ACK Release Notes for Kubernetes 1.35

Component versions

Supported versions of core components in ACK clusters.

Breaking changes

• Starting with version 1.35, Kubernetes no longer supports cgroup v1. Support for cgroup v2 graduated to Stable in version 1.25. Upgrade the node OS to support cgroup v2, or the kubelet will fail to start.

  Operating systems lists cgroup version support for ACK OS images. To upgrade, see Change operating systems.

Feature updates

• The PreferSameNode option for the Service trafficDistribution field has graduated to General Availability (GA). It routes traffic to same-node endpoints first, falling back only when none are available locally.

  The PreferSameTrafficDistribution feature gate has been enabled by default since version 1.34 and supports both PreferSameNode and PreferSameZone. PreferClose has been renamed to PreferSameZone.

• PodObservedGenerationTracking has graduated to GA. When a Pod's spec is updated, its .metadata.generation is incremented. The kubelet now records the spec version it has processed in the Pod's .status.observedGeneration field. Controllers and Operators can now determine whether Pod changes, such as in-place scaling, have taken effect on the node, avoiding issues from status update delays.

• The node topology manager policy option max-allowable-numa-nodes (max-allowable-numa-nodes) has graduated to GA. The topology manager can now correctly calculate affinity on servers with more than 8 NUMA nodes.

• The Downward API now supports injecting node topology labels, such as topology.kubernetes.io/zone and topology.kubernetes.io/region, into Pods.

• StorageVersionMigrator, promoted to Beta and disabled by default, moves storage version migration from an external tool into the Kubernetes core. See Move Storage Version Migrator in-tree.

• MutableCSINodeAllocatableCount is now enabled by default. CSI drivers can now periodically update allocatable volume counts per node, preventing Pods from getting stuck in ContainerCreating due to insufficient volume capacity.

• Opportunistic batching lets the scheduler cache intermediate scheduling results, significantly improving throughput for similar Pods.

• MaxUnavailableStatefulSet is promoted to Beta and is enabled by default. Set the maxUnavailable field in a StatefulSet's rolling update strategy to limit unavailable Pods during updates.

• Pod Certificates is promoted to Beta and is disabled by default. Pods can use certificates for mutual TLS authentication with the kube-apiserver, with automatic rotation for stronger security than ServiceAccount tokens. See KEP-4317: Pod Certificates.

• Kubectl now supports the KYAML format. KYAML is a YAML subset for Kubernetes that resolves ambiguities and security issues in standard YAML parsing. Disable it with the KUBECTL_KYAML=false environment variable. See Introducing KYAML.

• The HPA behavior field now supports configurable tolerance thresholds, replacing the fixed global tolerance of 10%.

• User namespaces is promoted to Beta. Pods can run in a user namespace that is isolated from the host. Container processes can run as root (UID 0) within their namespace but are mapped to an unprivileged, non-zero user ID on the host. This reduces the security risk of privilege escalation from a container escape.

• ImageVolume is now enabled by default, allowing Pods to mount container image contents as read-only image-type volumes. Requires containerd v2.1 or later.

• KubeletEnsureSecretPulledImages is promoted to Beta and is enabled by default. It enforces credential checks for Pods using imagePullPolicy: IfNotPresent in multi-tenant clusters, preventing unauthorized Pods from accessing private images pulled by credentialed Pods via the local cache.

• ContainerRestartRules, promoted to Beta and enabled by default, enables container-level restart policy overrides via restartPolicy and restartPolicyRules for individual containers. See Individual container restart policy and rules.

• CSI drivers can now set the CSIDriver object's spec.serviceAccountTokenInSecrets field to true to mount ServiceAccount tokens via a Secret instead of placing them directly in the volume context. This prevents accidental credential exposure in logs and error messages. See CSI driver opt-in for service account tokens via secrets field.

• Deployments now include a terminatingReplicas field that counts Pods with a deletion timestamp not yet fully removed.

• Fixed CVE-2025-61732 and CVE-2025-68121 in version 1.35.2-aliyun.1.

Deprecations

• The kube-proxy ipvs mode is deprecated and scheduled for removal. Switch to nftables mode, stable since v1.33. Since nftables mode is new, ACK 1.35 clusters still default to ipvs mode, but you can select nftables as the Service Forwarding Mode when creating a cluster.

  We recommend Terway Datapath V2, which operates independently of kube-proxy.

• Version 1.35 is the last release to support containerd 1.x. Upgrade containerd to 2.x before upgrading to Kubernetes 1.36 or later. ACK clusters default to containerd 2.x since version 1.33. See Introduction to containerd 2.1.

References

Complete Kubernetes 1.35 changelog: CHANGELOG-1.35 and Kubernetes v1.35: Timbernetes (The World Tree Release).