tag: Networking · 27 items
- Platform/SRE — Plan: If your org maintains a firewall or security-group allowlist for incoming GitHub webhook traffic, update it to include the new IP ranges from the Meta API hooks field before deployments that rely on webhooks start failing.
- CI/CD — Plan: Pipelines that trigger via GitHub webhooks and sit behind a strict inbound allowlist may silently drop deliveries; pull the updated ranges from the Meta API and refresh your allowlist rules.
- Leader — Skip
- Platform/SRE — Plan: This GA capability eliminates the need for a NAT appliance or IP renumbering when connecting networks with overlapping CIDRs — directly relevant if the org has pending M&A integration, partner VPN, or multicloud connectivity work blocked by address conflicts. Evaluate adding to the network-connectivity pattern for such scenarios this quarter.
- CI/CD — Skip
- Leader — Learn: Managed 1:1 NAT on Transit Gateway removes the appliance cost and renumbering complexity historically incurred during M&A network integration; worth noting as an option when assessing future acquisition or partner-connectivity scope.
- Platform/SRE — Skip
- CI/CD — Plan: If your runners operate behind strict outbound firewall or IP allowlist rules, review and update allowlists to include the new GitHub Actions blob storage endpoints surfaced in the meta API — no deadline given, but unpatched allowlists could silently break artifact uploads or caching.
- Leader — Skip
- Platform/SRE — Plan: If you run Oracle Database@AWS, this new GA capability lets you advertise a single aggregate CIDR or default route (0.0.0.0/0) over ODB peering instead of managing per-network entries — worth updating your ODB network peering config during your next network ops review cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If your org has IPv6 compliance or architecture requirements, you can now route IPv6 traffic end-to-end through CloudFront to private ALB/NLB/EC2 origins without exposing them publicly. Evaluate updating VPC origin configs to dual-stack in your next architecture review.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful architecture pattern for orgs centralizing networking across AWS accounts in healthcare/life sciences workloads, but no deadline or breaking change — worth noting if you operate HealthOmics or shared VPC networking today.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: A practical walkthrough of using Squid as a Kubernetes egress proxy — useful design reference if evaluating egress filtering patterns, but no deadline or breaking change to act on.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: StandardV2 is now the default managed NAT Gateway SKU for new AKS clusters in supported regions, which may affect cluster provisioning templates and IaC modules. Review and update cluster-creation configurations to account for the new default SKU before spinning up new clusters.
- CI/CD — Skip
- Leader — Learn: AKS now manages a higher-performance NAT Gateway SKU by default for new clusters, shifting the networking default without a licensing or cost-model change — worth noting as AKS managed networking capabilities mature.
- Signals: GA announcement
- Platform/SRE — Learn: Pre-GA release of the Cilium CNI; notable upcoming changes include a new LB IPAM IP-sharing annotation for mixed-pod services and a fix for BGP route advertisement racing BPF attachment on node reboot — worth tracking before the GA upgrade cycle.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found)
- Platform/SRE — Plan: Teams centralizing AWS networking with shared VPCs can now use a single DataSync VPC endpoint per central account instead of one per spoke account; evaluate consolidating existing per-account endpoints to reduce IP consumption and maintenance overhead this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Teams using Transfer Family SFTP behind an NLB for compliance or IP-based access controls should evaluate enabling this feature; no deadline, but it unlocks accurate audit logs and identity-provider IP filtering that may be required for security reviews.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Cilium 1.20 is a GA minor release of a CNI/service-mesh stack platform teams operate directly; new ENI IPAM for IPv6 and Gateway API ExternalAuth are worth evaluating for adoption this quarter, and the TCPRoute/UDPRoute additions may change how non-HTTP traffic routing is architected on the cluster.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Pre-GA release of Cilium 1.21 introduces notable features like BPF masquerading on by default and SR-IOV device manager support — worth tracking for planning a future upgrade, but not actionable until GA.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Pre-GA release of Cilium 1.21.0; worth tracking for upcoming features in the eBPF-based CNI, but not actionable until GA.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Teams using Transit Gateway inter-Region peering can now add network health indicators to CloudWatch dashboards and alarms, reducing time to isolate AWS-side degradation; evaluate adding NHI alarms to existing TGW peering path monitoring this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Early pre-release of Cilium 1.21; worth tracking for upcoming CNI/eBPF features but not yet GA — no action on production clusters.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Relevant to any team using BYOIP prefixes on AWS: the new delegated RPKI automation eliminates manual ROA creation/renewal at the RIR, and the centralized dashboard surfaces hijacking risk via route overlap detection. Evaluate enabling this during the next IPAM configuration review cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: GA capability that may reduce execution time and cost for high-memory Lambda workloads outside a VPC; no deadline or migration required, but worth noting when sizing memory for data-intensive functions.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: TCPRoute and UDPRoute are now stable in the v1 API, making portable L4 routing viable for production workloads like databases, DNS, and VoIP. If you’re already using experimental Gateway API resources, audit for the new gateway.networking.x-k8s.io API group separation to avoid breakage on upgrade.
- CI/CD — Skip
- Leader — Learn: Gateway API continues maturing as the unified Kubernetes networking standard; L4 GA coverage strengthens the case for standardizing on it as the org’s golden-path ingress model over implementation-specific CRDs.
- Platform/SRE — Plan: Teams using IP allowlisting to permit Grafana Cloud traffic must migrate from legacy per-product endpoints (JSON, txt, DNS) to the new unified Allowlist API before January 31, 2027, when the old formats stop being maintained; schedule the allowlist automation update and test before the deadline.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: GA feature that reduces cross-AZ data transfer costs and latency for ECS Service Connect; existing services need a one-time redeployment to activate it. Schedule the redeployment across affected ECS services this quarter to capture the cost and latency benefit.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: ALB logs are now a first-class CloudWatch vended log type, enabling Logs Insights queries, metric filters, and Live Tail for load balancer traffic without custom shipping pipelines; evaluate adopting telemetry enablement rules to standardize coverage across accounts, noting the per-GB vended log cost vs. free S3 delivery.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Practical post-mortem on how Cilium networking caused GPU underutilization in Kubeflow training jobs — worth reading for anyone operating GPU clusters or eBPF-based CNIs where pod-to-pod latency affects collective communication.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful capability if you run Consul service mesh — one identity with multiple named ports reduces catalog sprawl. No deadline or GA-vs-pre-GA status confirmed in signals, so evaluate when scoping next Consul adoption work.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Regional expansion of network-optimized instances is worth noting if you run memory-intensive or high-throughput workloads in eu-west-3 or ca-central-1, but no action is required unless you’re actively evaluating instance types for those regions.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Pre-release provider for scraping budget switch web UIs via Terraform — interesting pattern for home-lab or SMB infrastructure automation, but pre-GA status caps this at Learn and HRUI hardware is unlikely in production platform environments.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: A practical pattern for restricting Kubernetes egress via Squid proxy — worth evaluating if the team lacks an egress-filtering strategy, but no deadline or GA release anchors this as Plan.
- CI/CD — Skip
- Leader — Skip