(Discontinued) Kubernetes 1.32 release notes

Component versions

Key component versions in ACK clusters:

Major changes

• Starting v1.32:

  • When creating an ACK cluster through the CreateCluster API, kube-proxy defaults to IPVS instead of iptables. Existing clusters upgraded to v1.32 retain their current proxy mode.

  • kube-apiserver no longer supports the TLS_RSA_WITH_AES_256_GCM_SHA384 and TLS_RSA_WITH_AES_128_GCM_SHA256 TLS cipher suites. This change automatically applies to existing clusters upgraded to v1.32.

  • When you enable the RRSA feature, the --api-audiences parameter of kube-apiserver retains its pre-RRSA value. This only affects clusters that have not yet enabled RRSA.

  • NVIDIA Device Plugin can now be managed through the console, with deployment transitioning from Static Pod to DaemonSet.

• The ServiceAccount annotation kubernetes.io/enforce-mountable-secretsis removed in v1.32. Use separate namespaces to isolate access to Secrets.

• The DRAControlPlaneController feature gate (alpha since v1.26, disabled by default) is removed. If you enabled this feature, remove related resources before upgrading to avoid abnormal workloads. See #128003.

• In v1.32.7-aliyun.1, CVE-2025-4563 is fixed.

Other highlights

• The WatchList feature gate reaches beta and is enabled by default. The client-go client uses streaming requests instead of full list operations, reducing control plane resource consumption. The kube-controller-manager component enables this feature by default. See Enhancing Kubernetes API Server Efficiency with API Streaming.

• The RelaxedEnvironmentVariableValidation feature gate reaches beta and is enabled by default, allowing environment variable names to include almost all printable ASCII characters except the equal sign (=).

• Pod status display is optimized: when an image pull fails, the status.containerStatuses[*].state.waiting field records the failure reason (ImagePullBackOff) and specific details.

• The CustomResourceFieldSelectors feature gate reaches GA in v1.32 and is enabled by default, enabling selectableFields in CRD (including list, watch, and deletecollection operations) to filter custom resources more efficiently.

• The StatefulSetAutoDeletePVC feature gate reaches GA in v1.32 and is enabled by default, automatically cleaning up PVCs no longer needed by the StatefulSet. PVC cleanup is not triggered during StatefulSet updates or node maintenance.

• The JobManagedBy feature gate reaches beta and is enabled by default, allowing Jobs to be reconciled by an external controller through the spec.managedBy field.

  The managedBy field cannot be set to kubernetes.io/job-controller, because this is reserved for the built-in Kubernetes controller.

• All scheduler plugins implement the QueueingHint function, which determines whether incoming events could make a pod schedulable, reducing unnecessary scheduling attempts and improving throughput. See QueueingHint Brings a New Possibility to Optimize Pod Scheduling.

• The RecoverVolumeExpansionFailure feature gate reaches beta and is enabled by default. Manually reduce the .spec.resources of a PVC to recover from expansion failures without data loss. See Recovering from Failure when Expanding Volumes.

• The AuthorizeWithSelectors and AuthorizeNodeWithSelectors feature gates are promoted to beta, with the latter dependent on the former. AuthorizeNodeWithSelectors allows the node authorizer to use selection operators such as fieldSelector and labelSelector for finer-grained authorization. The kubelet is granted only essential permissions, reading only its associated node object and assigned pods. See Using Node Authorization.

• The PodLogOptions parameter includes the Stream field, which enables real-time streaming of container logs without waiting for the full download. The Stream and TailLines fields cannot be used simultaneously.

• JobController is optimized for faster Job updates and deletions, especially at scale. See #126567, #127228, and #127378.

• kube-proxy uses fieldSelector: clusterIP!=None when updating a Service to exclude Headless Services, reducing network bandwidth. See #126769.

Deprecated APIs

• The flowcontrol.apiserver.k8s.io/v1beta3 API version of FlowSchema and PriorityLevelConfiguration is no longer served in v1.32. Migrate to the flowcontrol.apiserver.k8s.io/v1 API version, available since v1.29.

  In the flowcontrol.apiserver.k8s.io/v1 API version, the spec.limited.nominalConcurrencyShares field of PriorityLevelConfiguration defaults to 30 when unspecified, but an explicit 0 is not overridden to 30.

References

Complete Kubernetes 1.32 changelog: CHANGELOG-1.32 and Kubernetes v1.32: Penelope.