kvz v1.37.2-2

kvz now embeds Kubernetes v1.37.2 (from v1.35.10), the latest stable release.

brew upgrade kvz        # or: brew install kvz-platform/tap/kvz

Highlights

• Kubernetes v1.37.2. All 454 tests of the Sonobuoy certified-conformance suite pass on a two-node cluster.
• New volume types, all part of 1.37 conformance:
  • Image volumes (volumes[].image) mount an OCI image's files read-only, straight from the image store with nothing copied.
  • clusterTrustBundle projections provide CA bundles by name, or by signer and label selector.
  • podCertificate projections provide a per-pod key and certificate from a signer, refreshed before they expire.
• Quieter terminal. kvz server in a terminal shows a short ready banner; component logs go to ~/.kvz/kvz.log (--verbose streams them). The banner names the join-token file instead of printing the token.

Fixes

• Two kvz processes on one Mac, such as a server and an agent, could leave a half-unpacked image marked ready when both pulled it at once. Pulls are now locked across processes.
• Homebrew installs now ship the kernel's config, so CPU hotplug and CPU/memory limits work. They also prefer the bundled kernel over ~/.kvz/kernel, so upgrades get the matching kernel.
• go list -m all resolves, which fixes GoLand and VS Code setup for contributors.

Upgrading

Upgrading a running 1.35 cluster in place was tested: existing objects and nodes carried over. With several Macs, upgrade the servers first, then the agents. The embedded etcd can't be downgraded, so take a snapshot first (kvz etcd-snapshot save) if you might roll back.

This release is ad-hoc signed, not notarized. Homebrew and curl downloads run as is; for a browser download, run xattr -dr com.apple.quarantine on the unpacked folder.

Full changelog: v1.35.10-1...v1.37.2-2

kvz v1.35.10-1

The first release of kvz: Kubernetes that runs natively on your Mac. It embeds Kubernetes v1.35.10 and etcd 3.7.

brew install kvz-platform/tap/kvz
kvz server

You need an Apple Silicon Mac on macOS 26 or later. You can also download the tarball below, unpack it and run bin/kvz server from inside it; see Getting started.

What's in it

• One binary, no Linux VM underneath. etcd, kube-apiserver, the controller manager, the scheduler and a node all run as one macOS process. The API is ready in about 2 s and idles at about 1 % of a core and 260 MB.
• Every Linux pod is its own microVM. It runs on kvz's own Virtualization.framework monitor with a small Linux 6.18 kernel. A pod reaches Ready in about 100 ms, and 20 pods in under half a second. No VM pools, snapshots or pre-started pods are used.
• macOS pods and native pods. Run full macOS VMs you can kubectl exec into, or plain macOS processes for Xcode builds and code signing, in the same cluster.
• Conformance. All 428 tests of the Sonobuoy certified-conformance suite pass on a two-node cluster.
• Distribution features, in the spirit of k3s:
  • multi-Mac clusters with a pod network across nodes;
  • HA control planes (--cluster-init / --server);
  • cluster DNS, Services and NodePorts, hostPort, and fully emulated hostNetwork;
  • CPU and memory limits through cgroup v2, OOMKilled reporting and in-place resize;
  • ephemeral containers (kubectl debug);
  • Traefik ingress, helm-controller, local-path storage and metrics-server;
  • registry mirrors and auth (registries.yaml);
  • Secrets encryption at rest;
  • etcd snapshots and restore;
  • kvz install to run it as a login service.

Notes

• This release is ad-hoc signed, not notarized. Homebrew and curl downloads run as is. If a browser downloaded the tarball, run xattr -dr com.apple.quarantine on the unpacked folder first.
• kvz is new. Please don't run production on it yet.
• Benchmarks and method: docs/BENCHMARKS.md.