Kubernetes 1.26 What's new?
Tags: kubernetes, devops, docker
Published: 2022-12-01 09:19:05


---
title: Kubernetes 1.26 What's new?
published: true
description: Kubernetes 1.26 will be out next week! - Learn what’s new and what’s deprecated - Admission Controller Policies - Improved volume snapshots - Improved CPUManager - More resource management options… And more!

tags: kubernetes, devops, docker
cover_image: https://sysdig.com/wp-content/uploads/kubernetes-1.26.png
canonical_url: https://sysdig.com/blog/kubernetes-1-26-whats-new/
---

<!-- wp:paragraph -->
<p><strong>Kubernetes 1.26</strong> is about to be released, and it comes packed with novelties! Where do we begin?</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This release brings 37 enhancements, on par with the <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-25-whats-new/" rel="noopener">40 in Kubernetes 1.25</a> and the <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-24-whats-new/" rel="noopener">46 in Kubernetes 1.24</a>. Of those 37 enhancements, 11 are graduating to Stable, 10 are existing features that keep improving, 16 are completely new, and one is a deprecated feature.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Watch out for all the <a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#deprecations">deprecations and removals in this version</a>!</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Two new features stand out in this release that have the potential to <strong>change the way users interact with Kubernetes</strong>: Being able to <a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3294">provisioning volumes with snapshots from other namespaces</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>There are also new features aimed at <strong>high performance workloads</strong>, like science researching or machine learning: Better <a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3545">what physical CPU cores your workloads run on</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Also, other features will make life easier for cluster administrators, like <a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3515">support for OpenAPIv3</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>We are really hyped about this release!</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>There is plenty to talk about, so let's get started with what’s new in Kubernetes 1.25.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="editors">Kubernetes 1.26 – Editor’s pick:</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>These are the features that look most exciting to us in this release (ymmv):</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3><a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3294">#3294</a> Provision volumes from cross-namespace snapshots</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The <em>VolumeSnapshot</em> feature allows Kubernetes users provision volumes from volume snapshots, providing great benefits for users and applications, like enabling database administrators to snapshot a database before any critical operation, or the ability to develop and implement backup solutions.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Starting in Kubernetes 1.26 as an Alpha feature, users will be able to create a <em>PersistentVolumeClaim</em> from a <em>VolumeSnapshot</em> across namespaces, breaking the initial limitation of having both objects in the same namespace.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement comes to eliminate the constraints that prevented users and applications from operating on fundamental tasks, like saving a database checkpoint when applications and services are in different namespaces.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph {"align":"right"} -->
<p class="has-text-align-right"><em><a rel="noopener nofollow noreferrer" target="_blank" href="https://www.linkedin.com/in/v%C3%ADctor-hernando-martin-49836334/">Víctor Hernando</a> - Sr. Technical Marketing Manager at Sysdig</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3><a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3488">#3488</a> CEL for admission control</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Finally, a practical implementation of the validation expression language from Kubernetes 1.25!</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>By defining rules for the admission controller as Kubernetes objects, we can start forgetting about managing webhooks, simplifying the setup of our clusters. Not only that, but implementing <a target="_blank" href="https://sysdig.com/learn-cloud-native/kubernetes-security/kubernetes-security-101/" rel="noopener">Kubernetes security</a> is a bit easier now.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>We love to see these user-friendly improvements. They are the key to keep growing Kubernetes adoption.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph {"align":"right"} -->
<p class="has-text-align-right"><em><a rel="noopener nofollow noreferrer" target="_blank" href="https://www.linkedin.com/in/victorjimenez/">Víctor Jiménez Cerrada</a> - Content Engineering Manager at Sysdig</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3><a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3466">#3466</a> Kubernetes component health SLIs</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Since Kubernetes 1.26, you can configure Service Level Indicator (SLI) metrics for the Kubernetes components binaries. Once you enable them, Kubernetes will expose the SLI metrics in the <code>/metrics/slis</code> endpoint - so you won't need a Prometheus exporter. This can take <a target="_blank" href="https://sysdig.com/blog/kubernetes-monitoring-prometheus/" rel="noopener">Kubernetes monitoring</a> to another level making it easier to create health dashboards and configure PromQL alerts to assure your cluster's stability.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph {"align":"right"} -->
<p class="has-text-align-right"><em><a rel="noopener nofollow noreferrer" target="_blank" href="https://twitter.com/eckelon">Jesús Ángel Samitier</a> - Integrations Engineer at Sysdig</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3><a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#2371">#2371</a> cAdvisor-less, CRI-full container and <em>Pod</em> stats</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Currently, to gather metrics from containers, such as CPU or memory consumed, Kubernetes relies on cAdvisor. This feature presents an alternative, enriching the CRI API to provide all the metrics from the containers, allowing more flexibility and better accuracy. After all, it's the Container Runtime who best knows the behavior of the container.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This feature represents one more step on the roadmap to remove cAdvisor from Kubernetes code. However, during this transition, cAdvisor will be modified not to generate the metrics added to the CRI API, avoiding duplicated metrics with possible different and incoherent values.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph {"align":"right"} -->
<p class="has-text-align-right"><em><a rel="noopener nofollow noreferrer" target="_blank" href="https://twitter.com/maellyssa">David de Torres Huerta</a> – Engineer Manager at Sysdig</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3><a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3063">#3063</a> Dynamic resource allocation</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>This new Kubernetes release introduces a new Alpha feature which will provide extended resource management for advanced hardware. As a cherry on top, it comes with a user-friendly API to describe resource requests. With the increasing demand to process different hardware components, like GPU or FPGA, and the need to set up initialization and cleanup, this new feature will speed up Kubernetes adoption in areas like scientific research or edge computing.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph {"align":"right"} -->
<p class="has-text-align-right"><em><a rel="noopener nofollow noreferrer" target="_blank" href="https://www.linkedin.com/in/javier-martinez-2b2a955/">Javier Martínez</a> - Devops Content Engineer at Sysdig</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3><a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3545">#3545</a> Improved multi-numa alignment in Topology Manager</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>This is yet another feature aimed at high performance workloads, like those involved in scientific computing. We are seeing the new CPU manager taking shape since Kubernetes 1.22 and 1.23, enabling developers to keep their workloads close to where their data is stored in memory, improving performance. Kubernetes 1.26 goes a step further, opening the door to further customizations for this feature. After all, not all workloads and CPU architectures are the same.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The future of HPC on Kubernetes is looking quite promising, indeed.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph {"align":"right"} -->
<p class="has-text-align-right"><em><a rel="noopener nofollow noreferrer" target="_blank" href="https://www.linkedin.com/in/vjjmiras/">Vicente J. Jiménez Miras</a> – Security Content Engineer at Sysdig</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3><a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3335">#3335</a> Allow StatefulSet to control start replica ordinal numbering</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><em>StatefulSets</em> in Kubernetes often are critical backend services, like clustered databases or message queues.<br>This enhancement, seemingly a trivial numbering change, allows for greater flexibility and enables new techniques for rolling cross-namespace or even cross-cluster migrations of the replicas of the <em>StatefulSet</em> <strong>without any downtime</strong>. While the process might seem a bit clunky, involving careful definition of <em>PodDisruptionBudgets</em> and the moving of resources relative to the migrating replica, we can surely envision tools (or existing operators enhancements) that automate these operations for <strong>seamless migrations</strong>, in stark contrast with the cold-migration strategy (shutdown-backup-restore) that is currently possible.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph {"align":"right"} -->
<p class="has-text-align-right"><em><a rel="noopener nofollow noreferrer" target="_blank" href="https://www.linkedin.com/in/danielsimionato/">Daniel Simionato</a> - Security Content Engineer at Sysdig</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3><a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3325">#3325</a> Auth API to get self user attributes</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>This new feature coming to alpha will simplify cluster Administrator's work, especially when they are managing multiple clusters. It will also assist in complex authentication flows, as it lets users query their user information or permissions inside the cluster.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Also, this includes whether you are using a proxy (Kubernetes API server fills in the <code>userInfo</code> after all authentication mechanisms are applied) or impersonating (you receive the details and properties for the user that was impersonated), so you will have your user information in a very easy way.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph {"align":"right"} -->
<p class="has-text-align-right"><em><a rel="noopener nofollow noreferrer" target="_blank" href="https://www.linkedin.com/in/miguelhzbz/">Miguel Hernández</a> - Security Content Engineer at Sysdig</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3><a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3352">#3352</a> Aggregated Discovery</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>This is a tiny change for the users, but one step further on cleaning the Kubernetes internals and improving its performance. Reducing the number of API calls by aggregating them (or at least on the discovery part) is a nice solution to a growing problem. Hopefully, this will provide a small break to cluster administrators.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph {"align":"right"} -->
<p class="has-text-align-right"><em><a rel="noopener nofollow noreferrer" target="_blank" href="https://www.linkedin.com/in/ddok/">Devid Dokash</a> - Content Engineering Intern at Sysdig</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="deprecations">Deprecations</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>A few beta APIs and features have been removed in Kubernetes 1.26, including:</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Deprecated <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/docs/reference/using-api/deprecation-guide/#v1-25">API versions</a></strong> that are no longer served, and you should use a newer one:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>CRI <code>v1alpha2</code>, use <code>v1</code> (<em>containerd</em> version 1.5 and older are not supported).</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><code>flowcontrol.apiserver.k8s.io/v1beta1</code>, use <code>v1beta2</code>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><code>autoscaling/v2beta2</code>, use <code>v2</code>.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Deprecated</strong>. Implement an alternative before the next release goes out:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>In-tree GlusterFS driver.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><code>kubectl --prune-whitelist</code>, use <code>--prune-allowlist</code> instead.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><code>kube-apiserver --master-service-namespace</code>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Several unused options for <code>kubectl run</code>: <code>--cascade</code>, <code>--filename</code>, <code>--force</code>, <code>--grace-period</code>, <code>--kustomize</code>, <code>--recursive</code>, <code>--timeout</code>, <code>--wait</code>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>CLI flag <code>pod-eviction-timeout</code>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>The <code>apiserver_request_slo_duration_seconds</code> metric, use <code>apiserver_request_sli_duration_seconds</code>.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Removed</strong>. Implement an alternative before upgrading:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Legacy authentication for Azure and Google Cloud is deprecated.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>The <code>userspace</code> proxy mode.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Dynamic <em>kubelet</em> configuration.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Several <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-23-whats-new/#2845" rel="noopener">command line arguments related to logging</a>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>in-tree OpenStack (<code>cinder</code> volume type), use <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/cloud-provider-openstack">the CSI driver</a>.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Other changes</strong> you should adapt your configs for:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Pod Security admission: the pod-security <code>warn</code> level will now default to the <code>enforce</code> level.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>kubelet: The default <code>cpuCFSQuotaPeriod</code> value with the <code>cpuCFSQuotaPeriod</code> flag enabled is now 100µs instead of 100ms.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>kubelet: The <code>--container-runtime-endpoint</code> flag cannot be empty anymore.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>kube-apiserver: gzip compression switched from level 4 to level 1.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Metrics: Changed <code>preemption_victims</code> from <code>LinearBuckets</code> to <code>ExponentialBuckets</code>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Metrics: <code>etcd_db_total_size_in_bytes</code> is renamed to <code>apiserver_storage_db_total_size_in_bytes</code>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Metrics: <code>kubelet_kubelet_credential_provider_plugin_duration</code> is renamed <code>kubelet_credential_provider_plugin_duration</code>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Metrics: <code>kubelet_kubelet_credential_provider_plugin_errors</code> is renamed <code>kubelet_credential_provider_plugin_errors</code>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Removed Windows Server, Version 20H2 flavors from various container images.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>The e2e.test binary no longer emits JSON structs to document progress.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>You can check the full list of changes in the <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md">Kubernetes 1.26 release notes</a>. Also, we recommend the <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/blog/2022/11/18/upcoming-changes-in-kubernetes-1-26/">Kubernetes Removals and Deprecations In 1.26</a> article, as well as keeping the <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/docs/reference/using-api/deprecation-guide/">deprecated API migration guide</a> close for the future.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="281"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/281">#281</a> Dynamic Kubelet configuration</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Feature group:</strong> node</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>After being in beta since Kubernetes 1.11, the Kubernetes team <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/kubernetes/issues/100799">has decided</a> to deprecate <code>DynamicKubeletConfig</code> instead of continuing its development.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This feature was marked for deprecation in 1.21, then removed from the Kubelet in 1.24. Now in 1.26, it has been <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/pull/3605/files#diff-138ec4a122ef9ea3b885191796faf63ca6511747e4be18840dd67ffa2a386d1d">completely removed from Kubernetes</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="api">Kubernetes 1.26 API</h2>
<!-- /wp:heading -->

<!-- wp:heading {"level":3} -->
<h3 id="3352"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3352">#3352</a> Aggregated discovery</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> api-machinery<br><strong>Feature gate:</strong> <code>AggregatedDiscoveryEndpoint</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Every Kubernetes client like <code>kubectl</code> needs to discover what APIs and versions of those APIs are available in the <code>kubernetes-apiserver</code>. For that, they need to make a request per each API and version, which causes a storm of requests.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement aims to reduce all those calls to just two.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Clients can include <code>as=APIGroupDiscoveryList</code> to the <code>Accept</code> field of their requests to the <code>/api</code> and <code>/apis</code> endpoints. Then, the server will return an aggregated document (<code>APIGroupDiscoveryList</code>) with all the available APIs and their versions.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3488"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3488">#3488</a> CEL for admission control</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> api-machinery</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Feature gate:</strong> <code>ValidatingAdmissionPolicy</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Building on <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-25-whats-new/#2876" rel="noopener">#2876 CRD validation expression language</a> from Kubernetes 1.25, this enhancement provides a new admission controller type (<code>ValidatingAdmissionPolicy</code>) that allows implementing some validations without relying on webhooks.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>These new policies can be defined like:</p>
<!-- /wp:paragraph -->

<!-- wp:code {"language":"yaml"} -->
<pre class="wp-block-code"><code> apiVersion: admissionregistration.k8s.io/v1alpha1
 kind: ValidatingAdmissionPolicy
 metadata:
   name: "demo-policy.example.com"
 Spec:
   failurePolicy: Fail
   matchConstraints:
     resourceRules:
     - apiGroups:   &#91;"apps"]
       apiVersions: &#91;"v1"]
       operations:  &#91;"CREATE", "UPDATE"]
       resources:   &#91;"deployments"]
   validations:
     - expression: "object.spec.replicas &lt;= 5"
</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>This policy would deny requests for some deployments with <code>5</code> replicas or less.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Discover the full power of this feature <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/website/blob/9a8c421c1e18dd9485788f1ffc23944c41e91483/content/en/docs/reference/access-authn-authz/validating-admission-policy.md">in the docs</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="1965"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/1965">#1965</a> <em>kube-apiserver</em> identity</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> api-machinery<br><strong>Feature gate:</strong> <code>APIServerIdentity</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In order to better control which <em>kube-apiservers</em> are alive in a high availability cluster, a new lease / heartbeat system has been implemented.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-20/#1965" rel="noopener">What's new in Kubernetes 1.20</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="apps">Apps in Kubernetes 1.26</h2>
<!-- /wp:heading -->

<!-- wp:heading {"level":3} -->
<h3 id="3017"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3017">#3017</a> <em>PodHealthyPolicy</em> for <em>PodDisruptionBudget</em></h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> apps<br><strong>Feature gate:</strong> <code>PDBUnhealthyPodEvictionPolicy</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>A <em><a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/docs/tasks/run-application/configure-pdb/">PodDisruptionBudget</a></em> allows you to communicate some minimums to your cluster administrator to make maintenance tasks easier, like "Do not destroy more than one of these" or "Keep at least two of these alive".</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>However, this only takes into account if the pods are running, not if they are healthy. It may happen that your pods are Running but not Ready, and a <em>PodDisruptionBudget</em> may be preventing its eviction.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement expands these budget definitions with the <code>status.currentHealthy</code>, <code>status.desiredHealthy</code>, and <code>spec.unhealthyPodEvictionPolicy</code> extra fields to help you define how to manage unhealthy pods.</p>
<!-- /wp:paragraph -->

<!-- wp:code {"language":"yaml"} -->
<pre class="wp-block-code"><code>$ kubectl get poddisruptionbudgets example-pod
apiVersion: policy/v1
kind: PodDisruptionBudget
&#91;...]
status:
  currentHealthy: 3
  desiredHealthy: 2
  disruptionsAllowed: 1
  expectedPods: 3
  observedGeneration: 1
  unhealthyPodEvictionPolicy: IfHealthyBudget
</code></pre>
<!-- /wp:code -->

<!-- wp:heading {"level":3} -->
<h3 id="3335"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3335">#3335</a> Allow <em>StatefulSet</em> to control start replica ordinal numbering</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> apps<br><strong>Feature gate:</strong> <code>StatefulSetStartOrdinal</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>StatefulSets</em> in Kubernetes currently number their pods using ordinal numbers, with the first replica being <code>0</code> and the last being <code>spec.replicas</code>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement adds a new struct with a single field to the <em>StatefulSet</em> manifest spec,<code> spec.ordinals.start</code>, which allows to define the starting number for the replicas controlled by the <em>StatefulSet</em>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This is useful, for example, in cross-namespace or cross-cluster migrations of <em>StatefulSet</em>, where a clever use of <em>PodDistruptionBudgets</em> (and multi-cluster services) can allow a controlled rolling migration of the replicas avoiding any downtime to the <em>StatefulSet</em>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3329"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3329">#3329</a> Retriable and non-retriable <em>Pod</em> failures for <em>Jobs</em></h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> apps<br><strong>Feature gate:</strong> <code>JobPodFailurePolicy</code> <strong>Default value:</strong> <code>true<br><strong>Feature gate:</strong></code> <code>PodDisruptionsCondition</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement allows us to configure a <code>.spec.podFailurePolicy</code> on the <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/docs/concepts/workloads/controllers/job/">Jobs</a>'s spec that determines whether the Job should be retried or not in case of failure. This way, Kubernetes can terminate Jobs early, avoiding increasing the backoff time in case of infrastructure failures or application errors.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-25-whats-new/#3329" rel="noopener">What's new in Kubernetes 1.25</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="2307"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/2307">#2307</a> <em>Job</em> tracking without lingering <em>Pods</em></h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> apps<br><strong>Feature gate:</strong> <code>JobTrackingWithFinalizers</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>With this enhancement, Jobs will be able to remove completed pods earlier, freeing resources in the cluster.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-22-whats-new/#2307" rel="noopener">Kubernetes 1.22 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="auth">Kubernetes 1.26 Auth</h2>
<!-- /wp:heading -->

<!-- wp:heading {"level":3} -->
<h3 id="3325"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3325">#3325</a> Auth <em>API</em> to get self user attributes</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> auth<br><strong>Feature gate:</strong> <code>APISelfSubjectAttributesReview</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This new feature is extremely useful when a complicated authentication flow is used in a Kubernetes cluster, and you want to know all your <code>userInfo</code>, after all authentication mechanisms are applied.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Executing <code>kubectl alpha auth whoami</code> will produce the following output:</p>
<!-- /wp:paragraph -->

<!-- wp:code {"language":"yaml"} -->
<pre class="wp-block-code"><code>apiVersion: authentication.k8s.io/v1alpha1
kind: SelfSubjectReview
status:
  userInfo:
    username: jane.doe
    uid: b79dbf30-0c6a-11ed-861d-0242ac120002
    groups:
    - students
    - teachers
    - system:authenticated
    extra:
      skills:
      - reading
      - learning
      subjects:
      - math
      - sports
</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>In summary, we are now allowed to do a typical <em>/me</em> to know our own permissions once we are authenticated in the cluster.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="2799"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/2799">#2799</a> Reduction of secret-based service account tokens</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> auth<br><strong>Feature gate:</strong> <code>LegacyServiceAccountTokenNoAutoGeneration</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>API credentials are now obtained through the <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/">TokenRequest API</a>, are stable since <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-22-whats-new/#542" rel="noopener">Kubernetes 1.22</a>, and are mounted into Pods using a projected volume. They will be automatically invalidated when their associated Pod is deleted.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-24-whats-new/#2799" rel="noopener">Kubernetes 1.24 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="network">Network in Kubernetes 1.26</h2>
<!-- /wp:heading -->

<!-- wp:heading {"level":3} -->
<h3 id="3453"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3453">#3453</a> Minimizing <em>iptables-restore</em> input size</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> network<br><strong>Feature gate:</strong> <code>MinimizeIPTablesRestore</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement aims to improve the performance of <code>kube-proxy</code>. It will do so by only sending the rules that have changed on the calls to <code>iptables-restore</code>, instead of the whole set of rules.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="1669"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/1669">#1669</a> <em>Proxy</em> terminating endpoints</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> network<br><strong>Feature gate:</strong> <code>ProxyTerminatingEndpoints</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement prevents traffic drops during rolling updates by sending all external traffic to both ready and not ready terminating endpoints (preferring the ready ones).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-22-whats-new/#1669" rel="noopener">Kubernetes 1.22 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="2595"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/2595">#2595</a> Expanded DNS configuration</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> network<br><strong>Feature gate:</strong> <code>ExpandedDNSConfig</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>With this enhancement, Kubernetes allows up to 32 DNS in the search path, and an increased number of characters for the search path (up to 2048), to keep up with recent DNS resolvers.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-22-whats-new/#2595" rel="noopener">Kubernetes 1.22 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="1435"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/1435">#1435</a> Support of mixed protocols in <em>Services</em> with <em>type=LoadBalancer</em></h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> network<br><strong>Feature gate:</strong> <code>MixedProtocolLBService</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement allows a LoadBalancer Service to serve different protocols under the same port (UDP, TCP). For example, serving both UDP and TCP requests for a DNS or SIP server on the same port.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-20/#1435" rel="noopener">Kubernetes 1.20 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="2086"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/2086">#2086</a> Service internal traffic policy</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> network<br><strong>Feature gate:</strong> <code>ServiceInternalTrafficPolicy</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>You can now set the <code>spec.trafficPolicy</code> field on <code>Service</code> objects to optimize your cluster traffic:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>With <code>Cluster</code>, the routing will behave as usual.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>When set to <code>Topology</code>, it will use <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-21-whats-new/#2433" rel="noopener">the topology-aware routing</a>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>With <code>PreferLocal</code>, it will redirect traffic to services on the same node.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>With <code>Local</code>, it will only send traffic to services on the same node.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-21-whats-new/#2086" rel="noopener">Kubernetes 1.21 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3070"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3070">#3070</a> Reserve service IP ranges for dynamic and static IP allocation</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> network<br><strong>Feature gate:</strong> <code>ServiceIPStaticSubrange</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This update to the <code>--service-cluster-ip-range</code> flag will lower the risk of having IP conflicts between Services using static and dynamic IP allocation, and at the same time, keep the compatibility backwards.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-24-whats-new/#3070" rel="noopener">What's new in Kubernetes 1.24</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="nodes">Kubernetes 1.26 Nodes</h2>
<!-- /wp:heading -->

<!-- wp:heading {"level":3} -->
<h3 id="2371"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/2371">#2371</a> cAdvisor-less, CRI-full container and Pod stats</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Major change to Alpha<br><strong>Feature group:</strong> node<br><strong>Feature gate:</strong> <code>PodAndContainerStatsFromCRI <strong>Default value: </strong>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement summarizes the efforts to retrieve all the stats about running containers and pods from the <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/blog/2016/12/container-runtime-interface-cri-in-kubernetes/">Container Runtime Interface (CRI)</a>, removing the dependencies from cAdvisor.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Starting with 1.26, the metrics on <code>/metrics/cadvisor</code> are gathered by CRI instead of cAdvisor.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-23-whats-new/#2371" rel="noopener">Kubernetes 1.23 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3063"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3063">#3063</a> Dynamic resource allocation</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> node<br><strong>Feature gate:</strong> <code>DynamicResourceAllocation</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Traditionally, the Kubernetes scheduler could only take into account <a target="_blank" href="https://sysdig.com/blog/kubernetes-limits-requests/" rel="noopener">CPU and memory limits and requests</a>. Later on, the scheduler was expanded to also take storage and other resources into account. However, this is limiting in many scenarios.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>For example, what if the device needs initialization and cleanup, like an FPGA; or what if you want to limit the access to the resource, like a shared GPU?</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This new API covers those scenarios of resource allocation and dynamic detection, using the new <code>ResourceClaimTemplate</code> and <code>ResourceClass</code> objects, and the new <code>resourceClaims</code> field inside <em>Pods</em>.</p>
<!-- /wp:paragraph -->

<!-- wp:code {"language":"yaml"} -->
<pre class="wp-block-code"><code>apiVersion: v1
 kind: Pod
&#91;...]
 spec:
   resourceClaims:
   - name: resource0
     source:
       resourceClaimTemplateName: resource-claim-template
   - name: resource1
     source:
       resourceClaimTemplateName: resource-claim-template
&#91;...]
</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>The scheduler can keep track of these resource claims, and only schedule <em>Pods</em> in those nodes with enough resources available.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3386"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3386">#3386</a> Kubelet evented <em>PLEG</em> for better performance</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> node<br><strong>Feature gate:</strong> <code>EventedPLEG</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The aim of this enhancement is to reduce the CPU usage of the <code>kubelet</code> when keeping track of all the pod states.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It will partially reduce the periodic polling that the <code>kubelet</code> performs, instead relying on notifications from the Container Runtime Interface (CRI) as much as possible.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>If you are interested in the implementation details, you may want to <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/3386-kubelet-evented-pleg/README.md">take a look at the KEP</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3545"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3545">#3545</a> Improved <em>multi-NUMA</em> alignment in topology manager</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> node<br><strong>Feature gate:</strong> <code>TopologyManagerPolicyOptions</code> <strong>Default value:</strong> <code>false<br><strong>Feature gate:</strong></code> <code>TopologyManagerPolicyBetaOptions</code> <strong>Default value:</strong> <code>false</code><br><strong>Feature gate:</strong> <code>TopologyManagerPolicyAlphaOptions</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This is an improvement for <em>TopologyManager</em> to better handle Non-Uniform Memory Access (<a rel="noopener nofollow noreferrer" target="_blank" href="https://en.wikipedia.org/wiki/Non-uniform_memory_access">NUMA</a>) nodes. For some high-performance workloads, it is very important to control in which physical CPU cores they run. You can significantly improve performance if you avoid memory jumping between the caches of the same chip, or between sockets.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>A new <code>topology-manager-policy-options</code> flag for <code>kubelet</code> will allow you to pass options and modify the behavior of a topology manager.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Currently, only one alpha option is available:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>When <code>prefer-closest-numa-nodes=true</code> is passed along, the Topology Manager will align the resources on either a single NUMA node or the minimum number of NUMA nodes possible.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>As new options may be added in the future, several feature gates have been added so you can choose to focus only on the stable ones:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li><code>TopologyManagerPolicyOptions</code>: Will enable the <code>topology-manager-policy-options</code> flag and the stable options.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><code>TopologyManagerPolicyBetaOptions</code>: Will also enable the beta options.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><code>TopologyManagerPolicyAlphaOptions</code>: Will also enable the alpha options.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>Related:</strong> <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-23-whats-new/#2902" rel="noopener">#2902 CPUManager policy option to distribute CPUs across NUMA nodes in Kubernetes 1.23</a>.<br><strong>Related:</strong> <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-22-whats-new/#2625" rel="noopener">#2625 New CPU Manager Policies in Kubernetes 1.22</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="2133"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/2133">#2133</a> Kubelet credential provider</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> node<br><strong>Feature gate:</strong> <code>KubeletCredentialProviders</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement replaces in-tree container image registry credential providers with a new mechanism that is external and pluggable.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-20/#2133" rel="noopener">Kubernetes 1.20 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3570"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3570">#3570</a> Graduate to <em>CPUManager</em> to GA</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> node<br><strong>Feature gate:</strong> <code>CPUManager</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The CPUManager is the Kubelet component responsible for assigning pod containers to sets of CPUs on the local node.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It was introduced in Kubernetes 1.8, and graduated to beta in release 1.10. For 1.26, the core CPUManager has been deemed stable, while experimentation continues with the additional work on its policies.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Related:</strong> <a href="http://sysdig.com/blog/kubernetes-1-26-whats-new/#3545">#3545 Improved multi-numa alignment in Topology Manager in Kubernetes 1.26</a>.<br><strong>Related:</strong> <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-22-whats-new/#2625" rel="noopener">#2625 New CPU Manager Policies in Kubernetes 1.22</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3573"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3573">#3573</a> Graduate <em>DeviceManager</em> to GA</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> node<br><strong>Feature gate:</strong> <code>DevicePlugins</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The DeviceManager in the Kubelet is the component managing the interactions with the different Device Plugins.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Initially introduced in Kubernetes 1.8 and moved to beta stage in release 1.10, the Device Plugin framework saw widespread adoption and is finally moving to GA in 1.26.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This framework allows the use of external devices (e.g., <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/NVIDIA/k8s-device-plugin">NVIDIA GPUs</a>, <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/RadeonOpenCompute/k8s-device-plugin">AMD GPUS</a>, <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/k8snetworkplumbingwg/sriov-network-device-plugin">SR-IOV NICs</a>) without modifying core Kubernetes components.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="scheduling">Scheduling in Kubernetes 1.26</h2>
<!-- /wp:heading -->

<!-- wp:heading {"level":3} -->
<h3 id="3521"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3521">#3521</a> <em>Pod</em> scheduling readiness</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> scheduling<code><br><strong>Feature gate:</strong></code> <code>PodSchedulingReadiness</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement aims to optimize scheduling by letting the Pods define when they are ready to be actually scheduled.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Not all <a target="_blank" href="https://sysdig.com/blog/kubernetes-pod-pending-problems/" rel="noopener">pending Pods</a> are ready to be scheduled. Some stay in a <code>miss-essential-resources</code> state for some time, which causes extra work in the scheduler.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The new <code>.spec.schedulingGates</code> of a Pod allows to identify when they are ready for scheduling:</p>
<!-- /wp:paragraph -->

<!-- wp:code {"language":"yaml"} -->
<pre class="wp-block-code"><code>apiVersion: v1
 kind: Pod
&#91;...]
 spec:
   schedulingGates:
   - name: foo
   - name: bar
&#91;...]
</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>When any scheduling gate is present, the Pod won't be scheduled.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>You can check the status with:</p>
<!-- /wp:paragraph -->

<!-- wp:code {"language":"yaml"} -->
<pre class="wp-block-code"><code>$ kubectl get pod test-pod
 NAME       READY   STATUS            RESTARTS   AGE
 test-pod   0/1     SchedulingGated   0          7s
</code></pre>
<!-- /wp:code -->

<!-- wp:heading {"level":3} -->
<h3 id="3094"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3094">#3094</a> Take taints/tolerations into consideration when calculating <em>PodTopologySpread</em> skew</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> scheduling<br><strong>Feature gate:</strong> <code>NodeInclusionPolicyInPodTopologySpread</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>As we discussed in our "<a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-16/#895" rel="noopener">Kubernetes 1.16 - What's new?</a>" article, the <code>topologySpreadConstraints</code> fields, along with <code>maxSkew</code>, allow you to spread your workloads across nodes. A new <code>NodeInclusionPolicies</code> field allows taking into account <code>NodeAffinity</code> and <code>NodeTaint</code> when calculating this pod topology spread skew.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-25-whats-new/#3094" rel="noopener">What's new in Kubernetes 1.25</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="storage">Kubernetes 1.26 storage</h2>
<!-- /wp:heading -->

<!-- wp:heading {"level":3} -->
<h3 id="3294"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3294">#3294</a> Provision volumes from cross-namespace snapshots</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> storage<br><strong>Feature gate:</strong> <code>CrossNamespaceVolumeDataSource</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Prior to Kubernetes 1.26, users were able to provision volumes from snapshots thanks to the <code>VolumeSnapshot</code> feature. While this is a great and super useful feature. it had some limitations, like the inability to bind a <code>PersistentVolumeClaim</code> to <code>VolumeSnapshots</code> from other namespaces.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement breaks this limitation and allows Kubernetes users to provision volumes from snapshots across namespaces.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>If you want to use the cross-namespace VolumeSnapshot feature, you’ll have to first create a <code>ReferenceGrant</code> object, and then a <code>PersistentVolumeClaim</code> binding to the <code>VolumeSnapshot</code>. Here, you’ll find a simple example of both objects for learning purposes.</p>
<!-- /wp:paragraph -->

<!-- wp:code {"language":"yaml"} -->
<pre class="wp-block-code"><code>---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: ReferenceGrant
metadata:
  name: test
  namespace: default
spec:
  from:
  - group: ""
    kind: PersistentVolumeClaim
    namespace: nstest1
  to:
  - group: snapshot.storage.k8s.io
    kind: VolumeSnapshot
    name: testsnapshot
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: testvolumeclaim
  namespace: nstest1
spec:
  storageClassName: mystorageclass
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  dataSourceRef2:
    apiGroup: snapshot.storage.k8s.io
    kind: VolumeSnapshot
    name: testsnapshot
    namespace: default
  volumeMode: Filesystem
</code></pre>
<!-- /wp:code -->

<!-- wp:heading {"level":3} -->
<h3 id="2268"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/2268">#2268</a> Non-graceful node shutdown</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> storage<br><strong>Feature gate:</strong> <code>NodeOutOfServiceVolumeDetach</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement addresses node shutdown cases that are not detected properly, where the pods that are part of a <em>StatefulSet</em> will be stuck in terminating status on the shutdown node and cannot be moved to a new running node.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The pods will be forcefully deleted in this case, trigger the deletion of the <em>VolumeAttachments</em>, and new pods will be created on a different running node so that application can continue to function.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-24-whats-new/#2268" rel="noopener">Kubernetes 1.24 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3333"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3333">#3333</a> Retroactive default <em>StorageClass</em> <em>assignement</em></h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> storage<br><strong>Feature gate:</strong> <code>RetroactiveDefaultStorageClass</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement helps manage the case when cluster administrators change the default storage class. All <em>PVCs</em> without <em>StorageClass</em> that were created while the change took place will retroactively be set to the new default <em>StorageClass</em>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-25-whats-new/#3333" rel="noopener">What's new in Kubernetes 1.25</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="1491"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/1491">#1491</a> vSphere <em>in-tree</em> to CSI driver migration</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> storage<br><strong>Feature gate:</strong> <code>CSIMigrationvSphere</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>As we covered in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-23-whats-new/#1487" rel="noopener">What's new in Kubernetes 1.19</a>" article, the CSI driver for vSphere has been stable for some time. Now, all plugin operations for <code>vspherevolume</code> are now redirected to <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes-sigs/vsphere-csi-driver">the out-of-tree 'csi.vsphere.vmware.com' driver</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement is part of the <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-25-whats-new/#625" rel="noopener">#625 In-tree storage plugin to CSI Driver Migration</a> effort.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="1885"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/1885">#1885</a> Azure file <em>in-tree</em> to CSI driver migration</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> storage<br><strong>Feature gate:</strong> <code>InTreePluginAzureDiskUnregister</code> <strong>Default value:</strong> <code>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement summarizes <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/docs/concepts/storage/volumes/#azurefile">the work to move Azure File code</a> out of the main Kubernetes binaries (out-of-tree).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-21-whats-new/#1885" rel="noopener">Kubernetes 1.21 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="2317"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/2317">#2317</a> Allow Kubernetes to supply pod's <em>fsgroup</em> to CSI driver on mount</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> storage<br><strong>Feature gate:</strong> <code>DelegateFSGroupToCSIDriver <strong>Default value: </strong>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement proposes providing the CSI driver with the <em>fsgroup</em> of the pods as an explicit field, so the CSI driver can be the one applying this natively on mount time.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-22-whats-new/#2317" rel="noopener">Kubernetes 1.22 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="other">Other enhancements in Kubernetes 1.26</h2>
<!-- /wp:heading -->

<!-- wp:heading {"level":3} -->
<h3 id="3466"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3466">#3466</a> Kubernetes component health SLIs</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> instrumentation<br><strong>Feature gate:</strong> <code>ComponentSLIs</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>There isn't a standard format to query the health data of Kubernetes components.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Starting with Kubernetes 1.26, a new endpoint <code>/metrics/slis</code> will be available on each component exposing their Service Level Indicator (SLI) metrics in Prometheus format.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>For each component, two metrics will be exposed:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>A <strong>gauge</strong>, representing the current state of the healthcheck.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>A <strong>counter</strong>, recording the cumulative counts observed for each healthcheck state.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>With this information, you can check the overtime status for the Kubernetes internals, e.g.:</p>
<!-- /wp:paragraph -->

<!-- wp:code {"language":"bash"} -->
<pre class="wp-block-code"><code>kubernetes_healthcheck{name="etcd",type="readyz"}</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>And create an alert for when something's wrong, e.g.:</p>
<!-- /wp:paragraph -->

<!-- wp:code {"language":"bash"} -->
<pre class="wp-block-code"><code>kubernetes_healthchecks_total{name="etcd",status="error",type="readyz"} &gt; 0</code></pre>
<!-- /wp:code -->

<!-- wp:heading {"level":3} -->
<h3 id="3498"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3498">#3498</a> Extend metrics stability</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> instrumentation<br><strong>Feature gate:</strong> N/A</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Metrics in Kubernetes are classified as <code>alpha</code> or <code>stable</code>. The <code>stable</code> ones are guaranteed to be maintained, providing you with the information to prepare your dashboards so they don't break unexpectedly when you upgrade your cluster.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In Kubernetes 1.26, two new classes are added:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li><code>beta</code>: For metrics related to beta features. They may change or disappear, but they are in a more advanced development state than the alpha ones.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><code>internal</code>: Metrics for internal usage that you shouldn't worry about, either because they don't provide useful information for cluster administrators, or because they may change without notice.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>You can check a full <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/docs/reference/instrumentation/metrics/">list of available metrics in the documentation</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Related:</strong> <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-21-whats-new/#1209" rel="noopener">#1209 Metrics stability enhancement in Kubernetes 1.21</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3515"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3515">#3515</a> OpenAPI v3 for <em>kubectl</em> explain</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> cli<br><strong>Environment variable:</strong> <code>KUBECTL_EXPLAIN_OPENAPIV3</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement allows <code>kubectl explain</code> to gather the data from OpenAPIv3 instead of v2.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In OpenAPIv3, some data can be represented in a better way, like <em>CustomResourceDefinition</em>s (CDRs).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Internal work is also being made to improve how <code>kubectl explain</code> prints the output.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Related:</strong> <a target="_blank" href="https://sysdig.com/blog/kubernetes-1-24-whats-new/#2896" rel="noopener">#2896 OpenAPI v3 in Kubernetes 1.24</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="1440"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/1440">#1440</a> <em>kubectl</em> events</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> cli<br><strong>Feature gate:</strong> N/A</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>A new <code>kubectl events</code> command is available that will enhance the current functionality of <code>kubectl get events</code>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-23-whats-new/#1440" rel="noopener">Kubernetes 1.23 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3031"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3031">#3031</a> Signing release artifacts</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Beta<br><strong>Feature group:</strong> release<br><strong>Feature gate:</strong> N/A</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement introduces a unified way to sign artifacts in order to help avoid <a target="_blank" href="https://sysdig.com/blog/software-supply-chain-security/" rel="noopener">supply chain attacks</a>. It relies on the <a rel="noopener nofollow noreferrer" target="_blank" href="https://www.sigstore.dev/">sigstore</a> project tools, and more specifically <code><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/sigstore/cosign">cosign</a></code>. Although it doesn’t add new functionality, it will surely help to keep our cluster more protected.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-24-whats-new/#3031" rel="noopener">Kubernetes 1.24 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="3503"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/3503">#3503</a> Host network support for Windows pods</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Net new to Alpha<br><strong>Feature group:</strong> windows<br><strong>Feature gate:</strong> <code>WindowsHostNetwork</code> <strong>Default value:</strong> <code>false</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>There is a weird situation in Windows pods where you can set <code>hostNetwork=true</code> for them, but it doesn't change anything. There isn't any platform impediment, the implementation was just missing.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Starting with Kubernetes 1.26, the <code>kubelet</code> can now request that Windows pods use the host's network namespace instead of creating a new pod network namespace.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This will come handy to avoid port exhaustion where there's large amounts of services.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 id="1981"><a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/enhancements/issues/1981">#1981</a> Support for Windows privileged containers</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>Stage:</strong> Graduating to Stable<br><strong>Feature group:</strong> windows<br><strong>Feature gate:</strong> <code>WindowsHostProcessContainers <strong>Default value: </strong>true</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enhancement brings the <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/docs/concepts/workloads/pods/#privileged-mode-for-containers">privileged containers</a> feature available in Linux to Windows hosts.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Privileged containers have access to the host, as if they were running directly on it. Although they are not recommended for most of the workloads, they are quite useful for administration, security, and monitoring purposes.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more in our "<a target="_blank" href="https://sysdig.com/blog/kubernetes-1-22-whats-new/#1981" rel="noopener">Kubernetes 1.22 - What's new?</a>" article.</p>
<!-- /wp:paragraph -->

<!-- wp:separator -->
<hr class="wp-block-separator has-alpha-channel-opacity"/>
<!-- /wp:separator -->

<!-- wp:paragraph -->
<p>That’s all for Kubernetes 1.26, folks! Exciting as always; get ready to upgrade your clusters if you are intending to use any of these features.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>If you liked this, you might want to check out our previous ‘What’s new in Kubernetes’ editions:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/kubernetes-1-26-whats-new/" rel="noopener">Kubernetes 1.26 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/kubernetes-1-25-whats-new/" rel="noopener">Kubernetes 1.25 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/kubernetes-1-24-whats-new/" rel="noopener">Kubernetes 1.24 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/kubernetes-1-23-whats-new/" rel="noopener">Kubernetes 1.23 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/kubernetes-1-22-whats-new/" rel="noopener">Kubernetes 1.22 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/kubernetes-1-21-whats-new/" rel="noopener">Kubernetes 1.21 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-20/" rel="noopener">Kubernetes 1.20 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-19/" rel="noopener">Kubernetes 1.19 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-18/" rel="noopener">Kubernetes 1.18 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-17/" rel="noopener">Kubernetes 1.17 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-16/" rel="noopener">Kubernetes 1.16 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-15/" rel="noopener">Kubernetes 1.15 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/whats-new-kubernetes-1-14/" rel="noopener">Kubernetes 1.14 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/whats-new-in-kubernetes-1-13" rel="noopener">Kubernetes 1.13 - What's new?</a></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><a target="_blank" href="https://sysdig.com/blog/whats-new-in-kubernetes-1-12" rel="noopener">Kubernetes 1.12 - What's new?</a></li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Get involved in the Kubernetes community:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Visit <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io">the project homepage</a>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Check out <a rel="noopener nofollow noreferrer" target="_blank" href="https://github.com/kubernetes/">the Kubernetes project on GitHub</a>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Get involved <a rel="noopener nofollow noreferrer" target="_blank" href="https://kubernetes.io/community/">with the Kubernetes community</a>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Meet the maintainers <a rel="noopener nofollow noreferrer" target="_blank" href="https://slack.k8s.io">on the Kubernetes Slack</a>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Follow <a rel="noopener nofollow noreferrer" target="_blank" href="https://twitter.com/kubernetesio">@KubernetesIO on Twitter</a>.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>And if you enjoy keeping up to date with the Kubernetes ecosystem, <a target="_blank" href="https://go.sysdig.com/container-newsletter-signup.html" rel="noopener">subscribe to our container newsletter</a>, a monthly email with the coolest stuff happening in the cloud-native ecosystem.</p>
<!-- /wp:paragraph -->