which has now been renamed to custom resource definitions. These power a number of software systems[2] today and the changes are explained in this blog post[3]. [1]: https://github.com/kubernetes-incubator/apiserver-builder https://github.com/kubernetes-incubator/apiserver-builder [2]: https://github.com/coreos/awesome-kubernetes-extensions https://github.com/coreos/awesome-kubernetes-extensions [3]: https://coreos.com/blog/custom-resource-kubernetes-v17 https://coreos.com/blog/custom-resource-kubernetes-v17
- hosh 9y ago
  "API Aggregation" along with CRDs are going to be huge. It essentially lets people create plugins and Operators more easily, without having to go through the development and release cycle for the core project. That's going to accelerate a lot of innovation. Combined with Helm charts and some discovery mechanism, and it is going to crank things up for Kubernetes even more so than what we've seen in the past year and a half. I was looking at service-catalog, and I got thinking, wow, K8S rapidly catching up to CloudFoundry. It may not be long before it starts overtaking it. I still wonder how the pre-container generation of DevOps tools will work with this -- Puppet, Chef, Ansible, etc. It seems to me that all the older-generation devops "infrastructure as code" tooling are one move behind Kubernetes.
  - lobster_johnson 9y ago
    I wonder if the plan is to eventually split out core controllers into separate modules. For example, the replica set controller could easily be its own thing that ran as a pod; what it does, fundamentally, is ensure that the correct number of pods exists for a specific template. Kubernetes is, conceptually, MVC. There's a data store of objects that describe what the world should look like, then a bunch of controllers that use this store to continually "converge" and "repair" the world so it looks like the description, plus APIs to perform specific actions such as perform a rollout or undo. With this new addition, you get closer to erasing the conceptual distinction between "core" Kubernetes and everything else, which is great.

127 points by clhodapp 9y ago

Has the apt repo been updated? `apt-get install kubelet` is still giving me v1.6.6. I'm using `deb http://apt.kubernetes.io/ http://apt.kubernetes.io/ kubernetes-xenial main` as the apt source. Edit: I think it's a mistake. Reported here: https://github.com/kubernetes/release/issues/358 https://github.com/kubernetes/release/issues/358

djb_hackernews 9y ago

Does Kubernetes support adding "middleware" between it and docker? ie when it comes time to do a container start, it calls my custom plugin instead of docker directly? I read the docs about extensibility and it didn't seem so.

gtirloni 9y ago
You're probably interested in the Container Runtime Interface [0] 0 - http://blog.kubernetes.io/2016/12/container-runtime-interface-cri-in-kubernetes.html http://blog.kubernetes.io/2016/12/container-runtime-interfac...
puzzle 9y ago
What kind of plugins are you thinking of?
- djb_hackernews 9y ago
  This is a very simple example. But we require setting the pid limit cgroup. Right now Kubernetes doesn't support this (again, just an example, there are a lot of things kubernetes doesn't support that we need beyond pid limits). So it'd be nice to be able to proxy the call to docker to inject our own config before hitting docker. It looks like CRI is exactly what we'd need, possibly maintaining our own fork of the docker shim? Trying to figure out if there is a way to put in arbitrary data in the config sent to the docker shim[0] [0] https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/cri/v1alpha1/runtime/api.pb.go https://github.com/kubernetes/kubernetes/blob/master/pkg/kub...
davidopp_ 9y ago
That idea was proposed here: https://github.com/kubernetes/features/issues/246 https://github.com/kubernetes/features/issues/246 ; there's a pretty thorough design doc linked to from the issue. The decision was made not to add it to the system for now (see the issue for discussion).

SjuulJanssen 9y ago

I just checked Google container engine. It's not available yet in the update list for GCE

gtirloni 9y ago
Kubernetes is a community project, not directly tied to GKE release dates [0] K8s 1.6 was released on March 28 and GKE made that version available on April 4. I would expect a similar wait time to 1.7. 0 - https://cloud.google.com/container-engine/release-notes#supported_kubernetes_versions https://cloud.google.com/container-engine/release-notes#supp...
- timdorr 9y ago
  It may be a little more delayed because of the US 4th of July holiday: > There will be no release for the week of July 3rd, since this is a holiday in the US. The next release is planned for the week of July 10th.

philips 9y ago

Kubernetes is getting a number of extensibility features in this release. The net new one is "API Aggregation" which enables the addition/registration of API servers behind the primary API server. And there is sort of a toolkit for building these new API servers emerging[1]. The second major one is "third-party resources" which has now been renamed to custom resource definitions. These power a number of software systems[2] today and the changes are explained in this blog post[3]. [1]: https://github.com/kubernetes-incubator/apiserver-builder https://github.com/kubernetes-incubator/apiserver-builder [2]: https://github.com/coreos/awesome-kubernetes-extensions https://github.com/coreos/awesome-kubernetes-extensions [3]: https://coreos.com/blog/custom-resource-kubernetes-v17 https://coreos.com/blog/custom-resource-kubernetes-v17

hosh 9y ago
"API Aggregation" along with CRDs are going to be huge. It essentially lets people create plugins and Operators more easily, without having to go through the development and release cycle for the core project. That's going to accelerate a lot of innovation. Combined with Helm charts and some discovery mechanism, and it is going to crank things up for Kubernetes even more so than what we've seen in the past year and a half. I was looking at service-catalog, and I got thinking, wow, K8S rapidly catching up to CloudFoundry. It may not be long before it starts overtaking it. I still wonder how the pre-container generation of DevOps tools will work with this -- Puppet, Chef, Ansible, etc. It seems to me that all the older-generation devops "infrastructure as code" tooling are one move behind Kubernetes.
- lobster_johnson 9y ago
  I wonder if the plan is to eventually split out core controllers into separate modules. For example, the replica set controller could easily be its own thing that ran as a pod; what it does, fundamentally, is ensure that the correct number of pods exists for a specific template. Kubernetes is, conceptually, MVC. There's a data store of objects that describe what the world should look like, then a bunch of controllers that use this store to continually "converge" and "repair" the world so it looks like the description, plus APIs to perform specific actions such as perform a rollout or undo. With this new addition, you get closer to erasing the conceptual distinction between "core" Kubernetes and everything else, which is great.