Container Service for Kubernetes:ACK Release Notes for Kubernetes 1.35

Component versions

The following table lists the supported versions of core components in ACK clusters.

Breaking changes

• Starting with version 1.35, Kubernetes no longer supports cgroup v1. Support for cgroup v2 graduated to Stable in version 1.25. The node operating system must be upgraded to support cgroup v2, or the kubelet will fail to start.

  For information about cgroup version support in ACK OS images, see Operating systems. To learn how to change or upgrade the operating system, see Change operating systems.

Feature updates

• The PreferSameNode option for the Service trafficDistribution field has graduated to General Availability (GA). This option prioritizes routing traffic to endpoints on the same node, falling back to other nodes only when no local endpoints are available.

  The feature gate for this feature, PreferSameTrafficDistribution, has been enabled by default since version 1.34 and supports both PreferSameNode and PreferSameZone. The original PreferClose option has been renamed to PreferSameZone.

• PodObservedGenerationTracking has graduated to GA. When a Pod's spec is updated, its .metadata.generation is incremented. The kubelet now records the spec version it has processed in the Pod's .status.observedGeneration field. This allows controllers and Operators to accurately determine if changes to a Pod, such as in-place scaling, have taken effect on the node, preventing issues caused by status update delays.

• The node topology manager policy option max-allowable-numa-nodes (max-allowable-numa-nodes) has graduated to GA. The topology manager can now correctly calculate affinity on servers with more than 8 NUMA nodes.

• The Downward API now supports injecting node topology labels, such as topology.kubernetes.io/zone and topology.kubernetes.io/region, into Pods.

• StorageVersionMigrator, promoted to Beta and disabled by default, moves the storage version migration capability from an external tool into the Kubernetes core. For more information, see Move Storage Version Migrator in-tree.

• MutableCSINodeAllocatableCount is now enabled by default. It allows CSI drivers to periodically update the number of allocatable volumes on a node. This helps resolve an issue where Pods could be scheduled to nodes with insufficient volume capacity and get stuck in the ContainerCreating state.

• Opportunistic batching allows the scheduler to cache intermediate scheduling results, significantly improving scheduling throughput for similar Pods.

• MaxUnavailableStatefulSet is promoted to Beta and is enabled by default. This feature allows you to set the maxUnavailable field in a StatefulSet's rolling update strategy to specify the maximum number of unavailable Pods during an update.

• Pod Certificates is promoted to Beta and is disabled by default. This feature supports generating certificates for Pods to perform mutual TLS authentication with the kube-apiserver. It also supports automatic certificate rotation, providing a more secure authentication method than traditional ServiceAccount tokens. For details, see KEP-4317: Pod Certificates.

• Kubectl now supports the KYAML format. KYAML is a subset of YAML designed for Kubernetes that aims to resolve certain ambiguities and security issues found in standard YAML parsing. You can disable this feature by setting the KUBECTL_KYAML=false environment variable. For more information, see Introducing KYAML.

• The behavior field of the HorizontalPodAutoscaler (HPA) now supports configurable tolerance thresholds. Previously, scaling decisions relied on a fixed global tolerance of 10%, which is now configurable.

• User namespaces is promoted to Beta. This feature allows a Pod to run in a user namespace that is isolated from the host. Container processes can run as root (UID 0) within their namespace but are mapped to an unprivileged, non-zero user ID on the host. This reduces the security risk of privilege escalation from a container escape.

• ImageVolume is now enabled by default, allowing you to use volumes of type image in a Pod. This type of volume mounts the contents of a container image as a read-only volume. This feature requires containerd v2.1 or later.

• KubeletEnsureSecretPulledImages is promoted to Beta and is enabled by default. This feature improves security in multi-tenant clusters by enforcing credential checks for Pods that use imagePullPolicy: IfNotPresent. It prevents a scenario where one Pod with credentials pulls a private image, allowing other Pods on the same node without credentials to access the sensitive image from the local cache.

• ContainerRestartRules, promoted to Beta and enabled by default, enables more granular, container-level restart policy configuration. It allows you to override the Pod-level restart policy by specifying restartPolicy and restartPolicyRules for individual containers. For details, see Individual container restart policy and rules.

• CSI drivers can now set the CSIDriver object's spec.serviceAccountTokenInSecrets field to true to mount ServiceAccount tokens via a Secret instead of placing them directly in the volume context. This helps prevent credentials from being accidentally exposed in logs and error messages. For more information, see CSI driver opt-in for service account tokens via secrets field.

• A new terminatingReplicas field has been added to Deployments. It records the number of Pods that have a deletion timestamp set but have not yet been completely removed from the system.

• Fixed CVE-2024-61732 and CVE-2024-68121 in version 1.35.2-aliyun.1.

Deprecations

• Starting from version 1.35, the kube-proxy ipvs mode has been deprecated and is scheduled for removal in a future release. The official recommendation is to switch to nftables mode, which has been stable since v1.33. Because nftables mode is relatively new, ACK clusters created with version 1.35 still default to ipvs mode. However, you can now select nftables as the Service Forwarding Mode when creating a new cluster.

  We recommend using Terway Datapath V2, which operates independently of kube-proxy.

• Version 1.35 is the last release to support containerd 1.x. Before upgrading to Kubernetes 1.36 or later, you must upgrade containerd to a 2.x version. ACK clusters have been using containerd 2.x by default since version 1.33. For details, see Introduction to containerd 2.1.

References

For the complete changelog for Kubernetes 1.35, see CHANGELOG-1.35 and Kubernetes v1.35: Timbernetes (The World Tree Release).