Kubernetes Known Issues

• Session recording is not supported when either the client or the Kubernetes cluster is using the now-deprecated SPDY protocol.

  • If your kubectl client and Kubernetes cluster are v1.31 and above, you shouldn't have this issue unless you explicitly disable the following kubectl feature control environment variables: KUBECTL_REMOTE_COMMAND_WEBSOCKETS and KUBECTL_PORT_FORWARD_WEBSOCKETS.
  • If you are connecting to an older cluster with the latest client, you need to enable both feature gates TranslateStreamCloseWebsocketRequests (added in Kubernetes v1.29) and PortForwardWebsockets (added in Kubernetes v1.30) to enable the newer WebSocket protocol. Otherwise, the streaming protocol will fall back to SPDY.
  • If your kubectl client or Kubernetes cluster is v1.28 and below, the streaming protocol will always fall back to SPDY.
  • For more detailed information, see this Kubernetes blog post.

• kubectl cp might experience failures on large files (see Kubernetes issue #60140). Use kubectl cp --retries option to mitigate the issue.

• Helm's lookup function does not work with ArgoCD by default. ArgoCD renders charts using helm template in an isolated repo-server with no Kubernetes API access, so lookup always returns empty. This is a known ArgoCD limitation.

  • The gateway Helm chart uses lookup to check whether a TLS secret already exists before deciding to reuse it or generate a new one. Because lookup returns an empty value under ArgoCD, the chart generates a new CA and certificate on every sync when tls.autoGenerated is true (the default).
  • See the ArgoCD enhancement proposal for further discussion on available workarounds.