Merge branch 'kubernetes:main' into dev

Author: arujjval

content/en/blog/_posts/2025-03-24-ingress-nginx-CVE-2025-1974.md

@@ -7,7 +7,7 @@ author: >
   Tabitha Sable (Kubernetes Security Response Committee)
 ---
 
-Today, the ingress-nginx maintainers have [released patches for a batch of critical vulnerabilities](https://github.com/kubernetes/ingress-nginx/releases) that could make it easy for attackers to take over your Kubernetes cluster. If you are among the over 40% of Kubernetes administrators using [ingress-nginx](https://github.com/kubernetes/ingress-nginx/), you should take action immediately to protect your users and data.
+Today, the ingress-nginx maintainers have released patches for a batch of critical vulnerabilities that could make it easy for attackers to take over your Kubernetes cluster: [ingress-nginx v1.12.1](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1) and [ingress-nginx v1.11.5](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5). If you are among the over 40% of Kubernetes administrators using [ingress-nginx](https://github.com/kubernetes/ingress-nginx/), you should take action immediately to protect your users and data.
 
 ## Background
 
@@ -23,7 +23,7 @@ Four of today’s ingress-nginx vulnerabilities are improvements to how ingress-
 
 The most serious of today’s vulnerabilities, [CVE-2025-1974](https://github.com/kubernetes/kubernetes/issues/131009), rated [9.8 CVSS](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), allows anything on the Pod network to exploit configuration injection vulnerabilities via the Validating Admission Controller feature of ingress-nginx. This makes such vulnerabilities far more dangerous: ordinarily one would need to be able to create an Ingress object in the cluster, which is a fairly privileged action. When combined with today’s other vulnerabilities, **CVE-2025-1974 means that anything on the Pod network has a good chance of taking over your Kubernetes cluster, with no credentials or administrative access required**. In many common scenarios, the Pod network is accessible to all workloads in your cloud VPC, or even anyone connected to your corporate network\! This is a very serious situation.
 
-Today, we have [released ingress-nginx v1.12.1 and v1.11.5](https://github.com/kubernetes/ingress-nginx/releases), which have fixes for all five of these vulnerabilities.
+Today, we have released [ingress-nginx v1.12.1](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1) and [ingress-nginx v1.11.5](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5), which have fixes for all five of these vulnerabilities.
 
 ## Your next steps
 
@@ -52,3 +52,5 @@ Thanks go out to Nir Ohfeld, Sagi Tzadik, Ronen Shustin, and Hillai Ben-Sasson f
 For further information about the maintenance and future of ingress-nginx, please see this [GitHub issue](https://github.com/kubernetes/ingress-nginx/issues/13002) and/or attend [James and Marco’s KubeCon/CloudNativeCon EU 2025 presentation](https://kccnceu2025.sched.com/event/1tcyc/).
 
 For further information about the specific vulnerabilities discussed in this article, please see the appropriate GitHub issue: [CVE-2025-24513](https://github.com/kubernetes/kubernetes/issues/131005), [CVE-2025-24514](https://github.com/kubernetes/kubernetes/issues/131006), [CVE-2025-1097](https://github.com/kubernetes/kubernetes/issues/131007), [CVE-2025-1098](https://github.com/kubernetes/kubernetes/issues/131008), or [CVE-2025-1974](https://github.com/kubernetes/kubernetes/issues/131009)
+
+*This blog post was revised in May 2025 to update the hyperlinks.*

content/en/blog/_posts/2025-05-19-announcing-etcd-3.6/figure-1.png renamed to content/en/blog/_posts/2025-05-15-announcing-etcd-3.6/figure-1.png

@@ -112,7 +112,7 @@ In this release, we reduced average memory consumption by at least 50% (see Figu
 - The default value of `--snapshot-count` has been reduced from 100,000 in v3.5 to 10,000 in v3.6. As a result, etcd v3.6 now retains only about 10% of the history records compared to v3.5.
 - Raft history is compacted more frequently, as introduced in [PR/18825][].
 
-![figure-1](../2025-05-19-announcing-etcd-3.6/figure-1.png "Diagram of memory usage")
+{{< figure src="figure-1.png" alt="Diagram of memory usage" >}}
 
 _**Figure 1:** Memory usage comparison between etcd v3.5.20 and v3.6.0-rc.2 under different read/write ratios.
 Each subplot shows the memory usage over time with a specific read/write ratio. The red line represents etcd
@@ -126,25 +126,25 @@ in both read and write throughput (see Figure 2, 3, 4 and 5). This improvement i
 any single major change, but rather the cumulative effect of multiple minor enhancements. One such
 example is the optimization of the free page queries introduced in [PR/419][].
 
-![figure-2](../2025-05-19-announcing-etcd-3.6/figure-2.png "etcd read transaction performance with a high write ratio")
+{{< figure src="figure-2.png" alt="etcd read transaction performance with a high write ratio" >}}
 
 _**Figure 2:** Read throughput comparison between etcd v3.5.20 and v3.6.0-rc.2 under a high write ratio. The
 read/write ratio is 0.0078, meaning 1 read per 128 writes. The right bar shows the percentage improvement
 in read throughput of v3.6.0-rc.2 over v3.5.20, ranging from 3.21% to 25.59%._
 
-![figure-3](../2025-05-19-announcing-etcd-3.6/figure-3.png "etcd read transaction performance with a high read ratio")
+{{< figure src="figure-3.png" alt="etcd read transaction performance with a high read ratio" >}}
 
 _**Figure 3:** Read throughput comparison between etcd v3.5.20 and v3.6.0-rc.2 under a high read ratio.
 The read/write ratio is 8, meaning 8 reads per write. The right bar shows the percentage improvement in
 read throughput of v3.6.0-rc.2 over v3.5.20, ranging from 4.38% to 27.20%._
 
-![figure-4](../2025-05-19-announcing-etcd-3.6/figure-4.png "etcd write transaction performance with a high write ratio")
+{{< figure src="figure-4.png" alt="etcd write transaction performance with a high write ratio" >}}
 
 _**Figure 4:** Write throughput comparison between etcd v3.5.20 and v3.6.0-rc.2 under a high write ratio. The
 read/write ratio is 0.0078, meaning 1 read per 128 writes. The right bar shows the percentage improvement
 in write throughput of v3.6.0-rc.2 over v3.5.20, ranging from 2.95% to 24.24%._
 
-![figure-5](../2025-05-19-announcing-etcd-3.6/figure-5.png "etcd write transaction performance with a high read ratio")
+{{< figure src="figure-5.png" alt="etcd write transaction performance with a high read ratio" >}}
 
 _**Figure 5:** Write throughput comparison between etcd v3.5.20 and v3.6.0-rc.2 under a high read ratio.
 The read/write ratio is 8, meaning 8 reads per write. The right bar shows the percentage improvement in

content/en/blog/_posts/2025-05-19-announcing-etcd-3.6/figure-2.png renamed to content/en/blog/_posts/2025-05-15-announcing-etcd-3.6/figure-2.png

@@ -22,11 +22,11 @@ deprecated API versions to newer and more stable API versions.
 
 ### v1.32
 
-The **v1.32** release will stop serving the following deprecated API versions:
+The **v1.32** release stopped serving the following deprecated API versions:
 
 #### Flow control resources {#flowcontrol-resources-v132}
 
-The **flowcontrol.apiserver.k8s.io/v1beta3** API version of FlowSchema and PriorityLevelConfiguration will no longer be served in v1.32.
+The **flowcontrol.apiserver.k8s.io/v1beta3** API version of FlowSchema and PriorityLevelConfiguration is no longer served as of v1.32.
 
 * Migrate manifests and API clients to use the **flowcontrol.apiserver.k8s.io/v1** API version, available since v1.29.
 * All existing persisted objects are accessible via the new API

content/en/blog/_posts/2025-05-19-announcing-etcd-3.6/figure-3.png renamed to content/en/blog/_posts/2025-05-15-announcing-etcd-3.6/figure-3.png

@@ -80,23 +80,6 @@ <h2 style="color: #3771e3;">Kubernetes上にはじめてのアプリケーショ
             </div>
         </div>
 
-        <div class="row">
-            <div class="col-md-8">
-
-                <p>最初のDeploymentには、DockerコンテナにパッケージされたNode.jsアプリケーションを使用します。(まだNode.jsアプリケーションを作成してデプロイしていない場合、<a href="/ja/docs/tutorials/hello-minikube/">Hello Minikubeチュートリアル</a>の通りにやってみましょう。)</p>
-
-                <p>Deploymentが何であるかがわかったので、オンラインチュートリアルに行き、最初のアプリケーションをデプロイしましょう！</p>
-
-            </div>
-        </div>
-        <br>
-
-        <div class="row">
-            <div class="col-md-12">
-                <a class="btn btn-lg btn-success" href="/ja/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive/" role="button">対話型のチュートリアルを始める <span class="btn__next">›</span></a>
-            </div>
-        </div>
-
     </main>
 
 </div>