Skip to content

Commit 7467815

Browse files
author
Tim Bannister
authored
Revise article
1 parent 378ccb1 commit 7467815

File tree

1 file changed

+9
-3
lines changed

1 file changed

+9
-3
lines changed

content/en/blog/_posts/2023-12-13-kubernetes-1.29.md

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,12 @@ To meet this requirement, the CSI Node Expand Secret feature was introduced in K
4949

5050
### KMS v2 encryption at rest generally available ([SIG Auth](https://github.com/kubernetes/community/tree/master/sig-auth)) {#kms-v2-api-encryption}
5151

52-
One of the first things to consider when securing a Kubernetes cluster is encrypting persisted API data at rest. KMS provides an interface for a provider to utilize a key stored in an external key service to perform this encryption. With the new release of Kubernetes, KMS v2 has become a stable feature bringing numerous improvements in performance, key rotation, health check & status, and observability. These enhancements enable users with a reliable solution to encrypt all resources in their Kubernetes clusters. [KEP-3299](https://kep.k8s.io/3299)
52+
One of the first things to consider when securing a Kubernetes cluster is encrypting persisted
53+
API data at rest. KMS provides an interface for a provider to utilize a key stored in an external
54+
key service to perform this encryption. With the Kubernetes v1.29, KMS v2 has become
55+
a stable feature bringing numerous improvements in performance, key rotation,
56+
health check & status, and observability.
57+
These enhancements provide users with a reliable solution to encrypt all resources in their Kubernetes clusters. You can read more about this in [KEP-3299](https://kep.k8s.io/3299).
5358

5459
For Kubernetes v1.29, [encryption at rest for API data](/docs/tasks/administer-cluster/encrypt-data/)
5560
can integrate with an external _key management service_ (KMS). Available since Kubernetes v1.13,
@@ -100,15 +105,16 @@ This feature implements a new allocator logic that uses 2 new API Objects: Servi
100105

101106
### Add support to containerd/kubelet/CRI to support image pull per runtime class ([SIG Windows](https://github.com/kubernetes/community/tree/master/sig-windows)) {#image-pull-per-runtimeclass}
102107

103-
This feature adds support to pull container images based on runtime class. This feature is off by default in v1.29 under a feature gate called `RuntimeClassInImageCriApi`.
108+
Kubernetes v1.29 adds support to pull container images based on the RuntimeClass of the Pod that uses them.
109+
This feature is off by default in v1.29 under a feature gate called `RuntimeClassInImageCriApi`.
104110

105111
Container images can either be a manifest or an index. When the image being pulled is an index (image index has a list of image manifests ordered by platform), platform matching logic in the container runtime is used to pull an appropriate image manifest from the index. By default, the platform matching logic picks a manifest that matches the host that the image pull is being executed from. This can be limiting for VM-based containers where a user could pull an image with the intention of running it as a VM-based container, for example, Windows Hyper-V containers.
106112

107113
The image pull per runtime class feature adds support to pull different images based the runtime class specified. This is achieved by referencing an image by a tuple of (`imageID`, `runtimeClass`), instead of just the `imageName` or `imageID`. Container runtimes could choose to add support for this feature if they'd like. If they do not, the default behavior of kubelet that existed prior to Kubernetes v1.29 will be retained.
108114

109115
### In-place updates for Pod resources, for Windows Pods ([SIG Windows](https://github.com/kubernetes/community/tree/master/sig-windows))
110116

111-
This feature makes the Pod spec mutable with respect to `resources`, allowing users to define the _desired_ resource requests and limits for a Pod without the need to restart the Pod. With v1.29, this feature is now supported for Windows containers.
117+
As an alpha feature, Kubernetes Pods can be mutable with respect to their `resources`, allowing users to change the _desired_ resource requests and limits for a Pod without the need to restart the Pod. With v1.29, this feature is now supported for Windows containers.
112118

113119
## Graduations, deprecations and removals for Kubernetes v1.29
114120

0 commit comments

Comments
 (0)