– Improvement

SKS: Container registry mirroring for Karpenter nodes

Wed, 19 Aug 2026 08:00:00 +0000

Exoscale SKS now supports configuring OCI registry mirrors for nodes provisioned by Karpenter. Registry mirror endpoints and pull credentials can be defined in an ExoscaleNodeClass and applied consistently to new nodes created from that class.

What this enables

Faster and more reliable image pulls: Route image requests through private mirrors located closer to your workloads.
Lower egress costs: Reduce repeated downloads from public registries by caching commonly used container images.
Fewer upstream limits: Avoid relying solely on public registries and reduce the impact of their rate limits or availability issues.
Greater supply-chain control: Use private registries, authenticated mirrors, and trusted TLS configurations for container images.

Why it matters

Registry mirroring gives teams more control over how container images reach their SKS clusters. It improves reliability and supports production environments that require private access, predictable image delivery, or tighter control over external dependencies.

Learn how to configure OCI registry mirroring for Karpenter nodes.

SKS: CPU Manager policies for Karpenter-provisioned nodes

Mon, 17 Aug 2026 08:00:00 +0000

Exoscale SKS now supports configuring Kubernetes CPU Manager policies for nodes provisioned by Karpenter. You can define the kubelet CPU Manager configuration in an ExoscaleNodeClass and apply it consistently to every node created from that class.

What this enables

More predictable performance: Assign exclusive CPUs to eligible workloads that are sensitive to latency or CPU contention.
Consistent node configuration: Apply the selected CPU policy automatically to new nodes provisioned by Karpenter.
Flexible workload isolation: Reserve CPU capacity for Kubernetes and system components while keeping application resources separate.

Why it matters

CPU Manager policies give teams greater control over how processor resources are allocated across their SKS workloads. This is especially useful for high-performance, real-time, and other compute-intensive applications that benefit from stable CPU placement.

Learn how to configure CPU Manager policies with Karpenter.

SOS: Full-Object Checksums for Multipart Uploads

Tue, 03 Feb 2026 08:00:00 +0000

SOS now supports full-object checksums for multipart uploads using CRC32C, CRC64, and CRC64NVME. This allows you to verify the integrity of large objects end-to-end, without re-reading all parts again. As a result, integrity checks are faster, cheaper, and better suited for backup and compliance workloads.

Read our documentation

SOS: Encryption at rest with SSE-SOS

Tue, 04 Nov 2025 08:00:19 +0000

SOS now supports encryption at rest with SSE-SOS (using AES-256 encryption). When enabled, SSE-SOS offers free, automatic and fully managed encryption of all new objects written to your bucket. Combined with encryption in transit (TLS), your data is protected end-to-end without the need to manage keys on your side.

Learn more

Portal & Billing: Additional Invoice Email

Tue, 07 Oct 2025 10:07:42 +0000

We are introducing a new feature to simplify invoice management — Additional Invoice Email.

Until now, customers who wanted invoices sent to a different address needed to create an extra user within their organization. With this update, that’s no longer necessary.

You can now add an additional email address under your organization’s Billing details in the Portal. This address will receive invoices only, without requiring user registration or login access.

This change makes it easier for finance teams and accounting departments to receive invoices directly, without involving technical or administrative users. It’s a small improvement that helps customers manage billing more easily and efficiently.

Check our documentation

SSO: Available for all organizations

Tue, 02 Sep 2025 05:07:59 +0000

We have made single sign-on (SSO) available to every organization on Exoscale. SSO was previously limited to customers with specific support plans. With this change, all organizations can now benefit from secure and centralized authentication.

This update aligns with our mission to provide a simple, secure, and scalable cloud platform for everyone, without limiting essential features to plan tiers.

What’s new?

All organizations can now enable SSO.
No support plan requirement.
Works with existing identity providers, such as Auth0, Okta, EntraID, JamF and many more.

Why is it important for you?

Unified authentication for all team members.
Increased security through identity provider integration.
Faster and easier user onboarding.

Learn more about activating and configuring SSO

SOS: Conditional Requests and Conditional Delete

Tue, 19 Aug 2025 08:00:00 +0000

Conditional requests have been implemented across SOS to enhance the safety of write and delete operations and improve the efficiency of read operations.

Key features include:

Conditional Delete (DeleteObject): Utilize If-Match, If-Match-Size, and If-Match-Last-Modified-Time for safer deletions.
Conditional Get: Employ If-Match / If-None-Match or If-Modified-Since / If-Unmodified-Since for efficient retrieval.
Conditional Put: Use If-Match / If-None-Match for controlled writes.
Conditional Copy: Apply copy-source-if-match / copy-source-if-none-match or copy-source-if-modified-since / copy-source-if-unmodified-since for precise copying.
Write-once policy example: Enforce If-None-Match: "*" at the bucket level to ensure data is written only once.

For a comprehensive guide, please refer to the Exoscale documentation

Anonymization of custom Object Storage ACLs

Tue, 12 Aug 2025 07:23:35 +0000

Starting October first, it will be possible to set ACLs giving grants to other Exoscale organizations only by using their opaque UUIDs. The same UUID will be returned in all response listing grants.

The change is in line with the latest AWS S3 API behaviour, and will ensure full anonymity across the platform when using ACLs.

Exoscale Calculator – Major Update

Thu, 07 Aug 2025 13:35:35 +0000

We've rolled out a significant update to the Exoscale Calculator to make planning and comparing your cloud workloads easier. Here's what's new:

Compare multiple setups: You can now work with various carts in tabbed view. Duplicate an entire cart or individual items, and reorder them via drag‑and‑drop.

Better planning tools: Cost and resource estimates are more detailed. We've reorganized VM and DB listings with clearer categories and GPU details. A fuzzy search supports queries like "2 CPU 4 GB RAM" or "GPU", and a "Find My Instance" helper suggests the closest fit based on your input.

Interactive zone selection: A new SVG map lets you pick a datacenter visually and see where your workloads would run.

Improved cluster configuration: Kubernetes clusters now support adding block storage and network load balancers directly; the calculator displays associated security groups and averages CPU/RAM consumption.

Other enhancements: We've added a collapsible list of features included with every account, improved mobile layouts, and folded in numerous minor fixes and translation tweaks.

Why it matters?

Existing customers can fine-tune costs and plan future workloads. New customers get a clearer view of our data centers and can easily find the best fit for their projects.

Try the Exoscale Advanced Calculator now

SKS: Option to Automatically Create Security Group Rules on Cluster Creation

Tue, 15 Jul 2025 12:53:27 +0000

We’ve added a new option to automatically create the required security group rules when provisioning a Kubernetes cluster. When enabled, Exoscale will automatically create a Security Group with the necessary network rules based on the selected CNI (Container Network Interface). It will be automatically attached to any node pool created in this cluster. This ensures your cluster has the correct communication paths between nodes and services, without requiring manual configuration.

Availability

Enabled by default in the portal
Available in the Exoscale Web Portal
Soon to be available in the Exoscale CLI (as a flag)
Not available in the Terraform provider, to preserve consistency with existing resource semantics

This addition enhances the onboarding experience by reducing the need for manual network configuration, while still allowing users who prefer to manage their own rules to maintain complete control over their settings.

Check our SKS documentation

Decoupled CCM & CSI Add-ons

Fri, 13 Jun 2025 12:30:00 +0000

We’ve introduced a credential separation improvement for Kubernetes clusters using Exoscale SKS. The Cloud Controller Manager (CCM) and Container Storage Interface (CSI) add-ons now use independent IAM API keys and roles, improving security and lifecycle management, as well as allowing CSI to be deployed independently.

What's new?

When creating or updating an SKS cluster with add-ons enabled, separate IAM roles and API keys are now automatically created per add-on and per cluster.
These credentials follow a clear naming pattern: sks-<addon>-<cluster-id>
Credential lifecycles are fully managed by Exoscale: they’re created with the cluster and automatically removed when the cluster is deleted.

Why does this matter?

Improved Security: Credentials are isolated per add-on, minimizing permission exposure.
Granular Access Control: Fine-tune or audit CCM and CSI access independently.
Easier Auditing: Identify and monitor actions from each add-on individually.
Simplified Operations: In case of accidental deletion or suspected compromise, credentials can be rotated easily.

This change applies automatically to newly created or updated clusters. Existing clusters continue to work as-is and can adopt the new model by updating the cluster configuration or rotating the respective credentials.

Learn more in our docs

SKS Enhancements – Now Supporting Kubernetes 1.30 to 1.33 with Improved Security Defaults

Thu, 22 May 2025 12:29:43 +0000

We're excited to announce that Exoscale Scalable Kubernetes Service (SKS) now supports the following Kubernetes versions:

1.30.13
1.31.9
1.32.5
1.33.1

What's New

🔐 User Namespaces Enabled by Default in 1.33.1

Kubernetes 1.33.1 introduces user namespaces as a default feature in SKS. This critical security enhancement provides an extra isolation layer between containers and the host system, helping you run workloads more securely in multi-tenant and zero-trust environments.

User namespaces have been stable since Kubernetes 1.30.0, but with 1.33.1, we're enabling them out of the box.

Action required: To benefit from this security improvement, please upgrade your cluster nodes to version 1.33.1.

Learn more: Kubernetes Documentation on User Namespaces

🛡️ AppArmor Enforcement Introduced

We've also introduced explicit AppArmor compatibility checks starting with this release.

While AppArmor has been usable in most past SKS versions, a recent regression highlighted the need for stricter validation. We now enforce prerequisites to ensure AppArmor is consistently available across all future Kubernetes versions on SKS.

Learn more about our Kubernetes offering

Windows Server Update: Multilingual Support, 2025 Template, 2019 Deprecation & Price Stability

Wed, 19 Mar 2025 14:47:38 +0000

We are enhancing our Windows Server templates with language configuration options as well as introducing the latest Windows Server 2025 template, and phasing out older versions.

Windows Server Pricing Stability

As you may know, Microsoft has announced a price increase for Windows Server licenses effective January 1, 2025. However, we are pleased to inform you that Exoscale will not be increasing our prices for this license. Our goal is to provide consistent value without unexpected changes that could disrupt your operations.

Multilingual Windows Server Templates

Our Windows Server templates now come with English, German, and French pre-installed, with English set as the default language. You can configure your server to use German or French as the display and/or system language. For detailed instructions, refer to our technical documentation.

New Windows Server 2025 Template

We are introducing a Windows Server 2025 template, incorporating the latest features and improvements from Microsoft.

Windows Server 2019 Deprecation

As Windows Server 2019 reached end-of-life in January 2024, it will no longer be available for starting new instances. Existing instances running Windows Server 2019 will continue to operate.

SKS Now Ships Kubernetes 1.32

Tue, 18 Feb 2025 08:59:02 +0000

We’re happy to announce that Kubernetes 1.32 is now available in SKS! This latest release brings a set of improvements designed to make your clusters more efficient than ever.

What’s New in SKS?

In addition to shipping Kubernetes 1.32 as supported version, we revamped our Node Operating System templates with the following characteristic:

About 40% faster boot times
No SSH Server anymore and reduced amount of installed software
Better Resource Management of system workloads like containerd and kubelet.
Containerd 2.0: The latest version of the container runtime, replacing containerd 1.

How to benefit from those improvements?

We encourage you to stay as much up-to-date as possible to improve your security posture, so you can upgrade to the latest release of Kubernetes 1.32.2.

However, we have also backported those changes in older, still supported, versions like: 1.29.14, 1.30.10 and 1.31.6.

You can find more information about how to upgrade here.

New CLI Features for DBaaS User Management

Mon, 16 Dec 2024 07:00:17 +0000

We’ve extended DBaaS user management capabilities to the Exoscale CLI, making database administration easier and more flexible.

New Features:

Create DBaaS users.
Delete DBaaS users.
Reset DBaaS user credentials.
List and view DBaaS user details.

Example:

# Resetting a DBaaS user’s credentials

➜ exo dbaas user reset-credentials test myuser2

✔ Resetting DBaaS user "myuser2" 0s

┼───────────────┼──────────────────────────┼
│ Username │ myuser2 │
│ Type │ regular │
│ Password │ AVNS_46o-1gO9pE8acEc9Nzp │
┼───────────────┼──────────────────────────┼

To see the full list of DBaaS User Management commands, run:

exo dbaas user -h

These features enhance flexibility and bring API capabilities to our CLI tooling.

Object Storage - Encryption at Rest (SSE-C)

Fri, 16 Jun 2023 06:35:33 +0000

Encryption at Rest (SSE-C) is now available for our Object Storage. By supporting the S3 SSE-C extension, we are going the next step to help you secure your data. Up until now, all data transiting from and to our storage benefited from encryption in transit already. Server Side Encryption adds full protection to data while maintaining the data owner's control over it.

With SSE-C a "Customer" key must be referenced when uploading and retrieving data. This ensures, that data is encrypted at rest and unreadable without the key. Find more details in our storage documentation.

The feature is available via API and compatible with many S3 libraries and tools.

Get started

Simple Object Storage Versioning

Mon, 24 Apr 2023 15:34:37 +0000

We are now supporting bucket versioning. Preserve, retrieve and restore previous versions of objects stored in SOS/S3 buckets easily. Read more about the features in the documentation.

The feature is usable via API and portal support will be added at a later stage.

Create your bucket

Integrated Kafka Connect

Mon, 27 Feb 2023 10:41:02 +0000

It is now easier to retrieve the URL and credentials of the integrated Kafka Connect within the portal and API. Next to the Apache Kafka REST API and Schema Registry the new feature lets you easily stream data into and out of Apache Kafka.

The feature is only available for Business and Premium plans.

Explore Kafka Connect

PgBouncer enabled in Portal

Fri, 29 Jul 2022 14:04:01 +0000

Next to Backups, Metrics or Logs it is now possible to set up PgBouncer within the portal. In the tab "Connection Pools" you can now set up your PgBouncer and improve the performance of your databases and easily maintain a pool of connections for your PostgreSQL databases.

The default mode for connection pools is Transaction but can be switched to Session or Statement as well.

Set up your PgBouncer

Metrics for DBaaS

Tue, 05 Jul 2022 14:41:36 +0000

Next to the Backups, IP Filter and Logs tabs you can now access Metrics for your databases within the portal. Keep track of the performance and behaviour of your databases by reviewing the most important stats.

Following metrics are available:

Load average (5 min)
CPU usage %
Memory usage %
Disk space usage %
Disk IOPS (writes & reads)
Network transmit (KB/s)
Network receive (KB/s)

Try it in the portal

DBaaS Backup Plans in CLI

Wed, 08 Jun 2022 13:41:18 +0000

It is now easier to check the specific DBaaS backup plan in the CLI. Get an overview of the backup interval, max backups, recovery mode and more with a simple command:

exo dbaas type show pg --backup-config startup-8

┼────────────────────────────┼──────┼
│ Backup interval (hours) │ 24 │
│ Max backups │ 3 │
│ Recovery mode │ pitr │
│ Frequent backup interval │ n/a │
│ Frequent backup max age │ n/a │
│ Infrequent backup interval │ n/a │
│ Infrequent backup max age │ n/a │
┼────────────────────────────┼──────┼

All our DBaaS offerings come with daily automatic backups included. The daily backup frequency and retention depends on the chosen plan.

Note: Update to the latest CLI version to be able to use the new command.

More about backups & restoring on DBaaS

Cilium CNI & SKS

Fri, 03 Jun 2022 08:50:26 +0000

The Cilium CNI is now even easier to use with SKS. While SKS has had previous support for other CNIs than our default Calico setup, we now enabled a simple switch to specify Cilium instead. While initiating your cluster you can specify Cilium as CNI plugin using the --cni flag:

exo compute sks create my-test-cluster \
 --zone de-fra-1 \
 --cni cilium \
 --service-level pro \
 --nodepool-name my-test-nodepool \
 --nodepool-size 3 \
 --nodepool-security-group sks-security-group

Cilium is an open source software providing and securing network connectivity between application workloads like containers or processes. The software is integrated into orchestration frameworks like Kubernetes.

A Linux eBPF Kernel is at the foundation of Cilium. The kernel supports dynamic insertion of eBPF bytecode, like security, visibility, and networking control logic. eBPF is used to provide high-performance networking, multi-cluster capabilities, extensive network security capabilities and more.

How to use Cilium on SKS

ED25519 keys for SSH now supported in our portal

Tue, 02 Feb 2021 10:34:58 +0000

ED25519 ssh keys can now be imported in the Exoscale portal. These keys are smaller, faster to generate and verify and more importantly offer better security.

If you do not have one already create a new key pair with ssh-keygen -t ed25519 -C "strong-key@exoscale.net"

Import the key in the Exoscale portal:

Import keypairs in Exoscale portal

Pre-built Windows Recovery Images

Wed, 30 Sep 2020 19:38:52 +0000

Pre-built Recovery Images for Windows Server 2016 and Windows Server 2019 are now available, allowing you to boot and rescue a corrupted Windows-based Instance more easily.

Managed Setup and Health Check for Elastic IP

Wed, 26 Jun 2019 12:26:00 +0000

Elastic IP get transparent mangement and health check functionalities.

Exoscale security certificates for ISO27001, ISO27018 and CSA

Thu, 10 Jan 2019 23:00:00 +0000

We have reached full compliance level with certifications on all aspects of our cloud hosting - compute, network and storage - in all locations for:

ISO27001: Managing Information Security
CSA Star 2: Securing cloud computing environments
ISO27018: Protecting personal data

Learn more in our compliance center

USD support

Tue, 27 Nov 2018 23:00:00 +0000

Pricing and payments in USD throughout the platform.

The experience for our customers outside Switzerland and Europe can be completely provided in USD with lower currency exchange impact.