Kubernetes 1.34 Released with KYAML, Traffic Routing Controls, and Improved Observability

"A key highlight in 1.34 is the introduction of enhanced in-cluster traffic routing by providing network operators with the ability to express preferences on how traffic should be routed to service endpoints. Alpha features in Kubernetes 1.34 include KYAML, a streamlined YAML subset designed to mitigate common YAML related challenges in Kubernetes configurations, such as whitespace sensitivity and type coercion errors. This aims to improve the readability and maintainability of Kubernetes manifests."

"In version 1.34, users will be able to view the manifests of resources by specifying KYAML as the output format. For example, kubectl get pods -o kyaml to view the pods in the default namespace. Another feature entering alpha is a built-in mechanism to manage and request X.509 certificates for pods via PodCertificateRequests. Before, ServiceAccount tokens were used to authenticate pods to the API server, which lacked mutual TLS (mTLS) support and posed challenges when interacting with other systems that required certificate-based authentication."

"Kubernetes 1.34 is bringing beta support for ServiceAccount tokens for kubelet image credential providers. This enhanced security feature enables users to eliminate the need for Kubernetes secrets to store credentials required for pulling images from a private registry by utilizing a short-lived token. By utilizing short-lived tokens and reducing the need to store credentials in Kubernetes secrets, this beta feature strengthens cluster security and simplifies private registry authentication"

Kubernetes 1.34, named 'Of Wind & Will', adds distributed resource allocation and production-grade tracing for the kubelet and API server. The release introduces enhanced in-cluster traffic routing that lets network operators express routing preferences for service endpoints. Alpha features include KYAML, a streamlined YAML subset to reduce whitespace sensitivity and type coercion errors, and native PodCertificateRequests for requesting X.509 certificates for pods to enable mTLS and certificate-based authentication. Beta features include ServiceAccount tokens for kubelet image credential providers, allowing short-lived tokens to replace stored secrets and strengthen private registry authentication.

Read at InfoQ