Kubernetes 1.32 Release Highlights

[mbianchidev]

This is a discussion to collect the Release Highlights for the v1.32 release cycle.

Release Highlights are an essential part of the Kubernetes release cycle as they provide a birds-eye view of improvements, breaking or user-facing changes that are coming as part of the upcoming release. The release Comms team is asking for SIGs to comment on this discussion with items that we should highlight in release communications for 1.32.
For each submission, please include a link to the KEP, the stage the feature is moving to, and a brief description of the KEP.

The deadline for 1.32 Release Highlights is Tuesday 19th November 2024.
We understand is very close to KubeCon NA so we cloud have some delay, if you can submit your topics before KubeCon it would be great.

Here is the discussion thread from the last release cycle.

cc @kubernetes/release-team-leads
cc @edithturn @rashansmith @rytswd @wrkode

[mbianchidev]

SIGs not included:

• SIG Cluster Lifecycle has nothing to highlight, see this Slack message
• SIG Contributor
• SIG Docs
• SIG Release

[rashansmith]

SIG Contributor has nothing to highlight in this release.

[sanposhiho]

SIG Scheduling: performance, performance... PERFORMANCE!

• Per-plugin callback functions for accurate requeueing in kube-scheduler enhancements#4247 (Beta): Enhance the scheduling throughput with more efficient scheduling retry decisions by per-plugin callback functions (QueueingHint). We've implemented QueueingHints in all plugins, and are moving ahead enabling this feature by default.
• Asynchronous preemption in the scheduler enhancements#4832 (Alpha): Enhance the scheduling throughput when the preemption is involved, by making some expensive operations within the preemption asynchronously.

[sanposhiho]

cc @kubernetes/sig-scheduling-approvers

[alculquicondor]

@macsko @dom4ha anything else you would like to highlight?

[benjaminapetersen]

Updating from SIG-Auth coming soon! (also slack thread link)

[mbianchidev]

@benjaminapetersen news from Sig-Auth? 👀

[benjaminapetersen]

Redacting, going to post to the slack thread first, for feedback, to ensure correctness, then will add back here.

[benjaminapetersen]

@enj @ritazh quick 👀 to verify these!

[benjaminapetersen]

@stlaz @aramase as well.

[benjaminapetersen]

Features going GA:

• Structured Authorization Configuration is GA in 1.32 release. It adds the ability to configure multiple authorizers and supports CEL match conditions for webhooks.
• Bound service account token improvements is GA in 1.32 release. This includes the node name in service account token claims and surfaces the node name as a user attribute allowing it to be used in authorization and admission (Validating Admission Policy) and furthers the work to keep service account credentials from being a privilege escalation path for nodes.

Features making progress in Beta:

• Restrict anonymous authentication is beta in 1.32 release. This allows the admin to restrict anonymous authentication only to non-resource paths (such as /healthz, /livez, and /readyz) and improves protection from an RBAC mistake that might allow anonymous authorization.
• Label / Field Selector Authorization is beta in 1.32 release. It allows using field and label selectors in authorization decisions. The node authorizer automatically takes advantage of this to limit nodes to listing/watching only their pods. Webhook authorizers can be updated to limit requests based on the label or field selector used.

[SergeyKanzhelev]

SIG Node some highlights beyond KEPs to not forget in future:

A few more exciting things from SIG Node around quility of life and small improvements:

1. integrate kubelet with the systemd watchdog kubernetes#127566 - support for systemd watchdog is implemented for the kubelet.
2. Better message in image pull backoff message: Use image pull error in message during back-off kubernetes#127918

Also we are preparing to the major GA in 1.33 - tracking last remaining items and feedback for sidecar containers KEP: kubernetes/enhancements#753 (comment)

[xing-yang]

Highlights from SIG Storage:
New Features:

• Recover from Volume Expansion Failure feature moved to Beta in v1.32. This feature allows users to recover from volume expansion failure by retrying with a smaller size.
• Volume Group Snapshot feature moved to Beta in v1.32. The feature introduces a VolumeGroupSnapshot API to take a snapshot of multiple volumes together.

Deprecations:

• The gitRepo volume type is deprecated and will be removed in a future release.

cc @saad-ali @msau42 @jsafrane

[pohly]

Highlight from WG Device Management (= SIG Node, SIG Scheduling, SIG Autoscaling):

• The core part of Dynamic Resource Allocation (DRA), the structured parameter support, got promoted to beta.

[mbianchidev]

We are currently drafting the release blog with these KEPs that were highlighted and will insert a couple of others that will be picked at our discretion.

If you wish to highlight something else the deadline is (flexible up to a certain point) today.

Thanks for contributing with your set of enhancements!

[ndixita]

Highlight from Sig Node: kubernetes/enhancements#4678 Pod Level Resources allows users to set requests and limits for the entire pod. This feature is now alpha in 1.32

[jpbetz]

Highlights from SIG API Machinery:

KEP-3157 (beta): New WATCH-LIST operation allows informers to stream data all data. This improves control plane stability and resource usage by avoiding large, memory-intensive LIST requests. This enhancement is especially beneficial for large clusters where LIST requests can cause disruptions.

KEP-4358 (stable): Custom resource field selectors allow developers to add field selectors to custom resources, mirroring the functionality available for built-in Kubernetes objects. This allows for more efficient and precise filtering of custom resources, promoting better API design practices.

KEP-4222 (alpha): CBOR Serializer introduces an alternative serialization format for Kubernetes APIs, offering significant performance improvements over JSON, particularly for custom resources. This change reduces CPU load and memory usage, leading to more efficient cluster operations.

KEP-3962 (alpha): The new MutatingAdmissionPolicy API offers CEL-based admission policies directly within the kube-apiserver. This offers a lightweight and performant alternative to mutating admission webhooks, dramatically reducing development costs and operational complexity.

[richabanker]

Highlights from SIG Instrumentation:
KEP-4827(alpha): New statusz endpoint added for core components(right now only supported in apiserver) to enhance debuggability by gaining insight into what version (golang version, binary version, emulation version) the component is running as along with details about its uptime, making it easier to diagnose issues.

KEP-4828(alpha): New flagz endpoint added for core components(right now only supported in apiserver) to enhance debuggability by gaining insight into what command line flags the component was started with, to help troubleshoot configuration issues.

[dchen1107]

Highlights from SIG Node:

• Structured parameters (DRA MVP) graduated to Beta. This allows device drivers to expose their resources in a structured way, making them easily consumable by Kubernetes. This means easier management, better performance, and new possibilities.
• Pod Level Resource The feature is introduced to k8s 1.32 as alpha. Instead of setting resource requirements for each individual container, the new feature allows you to define them for the pod as a whole. This creates a shared pool of resources that all containers within the pod can access dynamically.
• Sleep Action for PreStop Hook is stable now. The feature makes the graceful shutdowns much easier without any custom scripts or workarounds.
• Dynamically size memory-backed volumes is stable in 1.32 release. The feature made it possible to dynamically size memory-backed volumes based on pod resource limits. This improves the workload's portability and overall node resource utilization for the users using .
• In-place Pod Resizing will stay as alpha, but a lot of enhancement was made in 1.32. This feature lets you dynamically adjust the resources allocated to a pod without restarting it—meaning no disruption to your applications.

cc/ @mrunalp @SergeyKanzhelev @derekwaynecarr @haircommander for vis.

[SergeyKanzhelev]

Also please merge it with the comment above: #2639 (comment)

Repeating and extending here:

1. integrate kubelet with the systemd watchdog kubernetes#127566 - support for systemd watchdog is implemented for the kubelet.
2. Long awaitred usability improvement: Better message in image pull backoff message: Use image pull error in message during back-off kubernetes#127918
3. Keep hardening device plugin to kubelet integration: Integrate device plugin registration gRPC server health checks. kubernetes#128432
4. Looking ahead: We are preparing to the major GA in 1.33 - tracking last remaining items and feedback for sidecar containers KEP: Sidecar Containers  enhancements#753 (comment) Note, there were a lot of small bug fixes, feedback is welcome! Let's make 1.33 landing of the feature a great success!

[janetkuo]

Highlights from SIG Apps:

• Auto remove PVCs created by StatefulSet is stable in 1.32 release. This simplifies storage management by automatically deleting PersistentVolumeClaims (PVCs) created by StatefulSets when no longer needed, while ensuring data persistence during StatefulSet updates and node maintenance.
• Support managedBy field for Jobs is stable in 1.32 release. This feature enables external controllers (like Kueue) to manage Job synchronization, offering greater flexibility and integration with advanced workload management systems.

[aojea]

Highlights from SIG Network:

• DRA: Resource Claim Status with standardized network interface data is alpha in 1.32 release. Adds a new field that allows drivers to report driver-specific device
  status data for each allocated device in a resource claim. It also establishes a standardization for networking devices information.

• Make Kubernetes aware of the LoadBalancer behaviour is GA in 1.32 release. Add a new field to the Service status so in-cluster Services proxies implementation like kube-proxy should delegate the traffic to the external Load Balancer, that may implement features like TLS termination, PROXY protocol.

[aravindhp]

Highlights from SIG Windows:

• Windows CPU and Memory Affinity enhancements#4885 is alpha in 1.32 release. It adds CPU and memory affinity support to Windows nodes with CPUManager, MemoryManager and Topology manager.
• Windows node gracefully shutdown enhancements#4802 is alpha in 1.32 release. This brings Windows on par with the Linux node graceful shutdown feature.

[mbianchidev]

All highlights received and (a good part of them) incorporated in the PR:

kubernetes/website#48666

Ready to be reviewed, I will do my best to address comments on a daily basis (weekdays)