Redesigning Kubelet Probes
Talkat CNCF Maintainer Summit Europe 2025 · on Monday, 2025-03-31· at 11:35· Level 3 | ICC Capital Suite 10-12·
summary
Cluster probes currently let kubelet reach pods in ways that create SSRF and NetworkPolicy holes, fail on dual‑stack or multi‑network pods, and break with overlapping pod IPs; CAP-4559 catalogs these issues and CAP-4942 adds a PSA as a stopgap. Proposed fixes include using CRI port-forward to connect into the pod namespace (more CPU cost), doing exec-in-pod probes or a new CRI probe API (changes semantics), or moving probing to a probing sidecar / ephemeral container (accounting and security tradeoffs). Watch if you care about concrete API changes, CRI work, and security mitigations.
AI-written summary · about
chapters (5)
- 0:00Introduction
- 1:05Kubelet probe problems
- 10:08Solutions and API compatibility
- 21:58Community feedback
- 43:13Q&A
related talks
42mPanel - Klustered: eBPF Edition
26mKubernetes Probes: What are they for and why you should always properly configure them
30mPod Security as an Afterthought
19mTalk Deep Dive
33mCAP_NET_RAW And ARP Spoofing in Your Cluster: It's Going Downhill From Here
19mSIG-network: Updates and Future Directions
33mBringing Pod Security Admission to Your Kubernetes Distribution
51mKubernetes SIG-Network: Intro and Deep-Dive