Evaluate Kubernetes 1.27 changes

[lfrancke]

I would like to know if there are any changes in Kubernetes 1.27 that the SDP could potentially make use of (e.g. sidecars), will require changes or will break things on our end.

This should be timeboxed and take up at most 4h of research and reading. The result of this should be a comment on this issue or follow-up issues listing the high level points of things we could, should and should not do.

Must read:

• https://kubernetes.io/blog/2023/04/11/kubernetes-v1-27-release/

And the Kubernetes blog has dedicated blog post for certain topics: https://kubernetes.io/blog/ (they are in the archives but can be found).

This is relevant as we can now support these things in SDP 24.11

[razvan]

Kubernetes v1.27: Chill Vibes

Link: https://kubernetes.io/blog/2023/04/11/kubernetes-v1-27-release/

Possible actions

No obvious immediate actions that I see.

For production deployments, the following features might be interesting:

• Faster Pod cleanup in case of failure: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2238-liveness-probe-grace-period
• Ensure only one pod can write to a volume at a time: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/2485-read-write-once-pod-pv-access-mode

Summary

• 60 enhancements
  • 13 stable
  • 29 beta
  • 18 alpha

Highlights - Stable Features

• Add configurable grace period to probes
• OpenAPI v3
• k8s.gcr.io frozen. use registry.k8s.io instead.
• SeccompDefault is now RuntimeDefault instead of Unconfined.
• mutable scheduling directives for Jobs. Node affinity, node selector, tolerations, annotations can be updated as long as the Job is in a suspended state and has never been unsuspended before.
• requests.hugepages-<pagesize> and limits.hugepages-<pagesize> are now supported.
• respect PodTopologySpread after rolling upgrades

Highlights - Beta Features

• ReadWriteOncePod PersistentVolume access mode - ensures that only one pod can write to a volume at a time.
• Faster SELinux volume relabeling using mounts. This feature speeds up container startup by mounting volumes with the correct SELinux label instead of changing each file on the volumes recursively.
• Robust VolumeManager reconstruction. Make volume cleanup better by populating additional info during kubelte startup.
• Pod scheduling readiness with .spec.schedulingGates

Highlights - Alpha Features

• Node log access via Kubernetes API

[sbernauer]

LGTM