Kubernetes 1.33 Release Notes

Component versions

The following table lists the supported versions of the core components in an ACS cluster.

Important notes

Due to product optimizations in ACS, you must grant the required service-linked role to Container Service for Kubernetes (ACK) when creating clusters of version 1.33.3-aliyun.1 or later.

Breaking changes

When you create a NAS persistent volume claim, the Allocation Mode no longer supports Use Mount Target Domain Name. You can now select Existing Volumes or Create PV instead.

Feature changes

• The In-place Pod Vertical Scaling feature graduates to Beta and is enabled by default. This feature allows you to dynamically modify a container's CPU and memory resource configurations without restarting the Pod.

• kubectl now supports the --subresources flag to modify specific subresources. For example, you can use kubectl edit pod <pod-name> --subresource resize to dynamically resize a Pod's resources. Supported subresources in version 1.33 include status, scale, and resize.

• EndpointSlice TopologyAwareHints graduates to General Availability (GA). The Beta annotation service.kubernetes.io/topology-mode is deprecated. We recommend using the spec.trafficDistribution field to define the topology policy. For example, by setting trafficDistribution to PreferClose, you can preferentially route traffic to endpoints in the same zone as the client. For more information, see Traffic distribution.

• The Pod .status.resize field is deprecated and can no longer be set. Two new condition fields have been added: PodResizeInProgress and PodResizePending.

• The .spec.serviceName field for StatefulSets is now optional. Validation for this field is stricter and must now conform to the DNS-1123 standard. If an existing StatefulSet has a .spec.serviceName that fails this validation, new Pods cannot be created until you manually remove the field. This update moves the DNS validation from the Pod creation stage to the StatefulSet configuration stage, which reduces failed retries by the StatefulSet controller.

• The Git-Repo volume plugin is disabled by default. To continue using it, enable the GitRepoVolumeDriver feature gate.

• Version 1.33.3-aliyun.1 includes fixes for CVE-2025-4563.

New features

• Sidecar containers graduate to GA and are enabled by default. A sidecar container is a special type of init container that uses restartPolicy: Always to ensure it runs for the entire Pod lifecycle and supports probe configurations.

• OrderedNamespaceDeletion graduates to Beta. This feature optimizes the namespace resource cleanup process. When a namespace is deleted, workload Pods are terminated first, followed by dependent resources such as NetworkPolicies and storage resources. This prevents Pods from remaining active after critical security resources have been removed.

• SupplementalGroupsPolicy graduates to Beta and is enabled by default. It allows fine-grained supplemental group control for a Pod via the .spec.securityContext.supplementalGroupsPolicy field. This provides more precise control over volume access permissions. For more information, see Configure fine-grained SupplementalGroups control for a Pod.

• MultiCIDRServiceAllocator graduates to GA and is enabled by default. It introduces ServiceCIDR and IPAddress resources to track ClusterIP allocations for services and allows you to dynamically expand the assignable ClusterIP range by using ServiceCIDR.

• JobBackoffLimitPerIndex graduates to GA. This feature allows you to specify the maximum number of Pod retries for each index in an indexed Job.

• JobSuccessPolicy graduates to GA. This allows you to define a custom success policy for a Job, such as determining Job completion based on whether specific indexes have succeeded and the total number of successful indexes. For more information, see Job's SuccessPolicy Goes GA.

• ImageVolume graduates to Beta and is disabled by default. To use this feature, you must manually enable the corresponding feature gates on the API server and kubelet. This allows Pods to use an image volume source, which mounts a container image as a read-only volume.

• UserNamespacesSupport graduates to Beta and is enabled by default. This feature allows a Pod to use Linux user namespaces to enhance container security. This change does not affect existing Pods. To use this feature, you must manually specify pod.spec.hostUsers. For more information, see User Namespaces enabled by default.

• RelaxedDNSSearchValidation graduates to Beta and is enabled by default. It allows the use of special characters, such as . and _, in a Pod's .spec.dnsConfig.searches field, increasing DNS configuration flexibility.

• The kube-apiserver now disables the WatchList mechanism by default, using a streaming encoding mechanism instead (including StreamingCollectionEncodingToJSON and StreamingCollectionEncodingToProtobuf). This improves List operation performance by streaming large resource list requests. For List requests that involve many resources, this change can significantly reduce memory consumption and improve system stability. For more information, see Streaming List responses.

  The kube-controller-manager no longer enables the WatchListClient feature by default.

• CPUManagerPolicyOptions graduates to GA and is enabled by default. This feature allows fine-tuning the CPU Manager's resource allocation policies:

  • When a Pod requires exclusive CPUs, SMT alignment is enforced to ensure that the allocated CPUs occupy complete physical cores. For more information, see cpu manager extension to reject non SMT-aligned workload.

  • When CPUs need to be allocated across NUMA nodes, you can ensure that CPU resources are distributed evenly among the NUMA nodes. For more information, see Add CPUManager policy option to distribute CPUs across NUMA nodes instead of packing them.

• MatchLabelKeysInPodAffinity graduates to GA and is enabled by default. It adds the matchLabelKeys and mismatchLabelKeys fields to Pod affinity rules, providing more precise control over Pod co-location.

• NodeInclusionPolicyInPodTopologySpread graduates to GA and is enabled by default. It allows you to use nodeAffinityPolicy and nodeTaintsPolicy in Pod topology spread constraints to dynamically filter schedulable nodes.

  • nodeAffinityPolicy: Defaults to Honor. Only nodes that match the Pod's nodeSelector or nodeAffinity are included in the topology spread calculation.

  • nodeTaintsPolicy: Defaults to Ignore. All nodes are included in the topology spread calculation, regardless of the Pod's nodeAffinity and nodeSelector rules.

• HonorPVReclaimPolicy graduates to GA and is enabled by default. This ensures that when a persistent volume's reclaimPolicy is set to Delete, the underlying storage resource is deleted according to the policy, regardless of the deletion order of the PV or PVC. This prevents storage resource leaks.

• ProcMountType graduates to Beta. It allows you to customize the mount type of the /proc filesystem in a container by using a Pod's securityContext.procMount field. This enables fine-grained control over /proc filesystem access, enhancing Pod security and isolation. This feature is useful for running unprivileged containers in user namespaces, where relaxing /proc restrictions can improve compatibility and flexibility.

• PodLifecycleSleepActionAllowZero graduates to Beta. It allows setting the wait time for a sleep action in a container's preStop lifecycle hook to 0.

• You can now use a ResourceQuota to limit the number of persistent volume claims associated with a specific Volume Attributes Class.

• Scheduler performance optimizations:

  • The new SchedulerPopFromBackoffQ feature is enabled by default. It optimizes scheduling queue logic by allowing a Pod to be popped directly from the backoffQ when the activeQ is empty, significantly reducing Pod scheduling latency.

  • SchedulerAsyncPreemption graduates to Beta and is enabled by default. It allows preemption to be performed asynchronously. Because preemption is a resource-intensive operation, running it asynchronously can effectively reduce scheduling latency.

  • The scheduling performance for Pods that use topology spread constraints is optimized.

Deprecated APIs

• Version 1.33 uses containerd 2.1 by default. Containerd 2.1 no longer supports the CRI v1alpha2 API. If your workloads depend on this API version, you must migrate to the CRI v1 API to ensure compatibility.

• The v1 Endpoints API is officially deprecated. We recommend using the EndpointSlice API instead. The EndpointSlice API has been stable since version 1.21 and introduces features such as dual-stack network support. However, the v1 Endpoints API will not be removed at this time. For more information, see Continuing the transition from Endpoints to EndpointSlices.

• The apidiscovery.k8s.io/v2beta1 API group is disabled. This API is used by clients to discover all registered API resources in a cluster. We recommend migrating to the v2 stable version. Older clients can automatically fall back to using the unaggregated v1 API for service discovery, so they will not fail immediately. However, clients that do not support the v2 version must make multiple API calls to retrieve the complete unaggregated data, which may increase request volume and latency.

References

For the complete changelog for Kubernetes 1.33, see CHANGELOG-1.33 and Kubernetes v1.33: Octarine.