(Deprecated) ACK Release Notes for Kubernetes 1.31

CephFS volume plugin removed

The built-in CephFS volume plug-in kubernetes.io/cephfs is removed in 1.31. Use the CephFS CSI driver instead.

If your cluster uses the CephFS volume plugin, migrate to the CephFS CSI driver and re-deploy your application before upgrading to 1.31.

CephRBD volume plug-in removed

The built-in CephRBD volume plug-in kubernetes.io/rbd is removed in 1.31. Use the RBD CSI driver instead.

If your cluster uses the CephRBD volume plugin, migrate to the RBD CSI driver and re-deploy your application before upgrading to 1.31.

CSIMigrationPortworx enabled by default

The CSIMigrationPortworx feature gate is enabled by default, migrating volumes from the legacy embedded Portworx plug-in to the Portworx CSI plug-in.

If you use Portworx, install and configure the Portworx CSI plug-in before upgrading to 1.31.

Workload scheduling

MatchLabelKeysInPodAffinity promoted to beta (enabled by default)

To resolve affinity and anti-affinity violations during rolling updates, specify the matchLabelKeys and mismatchLabelKeys fields in podAffinity and podAntiAffinity. The scheduler uses these fields to distinguish old from new pods during a rollout. See matchLabelKeys and mismatchLabelKeys.

Storage

RecursiveReadOnlyMounts promoted to beta (enabled by default)

Pod-mounted volumes can now be made recursively read-only. All files and subdirectories under the mount become read-only. See Recursive read-only mounts.

HonorPVReclaimPolicy promoted to beta (enabled by default)

Finalizers can now be added to a PersistentVolume (PV) to ensure a PV with the Delete reclaim policy is deleted only after its backing storage is deleted. See PersistentVolume deletion protection finalizer.

Workloads

JobSuccessPolicy promoted to beta (enabled by default)

A success policy can now be configured for Indexed Jobs. See Job success policy.

kubelet no longer restarts containers on non-image spec changes

If a pod's spec changes but the image field is unchanged, the kubelet does not restart the container. This prevents unnecessary restarts from non-functional spec updates.

Security and authentication

ServiceAccountTokenNodeBinding promoted to beta (enabled by default)

A ServiceAccount token can now be bound to a specific node. The token is invalidated when it expires or the associated node or ServiceAccount is deleted.

API and tooling

DisableNodeKubeProxyVersion promoted to beta (enabled by default)

The status.nodeInfo.kubeProxyVersion field no longer displays the kube-proxy version. This field was inaccurate and did not reflect the actual kube-proxy version on the node.

kubectl debug custom profiling promoted to beta

kubectl debug now supports custom profiling for pod troubleshooting. See Kubernetes 1.31: Custom Profiling in Kubectl Debug Graduates to Beta.

kubectl streaming migrated from SPDY to WebSocket

kubectl cp, kubectl attach, kubectl exec, and kubectl port-forward now use WebSocket for streaming instead of SPDY. WebSocket is the default streaming protocol for Kubernetes clients.

Consistent reads from cache promoted to beta

The Kubernetes API server can now serve consistent reads from cache instead of fetching the full dataset from etcd, improving List request efficiency. See Consistent reads from cache.

CRD validation

caBundle validation enforced

If the caBundle field in a CustomResourceDefinition (CRD) is non-empty but contains an invalid value or no CA certificates, the CRD stops serving requests. Once a valid caBundle is established, updates that would render it invalid or empty are rejected to prevent service disruption.