Highlights
Pod networking in rootless mode (#1423)
Rootless clusters now get real pod networking. rootlesskit runs with its own network namespace via slirp4netns, so the user namespace owns the cluster network and only the API server port (6443) is published to 127.0.0.1 on the host. This enables in rootless mode:
- The bridge CNI plugin, with pods in their own network namespaces
kube-proxy, masquerading all Service traffic and leaving the conntrack sysctls untouched- CRI-O host port mapping
- The
runcruntime
Fixes
- The firewall CNI plugin now accepts pod traffic in the
FORWARDchain. This fixes pod egress on hosts with aDROPpolicy, for example when Docker is running. - Overlapping route checks now run before entering the network namespace.
Notable changes
--cidrmust not overlap with the slirp4netns network10.0.2.0/24.- The integration tests now cover pod networking, ClusterIP Service routing, outbound access and the RuntimeClass check in all modes.
Dependencies
- Updated nixpkgs, which ships Kubernetes v1.37.1, CRI-O v1.37.2, containerd v2.4.1, etcd v3.6.15, podman v5.8.9 and runc v1.5.2 (see the README for the full list)
- Updated Rust crates:
equivalent,libc,serde_json,smallvec,syn,tomlandunicode-ident - Updated GitHub Actions:
actions/upload-artifact,actions/download-artifactandtaiki-e/install-action
Install
Download a static binary for your architecture below, or install from crates.io:
cargo install kubernix
Full Changelog: v0.4.2...v0.4.3