ACK release notes for Kubernetes 1.30

Version 1.30.7-aliyun.1 addresses the CVE-2024-10220 vulnerability.

In Kubernetes 1.29

• The PreStop hook now includes a sleep action that pauses a container before termination, allowing in-flight requests to complete. See KEP-3960: Introducing Sleep Action for PreStop Hook.

• The SidecarContainers feature (Beta, enabled by default) lets you set an init container's restartPolicy to Always, turning it into a sidecar container that starts, stops, and restarts independently of the main container and other init containers. See Sidecar Containers.

  Ensure the kubelet version on nodes matches the control plane version.

• The new ServiceCIDR resource type dynamically configures the Service cluster IP range (Alpha, disabled by default). See KEP-1880: Multiple Service CIDRs.

• PVCs and Containers previously shared the ResourceRequirements struct for requests and limits, causing unwanted PVC API changes when the Container resources struct changed (e.g., when claims was added). PVCs now use a separate VolumeResourceRequirements struct with only requests and limits, excluding claims. See Volume resource requirements.

• The PodReadyToStartContainers feature (Beta, enabled by default) indicates that a Pod's sandbox and network configuration are ready, helping the kubelet track Pod status. See Pod conditions.

• PodAffinity and PodAntiAffinity now support matchLabelKeys and mismatchLabelKeys to distinguish new and old Pods during rolling updates. With matchLabelKeys, the Deployment's pod-template-hash label lets the scheduler evaluate only Pods with the same pod-template-hash value. See KEP-3633.

• ValidatingAdmissionPolicy type checking now supports CRDs and API Extension types in addition to core Kubernetes API resources. See type-checking.

• The new UserNamespacesPodSecurityStandards feature gate integrates user namespaces with Pod Security Standards, allowing containers to run with a non-root or specified user identity (Alpha, false by default, may remain false). See KEP-127: Update PSS based on feature gate.

• The new DisableNodeKubeProxyVersion feature gate deprecates the status.nodeInfo.kubeProxyVersion field, disabling the kubeProxyVersion field on nodes because the kubelet cannot always accurately identify the kube-proxy version (Alpha, disabled by default).

• The JobBackoffLimitPerIndex feature gate (Beta, true by default) sets the maximum retries per index in an indexed job.

In Kubernetes 1.30

• The ImageMaximumGCAge feature gate configures the maximum age for unused images before garbage collection (default: "0s", no time limit). Introduced as Alpha in v1.29, promoted to Beta in v1.30.

• Kubelet adds the image_pull_duration_seconds metric to track image pull duration. See List of alpha Kubernetes metrics.

• The LegacyServiceAccountTokenCleanUp feature gate (GA, enabled by default) auto-cleans unused ServiceAccount Secrets. If an auto-generated Secret is unused and unmounted for one year, the kube-controller-manager labels it with kubernetes.io/legacy-token-invalid-since. If still unused after another year, the kube-controller-manager deletes it. Remove the kubernetes.io/legacy-token-invalid-since label to revalidate a Secret. See Auto-generated legacy ServiceAccount token clean up and Legacy ServiceAccount token cleaner.

• In v1.30, if the --nodeport-addresses flag for kube-proxy is unset (default), NodePort Service updates apply only to the primary node IP, not all IPs. See #122724.

• The OIDC Issuer URL must differ from the API server's ServiceAccount Issuer URL to prevent configuration conflicts and security issues. See #123561.

• The LoadBalancerIPMode feature gate (Beta) adds the .status.loadBalancer.ingress.ipMode field to LoadBalancer Services to specify load balancer IP forwarding behavior. This field requires the .status.loadBalancer.ingress.ip field. See Specifying IPMode of load balancer status and Load Balancer IP Mode for Services.

• Horizontal Pod Autoscaler (HPA) based on container resource metrics graduates to Stable in v1.30, enabling per-container scaling thresholds instead of pod-level only. See Container resource metrics.

• The AdmissionWebhookMatchConditions feature gate (GA, always enabled) lets you define match conditions for admission webhooks for granular trigger control. See Dynamic Admission Control.

• The new JobSuccessPolicy feature gate (Alpha) declares a Job complete based on a set of succeeded pods, specified by count or specific pod indexes (for example, pods with index x, y, and z). See Job success/completion policy.

• The RelaxedEnvironmentVariableValidation feature gate (Alpha, disabled by default) allows most printable ASCII characters (32–126, except =) in environment variables. See #123385.

• The CustomResourceFieldSelectors feature gate (Alpha, disabled by default) lets you configure selectableFields for CRDs, enabling field selectors to filter List, Watch, and DeleteCollection requests. See Custom Resource Field Selectors.

• The CRDValidationRatcheting feature gate (Beta, enabled by default) allows the API server to accept updates to existing resources that fail new CRD validations, as long as the invalid parts remain unmodified. This enables safe rollout of new validation rules when migrating to OpenAPI v3 schemas. See CRD Validation ratcheting.

• The Downward API supports dual-stack (IPv4 and IPv6) via the status.hostIPs field. The first IP in status.hostIPs always matches status.hostIP. See Downward API.

• The NodeLogQuery feature gate (Beta, disabled by default) enables querying node service logs via the /logs endpoint. See Log Query.

In Kubernetes 1.29

• CronJob no longer supports CRON_TZ or TZ in .spec.schedule. Use .spec.timeZone instead (available since v1.25). See CronJob limitations.

• The networking/v1alpha1 ClusterCIDR API has been removed. This API was in Alpha and considered controversial.

In Kubernetes 1.30

• The kubectl apply command removes the --prune-whitelist flag. Use --prune-allowlist instead. See --prune.

• v1.30 removes the SecurityContextDeny admission plugin (deprecated in v1.27). Use the PodSecurity admission plugin instead (Stable since v1.25, enabled by default).