Kubernetes

Just a dump of notes for my personal reference.

IngressClass

IngressClass replaces kubernetes.io/ingress.class: "nginx" annotations for clusters running multiple ingress controllers. You then use IngressClass name inside of an Ingress, at spec.ingressClassName.

kubectl debug

It lets you troubleshoot running environments using ephemeral containers, mainly useful when you are running a distroless container. E.g.:

kubectl debug -it my-pod --image=busybox:latest --target=web-app

Would run the container busybox inside of the pod my-pod. --target shares the process namespace (PID) of the web-app container so you can see its processes.

You can also copy a crashed pod with --copy-to=... and debug nodes.

Pod Security Admission (PSA)

The namespace labels pod-security.kubernetes.io/enforce, pod-security.kubernetes.io/enforce-version, pod-security.kubernetes.io/warn enforce Pod Security Standards and regulate the action the control plane take if a potential violation is detected.

HorizontalPodAutoscaler (HPA)

HorizontalPodAutoscaler now lets you to have spec.minReplicas: 0. It is interesting for workloads driven by external event streams (e.g. Kafka, queues, etc).

Vertical Pod Autoscaler (VPA)

The VPA automatically optimizes the CPU and memory resource requests and limits for your containers based on actual historical and real-time usage. It is compose of a recommender, an updater, and an admission controller.

In-Place Pod Resource Resizing

Historically, updating container CPU or memory requests/limits in a Pod manifest required terminating and recreating. This feature allows updating resources.requests and resources.limits for running containers on the fly. The underlying Container Runtime Interface (CRI) updates the Linux cgroups directly without killing or restarting the process. This feature allows non-disruptive update policies in the Vertical Pod Autoscaler (VPA).