Container Service for Kubernetes:ACK Kubernetes 1.33 release notes

Sidecar containers are promoted to GA and enabled by default. A sidecar container is a special type of init container. Set restartPolicy: Always to keep it running throughout the pod lifecycle. Probe configuration is also supported. (Automatically enabled; no action required.)

PodLifecycleSleepActionAllowZero is promoted to Beta. The sleep action in a preStop lifecycle hook can now be set to a wait time of 0 seconds. (Automatically enabled; no action required.)

UserNamespacesSupport is promoted to Beta and enabled by default. Pods can use Linux user namespaces to improve container isolation. This change does not affect existing pods. To use this feature, you must manually specify pod.spec.hostUsers. For more information, see User namespaces enabled by default. (Opt-in required: set pod.spec.hostUsers to enable per pod.)

SupplementalGroupsPolicy is promoted to Beta and enabled by default. Control supplemental groups for a pod through the .spec.securityContext.supplementalGroupsPolicy field for more precise access permissions on persistent volumes. For more information, see Configure fine-grained SupplementalGroups control for a pod. (Opt-in required: set .spec.securityContext.supplementalGroupsPolicy on the pod.)

ProcMountType is promoted to Beta. Customize the mount type of the /proc file system in a container using the securityContext.procMount field. This is particularly useful for unprivileged containers running in user namespaces, where relaxing /proc restrictions improves compatibility. (Opt-in required: set securityContext.procMount to use.)

SchedulerPopFromBackoffQ is added and enabled by default. When the activeQ is empty, pods are popped directly from the backoffQ, significantly reducing scheduling latency. (Automatically enabled; no action required.)

SchedulerAsyncPreemption is promoted to Beta and enabled by default. Preemptive scheduling runs asynchronously, reducing the latency impact of preemption on the scheduling cycle. (Automatically enabled; no action required.)

Scheduling performance for topology spread constraints is optimized. (Automatically applied; no action required.)

MatchLabelKeysInPodAffinity is promoted to GA and enabled by default. Pod affinity rules now support matchLabelKeys and mismatchLabelKeys for more precise control over pod colocation. (Opt-in required: set matchLabelKeys or mismatchLabelKeys in pod affinity rules to use.)

NodeInclusionPolicyInPodTopologySpread is promoted to GA and enabled by default. Use nodeAffinityPolicy and nodeTaintsPolicy in pod topology spread constraints to filter schedulable nodes dynamically. (Automatically applied with default values; configure explicitly to change behavior.)

• nodeAffinityPolicy: Defaults to Honor. Only nodes matching the pod's nodeSelector or nodeAffinity are included in topology spread calculations.

• nodeTaintsPolicy: Defaults to Ignore. The nodeAffinity and nodeSelector rules are ignored, and all nodes are included in the topology spread calculation.

CPUManagerPolicyOptions is promoted to GA and enabled by default. Fine-tune CPU Manager resource allocation with two options: (Opt-in required: configure CPUManagerPolicy options to use.)

• Force Simultaneous Multithreading (SMT) alignment so that exclusively allocated CPUs occupy complete physical cores. For more information, see CPU manager extension to reject non-SMT-aligned workloads.

• Distribute CPU resources evenly across Non-Uniform Memory Access (NUMA) nodes instead of packing them. For more information, see Distribute CPUs across NUMA nodes.

HonorPVReclaimPolicy is promoted to GA and enabled by default. When a persistent volume's (PV) reclaimPolicy is set to Delete, the underlying storage resource is deleted according to the policy regardless of the deletion order of the PV or PVC, preventing storage resource leaks. (Automatically applied; no action required.)

MultiCIDRServiceAllocator is promoted to GA and enabled by default. Introduces ServiceCIDR and IPAddress resources to track ClusterIP allocations for Services. The allocatable ClusterIP range can be expanded dynamically through ServiceCIDR. (Automatically enabled; no action required.)

ImageVolume is promoted to Beta but is disabled by default. To use it, manually enable the feature gates on both the kube-apiserver and kubelet. This lets you mount a container image as a read-only volume using an image volume source in a pod. (Opt-in required: enable feature gates on both kube-apiserver and kubelet.)

ResourceQuota can now limit the number of PVCs associated with a specific volume attributes class. (Opt-in required: configure ResourceQuota with the volume attributes class.)

RelaxedDNSSearchValidation is promoted to Beta and enabled by default. Special characters, including . and _, are now allowed in the .spec.dnsConfig.searches field of a pod, providing more flexibility for DNS configuration. (Automatically enabled; no action required.)

JobBackoffLimitPerIndex is promoted to GA. Specify the maximum number of pod retries per index in an indexed job. (Opt-in required: set backoffLimitPerIndex on the job spec.)

JobSuccessPolicy is promoted to GA. Define custom success policies for a job—for example, determine job completion based on which indexes succeeded and how many. For more information, see Job's SuccessPolicy goes GA. (Opt-in required: set successPolicy on the job spec.)

OrderedNamespaceDeletion is promoted to Beta. When a namespace is deleted, workload pods are removed first, followed by dependencies such as NetworkPolicy and storage resources. This prevents pods from remaining after critical security resources are deleted. (Automatically applied; no action required.)

Streaming list responses replace the WatchList mechanism. The kube-apiserver now uses StreamingCollectionEncodingToJSON and StreamingCollectionEncodingToProtobuf to stream responses for large-scale resource list requests. For list requests containing many resources, this significantly reduces memory usage and improves system stability. The kube-controller-manager no longer actively enables the WatchListClient feature. For more information, see Streaming list responses. (Automatically applied; no action required.)