Amazon Web Services (AWS) announces the development of a new availability zone in Maryland, enhancing the US East (N. Virginia) region's infrastructure. This expansion aims to improve performance, increase resiliency, and meet the growing demands of customers in the region. The new availability zone will further contribute to AWS's robust global network, ensuring optimized and reliable cloud services.

AWS is adding a new Availability Zone in Maryland to the US East (Northern Virginia) Region by 2026, enhancing redundancy and supporting growing AI workloads while maintaining high-bandwidth, low-latency network connections.

In the works – New Availability Zone in Maryland for US East (Northern Virginia) Region

"Unlock DevOps Secrets: JavaScript, Pandas & More!"

Issue %%issue_number%%

Law enforcement agencies have reportedly gained unauthorized access to computer systems as part of investigations, raising concerns about privacy and legal implications. This practice, often dubbed "lawful hacking," highlights the tension between cybersecurity and law enforcement objectives. The article examines the potential risks and ethical dilemmas posed by such actions.

A new Europol-led operation has dismantled infrastructure for key initial access malware used to launch ransomware attacks

Law Enforcement Busts Initial Access Malware Used to Launch Ransomware

"DevOps Boost: AI Tips, Linux Picks & More!"

Explore the new MatchLabelKeys feature in Kubernetes, which enhances pod affinity and anti-affinity rules by allowing more flexible scheduling configurations. The update provides developers with greater control over pod placement, improving application availability and resource optimization. This advancement highlights Kubernetes' commitment to continual improvement, expanding its functionality to meet evolving user needs.

Kubernetes 1. 29 introduced new fields MatchLabelKeys and MismatchLabelKeys in PodAffinity and PodAntiAffinity. In Kubernetes 1. 31, this feature moves to beta and the corresponding feature gate (MatchLabelKeysInPodAffinity) gets enabled by default. MatchLabelKeys - Enhanced scheduling for versatile rolling updates During a workload ' s (e. G. , Deployment) rolling update, a cluster may have Pods from multiple versions at the same time. However, the scheduler cannot distinguish between old and new versions based on the LabelSelector specified in PodAffinity or PodAntiAffinity. As a result, it will co-locate or disperse Pods regardless of their versions. This can lead to sub-optimal scheduling outcome, for example: New version Pods are co-located with old version Pods (PodAffinity), which will eventually be removed after rolling updates. Old version Pods are distributed across all available topologies, preventing new version Pods from finding nodes due to PodAntiAffinity. MatchLabelKeys is a set of Pod label keys and addresses this problem. The scheduler looks up the values of these keys from the new Pod ' s labels and combines them with LabelSelector so that PodAffinity matches Pods that have the same key-value in labels. By using label pod-template-hash in MatchLabelKeys, you can ensure that only Pods of the same version are evaluated for PodAffinity or PodAntiAffinity. ApiVersion: apps/v1 kind: Deployment metadata: name: application-server. . . Affinity: podAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: app operator: In values: - database topologyKey: topology. Kubernetes. Io/zone matchLabelKeys: - pod-template-hash The above matchLabelKeys will be translated in Pods like: kind: Pod metadata: name: application-server labels: pod-template-hash: xyz. . . Affinity: podAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: app operator: In values: - database - key: pod-template-hash # Added from matchLabelKeys; Only Pods from the same replicaset will match this affinity. Operator: In values: - xyz topologyKey: topology. Kubernetes. Io/zone matchLabelKeys: - pod-template-hash MismatchLabelKeys - Service isolation MismatchLabelKeys is a set of Pod label keys, like MatchLabelKeys, which looks up the values of these keys from the new Pod ' s labels, and merge them with LabelSelector as key notin (value) so that PodAffinity does not match Pods that have the same key-value in labels. Suppose all Pods for each tenant get tenant label via a controller or a manifest management tool like Helm. Although the value of tenant label is unknown when composing each workload ' s manifest, the cluster admin wants to achieve exclusive 1: 1 tenant to domain placement for a tenant isolation. MismatchLabelKeys works for this usecase; By applying the following affinity globally using a mutating webhook, the cluster admin can ensure that the Pods from the same tenant will land on the same domain exclusively, meaning Pods from other tenants won ' t land on the same domain. Affinity: podAffinity: # ensures the pods of this tenant land on the same node pool requiredDuringSchedulingIgnoredDuringExecution: - matchLabelKeys: - tenant topologyKey: node-pool podAntiAffinity: # ensures only Pods from this tenant lands on the same node pool requiredDuringSchedulingIgnoredDuringExecution: - mismatchLabelKeys: - tenant labelSelector: matchExpressions: - key: tenant operator: Exists topologyKey: node-pool The above matchLabelKeys and mismatchLabelKeys will be translated to like: kind: Pod metadata: name: application-server labels: tenant: service-a spec: affinity: podAffinity: # ensures the pods of this tenant land on the same node pool requiredDuringSchedulingIgnoredDuringExecution: - matchLabelKeys: - tenant topologyKey: node-pool labelSelector: matchExpressions: - key: tenant operator: In values: - service-a podAntiAffinity: # ensures only Pods from this tenant lands on the same node pool requiredDuringSchedulingIgnoredDuringExecution: - mismatchLabelKeys: - tenant labelSelector: matchExpressions: - key: tenant operator: Exists - key: tenant operator: NotIn values: - service-a topologyKey: node-pool Getting involved These features are managed by Kubernetes SIG Scheduling. Please join us and share your feedback. We look forward to hearing from you! How can I learn more? The official document of PodAffinity KEP-3633: Introduce MatchLabelKeys and MismatchLabelKeys to PodAffinity and PodAntiAffinity

Kubernetes 1.31: MatchLabelKeys in PodAffinity graduates to beta

"Unlock Cloud Agility & DevOps Trends Now!"

Explore how CRI-O utilizes Seccomp and OCI Artifacts to enhance container security by default in Kubernetes environments.

Seccomp stands for secure computing mode and has been a feature of the Linux kernel since version 2. 6. 12. It can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel. Kubernetes lets you automatically apply seccomp profiles loaded onto a node to your Pods and containers. But distributing those seccomp profiles is a major challenge in Kubernetes, because the JSON files have to be available on all nodes where a workload can possibly run. Projects like the Security Profiles Operator solve that problem by running as a daemon within the cluster, which makes me wonder which part of that distribution could be done by the container runtime. Runtimes usually apply the profiles from a local path, for example: apiVersion: v1 kind: Pod metadata: name: pod spec: containers: - name: container image: nginx: 1. 25. 3 securityContext: seccompProfile: type: Localhost localhostProfile: nginx-1. 25. 3. Json The profile nginx-1. 25. 3. Json has to be available in the root directory of the kubelet, appended by the seccomp directory. This means the default location for the profile on-disk would be /var/lib/kubelet/seccomp/nginx-1. 25. 3. Json. If the profile is not available, then runtimes will fail on container creation like this: kubectl get pods NAME READY STATUS RESTARTS AGE pod 0/1 CreateContainerError 0 38s kubectl describe pod/pod | tail Tolerations: node. Kubernetes. Io/not-ready: NoExecute op=Exists for 300s node. Kubernetes. Io/unreachable: NoExecute op=Exists for 300s Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 117s default-scheduler Successfully assigned default/pod to 127. 0. 0. 1 Normal Pulling 117s kubelet Pulling image  nginx: 1. 25. 3 Normal Pulled 111s kubelet Successfully pulled image  nginx: 1. 25. 3 in 5. 948s (5. 948s including waiting) Warning Failed 7s (x10 over 111s) kubelet Error: setup seccomp: unable to load local profile  /var/lib/kubelet/seccomp/nginx-1. 25. 3. Json : open /var/lib/kubelet/seccomp/nginx-1. 25. 3. Json: no such file or directory Normal Pulled 7s (x9 over 111s) kubelet Container image  nginx: 1. 25. 3 already present on machine The major obstacle of having to manually distribute the Localhost profiles will lead many end-users to fall back to RuntimeDefault or even running their workloads as Unconfined (with disabled seccomp). CRI-O to the rescue The Kubernetes container runtime CRI-O provides various features using custom annotations. The v1. 30 release adds support for a new set of annotations called seccomp-profile. Kubernetes. Cri-o. Io/POD and seccomp-profile. Kubernetes. Cri-o. Io/&lt; CONTAINER&gt; . Those annotations allow you to specify: a seccomp profile for a specific container, when used as: seccomp-profile. Kubernetes. Cri-o. Io/&lt; CONTAINER&gt; (example: seccomp-profile. Kubernetes. Cri-o. Io/webserver: ' registry. Example/example/webserver: v1 ' ) a seccomp profile for every container within a pod, when used without the container name suffix but the reserved name POD: seccomp-profile. Kubernetes. Cri-o. Io/POD a seccomp profile for a whole container image, if the image itself contains the annotation seccomp-profile. Kubernetes. Cri-o. Io/POD or seccomp-profile. Kubernetes. Cri-o. Io/&lt; CONTAINER&gt; . CRI-O will only respect the annotation if the runtime is configured to allow it, as well as for workloads running as Unconfined. All other workloads will still use the value from the securityContext with a higher priority. The annotations alone will not help much with the distribution of the profiles, but the way they can be referenced will! For example, you can now specify seccomp profiles like regular container images by using OCI artifacts: apiVersion: v1 kind: Pod metadata: name: pod annotations: seccomp-profile. Kubernetes. Cri-o. Io/POD: quay. Io/crio/seccomp: v2 spec: … The image quay. Io/crio/seccomp: v2 contains a seccomp. Json file, which contains the actual profile content. Tools like ORAS or Skopeo can be used to inspect the contents of the image: oras pull quay. Io/crio/seccomp: v2 Downloading 92d8ebfa89aa seccomp. Json Downloaded 92d8ebfa89aa seccomp. Json Pulled [registry] quay. Io/crio/seccomp: v2 Digest: sha256: f0205dac8a24394d9ddf4e48c7ac201ca7dcfea4c554f7ca27777a7f8c43ec1b jq. Seccomp. Json | head {  defaultAction :  SCMP_ACT_ERRNO ,  defaultErrnoRet : 38,  defaultErrno :  ENOSYS ,  archMap : [{  architecture :  SCMP_ARCH_X86_64 ,  subArchitectures : [ SCMP_ARCH_X86 ,  SCMP_ARCH_X32 # Inspect the plain manifest of the image skopeo inspect --raw docker: //quay. Io/crio/seccomp: v2 | jq. {  schemaVersion : 2,  mediaType :  application/vnd. Oci. Image. Manifest. V1+json ,  config : {  mediaType :  application/vnd. Cncf. Seccomp-profile. Config. V1+json ,  digest :  sha256: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 ,  size : 3, },  layers : [{  mediaType :  application/vnd. Oci. Image. Layer. V1. Tar ,  digest :  sha256: 92d8ebfa89aa6dd752c6443c27e412df1b568d62b4af129494d7364802b2d476 ,  size : 18853,  annotations : {  org. Opencontainers. Image. Title :  seccomp. Json }, },],  annotations : {  org. Opencontainers. Image. Created :  2024-02-26T09: 03: 30Z }, } The image manifest contains a reference to a specific required config media type (application/vnd. Cncf. Seccomp-profile. Config. V1+json) and a single layer (application/vnd. Oci. Image. Layer. V1. Tar) pointing to the seccomp. Json file. But now, let ' s give that new feature a try! Using the annotation for a specific container or whole pod CRI-O needs to be configured adequately before it can utilize the annotation. To do this, add the annotation to the allowed_annotations array for the runtime. This can be done by using a drop-in configuration /etc/crio/crio. Conf. D/10-crun. Conf like this: [crio. Runtime] default_runtime =  crun [crio. Runtime. Runtimes. Crun] allowed_annotations = [ seccomp-profile. Kubernetes. Cri-o. Io ,] Now, let ' s run CRI-O from the latest main commit. This can be done by either building it from source, using the static binary bundles or the prerelease packages. To demonstrate this, I ran the crio binary from my command line using a single node Kubernetes cluster via local-up-cluster. Sh. Now that the cluster is up and running, let ' s try a pod without the annotation running as seccomp Unconfined: cat pod. Yaml apiVersion: v1 kind: Pod metadata: name: pod spec: containers: - name: container image: nginx: 1. 25. 3 securityContext: seccompProfile: type: Unconfined kubectl apply -f pod. Yaml The workload is up and running: kubectl get pods NAME READY STATUS RESTARTS AGE pod 1/1 Running 0 15s And no seccomp profile got applied if I inspect the container using crictl: export CONTAINER_ID = $(sudo crictl ps --name container -q) sudo crictl inspect $CONTAINER_ID | jq. Info. RuntimeSpec. Linux. Seccomp null Now, let ' s modify the pod to apply the profile quay. Io/crio/seccomp: v2 to the container: apiVersion: v1 kind: Pod metadata: name: pod annotations: seccomp-profile. Kubernetes. Cri-o. Io/container: quay. Io/crio/seccomp: v2 spec: containers: - name: container image: nginx: 1. 25. 3 I have to delete and recreate the Pod, because only recreation will apply a new seccomp profile: kubectl delete pod/pod pod  pod deleted kubectl apply -f pod. Yaml pod/pod created The CRI-O logs will now indicate that the runtime pulled the artifact: WARN[…] Allowed annotations are specified for workload [seccomp-profile. Kubernetes. Cri-o. Io] INFO[…] Found container specific seccomp profile annotation: seccomp-profile. Kubernetes. Cri-o. Io/container=quay. Io/crio/seccomp: v2 id=26ddcbe6-6efe-414a-88fd-b1ca91979e93 name=/runtime. V1. RuntimeService/CreateContainer INFO[…] Pulling OCI artifact from ref: quay. Io/crio/seccomp: v2 id=26ddcbe6-6efe-414a-88fd-b1ca91979e93 name=/runtime. V1. RuntimeService/CreateContainer INFO[…] Retrieved OCI artifact seccomp profile of len: 18853 id=26ddcbe6-6efe-414a-88fd-b1ca91979e93 name=/runtime. V1. RuntimeService/CreateContainer And the container is finally using the profile: export CONTAINER_ID = $(sudo crictl ps --name container -q) sudo crictl inspect $CONTAINER_ID | jq. Info. RuntimeSpec. Linux. Seccomp | head {  defaultAction :  SCMP_ACT_ERRNO ,  defaultErrnoRet : 38,  architectures : [ SCMP_ARCH_X86_64 ,  SCMP_ARCH_X86 ,  SCMP_ARCH_X32],  syscalls : [{ The same would work for every container in the pod, if users replace the /container suffix with the reserved name /POD, for example: apiVersion: v1 kind: Pod metadata: name: pod annotations: seccomp-profile. Kubernetes. Cri-o. Io/POD: quay. Io/crio/seccomp: v2 spec: containers: - name: container image: nginx: 1. 25. 3 Using the annotation for a container image While specifying seccomp profiles as OCI artifacts on certain workloads is a cool feature, the majority of end users would like to link seccomp profiles to published container images. This can be done by using a container image annotation; instead of being applied to a Kubernetes Pod, the annotation is some metadata applied at the container image itself. For example, Podman can be used to add the image annotation directly during image build: podman build \ --annotation seccomp-profile. Kubernetes. Cri-o. Io = quay. Io/crio/seccomp: v2 \ -t quay. Io/crio/nginx-seccomp: v2. The pushed image then contains the annotation: skopeo inspect --raw docker: //quay. Io/crio/nginx-seccomp: v2 | jq  . Annotations.  seccomp-profile. Kubernetes. Cri-o. Io   quay. Io/crio/seccomp: v2 If I now use that image in an CRI-O test pod definition: apiVersion: v1 kind: Pod metadata: name: pod # no Pod annotations set spec: containers: - name: container image: quay. Io/crio/nginx-seccomp: v2 Then the CRI-O logs will indicate that the image annotation got evaluated and the profile got applied: kubectl delete pod/pod pod  pod deleted kubectl apply -f pod. Yaml pod/pod created INFO[…] Found image specific seccomp profile annotation: seccomp-profile. Kubernetes. Cri-o. Io=quay. Io/crio/seccomp: v2 id=c1f22c59-e30e-4046-931d-a0c0fdc2c8b7 name=/runtime. V1. RuntimeService/CreateContainer INFO[…] Pulling OCI artifact from ref: quay. Io/crio/seccomp: v2 id=c1f22c59-e30e-4046-931d-a0c0fdc2c8b7 name=/runtime. V1. RuntimeService/CreateContainer INFO[…] Retrieved OCI artifact seccomp profile of len: 18853 id=c1f22c59-e30e-4046-931d-a0c0fdc2c8b7 name=/runtime. V1. RuntimeService/CreateContainer INFO[…] Created container 116a316cd9a11fe861dd04c43b94f45046d1ff37e2ed05a4e4194fcaab29ee63: default/pod/container id=c1f22c59-e30e-4046-931d-a0c0fdc2c8b7 name=/runtime. V1. RuntimeService/CreateContainer export CONTAINER_ID = $(sudo crictl ps --name container -q) sudo crictl inspect $CONTAINER_ID | jq. Info. RuntimeSpec. Linux. Seccomp | head {  defaultAction :  SCMP_ACT_ERRNO ,  defaultErrnoRet : 38,  architectures : [ SCMP_ARCH_X86_64 ,  SCMP_ARCH_X86 ,  SCMP_ARCH_X32],  syscalls : [{ For container images, the annotation seccomp-profile. Kubernetes. Cri-o. Io will be treated in the same way as seccomp-profile. Kubernetes. Cri-o. Io/POD and applies to the whole pod. In addition to that, the whole feature also works when using the container specific annotation on an image, for example if a container is named container1: skopeo inspect --raw docker: //quay. Io/crio/nginx-seccomp: v2-container | jq  . Annotations.  seccomp-profile. Kubernetes. Cri-o. Io/container1   quay. Io/crio/seccomp: v2 The cool thing about this whole feature is that users can now create seccomp profiles for specific container images and store them side by side in the same registry. Linking the images to the profiles provides a great flexibility to maintain them over the whole application ' s life cycle. Pushing profiles using ORAS The actual creation of the OCI object that contains a seccomp profile requires a bit more work when using ORAS. I have the hope that tools like Podman will simplify the overall process in the future. Right now, the container registry needs to be OCI compatible, which is also the case for Quay. Io. CRI-O expects the seccomp profile object to have a container image media type (application/vnd. Cncf. Seccomp-profile. Config. V1+json), while ORAS uses application/vnd. Oci. Empty. V1+json per default. To achieve all of that, the following commands can be executed: echo  {} &gt; config. Json oras push \ --config config. Json: application/vnd. Cncf. Seccomp-profile. Config. V1+json \ quay. Io/crio/seccomp: v2 seccomp. Json The resulting image contains the mediaType that CRI-O expects. ORAS pushes a single layer seccomp. Json to the registry. The name of the profile does not matter much. CRI-O will pick the first layer and check if that can act as a seccomp profile. Future work CRI-O internally manages the OCI artifacts like regular files. This provides the benefit of moving them around, removing them if not used any more or having any other data available than seccomp profiles. This enables future enhancements in CRI-O on top of OCI artifacts, but also allows thinking about stacking seccomp profiles as part of having multiple layers in an OCI artifact. The limitation that it only works for Unconfined workloads for v1. 30. X releases is something different CRI-O would like to address in the future. Simplifying the overall user experience by not compromising security seems to be the key for a successful future of seccomp in container workloads. The CRI-O maintainers will be happy to listen to any feedback or suggestions on the new feature! Thank you for reading this blog post, feel free to reach out to the maintainers via the Kubernetes Slack channel #crio or create an issue in the GitHub repository.

CRI-O: Applying seccomp profiles from OCI registries

CloudOps Insights: DevOps Trends & Rust's Rise

This article discusses a recent ransomware attack targeting Elenor Corp, highlighting the evolving tactics of cybercriminals. It emphasizes the importance of reinforcing cybersecurity measures and staying vigilant against new threats. The report underscores the significance of integrating advanced security protocols to mitigate such risks.

ELENOR-corp ransomware, a new version of Mimic, is targeting healthcare organizations using advanced capabilities

ELENOR-corp Ransomware Targets Healthcare Sector

"CloudOps Weekly: Turbocharge Your DevOps Insights!"

The article reports a significant decline in ransomware attacks following a peak earlier in the year. The reduction is attributed to increased defensive measures and collaborative efforts among cybersecurity professionals globally. Despite the decrease, experts warn that the threat remains prevalent and urge continued vigilance.

NCC Group found that ransomware attacks fell by 32% in March compared to February, but described this finding as a “red herring”

Ransomware Attacks Fall Sharply in March

Unlock Cloud Secrets: 9s, AI Tools & AWS Updates!

Atlassian's CTO discusses the strategic integration and scaling of AI technologies while maintaining a positive developer experience. The article explores how AI can enhance productivity without compromising developer satisfaction. It highlights the company's commitment to innovation and balancing technological advancement with user needs.

It seems like every company is in rush to fit AI into their product. But what does that actually look The post Atlassian’s CTO on Scaling AI While Fueling ‘Developer Joy’ appeared first on The New Stack.

Atlassian’s CTO on Scaling AI While Fueling ‘Developer Joy’

"Level Up in CloudOps: AI, Java 23 & More!"

The UK communications regulator, Ofcom, has introduced strict child safety rules requiring tech firms to better protect children online. Companies are expected to assess potential risks and ensure robust measures to prevent harmful content exposure. The regulations aim to create a safer digital environment for young users, in alignment with growing concerns over child safety in the digital age.

Ofcom’s Protection of Children Codes and Guidance lists 40 new child safety measures for tech firms

Ofcom Lays Down the Law with Child Safety Rules for Tech Giants

"CloudOps: AI, Security & DevOps Futures Unveiled!"

Microsoft Azure has announced fine-tuning capabilities for customization in its Azure AI services, enhancing model development and deployment. The update includes support for new models, enabling users to optimize their AI solutions efficiently. This advancement aims to provide businesses with more scalable and precise AI functionalities, tailored to specific use cases.

To truly harness the power of generative AI, customization is key. In this blog, we share the latest Microsoft Azure AI updates. The post Announcing fine-tuning for customization and support for new models in Azure AI appeared first on Microsoft Azure Blog.

Announcing fine-tuning for customization and support for new models in Azure AI

"CloudOps Insights: Linux Hacks & AI Fixes 🚀"

Explore the newly released Kubernetes 1.29 which introduces updates to volume attributes and enhances class processing. This release aims to streamline resource allocation and management for users. The update includes detailed improvements and best practices for practitioners.

The v1. 29 release of Kubernetes introduced an alpha feature to support modifying a volume by changing the volumeAttributesClassName that was specified for a PersistentVolumeClaim (PVC). With the feature enabled, Kubernetes can handle updates of volume attributes other than capacity. Allowing volume attributes to be changed without managing it through different provider ' s APIs directly simplifies the current flow. You can read about VolumeAttributesClass usage details in the Kubernetes documentation or you can read on to learn about why the Kubernetes project is supporting this feature. VolumeAttributesClass The new storage. K8s. Io/v1alpha1 API group provides two new types: VolumeAttributesClass Represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning. ModifyVolumeStatus Represents the status object of ControllerModifyVolume operation. With this alpha feature enabled, the spec of PersistentVolumeClaim defines VolumeAttributesClassName that is used in the PVC. At volume provisioning, the CreateVolume operation will apply the parameters in the VolumeAttributesClass along with the parameters in the StorageClass. When there is a change of volumeAttributesClassName in the PVC spec, the external-resizer sidecar will get an informer event. Based on the current state of the configuration, the resizer will trigger a CSI ControllerModifyVolume. More details can be found in KEP-3751. How to use it If you want to test the feature whilst it ' s alpha, you need to enable the relevant feature gate in the kube-controller-manager and the kube-apiserver. Use the --feature-gates command line argument: --feature-gates= . . . , VolumeAttributesClass=true It also requires that the CSI driver has implemented the ModifyVolume API. User flow If you would like to see the feature in action and verify it works fine in your cluster, here ' s what you can try: Define a StorageClass and VolumeAttributesClass apiVersion: storage. K8s. Io/v1 kind: StorageClass metadata: name: csi-sc-example provisioner: pd. Csi. Storage. Gke. Io parameters: disk-type:  hyperdisk-balanced volumeBindingMode: WaitForFirstConsumer apiVersion: storage. K8s. Io/v1alpha1 kind: VolumeAttributesClass metadata: name: silver driverName: pd. Csi. Storage. Gke. Io parameters: provisioned-iops:  3000 provisioned-throughput:  50 Define and create the PersistentVolumeClaim apiVersion: v1 kind: PersistentVolumeClaim metadata: name: test-pv-claim spec: storageClassName: csi-sc-example volumeAttributesClassName: silver accessModes: - ReadWriteOnce resources: requests: storage: 64Gi Verify that the PersistentVolumeClaim is now provisioned correctly with: kubectl get pvc Create a new VolumeAttributesClass gold: apiVersion: storage. K8s. Io/v1alpha1 kind: VolumeAttributesClass metadata: name: gold driverName: pd. Csi. Storage. Gke. Io parameters: iops:  4000 throughput:  60 Update the PVC with the new VolumeAttributesClass and apply: apiVersion: v1 kind: PersistentVolumeClaim metadata: name: test-pv-claim spec: storageClassName: csi-sc-example volumeAttributesClassName: gold accessModes: - ReadWriteOnce resources: requests: storage: 64Gi Verify that PersistentVolumeClaims has the updated VolumeAttributesClass parameters with: kubectl describe pvc &lt; PVC_NAME&gt; Next steps See the VolumeAttributesClass KEP for more information on the design You can view or comment on the project board for VolumeAttributesClass In order to move this feature towards beta, we need feedback from the community, so here ' s a call to action: add support to the CSI drivers, try out this feature, consider how it can help with problems that your users are having… Getting involved We always welcome new contributors. So, if you would like to get involved, you can join our Kubernetes Storage Special Interest Group (SIG). If you would like to share feedback, you can do so on our public Slack channel. Special thanks to all the contributors that provided great reviews, shared valuable insight and helped implement this feature (alphabetical order): Baofa Fan (calory) Ben Swartzlander (bswartz) Connor Catlett (ConnorJC3) Hemant Kumar (gnufied) Jan Šafránek (jsafrane) Joe Betz (jpbetz) Jordan Liggitt (liggitt) Matthew Cary (mattcary) Michelle Au (msau42) Xing Yang (xing-yang)

Kubernetes 1.29: VolumeAttributesClass for Volume Modification

"Unveiling DevOps Breakthroughs: From Kubernetes to ETL"

I'm curating this article for a newsletter, give me a 3 sentence summary of this article so I can copy and paste it in my newsletter.  Make the tone professional and concise.

Stay informed about the latest advancements in DevOps and cloud technology by subscribing to our weekly newsletter. 
Each edition provides curated insights and trends designed to keep you updated and positioned at the forefront of the industry.
Don't miss the opportunity to enhance your knowledge and stay ahead of the curve.