Kubernetes 1.28 Accommodates the Service Mesh, Sudden Outages
Planternetes logo
With its latest release, version 1.28, Kubernetes has formally recognized the service mesh as a first-class citizen in a cluster.
K8s v1.28, nicknamed “Planternetes” is the first release where the API recognizes a service mesh as a special type of init container, or containers needed to initialize a pod.
“Folks have been using the sidecar pattern for a long time,” said Grace Nguyen, who led the v1.28 release. The API will support actions such as updating secrets and logging. You want logging to continue even after the node has been shut down, or before it is spun up, Nguyen said.
To support the service mesh, the API gets an additional field to designate a service mesh and has the policy that the containerized service mesh can remain operational for the lifetime of the pod, unlike a regular init container.
The sidecar pattern has been around since Kubernetes itself. A sidecar acts as a networking agent for a Kubernetes application, handling all the traffic in and out, as well as performing checks, monitoring, etc.
Ideally, the service mesh container to be running before the app itself, ensuring all inbound/outbound connections are supported. The service mesh container should also be around after the app containers are terminated, to manage any remaining traffic. In practice, making this happen has been tricky for the service mesh providers like Linkerd and Istio, some of whom have created brittle platform-specific workarounds.
Shut It Down
“Planternetes” is the second release of 2023, it consists of 46 enhancements and a fresh new logo (see above). Twenty of these enhancements are in the Alpha early stage, 14 are in Beta mode, and 12 are ready for production usage (“stable”).
Non-graceful shutdown is one such stable feature. A non-graceful shutdown is one in which the kubelet’s Node Shutdown Manager may not detect a pod becoming inoperable, due to some underlying hardware failure or the OS freezing up. Now, there is a mechanism to move pods to another node when the original node fails. The StatefulSet provides K8s with the info needed to airlift the pod to a healthier environment.
Those convinced that the culprit of any networking problem is always DNS will be happy to know that Kubernetes configuration for DNS has been expanded. Previously, K8s could only search across six domains, with a maximum of 256 characters each. Now, the search paths for kubelets have been increased to 32, with a maximum of 2,048 characters.
Enterprises that don’t want to update K8s as quickly as new versions are released will get some breathing room with this release, Nguyen said. Users can now skip up to three new releases of the control plane, instead of two. This means nodes would only have to be updated once a year instead of twice, and still be current with upstream support.
Release Complexities
Nguyen has been on the release team for over two years now, and would not characterize this release of Kubernetes as a major one — most major releases have a lot of deprecation of obsolete features. But there still has been a lot of work that went on here, just by the size Kubernetes is growing to be.
“I think that we are getting to the point where there are so many features coming in and so many code pull requests that it is hard to keep track of both at the same time,” Nguyen said. A large pull request may come in for a particular feature, but that feature may not be ready for release, and so that code may have to get rolled back.
