Kubernetes 1.25 (EOM) Release Notes

PodSecurityPolicy is replaced by Pod Security Admission. For details about the migration, see Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller.

An ephemeral container runs temporarily in an existing pod. It is useful for troubleshooting, especially when kubectl exec cannot be used to check a container that breaks down or its image lacks a debugging tool.

Kubernetes supports cgroups v2, which provides some improvements over cgroups v1. For details, see About cgroup v2.

endPort in Network Policy is stable. This feature is incorporated in version 1.21. endPort is added to NetworkPolicy. You can specify a port range.

This feature supports capacity isolation of local ephemeral storage shared between pods, such as emptyDir. If a pod consumes more local ephemeral storage capacity than the limit, the pod can be evicted to limit its consumption of shared resources.

This makes it possible to declare how to validate custom resources using CEL. For details, see Validation rules.

The KMS v2 alpha1 API is introduced to add performance, rotation, and observability improvements. This API uses AES-GCM to replace AES-CBC and uses DEK to encrypt data at rest (Kubernetes Secrets). No additional operation is required during this process. Additionally, data can be read through AES-GCM and AES-CBC. For details, see Using a KMS provider for data encryption.

Kubernetes 1.25 introduces alpha support for PodHasNetwork. This status is in the status field of the pod. For details, see Pod network readiness.

• In Kubernetes 1.25, minReadySeconds for StatefulSets is stable. It allows each pod to wait for an expected period of time to slow down the rollout of a StatefulSet. For details, see Minimum ready seconds.
• In Kubernetes 1.25, maxSurge for DaemonSets is stable. It allows a DaemonSet to run more than one pod on a node during a rollout. This minimizes DaemonSet downtime for users. DaemonSet does not allow maxSurge and hostPort to be used at the same time because two active pods cannot share the same port on the same node. For details, see Perform a Rolling Update on a DaemonSet.

Alpha support for running pods with user namespaces is provided. The root user in a pod is mapped to a non-zero ID outside the container, so that the root user appears to be running as root in the containers, while as a regular unprivileged ID from the host point of view. This feature is behind a feature gate, so make sure to enable the UserNamespacesStatelessPodsSupport gate before you can use the new feature. For details, see Alpha support for running pods with user namespaces.

Dockershim was marked deprecated in Kubernetes 1.20 and officially removed from kubelet in Kubernetes 1.24. If you want to use Docker container, switch to cri-dockerd or other runtimes that support CRI, such as containerd and CRI-O.

For details about how to switch from Docker to containerd, see Migrating Nodes from Docker to containerd.

Check whether there are agents or applications that depend on Docker Engine. For example, if docker ps, docker run, and docker inspect are used, ensure that multiple runtimes are compatible and switch to the standard CRI.

The Kubernetes community found 90% cluster administrators did not care about the beta APIs and left them enabled. However, beta features are not recommended because these APIs enabled in the production environment by default incur risks. Therefore, in 1.24 and later versions, beta APIs are disabled by default, but the existing beta APIs will retain the original settings.

In Kubernetes 1.24 and later versions, OpenAPI V3 is enabled by default.

In Kubernetes 1.24 and later versions, the CSIStorageCapacity API supports exposing the available storage capacity. This ensures that pods are scheduled to nodes with enough storage capacity, which reduces pod scheduling delay caused by volume creation and mounting failures. For details, see Storage Capacity.

In Kubernetes 1.24 and later versions, the gRPC probe goes to beta. The feature gate GRPCContainerProbe is available by default. For details about how to use this probe, see Configure Probes.

LegacyServiceAccountTokenNoAutoGeneration moves to beta. By default, this feature is enabled, where no secret token is automatically generated for a service account. To use a token that never expires, create a secret to hold the token. For details, see Service account token Secrets.

Kubernetes 1.24 introduces a new feature that allows users to soft-reserve a range for static IP address assignments to Services. After you enable this function, Service IP addresses will be automatically assigned from the IP address pool to minimize IP address conflict. For details, see Avoid Collisions Assigning IP Addresses to Services.

Kubernetes clusters of versions later than 1.24 are compiled based on Go 1.18. By default, the SHA-1 hash algorithm, such as SHA1WithRSA and ECDSAWithSHA1, is no longer supported for certificate signature verification. Use the certificate generated by the SHA256 algorithm instead.

In Kubernetes 1.24 and later versions, the maxUnavailable parameter can be configured for StatefulSets so that pods can be stopped more quickly during a rolling update.

In Kubernetes 1.24, non-graceful node shutdown is in the alpha stage. A node shutdown is considered graceful only if kubelet's node shutdown manager can detect the upcoming node shutdown action. For details, see Non-graceful node shutdown handling.

Kubernetes typically creates iptables chains to ensure data packets can be sent to the destination. These iptables chains and their names are for internal use only. These chains were never intended to be part of any Kubernetes API/ABI guarantees. For details, see Kubernetes's IPTables Chains Are Not API.

In versions later than Kubernetes 1.25, Kubelet uses IPTablesCleanup to migrate the Kubernetes-generated iptables chains used by the components outside of Kubernetes in phases so that iptables chains such as KUBE-MARK-DROP, KUBE-MARK-MASQ, and KUBE-POSTROUTING will not be created in the NAT table. For more details, see Cleaning Up iptables Chain Ownership.