Kubernetes 1.22

What’s New in Kubernetes 1.22

© 2021 Cloud Native Computing Foundation
2
James Laverack
1.22 Enhancements Lead
@JamesLaverack
Presenters
Jesse Butler
1.22 Communications
Lead & Moderator
@
Savitha Raghunathan
1.22 Release Lead
@coffeeartgirl

3
Agenda
★ 1.23 Release Updates
★ 1.22 Highlights
★ SIG Updates
★ Q&A

5
Overview
★ 1.23 Release Timeline
○ Start Date: Monday 23rd August 2021
○ Enhancements Freeze: 23:59 PDT Thursday 9th September 2021
○ Code Freeze: 18:00 PST Tuesday 15th November 2021
○ Target Release Date: Tuesday 7th December 2021
★ Kubernetes Release Cadence has changed to 3 releases
per calendar year
○ 1.23 is scheduled to be the last release of 2021

7
Kubernetes 1.22 - Reaching New Peaks
Logo Credits: Boris Zotkin

8
Overview
★ 56 total enhancements tracked in 1.22
○ 13 Stable Enhancements
○ 24 Graduating to Beta
○ 16 Introduced Alpha features
○ 3 Deprecations

9
★ Server-side Apply
★ Quality of Service for memory resources
★ Improved control-plane security with kubeadm
Major Themes!

10
★ Node swap support
★ Windows capabilities
★ Default profiles for seccomp
(more) Major Themes!

13
Server-Side Apply
● Logic for kubectl apply is moved from the
client-side to the server-side.
● This simplifies some non-kubectl use cases,
like controllers. feature.k8s.io/555
Enhancement Proposal
Status: Stable
Status: Stable

14
Warning Headers When Using Deprecated APIs
● This feature surfaces warnings to users and
cluster administrators when deprecated
APIs or features are used.
feature.k8s.io/1693
Status: Stable
Status: Stable

15
Immutable Label Selectors for all Namespaces
● Ensures that namespaces always have a
label with their name.
● Means you can use a label selector
instead of a field selector to filter a
namespace by name. feature.k8s.io/2161
Status: Stable
Status: Stable

16
Priority and Fairness for API Server Requests
● Extends the API server’s overload
protection to allow prioritising some kinds
of requests.
● Enables prioritising things like node
heartbeats and maintenance during
extremely high traffic situations.
feature.k8s.io/1040
Status: Stable
Status: Beta

18
CronJobs
● Upgrades the cronjob API version to
batch/v1 (from batch/v1beta1).
feature.k8s.io/19
Status: Stable
Status: Stable

19
PodDisruptionBudget Eviction
● Upgrades the eviction API version to
policy/v1 (from policy/v1beta1). The older
API will still be accepted.
feature.k8s.io/85
Status: Stable
Status: Stable

20
DaemonSet maxSurge
● Allows a daemonset to “surge” to more
than one pod per node during upgrade
cycles. Intended to reduce downtime of
critical services during upgrades. feature.k8s.io/1591
Status: Stable
Status: Beta

21
LogarithmicScaleDown
● Compares ready and creation
timestamps in a logarithmic scale
during downscale.
● Roughly if a Pod A has been
created/running for less than half the
time of Pod B, then Pod A will be
downscaled first.
feature.k8s.io/2185
Status: Stable
Status: Beta

22
Indexed Job Semantics
● This feature adds support to launch Jobs
with an ‘index’ on each Pod.
● Designed to split ‘embarrassingly parallel’
problems where each pod can take a
group of a larger set of work items. feature.k8s.io/2214
Status: Stable
Status: Beta

23
Add Suspend Field to Job API
● Allows users to suspend and resume a job
from the Job API.
feature.k8s.io/2232
Status: Stable
Status: Beta

24
PodDeletionCost
● Use an annotation on a pod to hint at
how “expensive” it is to delete a pod.
● Used by the replica set controller to scale
down more intelligently. feature.k8s.io/2255
Status: Stable
Status: Beta

25
Job Tracking Without Lingering Pods
● The current Job controller currently relies
on completed Pods to not be removed in
order to track the Job completion status.
● This alternative implementation removes
that requirement by using a finaliser to
account for them.
feature.k8s.io/2307
Status: Stable
Status: Alpha

26
minReadySeconds on stateful sets
● This feature allows a user to specify
minimum seconds for which a Pod should
be ready (without any container crashes)
before it’s considered available
● Adds parity with the same feature from
deployments, daemon sets, replica sets,
etc.
feature.k8s.io/2599
Status: Stable
Status: Alpha

28
External client-go Credential Providers
● Authentication providers moved
out-of-tree for applications using
client-go.
● In-tree GCP and Azure plugins
deprecated, replaced with
github.com/azure/kubelogin and gcloud.
feature.k8s.io/541
Status: Stable
Status: Stable

29
Bound Service Account Token Volumes
● More secure way of providing service
account tokens to pods.
feature.k8s.io/542
Status: Stable
Status: Stable

30
CertificateSigningRequest duration
● Allow clients to request a specific duration
for a given certificate.
feature.k8s.io/2784
Status: Stable
Status: Beta

31
PodSecurity Admission (PSP replacement)
● This feature replaces Pod Security Policies
that were deprecated in v1.21
● Designed to “replace PodSecurityPolicy
without compromising the ability for
Kubernetes to limit privilege escalation
out of the box
feature.k8s.io/2579
Status: Stable
Status: Alpha

33
kubectl Commands in Headers
● This feature makes kubectl send the
original command to the API Server as
part of the request.
● Designed to aid cluster administrators
debug and understand user intent. feature.k8s.io/859
Status: Stable
Status: Beta

35
Controller Manager Leader Migration
● Support a migration process for large
scale and highly available Kubernetes
clusters using the in-tree cloud providers
(via kube-controller-manager and
kubelet) to their out-of-tree equivalents
(via cloud-controller-manager).
feature.k8s.io/2436
Status: Stable
Status: Beta

37
Run control-plane as non-root in kubeadm
● This feature helps in running the
control-plane in kubeadm as non-root.
feature.k8s.io/2568
Status: Stable
Status: Alpha

39
API Server Tracing
● This feature enhances the API Server to
allow tracing requests.
feature.k8s.io/647
Status: Stable
Status: Alpha

41
EndpointSlices
● This feature introduces a new
EndpointSlice API aiming to replace
Core/V1 Endpoints API for most internal
consumers, including kube-proxy.
feature.k8s.io/752
Status: Stable
Status: Stable

42
Adding AppProtocol to Services and Endpoints
● A concept of AppProtocol was added
that would allow application protocols to
be specified for each port.
feature.k8s.io/1507
Status: Stable
Status: Stable

43
Service Disabling LB Node Ports
● This feature adds a new field to Service to
opt out of node port allocation for
loadbalancers.
feature.k8s.io/1864
Status: Stable
Status: Beta

44
Service LoadBalancer Class
● This is a light-weight approach for Service
Type=LoadBalancer by introducing a
Service field
service.spec.loadBalancerClass. feature.k8s.io/1959
Status: Stable
Status: Beta

45
Network Policy to support Port Ranges
● This feature adds a new field that allows a
declaration of a port range, simplifying
the creation of rules with multiple ports. feature.k8s.io/2079
Status: Stable
Status: Beta

46
Service Internal Traffic Policy
● This feature adds a new API in Service to
address use-cases such as node-local
and topology aware routing for internal
Service traffic. feature.k8s.io/2086
Status: Stable
Status: Beta

47
Namespace Scoped Ingress Class Parameters
● This feature adds a new Scope and
Namespace fields to the IngressClass
ParametersRef field, to allow referencing
namespace-scoped Parameters
resources.
feature.k8s.io/2365
Status: Stable
Status: Beta

48
Graceful Termination for Local External Traffic Policy
● Gracefully handle traffic to a node that
has only terminating endpoints for a
Service with externalTrafficPolicy=Local.
feature.k8s.io/1669
Status: Stable
Status: Alpha

49
Expanded DNS Configuration
● With this feature, kubernetes allows more
DNS search paths and longer list of DNS
search paths to keep up with recent DNS
resolvers. feature.k8s.io/2595
Status: Stable
Status: Alpha

51
HugePages
● Enable applications running in a
Kubernetes cluster to use huge pages.
feature.k8s.io/1539
Status: Stable
Status: Stable

52
Configure FQDN as Hostname for Pods
● This feature gives users the ability to set a
pod’s hostname to its Fully Qualified
Domain Name (FQDN).
● It would increase the interoperability of
Kubernetes with legacy applications. feature.k8s.io/1797
Status: Stable
Status: Stable

53
Sizable memory backed volumes
● This feature improves the portability of
pod definitions that use memory backed
empty dir volumes
feature.k8s.io/1967
Status: Stable
Status: Stable

54
Ephemeral Containers
● This proposal adds to Kubernetes a
mechanism to run a container with a
temporary duration that executes within
namespaces of an existing pod.
● Ephemeral Containers are initiated by a
user and intended to observe the state of
other pods and containers for
troubleshooting and debugging
purposes.
feature.k8s.io/277
Status: Stable
Status: Beta

55
Liveness Probe Grace Periods
● This feature will override the
`terminationGracePeriodSeconds` for
liveness or startup termination, and will be
ignored for readiness probes.
feature.k8s.io/2238
Status: Stable
Status: Beta

56
Kubelet-in-UserNS (aka Rootless mode)
● This feature allows running the entire
Kubernetes components (kubelet, CRI,
OCI, CNI, and all kube-*) as a non-root
user on the host, by running them in a user
namespace. feature.k8s.io/2033
<add links>
Status: Stable
Status: Alpha

57
Cgroups v2
● This feature adds support for cgroups v2 in
Kubernetes.
feature.k8s.io/2254
Status: Stable
Status: Alpha

58
Memory QoS with cgroups v2
● Use the cgroups v2 Linux kernel feature to
implement better memory management
for pods with limits/requests.
feature.k8s.io/2570
Status: Stable
Status: Alpha

59
Node system swap support
● This feature adds swap support to nodes
in a controlled, predictable manner so
that Kubernetes users can perform testing
and provide data to continue building
cluster capabilities on top of swap. feature.k8s.io/2400
Status: Stable
Status: Alpha

60
Enable seccomp by default
● This feature enables seccomp by default
for all workloads running on Kubernetes to
improve the default security of the overall
system. feature.k8s.io/2413
Status: Stable
Status: Alpha

61
CPU Manager Policies
● This feature guarantees that no physical
core is shared among different
containers, which improves cache
efficiency and mitigates the interference
with other workloads that can consume
resources of the same physical core, e.g.
first level caches.
feature.k8s.io/2625
Status: Stable
Status: Alpha

63
Scheduler Component Config API
● This feature provides a configuration API
that allows cluster administrators to build,
validate, and version their configurations
● A beta iteration to v1beta2 in 1.22
updates some plugin functionality and all
v1beta versions are compatible
feature.k8s.io/785
Status: Stable
Status: Beta

64
Prefer Nominated Nodes
● This enhancement can speed up
scheduling by evaluating and scheduling
to a Pod’s nominated node first
● If the nominated node cannot
accommodate the Pod, the scheduling
cycle continues with remaining nodes
feature.k8s.io/1923
Status: Stable
Status: Beta

65
Namespace Selector for Pod Affinity
● The Namespace selector for Pod affinity
graduates to beta in 1.22
● This allows for Pod affinity/anti-affinity
when Namespace names are not known
ahead of time (without this feature they
are specified in a static list).
feature.k8s.io/2249
Status: Stable
Status: Beta

66
Single scoring plugin for Node resources
● Combines existing scoring plugins in the
scheduler into one single plugin with a
ScoringStrategy parameter to specify
which scoring strategy to use
● Reduces complexity and is a step toward
allowing workloads to express resource fit
scoring strategy via Pod spec
feature.k8s.io/2458
Status: Stable
Status: Beta

68
CSIServiceAccountToken
● This feature is a way for for CSI drivers to
access the service account token for
pods which they mount the volumes for.
● Permits drivers to act on the Pod’s behalf
when mounting volumes.
● If you’re looking, the original KEP is
numbered 1855.
feature.k8s.io/2047
Status: Stable
Status: Stable

69
Volume Populator DataSource Redesign
● Originally added in alpha in v1.18.
● This change is an API improvement to the
API to allow things that are not PVCs or
volume snapshots to be data sources in
the future.
feature.k8s.io/1495
Status: Stable
Status: Alpha

70
Delegate FSGroup to CSI Driver instead of Kubelet
● When fsgroup is specified, a mounted
volume is recursively chown/chmod’d
● Kubelet handles this for most volume
plugins, but not all support chmod/chown
● This feature moves this to the CSI driver,
which can apply fsgroup on its mount
feature.k8s.io/2317
Status: Stable
Status: Alpha

71
RWO Pod Access Mode
● This feature adds a ReadWriteOncePod
access mode to persistent volumes.
feature.k8s.io/2485
Status: Stable
Status: Alpha

73
CSI Plugins for Windows
● CSI plugins and related support for
Windows is stable in 1.22
feature.k8s.io/1122
Status: Stable
Status: Stable

74
Windows Privileged Containers
● Some functionality in Kubernetes requires
privileged containers, such as networking,
storage, and device access
● On Windows this has led to workarounds
and special proxies
● This feature provides privileged containers
and host network mode for Windows
feature.k8s.io/1981
Status: Stable
Status: Alpha

76
Release Team Shadow Program
★ Release Team Roles
○ Release Team Lead
○ Enhancements
○ CI Signal
○ Bug Triage
○ Docs
○ Release Notes
○ Communications
★ 1 lead : 3 – 5 shadows
★ ~4 months // weekly workload varies depending on team
★ Release Team Shadows Github repo

Kubernetes 1.22

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Kubernetes 1.22

Similar to Kubernetes 1.22 (20)

More from LibbySchulze

More from LibbySchulze (20)

Recently uploaded

Recently uploaded (20)

Kubernetes 1.22