ACK release notes for Kubernetes 1.33

Component versions

Key component versions in this ACK release.

Upgrade notes

When you upgrade a cluster to version 1.33, pods created on version 1.20 or earlier are restarted once if they have never been updated or had a container restart.

Major changes

• ACK defaults to containerd 2.1. For existing clusters, the container runtime upgrades to containerd 2.1 during node upgrades. See containerd 2.1 introduction.

• New ACK managed clusters include the latest ack-ram-authenticator by default. See [Product Announcement] ack-ram-authenticator installed by default in ACK managed clusters v1.33 and later.

Feature changes

• The in-place pod resize feature is promoted to Beta and enabled by default, letting you adjust a container's CPU and memory without a pod restart.

• The --subresources option in kubectl adjusts specific subresources. For example, resize a pod with kubectl edit pod <pod-name> --subresource resize. Supported subresources include status, scale, and resize.

• TopologyAwareHints for EndpointSlices is now GA. The beta annotation service.kubernetes.io/topology-mode is deprecated; use the spec.trafficDistribution field instead. For example, setting trafficDistribution to PreferClose routes traffic preferentially to same-zone endpoints. See Traffic distribution.

• The .status.resize field for pods is deprecated and cannot be set. Two new condition fields are added: PodResizeInProgress and PodResizePending.

• The DisableNodeKubeProxyVersion feature gate is enabled by default and cannot be disabled. The kubelet no longer sets the status.kubeProxyVersion field on nodes.

• The .spec.serviceName field for StatefulSets is now optional with stricter DNS-1123 validation. If an existing StatefulSet's .spec.serviceName fails validation, new pods cannot be created until the field is removed. This moves DNS validation from pod creation to StatefulSet configuration, reducing controller retries.

• The Git-Repo volume plug-in is disabled by default; enable the GitRepoVolumeDriver feature gate to use it.

• Version 1.33.3-aliyun.1 fixes CVE-2024-4563.

Features

• Sidecar containers are now GA and enabled by default. A sidecar container is an init container that runs for the full pod lifecycle and supports probes with restartPolicy: Always.

• OrderedNamespaceDeletion is promoted to Beta, optimizing namespace deletion order: workload pods are deleted first, then dependent resources such as NetworkPolicy and storage. This prevents orphaned pods after critical security resources are removed.

• SupplementalGroupsPolicy is promoted to Beta and enabled by default. Use the .spec.securityContext.supplementalGroupsPolicy field for fine-grained supplemental group control, providing more precise volume access permissions. See Configure fine-grained SupplementalGroups control for a Pod.

• MultiCIDRServiceAllocator is now GA and enabled by default, introducing ServiceCIDR and IPAddress resources to track ClusterIP allocations for services. Use ServiceCIDR to dynamically expand the allocatable ClusterIP range.

• JobBackoffLimitPerIndex is now GA, letting you specify the maximum pod retries for each index of an indexed job.

• JobSuccessPolicy is now GA, letting you define custom success policies for Jobs. For example, specify which indexes must succeed and the required count. See Job's SuccessPolicy Goes GA.

• ImageVolume is promoted to Beta and is disabled by default. Enable the feature gates on the API server and kubelet to use an image volume source, which mounts a container image as a read-only volume.

• UserNamespacesSupport is promoted to Beta and enabled by default, allowing pods to use Linux user namespaces for enhanced security. Existing pods are unaffected. To opt in, specify pod.spec.hostUsers. See User Namespaces enabled by default.

• RelaxedDNSSearchValidation is promoted to Beta and enabled by default, allowing special characters such as . and _ in a pod's .spec.dnsConfig.searches field for more flexible DNS configuration.

• The kube-apiserver disables WatchList by default, replacing it with streaming encoding ( StreamingCollectionEncodingToJSON and StreamingCollectionEncodingToProtobuf). This streams large List responses, significantly reducing memory usage for resource-heavy requests. See Streaming List responses.

  The kube-controller-manager no longer actively enables the WatchListClient feature.

• CPUManagerPolicyOptions is now GA and enabled by default, letting you fine-tune CPU Manager allocation:

  • When a pod requires exclusive CPUs, SMT alignment ensures allocated CPUs occupy complete physical cores. See cpu manager extension to reject non SMT-aligned workload.

  • CPU resources are distributed evenly across NUMA nodes. See Add CPUManager policy option to distribute CPUs across NUMA nodes instead of packing them.

• MatchLabelKeysInPodAffinity is now GA and enabled by default, adding matchLabelKeys and mismatchLabelKeys fields to pod affinity rules for more precise co-location control.

• NodeInclusionPolicyInPodTopologySpread is now GA and enabled by default. Use nodeAffinityPolicy and nodeTaintsPolicy in pod topology spread constraints to dynamically filter schedulable nodes.

  • nodeAffinityPolicy: Defaults to Honor. Only nodes that match the pod's nodeSelector or nodeAffinity are considered in the topology spread calculation.

  • nodeTaintsPolicy: Defaults to Ignore. Node taints are ignored, and all nodes, including tainted ones that the pod does not tolerate, are considered in the topology spread calculation.

• HonorPVReclaimPolicy is now GA and enabled by default. When a PV's reclaimPolicy is Delete, the underlying storage is deleted regardless of PV/PVC deletion order, preventing storage leaks.

• ProcMountType is promoted to Beta. Use the pod's securityContext.procMount field to customize /proc mount types in a container for fine-grained /proc access control. Useful for non-privileged containers in user namespaces, where relaxing /proc restrictions improves compatibility.

• PodLifecycleSleepActionAllowZero is promoted to Beta, allowing the sleep duration in the preStop lifecycle hook to be 0.

• ResourceQuota can now limit the number of PVCs associated with a specific VolumeAttributesClass.

• Scheduler performance optimizations:

  • SchedulerPopFromBackoffQ is added and enabled by default. Pods can be popped directly from the backoffQ when the activeQ is empty, significantly reducing scheduling latency.

  • SchedulerAsyncPreemption is promoted to Beta and enabled by default. The scheduler performs preemption asynchronously, reducing scheduling latency.

  • Scheduling performance for pods with topology spread constraints is optimized.

Deprecated APIs

• Kubernetes 1.33 defaults to containerd 2.1, which no longer supports the CRI v1alpha2 API. If your workloads depend on this API version, switch to the CRI v1 API.

• The Endpoints v1 API is deprecated; use the EndpointSlice API instead. EndpointSlice, stable since Kubernetes 1.21, adds features such as dual-stack network support. The Endpoints v1 API will not be removed at this time. See Continuing the transition from Endpoints to EndpointSlices.

• The apidiscovery.k8s.io/v2beta1 API group is disabled. This API is used by clients to query all registered API resources in a cluster. Migrate to the stable v2 version. Older clients fall back to the non-aggregated v1 API automatically, so errors are not immediate. However, clients without v2 support must make multiple API calls to retrieve complete data, increasing request count and latency.

References

Complete Kubernetes 1.33 changelog: CHANGELOG-1.33 and Kubernetes v1.33: Octarine.