enhancements VS kubernetes

The motivation is more the latter, but it's not at all clear the proposed removal of the embedded kustomize will proceed, given the compatibility implications. See discussion at https://github.com/kubernetes/enhancements/issues/4706#issue... and following.

(I do see there are some proposed enhancements related to profiles that might help here)

Thanks for these links!

I picked out one at random just to check if my skeptical reaction is fair: https://github.com/kubernetes/enhancements/tree/master/keps/...

- OK, this is actually a really good and useful doc!

- However, it's not an up-front design doc, it has clearly been written after the bulk of the work has been done, to explain and justify rolling out a big change. (See the "implementation history" timeline: https://github.com/kubernetes/enhancements/tree/master/keps/...)

- It looks like the template wasn't very useful; most of the required sections are marked "N/A", and there are comments like The best test for work like this is, more or less, "did it work?"

> was always told early on that although they supported vault on kubernetes via a helm chart, they did not recommend using it on anything but EC2 instances (because of "security" which never really made sense their reasoning).

The reasoning is basically that there are some security and isolation guarantees you don't get in Kubernetes that you do get on bare metal or (to a somewhat lesser extent) in VMs.

In particular for Kubernetes, Vault wants to run as a non-root user and set the IPC_LOCK capability when it starts to prevent its memory from being swapped to disk. While in Docker you can directly enable this by adding capabilities when you launch the container, Kubernetes has an issue because of the way it handles non-root container users specified in a pod manifest, detailed in a (long-dormant) KEP: https://github.com/kubernetes/enhancements/blob/master/keps/... (tl;dr: Kubernetes runs the container process as root, with the specified capabilities added, but then switches it to the non-root UID, which causes the explicitly-added capabilities to be dropped).

You can work around this by rebuilding the container and setting the capability directly on the binary, but the upstream build of the binary and the one in the container image don't come with that set (because the user should set it at runtime if running the container image directly, and the systemd unit sets it via systemd if running as a systemd service, so there's no need to do that except for working around Kubernetes' ambient-capability issue).

> It always surprised me how these conversations went. "Well we don't really recommend kubernetes so we won't support (feature)."

0 is not the request we've defined. And that makes sense. Memory QoS has been in alpha since Kubernetes 1.22 (August 2021) and according to the KEP data was still in alpha as of 1.27.

Note: There's actually a Structured Authentication Config established via KEP-3331. It's in v1.28 as a feature flag gated option and removes the limitation of only having one OIDC provider. I may look into doing an article on it, but for now I'll deal with the issue in a manner that should work even with a bit older versions versions of Kubernetes.

Kubernetes supports a skew policy of n+2 between API server and kubelet. This means if your CP and DP are both on 1.20, you could upgrade your control plane twice (1.20 -> 1.21 -> 1.22) before you need to upgrade your data plane. And when it comes time to upgrade your data plane you can jump from 1.20 to 1.22 to minimize update churn. In the future, this skew will be opened to n+3 https://github.com/kubernetes/enhancements/tree/master/keps/sig-architecture/3935-oldest-node-newest-control-plane

The KEP (Kubernetes Enhancement Proposal) is linked to in the PR [1]. From the summary:

> Sidecar containers are a new type of containers that start among the Init containers, run through the lifecycle of the Pod and don’t block pod termination. Kubelet makes a best effort to keep them alive and running while other containers are running.

[1] https://github.com/kubernetes/enhancements/tree/master/keps/...

This is where the new feature of mutable scheduling directives for jobs comes into play. This feature enables the updating of a job's scheduling directives before it begins. Essentially, it allows custom queue controllers to influence pod placement without needing to directly handle the assignment of pods to nodes themselves. To learn more about this check out the Kubernetes Enhancement Proposal 2926.

What your asking is a (vanilla) Kubernetes non-goal, others have mentioned fluxcd and other add ons that provide primitives for dependency aware deployments. The problem space is so large, that it's unreasonable to to address these concerns in Kubernetes itself, instead, make it extensible... Look at this KEP for example: https://github.com/kubernetes/enhancements/issues/753 Sidecar containers have existed, and been named as such since WAY before that KEP's inception, defining what these things should and shouldn't do is largely arbitrary. Aka: your use-case is niche, if you don't like the behavior, use flux or argo, or write something yourself.

In containerized environments like Kubernetes or Amazon ECS, configuration is often injected as environment variables or mounted as files. Your app starts up with fresh values every time—no rebuilds needed.

The Official Kuberenetes GitHub

Using containerization: Containerization, such as Docker or Kubernetes, can help to simplify the deployment and management of microservices by providing a lightweight and portable way to package and run applications.

The implicit argument is that there's some irreducible non-negotiable project complexity in real-world software, and the explicit argument in the post is that you can either put it into the language/compiler or keep it in wetware.

The supporting argument in the text is that even simple things like downloading a file can get hairy very fast. Networks are complex, HTTP, IPv4/v6, DNS - it's always DNS! - filesystems, permissions, running out of space, computer runs out of battery, etc.

Probably a better argument would be to focus only on application logic (type system, error handling, syntactic-semantic ergonomics) and show that a complex piece of Go [like the k8s persistent volume controller] can be written in a nicer, more maintainable, safer way in Rust.

Of course not all Go code achieves Kubernetes-level complexity. And I think it makes sense to pick the right tool for the job, which is whatever the team/programmer is productive with. (And here productivity is measured based on how well the resulting code/software solves the business case. And basically if there's no need for Rust-level safety/quality/maintainability, or if there's an explicit need for Go-level cheaper hackability, then that's a great result business-wise.)

The important corollary of this is that business requirements tend to change, yet software has inertia and that's roughly how we ended up with insert famously bad software that got wildly popular unexpectedly (for example Windows, Macromedia/Adobe Flash and the infamous plugin, random low-level crap in appliances, and adjacent to that the Bluetooth stack that got rewritten in Rust for Android).

So - of course - for society it would be amazing if software would be better from the start. (Duh!)

https://github.com/kubernetes/kubernetes/blob/60c4c2b2521fb4...

Trends in DevOps and containerization on Kubernetes.

When designing a Go project, look to real-world examples like Kubernetes, Vault and the Golang Standards Project Layout. These showcase how powerful Go can be when the architecture embraces simplicity over rigid structure. Rather than trying to make Go fit a Clean Architecture mold, embrace an architecture that’s as straightforward and efficient as Go itself. This way, you’re building a codebase that’s not only idiomatic but one that’s easier to understand, maintain, and scale.

For more on Dapr, check out Part 1 of our series. You can also learn more about Kubernetes, AWS EKS, and microservices architecture to deepen your understanding of the concepts discussed in this post.

Introduced by Heroku and picked up by Papertrail, logfmt became the go-to for fast, high-volume logs. Kubernetes, Docker, and microservices architectures swear by it. It’s efficient and straight to the point.

Access the repository for code and documentation.