LoginSign Up
← Back to all sparks
K

kOps

INFRA · APIS
Velocity2.5

Production-grade Kubernetes cluster provisioning and operations

kops.sigs.k8s.io ↗

kOps is tightening cluster defaults and dropping the platforms it no longer wants to carry.

kubernetescluster-lifecyclemulti-cloudrbac-defaultsreconciliation
◆Current state
kOps publishes alpha and beta tags rather than finals to this feed, with long commit lists dominated by provider-specific work. The 1.36 cycle removed Amazon Linux 2 support outright and changed omitted authorization to default to RBAC instead of AlwaysAllow. The 1.37 alpha continues along provider lines: Azure node identity now uses the IMDS attested metadata document, AWS reconciles target group health check changes on existing groups, GCE does the same for HTTP health checks, and Linode gained SSH key management.
◆Where it's heading
Two patterns run through these tags. The first is reconciliation — kOps is closing the gaps where it created a resource but never re-checked it, which is what turns a provisioning tool into something that can be run continuously. The second is deliberate narrowing: dropping Amazon Linux 2 and defaulting authorization to RBAC both trade compatibility for a safer, smaller supported matrix.
◆Prediction
The health check reconciliation pattern has now landed for AWS and GCE in the same cycle, so Azure and the smaller providers are the likely next targets.

◆Recent moves

  1. 25d ago

    Azure attested node identity; AWS and GCE health check reconcile

    The reconciliation thread lands on both AWS target groups and GCE HTTP health checks in one tag, so drift in resources kOps already created now gets corrected. Azure switching to the IMDS attested metadata document for node identity is the security-relevant change, and Linode SSH key management continues filling out the smaller providers.

    View source ↗
  2. 1mo ago

    Omitted authorization now defaults to RBAC instead of AlwaysAllow

    The default change is the item that matters: a cluster spec that omits authorization no longer gets AlwaysAllow. Alongside it, addon apply failures are surfaced through a readiness probe rather than staying silent, and the containerd bump was reverted within the same tag.

    View source ↗
  3. 2mo ago

    Amazon Linux 2 support removed; warm pools take user-defined images

    Removing Amazon Linux 2 and updating the distribution matrix around it is a supported-platform decision that forces migration for anyone still on it. Warm pool instances pulling user-defined images is the useful addition for teams managing their own AMIs.

    View source ↗