Kubernetes v1.37: Bind Mount Options, emptyDir Mode and Memory QoS Beta

Feature Gates and Defaults in Kubernetes v1.37 #

Bind Mount Options: noexec on Writable Volumes #

Volumes are bind-mounted into containers without noexec, nosuid or nodev. The storage post by Nispriha Jagan and Neeraj Krishna Gopalakrishna of Red Hat explains the consequence: a compromised process can download a binary into any writable volume, such as an emptyDir or a PersistentVolume, make it executable and run it inside the container, even when the container has a read-only root filesystem. The new bindMountOptions field on a volume mount closes that gap. The same gap was raised in Kubernetes issue #48912 and in the Kubernetes 1.24 security audit, finding NCC-E003660-7HM.

The field works with emptyDir, PersistentVolumes, CSI, projected volumes, ConfigMaps and Secrets, but not with image volumes, and it is different from a PersistentVolume's mountOptions, which the CSI driver applies at the storage layer. The container runtime must support the CRI mount_options field and advertise it. The scheduler uses node declared features to avoid nodes without that support, and if a pod lands on one anyway the kubelet rejects it rather than run it without the options. The options have no effect on Windows nodes.

emptyDir Mode: Sticky Bit and Tighter Permissions #

An emptyDir has always been created with mode 0777, so any process in the pod could delete another container's files. A mode field now sets the creation mode: 01777 gives a shared directory the sticky bit, so only a file's owner can delete it, and 0750 limits access to the owner and group. It works with disk-backed, Memory and HugePages emptyDirs and does not need runtime support. If the pod sets fsGroup, the group permissions it applies override the emptyDir mode, as they already do for defaultMode on Secret and ConfigMap volumes.

The post's version skew note matters most for rollouts: if the API server has EmptyDirVolumeMode enabled but the kubelet does not, the field is accepted and ignored, and the kubelet falls back to 0777. A pod manifest that asks for 0750 can therefore run with a world-writable directory on a node whose kubelet lacks the gate, with no error.

Memory QoS Beta: On by Default, Throttling Off by Default #

The MemoryQoS gate is now on in every v1.37 kubelet, but the default memoryThrottlingFactor changed from 0.9 to null, so the kubelet writes no memory.high, memory.min or memory.low values unless configured. A kubelet configuration that already sets memoryThrottlingFactor keeps throttling after the upgrade; one that relied on the old 0.9 default silently loses it and must add the value explicitly. memoryReservationPolicy: TieredReservation enables tiered protection, but it applies to every pod on the node, with no per-pod opt-out.

Turning the feature off is where a node can fail to start its kubelet. With MemoryQoS: false, the kubelet rejects its configuration if memoryThrottlingFactor is anything other than 0.9 or if memoryReservationPolicy is TieredReservation, so those fields have to be removed or changed in the same rollout.

Pod-Level Resource Managers Beta #

Pod-Level Resource Managers let the Topology, CPU and Memory managers use a pod's .spec.resources, so a latency-critical container can get exclusive NUMA-aligned cores while sidecars share a pod-isolated pool. In beta, the PodResources gRPC service reports pod-level cpu_ids and memory. The gate stays off by default.

Adopting the v1.37 Changes on a Cluster #

1. Before relying on bindMountOptions or an emptyDir mode, enable VolumeBindMountOptions and EmptyDirVolumeMode on the API server and on every kubelet, kubelets first, so no node ignores a requested mode.
2. Add bindMountOptions: [noexec, nosuid] to writable volume mounts of workloads that run with readOnlyRootFilesystem: true, and confirm the container runtime advertises CRI mount options.
3. In every kubelet configuration that relied on Memory QoS throttling, set memoryThrottlingFactor explicitly before upgrading to v1.37.
4. When turning Memory QoS off, remove or adjust memoryThrottlingFactor and memoryReservationPolicy in the same change, or the kubelet will reject its configuration.
5. After rollout, run the post's checks inside a pod: an executable script on a noexec volume must fail with "Permission denied", and ls -ld on a 01777 emptyDir must show the sticky bit.