Container Service for Kubernetes:ACK release notes for Kubernetes 1.34

Component versions

The following table lists the supported versions of the core components for an ACK cluster.

Major changes

• Starting from version 1.34, new node pools use Alibaba Cloud Linux 3 Container-optimized by default if you do not specify an OS image.

• Starting from version 1.34, for new clusters created with the Terway network plugin and DataPath V2 selected, the kube-proxy container no longer runs on nodes where Terway is active. DataPath V2 uses eBPF to accelerate network access in shared ENI mode.

  This change applies only to newly created clusters.

• Starting from version 1.34, in ACK managed Pro clusters, the serverTLSBootstrap parameter and the RotateKubeletServerCertificate feature gate are enabled by default when you create standard and managed node pools.

  This configuration allows kubelet server certificates on nodes in the node pool to rotate automatically. It also supports validation of these certificates by the cluster CA, enhancing cluster node security.

• Starting from version 1.34, the kubelet server no longer supports the TLS_RSA_WITH_AES_256_GCM_SHA384 and TLS_RSA_WITH_AES_128_GCM_SHA256 TLS cipher suites. After you upgrade an existing cluster to version 1.34, this change is automatically applied to any new nodes.

• Starting from version 1.34, you can no longer mark a node as unschedulable during registration, and the set as unschedulable node pool configuration no longer has any effect. For details, see kubelet: remove --register-schedulable flag #122384.

  We recommend using node taints as an alternative to prevent pods from being scheduled onto newly registered nodes. When you configure a taint, do not use node.kubernetes.io/unschedulable as the key.

Feature updates

• The core functionality of Dynamic Resource Allocation (DRA) has graduated to General Availability (GA) and is enabled by default. With DRA, a workload can request resources by specifying the required device attributes. The scheduler allocates the device and places the pod on a node that can access it. The device driver and kubelet then configure the device and grant the pod access.

  Other DRA-related features have graduated to Beta and are enabled by default. These features allow administrators to access devices already in use with limited permissions for monitoring and diagnostics, configure an optional list of suitable device allocation options at request time, and enable the kubelet to monitor and report on DRA resources used by pods.

• The kubelet now supports using short-term credentials to authenticate with a container image repository. This improves security by avoiding the risks of using long-term credentials. For more information, see Service Account Token Integration for Image Pulls Graduates to Beta.

• The pod replacement policy for Jobs has graduated to GA to optimize pod replacement timing. By default, a replacement pod is created as soon as the old pod begins terminating, which can cause resource conflicts. By configuring the .spec.podReplacementPolicy field, you can delay the replacement until the old pod fully terminates, avoiding resource contention and unnecessary node scaling.

• The RecoverVolumeExpansionFailure feature has graduated to GA. If a volume expansion fails because the capacity requested in a PVC is too large, this feature allows you to recover by reducing the capacity request.

• Volume Attributes Classes has graduated to GA and is enabled by default. This feature allows you to define common volume parameters in a VolumeAttributesClass object. A PVC can then reference this object to apply the defined parameters.

• The kubelet now refuses to start a static pod if its referenced API objects, such as Secrets, ConfigMaps, PVCs, or ServiceAccounts, do not exist. This prevents the pod from entering an undefined state due to missing dependencies.

• Optimizations for kube-apiserver stability and performance:

  • Read requests are served from the cache, which reduces pass-through requests to etcd and lowers memory pressure on the kube-apiserver. Version 1.31 introduced support for Consistent Reads from Cache, and version 1.34 adds support for a Snapshottable API server cache that stores historical data versions.

  • For LIST requests, Kubernetes now supports streaming responses. This allows the server to use a small, constant amount of memory while processing the request, which effectively prevents memory spikes caused by clients fetching large amounts of data. For more information, see Streaming Encoding for LIST Responses.

• Version 1.34.3-aliyun.1 resolves an issue where pods that request resources using DRA get stuck in the Terminating state during deletion. For more information, see #133920.

New features

• PodLevelResources has graduated to Beta. Unlike traditional container-level resource definitions, this feature allows you to set overall resource requests and limits at the pod level to ensure that the total resource consumption of all containers does not exceed the pod's limits. For more information, see Pod Level Resource Specifications.

  This feature is not supported on Windows nodes.

• kubectl now supports defining user preferences in a .kuberc file by default. Unlike the kubeconfig file, which contains authentication credentials, this file is used exclusively for non-sensitive, client-side configurations. For more information, see Introduce kuberc.

• ExternalServiceAccountTokenSigner has graduated to Beta. This feature introduces the ExternalJWTSigner gRPC service, which allows an external key management solution to sign ServiceAccount tokens, instead of using a local static key.

• SchedulerAsyncAPICalls has graduated to Beta, and asynchronous API calls in kube-scheduler are enabled by default.

  This feature addresses kube-scheduler performance bottlenecks caused by blocking API calls during the scheduling cycle. By handling these calls asynchronously, this feature effectively reduces scheduling latency, prevents scheduler threads from being blocked by slow API responses, and provides faster retry opportunities for unschedulable pods. For more information, see Asynchronous API calls during scheduling.

• WindowsGracefulNodeShutdown has graduated to Beta and now supports graceful node shutdown on Windows nodes.

• PreferSameTrafficDistribution has graduated to Beta. This feature allows you to prioritize routing traffic to endpoints within the same availability zone or on the same node by setting the .spec.trafficDistribution field of a Service to PreferSameZone or PreferSameNode. The previous PreferClose option is now deprecated. For more information, see Traffic Distribution.

• kubeletPSI has graduated to Beta. It allows the kubelet to expose Pressure Stall Information (PSI) metrics in the Summary API and as Prometheus metrics. For more information, see PSI Metrics for Kubernetes Graduates to Beta.

• The static policy of the CPU manager now supports prefer-align-cpus-by-uncorecache to optimize the performance of workloads that run on processors with a disaggregated uncore cache architecture. For more information, see Introducing CPU Manager Static Policy Option for Uncore Cache Alignment.

References

For the complete changelog for Kubernetes 1.34, see CHANGELOG-1.34 and Kubernetes v1.34: Of Wind & Will (O' WaW).