Kubernetes v1.35 Promotes Fine-Grained Supplemental Groups Control to General Availability
The Kubernetes SIG Node has announced that the fine-grained supplemental groups control feature has graduated to General Availability (GA) in Kubernetes version 1.35. Initially introduced as an alpha feature in v1.31 and promoted to beta in v1.33, this update introduces the new Pod field supplementalGroupsPolicy. This enhancement allows administrators to implement precise control over supplemental groups in Linux containers, significantly strengthening security postures, particularly regarding volume access. Additionally, it improves the transparency of UID and GID details within containers, facilitating better security oversight. The announcement addresses a previous default behavior where Kubernetes merged group information from Pods with data defined in the container image's /etc/group file, which often occurred without user awareness. Administrators planning to upgrade clusters from version 1.32 or earlier are urged to review behavioral breaking changes introduced since the beta release. The update aims to provide more deterministic security contexts for workloads, ensuring that group memberships are explicitly managed rather than implicitly inherited, thereby reducing potential security risks associated with ambiguous permission settings in containerized environments.
Wire timeline
Kubernetes v1.35 Promotes Fine-Grained Supplemental Groups Control to General Availability
The Kubernetes SIG Node has announced that the fine-grained supplemental groups control feature has graduated to General Availability (GA) in Kubernetes version 1.35. Initially introduced as an alpha feature in v1.31 and promoted to beta in v1.33, this update introduces the new Pod field supplementalGroupsPolicy. This enhancement allows administrators to implement precise control over supplemental groups in Linux containers, significantly strengthening security postures, particularly regarding volume access. Additionally, it improves the transparency of UID and GID details within containers, facilitating better security oversight. The announcement addresses a previous default behavior where Kubernetes merged group information from Pods with data defined in the container image's /etc/group file, which often occurred without user awareness. Administrators planning to upgrade clusters from version 1.32 or earlier are urged to review behavioral breaking changes introduced since the beta release. The update aims to provide more deterministic security contexts for workloads, ensuring that group memberships are explicitly managed rather than implicitly inherited, thereby reducing potential security risks associated with ambiguous permission settings in containerized environments.
Kubernetes Blog