Kubernetes 1.25 Major Themes

[csantanapr]

This is a discussion to discuss Major Themes for the v1.25 release.

Here is the discussion from the last release cycle.

[leonardpahlke]

cc @kubernetes/release-team-leads

[cici37]

CRD Validation Expression Language is promoted to beta in 1.25

[csantanapr]

Do you have some links as references for the end user to know more about?

[cici37]

The documentation is available here: https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules
Thank you

[saschagrunert]

SeccompDefault promoted to beta in v1.25: https://deploy-preview-34290--kubernetes-io-main-staging.netlify.app/docs/tutorials/security/seccomp/#enable-the-use-of-runtimedefault-as-the-default-seccomp-profile-for-all-workloads

[ameukam]

Moving from k8s.gcr.io to registry.k8s.io got merged in 1.25: kubernetes/kubernetes#109938

More info: https://github.com/kubernetes/k8s.io/wiki/New-Registry-url-for-Kubernetes-(registry.k8s.io)

Announcement: https://groups.google.com/a/kubernetes.io/g/dev/c/DYZYNQ_A6_c/m/oD9_Q8Q9AAAJ

[rikatz]

endPort field in Network Policy is now promoted to GA

Network Policy providers that support endPort field now can use it to specify a range of ports to apply a Network Policy.

Previously, each Network Policy could only target a single port.

Please be aware that endPort field MUST BE SUPPORTED by the Network Policy provider. In case your provider does not support endPort and this field is specified in a Network Policy, the Network Policy will be created covering only the port field (single port).

Ref.: kubernetes/kubernetes#110868

[xing-yang]

We'd like to include the following in 1.25 major themes from sig-storage:

• The Local Ephemeral Storage Capacity Isolation feature moved to GA in 1.25. This was introduced as alpha in 1.8, moved to beta in 1.10, and it is now a stable feature. It provides support for capacity isolation of local ephemeral storage between pods, such as EmptyDir, so that a pod can be hard limited in its consumption of shared resources by evicting Pods if its consumption of local ephemeral storage exceeds that limit.
• CSI Migration is an on-going effort that SIG Storage has been working on for a few releases now. The goal is to move in-tree volume plugins to out-of-tree CSI drivers and eventually remove the in-tree volume plugins. The core CSI Migration feature moved to GA in 1.25. CSI Migration for GCE PD and AWS EBS also moved to GA. CSI Migration for vSphere remains in beta but is on by default in 1.25. CSI Migration for Portworx moved to Beta (but is off-by-default) in 1.25.
• Container Object Storage Interface (COSI) was introduced as an alpha feature in 1.25. COSI enables provisioning and access to object storage in Kubernetes alongside file and block storage. Similar to CSI, it introduces gRPC interfaces for object storage providers to write drivers to provision object storage.

cc @saad-ali @msau42 @jsafrane

[xing-yang]

We'd like to add one more GA feature from sig-storage:

• The CSI Ephemeral Volume feature allows CSI volumes to be specified directly in the pod specification for ephemeral use cases. They can be used to inject arbitrary states, such as configuration, secrets, identity, variables or similar information, directly inside pods using a mounted volume. This was initially introduced in 1.15 as an alpha feature, and it moved to GA in 1.25. This feature is used by some CSI drivers such as the secret-store CSI driver.

cc @saad-ali @msau42 @jsafrane

[marosset]

During The 1.25 release SIG-Windows has made a lot of improvements around testing including:

• http://perf-dash.k8s.io/#/?jobname=soak-tests-capz-windows-2019 now reports performance data for Windows!
• A lot of progress has been made towards running Kubernetes unit tests on Windows machines during CI (tracked with There is no kubernetes CI unit test machine for Windows  kubernetes#51540)
• More conformance tests can now run on Windows nodes (tests: Enables a few Conformance tests for Windows (part 2) kubernetes#108592)
• New repository created for Windows Operational Readiness work (https://github.com/kubernetes-sigs/windows-operational-readiness)

cc @jsturtevant @jayunit100 @claudiubelu

[ritazh]

1.25 major themes from sig-auth:

• The PodSecurity admission plugin has graduated to GA and is enabled by default. The admission configuration version has been promoted to pod-security.admission.config.k8s.io/v1.
  • PodSecurity: promote config and feature gate to GA kubernetes#110459
  • See https://kubernetes.io/docs/concepts/security/pod-security-admission/ for usage guidelines.
• The beta PodSecurityPolicy admission plugin, deprecated since 1.21, is removed. Follow the instructions at https://kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/ to migrate to the built-in PodSecurity admission plugin (or to another third-party policy webhook) prior to upgrading to v1.25.
  • Remove PodSecurityPolicy admission plugin kubernetes#109798
• As of v1.25, the PodSecurity restricted level no longer requires pods that set .spec.os.name="windows" to also set Linux-specific securityContext fields. If a 1.25+ cluster has unsupported out-of-skew nodes prior to v1.23 and wants to ensure namespaces enforcing the restricted policy continue to require Linux-specific securityContext fields on all pods, ensure a version of the restricted prior to v1.25 is selected by labeling the namespace (for example, pod-security.kubernetes.io/enforce-version: v1.24)
  • PodSecurity: OS based updates to restricted standard kubernetes#105919
• Adds KMS v2alpha1 support
  • Implement KMS v2alpha1 kubernetes#111126
  • KMS v2alpha1 website#35046
• Encrypt data with DEK using AES-GCM instead of AES-CBC for kms data encryption. No user action required. Reads with AES-GCM and AES-CBC will continue to be allowed.
  • feat:(kms) encrypt data with DEK using AES-GCM instead of AES-CBC kubernetes#111119
  • KMS v2alpha1 website#35046
• The gcp and azure auth plugins have been removed from client-go and kubectl. See https://github.com/Azure/kubelogin and https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke for details about the cloud-specific replacements.
  • Remove gcp and azure auth plugins kubernetes#110013

cc @tallclair @liggitt @enj @mikedanese @deads2k

[csantanapr]

Hi @ritazh are these all the changes from sig-auth for v1.25 or only major themes?

[ritazh]

Not all the changes, only major themes.

[csantanapr]

Thank you @ritazh for confirming