Kubernetes

The latest Routing Agent release for DOKS has a single CR, Route , that requires specifying gateways by IP address. Given how Droplets can be destroyed, rotated etc, even with reserved IPs attached, it'd be incredibly useful to have the agent find Droplets via a discovery mechanism, similar to how it currently supports using node selectors to restrict settings a route to a subnet of K8s nodes. This could work via Droplet tags, for instance. I'd imagine something similar to the way Cilium handles gateway discovery for Egress Gateways via the CiliumEgressGatewayPolicy CR. Route could look something like: apiVersion: networking.doks.digitalocean.com/v1alpha1 kind: Route metadata: name: egress-gateways spec: destinations: - 0.0.0.0/0 gateways: dropletSelector: matchTags: - egress-gateway

To enhance cluster's security, OIDC(OpenID Connect) is required. https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens

Containerd allows setting a directory for its CRI mirror configuration. Any configuration placed in this directory will be hot reloaded by Containerd. Unfortunately the directory setting requires a restart of Containerd to take effect. Including the following in the Containerd configuration by default would solve this. ```toml version = 2 [plugins."io.containerd.grpc.v1.cri".registry] config_path = "/etc/containerd/certs.d" ``` Having this set is useful for projects like Spegel which makes use of CRI mirror configuration to function. https://spegel.dev/docs/getting-started/

Currently DigitalOcean Managed Kubernetes doesn't provide any methods to track down control plane logs for auditing. Audit logs are highly necessary and useful for security-related issues and situations especially on production environments. This should be one of the first priority feature to be added on DOKS to let user keep their services safe and fully trust DOKS as a production-ready platform.

For security reasons, it would be nice to restrict access to the managed Kubernetes control plane API, either via Firewall configuration or basic IP Whitelisting like Managed Databases. Similar to the feature in EKS https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html

Please release a way to make k8s users authenticating through an OpenID Connect Identity provider, it would greatly enhance the maneageability for those organization already using this way of authenticating. I really like DO k8s, but I'm not sure I'm going to use it on a wider scale due to this limitation; as you know for sure, other cloud providers allow it.

Even though Kubernetes does not support IPv6, pods running with host networking enabled can make use of the IPv6 address. IPv6 should be enabled by default or there can be an option to enable it for a Kubernetes node pool.

Many images that are required for a node are pulled from external registries ( docker.io , gcr.io , registry.k8s.io ). This can cause new nodes to not be able to properly join the cluster if one of those registries is having issues. (Example: Cilium images could not be pulled due to an issue that caused HTTP 500 errors on docker hub) The use of an internal mirror for these essential images can prevent these kinds of issues from affecting a cluster, and also improve pull times.

Kubernetes has a powerful ability to alter schedule configurations, enabling it to do things such as bin-packing ( https://kubernetes.io/docs/concepts/scheduling-eviction/resource-bin-packing/ ), which can then make resource usage more efficient, or at least more predictable, when resources begin to spread across many nodes. There are other business cases, but these are all locked behind altering kube-scheduler's default configurations, or at least, adding new ones (under different scheduler names)