1. "Securing the Kubernetes Host Operating System" by Rafael Natali.
If the host operating system is breached, the attacker could use it to target other nodes in the cluster, along with all the Pods and applications running on that node. Eventually, the attacker can even access other systems in your network! The next subsections contain the information necessary to secure the host operating system.
2. "Every pod eviction in Kubernetes, explained" by Ahmet Alp Balkan.
There are so many ways Kubernetes terminates workloads, each with a non-trivial (and not always predictable) machinery, and there’s no page that lists out all eviction modes in one place. This article will dig into Kubernetes internals to walk you through all the eviction paths that can terminate your Pods, and why “kubelet restarts don’t impact running workloads” isn’t always true, and finally I’ll leave you with a cheatsheet at the end.
3. "WebAssembly on Kubernetes" by Nicolas Fränkel.
In this post, I showed how to use Webassembly on Kubernetes with the Wasmedge runtime. I created three flavors for comparison purposes: native, embed, and runtime. The first two are "regular" Docker images, while the latter contains only a single Wasm file, which makes it very lightweight and secure.
4. "Yoke is really cool" by Xe Iaso.
With Yoke, you write your infrastructure definitions in Go or Rust, compile it to WebAssembly, and then you take input and output Kubernetes manifests that get applied to the cluster. [..] One of the big advantages of using WebAssembly here is that you can use the same Kubernetes manifest types that Kubernetes itself uses. This means you don't have to write your own types and you can reuse code aggressively.
5. "Exploring Cloud Native projects in CNCF Sandbox. Part 3: 14 arrivals of 2024 H1" by Dmitry Shurupov, Palark.
We’re continuing this series with our brief introductions to the projects added to the Sandbox in April, June, and July of 2024: Radius, Stacker, Score, Bank-Vaults, TrestleGRC, bpfman, Koordinator, KubeSlice, Atlantis, Kubean, Connect, Kairos, Kuadrant, and openGemini.
6. "How to Setup Preview Environments with FluxCD in Kubernetes" by Meysam Azad.
Preview environment is where you see a live state of your changes from your pull request before being merged into the default branch. It gives you a look'n feel of what it would be like if you merged your changes. [..] in this blog post, I will show you how to achieve this using FluxCD Operator.
7. "Container Network Interface (CNI) in Kubernetes: An Introduction" by Homayoon (Hue) Alimohammadi.
In this article, we’re gonna learn about the Container Network Interface (CNI) and CNI plugins, what they’re supposed to do, and how they’re implemented. We’ll also see a simple CNI implementation in Go and Bash, and test it in a Canonical Kubernetes cluster.
#articles