GKE Features on Fire ??. Kubernetes 1.30?? Is it the end of Terraform ?

The News

GKE

• Kubernetes 1.30 : Is now available in the Rapid Channel.
• Backup for GKE support smart scheduling : You can turn on Smart Scheduling in Backup for GKE by setting a target RPO (Recovery Point Objective) and letting the backup service perform the backups for you. RPO is a time-based measurement for the maximum amount of data loss your organization tolerates. You can of course still set cron-base backups.
• GKE Compliance dashboard : Is a dashboard that shows compliance information of your GKE cluster with CIS Google Kubernetes Engine benchmark 1.5.0, Pod Security Standards Baseline and Pod Security Standards Restricted.
• Dual Stack IPv4/IPv6 for Cloud Load Balancers with GKE: You can set an internal or external load balancer with a dual stack IPv4/IPv6 with GKE.
• GKE threat detection : For Enterprise users GKE threat detection evaluates your GKE audit logs in Cloud Logging against a set of predefined rules for cluster and workload threats. Threats are classified using the MITRE ATT&CK? tactics [Preview].
• GKE security Posture findings in Security Command Center : If you enabled GKE security Posture findings will be pushed to SCC [Preview].
• Customize containerd configuration in GKE nodes : This feature allow customizing containerd config via a GKE node API. This is not a feature per-se but rather a new capability that would enable some use-cases in the future. The first is using image registries with privately signed CA’s . This native integration should be the replacement to my previously documented workaround .
• Schedule Multiple GPUs on GKE Autpilot : You can now specific a "https://cloud.google.com/gke-accelerator-count” annotation on the pod to specify the number of GPU's that would attached to the node.
• Enable Linux huge pages in GKE: Using node system configuration you can enable and customize Linux Huge Page. Linux Huge Page is a Kernel feature which allows you to customize the size of your memory pages.
• Resolve Headless Services from the VPC: Using Cloud DNS additive VPC scope you can make headless Services resolvable from other resources in the VPC [Preview].
• Nested VMs with GKE Standard clusters: You can enable Nested Virtualization on certain type of VM’s to allow you to use QUEMU to create VM’s inside Pods. Use cases are things like Android Emulator.
• GKE Gateway API Controller new Capabilities: New features like CRDs v1.0.0, Cloud Armor security policy support for Regional external Gateways, Self-managed certificates with Certificate Manager on Regional internal & external Gateways and more including a bug fix. Check out the link for details.

Google Cloud

• Cloud Ops Broken Links checker : In Cloud Monitoring you can set a synthetic monitor to periodically check if links within a specific page are still working.

Kubernetes

• ValidationAdmissionPolicy is GA in Kubernetes 1.30: Validation Admission Policies are an alternative to Validating Admission Webhooks. They offer an in-process way to validate policies using Common Expression Language (CEL).

The Technical

Google Cloud

• Using Gemini to help write Synthetic Monitoring tests: Learn how to use Gemini with Google Cloud Monitoring to write Synthetic Monitoring Test Suites.

Kubernetes

• Kubernetes security fundamentals from datadog :
• - Part 1 Introduction
• - Part 2 API Security
• - Part 3 Authentication
• Image signing validation on K8s: Learn how to use AWS KMS, Cosign and SigStore PolicyController to validate image signing before allowing them to be deployed to EKS.

The Editorial

• The beginning of the end of Terraform: A very interesting read on how the IBM acquisition of HashiCorp might impact the future of Terraform and the tools released by the same company.
• It’s time to retire Terraform: Another interesting argument for why we might want to say goodbye to Terraform.