[Security Advisory] CVE-2024-9042: Kubernetes Command Injection affecting Windows nodes via nodes/*/logs/query API
1_r/devopsish
Last Week in Kubernetes Development - Week Ending January 12 2025
Week Ending January 12, 2025
https://lwkd.info/2025/20250115
Developer News
Dims has requested that all SIGs review their Alpha and Beta features for ones that are “stuck” and need to advance or be removed.
The Kubernetes Github account now has access to a few new Github Issue features; sub-issues and advanced search seem particularly useful for us.
Maintainer Track submissions for Kubecon China are now open. The main track CfPs for India and Japan are also open.
Release Schedule
Next Deadline: Production Readiness Freeze, February 6
The full Release Schedule is being finalized by Release Lead Nina Polshakova. Major dates are: PRR Freeze, Feb 6; Enhancements Freeze, Feb 13; Code Freeze, March 6; release April 16th.
The January Patch Releases have been delayed until next week.
Featured PRs
129543: DRA API: bump maximum size of ReservedFor to 256
This PR increases the maximum size of the ReservedFor field in the DRA API from 32 to 256 to accommodate larger workloads, such as those involving shared non-local resources like interconnect channels. This change addresses use cases like NVIDIA GB200 and Google TPU, where a higher limit is necessary for workloads spanning multiple nodes. Warning: downgrades to Kubernetes 1.32 may be impacted if ResourceClaims exceed 256.
Other Merges
kubelet to use env vars in node log query PS command
Fix for image not being pulled if there are errors with sandbox image from CRI
Fix for CRD status subresource ratcheting
Extracted and unify cache bypass logic by creating a CacheProxy struct
Improve topologyToMatchedTermCount map in InterPodAffinity PreFilter
kube-proxy to periodically sync and rewrite iptables rule every one hour
Added introduced and removed version information in etcd fixtures
Upgraded Kubernetes contributor website to Docsy 0.5.1
Promotions
ServiceAccountTokenNodeBinding to GA
Deprecated
EtcdLearnerMode feature gate removed, after it graduated to GA in v1.32
Use of deprecated functions in k8s.io/utils/pointer and k8s.io/apimachinery/pkg/util/sets removed
Deprecate nodefeature for feature labels
Version Updates
coredns to 1.12.0
Subprojects and Dependency Updates
Kubernetes-Python v32.0 released
Shoutouts
Big shoutout to Sayak Mukhopadhyay for pushing through the long-overdue upgrade of Hugo/Docsy on for the contributor site
bentheelder: Thank you to Danilo Gemoli for tracking down multiple longstanding issues affecting Prow
via Last Week in Kubernetes Development https://lwkd.info/
January 15, 2025 at 05:00PM
oss-security - RSYNC: 6 vulnerabilities
TIL GitHub Buttons are a thing
The unofficial GitHub Buttons made for developers.
Stay human out there | LLM text makes human interactions less fun
Building connections with other people is what makes life fun. When humans communicate through LLM-written text, we lose that.
Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls - Arctic Wolf
Arctic Wolf Labs identified a campaign targeting Fortinet FortiGate firewall devices with exposed management interfaces.
An updated USB logo will now mark the fastest docking stations
The latest USB logos look different now, to better indicate how fast and how much power USB cables can transmit, including to USB4 docking stations.
Apple CEO Pay Rises 18%; Company Opposes Anti-Diversity Measure
Remove Paywall, free online paywall remover. Get access to articles without having to pay or login. Works on Bloomberg and hundreds more.
Chinese hackers breached US government office that assesses foreign investments for national security risks | CNN Politics
Chinese hackers breached the US government office that reviews foreign investments for national security risks, two US officials familiar with the matter told CNN.
DevOps Toolkit - Ep07 - Ask Me Anything About DevOps Cloud Kubernetes Platform Engineering... w/Scott Rosenberg - https://www.youtube.com/watch?v=biSxzzlCK-E
Ep07 - Ask Me Anything About DevOps, Cloud, Kubernetes, Platform Engineering,... w/Scott Rosenberg
There are no restrictions in this AMA session. You can ask anything about DevOps, Cloud, Kubernetes, Platform Engineering, containers, or anything else. We'll have a special guest Scott Rosenberg to help us out.
▬▬▬▬▬▬ 👋 Contact me 👋 ▬▬▬▬▬▬ ➡ BlueSky: https://vfarcic.bsky.social ➡ LinkedIn: https://www.linkedin.com/in/viktorfarcic/
▬▬▬▬▬▬ 🚀 Other Channels 🚀 ▬▬▬▬▬▬ 🎤 Podcast: https://www.devopsparadox.com/ 💬 Live streams: https://www.youtube.com/c/DevOpsParadox
via YouTube https://www.youtube.com/watch?v=biSxzzlCK-E
Which Kubernetes PostgreSQL operator should you choose? with David Pech
Which Kubernetes PostgreSQL operator should you choose?, with David Pech
Are you running PostgreSQL on Kubernetes and need to choose the right operator? In this episode, David Pech, Staff Cloud Ops Engineer, shares his experience implementing database platforms on Kubernetes and guides teams through operator selection and platform requirements.
You will learn:
The core requirements for a PostgreSQL platform on Kubernetes, including autopilot capabilities, security practices, and observability
How to evaluate PostgreSQL operators based on their architecture — from single-instance deployments to cloud-native implementations
What teams should consider before building their own database-as-a-service and common pitfalls to avoid
The distinction between being production-ready (running single instances) versus platform-ready (operating at scale with proper tooling)
Sponsor
This episode is sponsored by Learnk8s — get started on your Kubernetes journey through comprehensive online, in-person or remote training.
More info
Find all the links and info for this episode here: https://ku.bz/rGMF2ktdb
Interested in sponsoring an episode? Learn more.
via KubeFM https://kube.fm
January 14, 2025 at 05:00AM
Change to x86_64 slipped past x86 kernel devs and is breaking things in v6.13. Being disabled for public release.
A change to the Linux 6.13 kernel contributed by a Microsoft engineer ended up changing Linux x86_64 code without proper authorization and in turn causing troubles for users and now set to be disabled ahead of the Linux 6.13 stable release expected next Sunday.
👀 HTML Is Actually a Programming Language. Fight Me
In fact, HTML is the most significant computing language ever developed. Underestimate it at your peril.
marcomaroni-github/twitter-to-bluesky: Import all tweets exported from X/Twitter to a Bluesky account.
Import all tweets exported from X/Twitter to a Bluesky account. - marcomaroni-github/twitter-to-bluesky
Meta Is Blocking Links to Decentralized Instagram Competitor Pixelfed
Pixelfed said it is "seeing unprecedented levels of traffic."
I always wonder what folks think about what would replace email | It is time to ban email
I think everyone reading this post has accidentally messed up when sending an email, right? I noticed this story recently: The Metropolitan Police has apologised to victims of the Westminster "honeytrap" scandal after it accidentally sent an email which named all of them. … the sender, a detective sergeant in the Met’s Diplomatic and Parliamentary Protection unit, included the recipients’ names in the CC section of the email, rather than BCC, which would have concealed their identities. …
The New $30,000 Side Hustle: Making Job Referrals for Strangers
Remove Paywall, free online paywall remover. Get access to articles without having to pay or login. Works on Bloomberg and hundreds more.
The One GitHub Copilot Feature I Use
A couple of days back, I posted that I prefer to use Chat-driven development using ChatGPT or Claude over using IDE-integrated LLM tools like GitHub Copilot. An old friend reached out and asked if …
NeuralSVG: An Implicit Representation for Text-to-Vector Generation
How to Create Custom CLIs for Internal Developer Platforms with Nushell
How to Create Custom CLIs for Internal Developer Platforms with Nushell
In this video, we delve into the world of Command Line Interfaces (CLIs) and explore how to create our own platform-specific CLI using Nushell. We'll cover why building custom CLIs can be beneficial, especially for internal developer platforms, and how Nushell provides a perfect blend of scripting and programming capabilities. Learn to handle parameters, arguments, and data with ease, and see how to integrate and execute other binaries seamlessly. By the end of this tutorial, you'll be equipped to build efficient, user-friendly CLIs tailored to your platform's needs.
CLI #Nushell #DevTools #DeveloperPlatform
Consider joining the channel: https://www.youtube.com/c/devopstoolkit/join
▬▬▬▬▬▬ 🔗 Additional Info 🔗 ▬▬▬▬▬▬ ➡ Transcript and commands: https://devopstoolkit.live/terminal/how-to-create-custom-clis-that-make-your-devops-life-easier---nushell 🔗 Nushell: https://nushell.sh 🎬 The Future of Shells with Nushell! Shell + Data + Programming Language: https://youtu.be/zoX_S6d-XU4
▬▬▬▬▬▬ 💰 Sponsorships 💰 ▬▬▬▬▬▬ If you are interested in sponsoring this channel, please visit https://devopstoolkit.live/sponsor for more information. Alternatively, feel free to contact me over Twitter or LinkedIn (see below).
▬▬▬▬▬▬ 👋 Contact me 👋 ▬▬▬▬▬▬ ➡ BlueSky: https://vfarcic.bsky.social ➡ LinkedIn: https://www.linkedin.com/in/viktorfarcic/
▬▬▬▬▬▬ 🚀 Other Channels 🚀 ▬▬▬▬▬▬ 🎤 Podcast: https://www.devopsparadox.com/ 💬 Live streams: https://www.youtube.com/c/DevOpsParadox
▬▬▬▬▬▬ ⏱ Timecodes ⏱ ▬▬▬▬▬▬ 00:00 Intro to CLIs for Platforms 02:12 Why Build Our Own CLIs? 06:41 How to Build a Platform-Specific CLI? 10:46 Requirements for Internal CLIs 11:52 Help with Nushell 13:34 Parameters and Arguments with Nushell 15:58 Source Code with Nushell 18:35 Binaries Execution with Nushell 19:38 Data Management with Nushell 22:17 Creating Single Self-Sufficient Executable with Nushell
via YouTube https://www.youtube.com/watch?v=TgQZz2kGysk
turbot/steampipe: Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.
Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required. - turbot/steampipe
Apple’s 2025 Plan: iPhone Overhaul, Smart Home Push and AI Catch-Up (no paywall)
Remove Paywall, free online paywall remover. Get access to articles without having to pay or login. Works on Bloomberg and hundreds more.
UK prepared to loosen planning rules for massive datacenters
Nationally Significant Infrastructure Project designation could tear down more restrictions
NVIDIA Statement on the Biden Administration’s Misguided 'AI Diffusion' Rule
For decades, leadership in computing and software ecosystems has been a cornerstone of American strength and influence worldwide. The federal government has wisely refrained from dictating the design, marketing and sale of mainstream computers and software — key drivers of innovation and economic growth. The first Trump Administration laid the foundation for America’s current strength Read Article
This feels worse than the export controls around cryptography in the 90s | New US Rule Aims to Block China's Access to AI Chips and Models by Restricting the World
The US government has announced a radical plan to control exports of cutting-edge AI technology to most nations.
Mastodon announces transition to non-profit structure | TechCrunch
Decentralized social network organization Mastodon said Monday that it is planning to create a new non-profit organization in Europe and hand over
Inside the Black Box of Predictive Travel Surveillance
Behind the scenes, companies and governments are feeding a trove of data about international travelers into opaque AI tools that aim to predict who’s safe—and who’s a threat.
Microsoft MFA outage blocking access to Microsoft 365 apps
Microsoft is investigating an ongoing Multi-Factor Authentication (MFA) outage that is blocking customers from accessing Microsoft 365 Office apps.
Researchers Hacked into Apple's New USB-C Controller
The investigation started by analyzing the ACE2 to understand its architecture and vulnerabilities. Using hardware exploits on MacBooks and custom macOS kernel modules; they managed to backdoor the ACE2 persistently. However, the ACE3 posed a more formidable challenge due to its robust security enhancements.
Who remembers Google's first social network?
orkut.com is a social networking service developed in association with Google.