Kubernetes v1.34 Release Highlights

[aibarbetta]

This is a discussion to collect the Release Highlights for the v1.34 release cycle.

Release Highlights are an essential part of the Kubernetes release cycle as they provide a birds-eye view of improvements, breaking or user-facing changes that are coming as part of the upcoming release. The release Comms team is asking for SIGs to comment on this discussion with items that we should highlight in release communications for v1.34.

Important

For each submission, please include a link to the KEP, the stage the feature is moving to, and a brief description of the KEP that will be used as an outline for the blog post content.

The deadline for v1.34 Release Highlights is Tuesday 29th July 2025.

Some references for the previous releases:

• Kubernetes v1.33 Release Highlights #2734
• Kubernetes 1.32 Release Highlights #2639
• Kubernetes 1.31 Major Themes #2526

cc @kubernetes/release-team-leads
cc @dipesh-rawat @graz-dev @cloudmelon @88abb

[soltysh]

SIG CLI highlights:

• Separate kubectl user preferences from cluster configs enhancements#3104 - adds a .kuberc file with user preferences allowing kubectl customization. This feature graduates to beta in 1.34, so it's available by default for all kubectl users.
• KYAML enhancements#5295 - introduce a new output format for kubectl - kyaml. Users can use it in most of the places where --output can be specified, ie. kubectl get pods --output=kyaml. This feature is alpha in 1.34 so KUBECTL_KYAML=true environment variable is required to use it.

[soltysh]

Updated with kyaml (2nd entry), after last minute merges 🎉

[soltysh]

SIG Apps highlights:

• Allow for recreation of pods once fully terminated in the job controller enhancements#3939 reaches GA in 1.34. It allows defining when Job pods are replaced, either immediately (current and the default behavior), or only after a pod is fully terminated (new behavior).

[xing-yang]

SIG Storage highlights:

• Recover From Resize Failure feature moved to GA in v1.34. This feature allows users to cancel an expansion that is unsupported by underlying storage provider, and enable them to retry volume expansion with values that may succeed.
• Volume Attributes Class feature moved to GA in v1.34. This feature provides an extension to the Kubernetes Persistent Volume API to allow users to dynamically change select volume attributes (such as IOPs and throughput) after the volume is provisioned.

cc @saad-ali @msau42 @jsafrane

[aramase]

SIG Auth highlights

Stable Graduations:

• Structured Authentication Config (KEP-3331) - Graduates to stable. Replaces OIDC flag-based configuration with structured config files supporting multiple JWT authenticators, CEL expression validation, and dynamic reloading.
• Authorize with Field and Label Selectors (KEP-4601) - Graduates to stable. Adds field and label selectors to authorization decisions, with node authorizer automatically restricting kubelets to only their pods.
• Anonymous Auth Endpoint Restrictions (KEP-4633) - Graduates to stable. Allows configuring which endpoints can be accessed anonymously, protecting against RBAC misconfigurations targeting system:anonymous.

Beta Features:

• External Service Account Token Signing (KEP-740) - Advances to beta. Allows integration with external key management solutions (HSMs, cloud KMSes) for service account token signing instead of static disk-based keys.
• Projected Service Account Tokens for Kubelet Credential Providers (KEP-4412) - Advances to beta. Enables kubelet credential providers to use pod-specific service account tokens for registry authentication, eliminating long-lived image pull secrets.
• DRA AdminAccess for ResourceClaims (KEP-5018) - Advances to beta. Enables privileged access to devices already in use by other users for administrative tasks like health monitoring, restricted to authorized namespaces.

Alpha Features:

• Pod Certificates API (KEP-4317) - Introduces API for requesting and managing certificates scoped to individual pods.
• PSA to block .host field in ProbeHandler and LifecycleHandler (KEP-4940) - Adds Pod Security Admission policy to prevent SSRF attacks by blocking .host field in pod probes and lifecycle handlers.

cc @liggitt @enj @deads2k @ritazh @micahhausler

[macsko]

SIG Scheduling highlights:

• Asynchronous API calls during scheduling enhancements#5229 started as beta
  Change the kube-scheduler to make the entire scheduling cycle free of blocking requests to the Kubernetes API server.
• Use NominatedNodeName to express the expected pod placement enhancements#5278 started as beta
  Kube-scheduler now use NominatedNodeName to express where the pod is going to go before actually binding them. External components can set NominatedNodeName to specify a preferred pod placement.
• Per-plugin callback functions for accurate requeueing in kube-scheduler enhancements#4247 graduated to GA
  Enhance the scheduling throughput with more efficient scheduling retry decisions by per-plugin callback functions (QueueingHint).

[macsko]

cc: @dom4ha @sanposhiho

[johnbelamaric]

WG Device Management Highlights - Note that some of these may be duplicated in SIG highlights.

Stable Features

• DRA: structured parameters enhancements#4381 - Graduates to stable. The core DRA KEP that implements ResourceSlice, ResourceClaim, ResourceClaimTemplate, and DeviceClass functionality. DRA enables more powerful ways to select, allocate, share, and configure GPUs, TPUs, NICs and other devices.

Beta Features

• DRA: AdminAccess for ResourceClaims and ResourceClaimTemplates enhancements#5018 - Graduates to beta. This KEP enables monitoring and other administrative workloads to allocate devices, while still leaving them available for user workloads.
• DRA: Prioritized Alternatives in Device Requests enhancements#4816 - Graduates to beta. This KEP allows the user to provide multiple options in a ResourceClaim, increasing the chances of Pod scheduling in resource constrained clusters.
• DRA: Extend PodResources to include resources from Dynamic Resource Allocation enhancements#3695 - Graduates to beta. This KEP makes DRA resources available in the kubelet Pod resources API.

Alpha Features

• Add Resource Health Status to the Pod Status for Device Plugin and DRA enhancements#4680 - Alpha feature to reflect the health of DRA resources for a Pod in the PodStatus.
• DRA: Handle extended resource requests via DRA Driver enhancements#5004 - Alpha feature to enable DRA drivers to satisfy requests made via the Extended Resources API. This allows existing manifests to continue to working in clusters with DRA drivers instead of (or in addition to) Device Plugins for the same devices. Note: Exception Approved - Changes Due 02:00 UTC, 30th July.
• DRA: Consumable Capacity enhancements#5075 - Alpha feature to allow individual devices in a ResourceSlice to be shared between different, independent ResourceClaims, regulated by allocatable capacity values, when the driver allows it. This allows DRA devices to be shared by independent workloads, rather than only by cooperative workloads as is done today. Note: Exception Approved - Changes Due 02:00 UTC, 1st August.
• DRA: Device Binding Conditions enhancements#5007 - Alpha feature allowing driver's to model devices that must be prepared prior to finalizing the scheduling, such as fabric-attached devices.

[fedebongio]

SIG API Machinery
Graduating to Beta:
Mutating Admission Policies (KEP-3962): A highly anticipated feature graduating to Beta. It provides a declarative, in-process way to mutate objects using CEL. This significantly simplifies admission control by allowing administrators to define mutation rules directly in the API server, reducing the need for external webhooks.

Snapshottable API server cache (KEP-4988): Graduating to Beta, this feature introduces the ability to create snapshots of the API server's watch cache. This will enable faster startup times for new apiserver instances and improve overall control plane resilience by allowing new members to prime their cache from a snapshot instead of re-listing from etcd.

Declarative Validation Of Kubernetes Native Types (KEP-5073): This enhancement, now in Beta, brings CEL-based validation rules to native Kubernetes types. It allows for more granular and declarative validation to be defined directly in the type definitions, improving API consistency and developer experience.

Allow informers for getting a stream of data instead of chunking (KEP-3157): Graduating to Beta, this feature protects critical APIServer memory usage. It uses standard WATCH request mechanics for getting a stream of individual objects, using streaming from the watch-cache instead of paging from etcd, but using it for LISTs. This would allow us to keep memory allocations constant.

Graduating to Stable/GA:
Consistent Reads from Cache (KEP-2340): Now Stable, this feature introduces a mechanism to serve most reads from the watch cache while maintaining the same consistency guarantees as reading from etcd. This is achieved by first making a consistent read to etcd to get the latest revision and then ensuring the data in the watch cache is at least as up-to-date as that revision

Ordered Namespace Deletion (KEP-5080): Now graduating to Stable, this feature ensures that resources within a namespace are terminated in a predictable, ordered sequence. This resolves long-standing issues with namespace finalization and prevents deadlocks during deletion.

Streaming Encoding for LIST Responses (KEP-5116): This feature moves to Stable, optimizing how large resource lists are returned from the API server. By streaming the response, it significantly reduces the memory footprint of the kube-apiserver and improves performance for clients making large LIST requests.

Resilient Watchcache Initialization (KEP-4568): Now graduating to Stable, this feature improves the robustness of the control plane by making the watch cache initialization process more resilient to failures, ensuring controllers and clients can reliably establish watches.

[aibarbetta]

@fedebongio Consistent Reads from Cache is kubernetes/enhancements#2340, the text links kubernetes/enhancements#3157, which one should be highlighted?

[fedebongio]

Sorry I mixed both into one. I've updated the comment including both, "Consistent Reads from Cache" (KEP-2340) which graduates to Stable and "Allow informers for getting a stream of data instead of chunking"(KEP-3157) which graduates to Beta. Does it look better / make sense now?

[aojea]

SIG Network:

• PreferSameNode Traffic Distribution (formerly PreferLocal traffic policy / Node-level topology) enhancements#3015 goes beta (enabled by default). Adds a new value PreferSameNode to the TrafficDistribution field on Services to allow connections to be delivered to a local endpoint when possible, and a remote endpoint if not. It also introduces PreferSameZone as an alias for the existing PreferClose value to make the semantics clear.
• Relaxed DNS search string validation enhancements#4427 graduates to Stable. Kubernetes validated resolv.conf search string in the dnsConfig.searches according to RFC-1123 which defines restrictions for hostnames. However, there are reasons why this validation is too strict for the use in dnsConfig.searches and created friction when dealing with legacy or not fully compliant DNS environments.

[aojea]

@thockin @danwinship PTAL , I didn't add the alpha KEPs kubernetes/enhancements#5311 kubernetes/kubernetes#132558 in the highlights, as usually alpha is not easy to use for end users

[raywainman]

SIG-Autoscaling:

• [Beta] HPA support for pod-level resource specifications kubernetes#132430 - Native support in HPA for pod-level resource specification (see Pod level resources enhancements#2837)

[aibarbetta]

Hi @raywainman, did you mean beta instead of alpha here? The KEP linked seems to be targeting beta

[raywainman]

You are correct, I've fixed this, thanks for catching!

[marosset]

SIG-Windows

• [Stable] - Support for Direct Service Return (DSR) and overlay networking in Windows kube-proxy  enhancements#5100
• [Beta] - Windows Node Graceful Shutdown enhancements#4802

[SergeyKanzhelev]

SIG Node

Big highlights

• WIth the Discover cgroup driver from CRI feature proceeding to GA, the command line flag --cgroup-driver is marked as deprecated and in two releases or later it will be removed. This will make it impossible to use Kubernetes with the Containerd 1.X versions. The timeline of this deprecation is aligned with Containerd 1.7 EOL. This is an early warning that if you are using Containerd 1.X, consider switching to 2.0+ soon.
• SIG Node helped with many DRA features. Please check out the DRA section of this release highlights for details.

• This release featuring a few long awaited features graduating to GA:

  • Node memory swap support - allows Pods to use swap memory.
  • Kubelet OpenTelemetry Tracing - collects OpenTelemetry traces from Kubelet.
  • Allow almost all printable ASCII characters in environment variables - general improvement in usability and globalization
  • Introducing Sleep Action for PreStop Hook and Allow zero value for Sleep Action of PreStop Hook allow to use sleep declaratively without bundling any special binaries.
  • Decouple TaintManager from NodeLifecycleController will be useful for advanced customizations of node lifecycle controller.

• Integrations between features

  • In-Place Update of Pod Resources received a few useful improvements like allowing to decrease memory usage. It also now integrated with the pod level resources

• Exciting new work

  • Container restart rules to customize the pod restart policy - the feature enables many advanced Pod lifecycle behaviors expressed in Pod spec. Definitely check out the docs.

Small changes

• Many proto files were switched to protoc files. Developers consuming them, please, rebuild clients. There is no wire format changes, but you may see some some internal field names changed.
• If you run kubelet as systemd service, we encourage to use the watchdog for kubelet and give feedback. One issue was found and fixed Fix the issue of slow startup of the systemd watchdog kubernetes#132171 and the feature gate that disables the watchdog will be removed in upcoming releases.
• If you use podresources API - beware of behavior change. Now the list will only return active pods podresources: list: use active pods kubernetes#132028 and will not include terminated Pods. This was an intended behavior from the beginning. Please report back if this causes issues.
• The Apparmor cleanup continues. Please use Pod fields and stop using annotations to configure AppArmor. You can find more details in this PR: Apparmor cleanup kubernetes#131989
• Long standing issue was fixed and may cause the change of behavior. Now kubelet will deny pod admission for static pods referencing API objects Deny pod admission for static pods referencing API objects kubernetes#131837
• In-place pod resize: prioritized resizes and support for memory limit decrease
• PSI metrics goes beta. See public doc (WIP PR) on how to use it in practice

[aibarbetta]

Summary of highlights

Features graduating to Stable (20)

• SIG Apps
  • Allow for recreation of pods once fully terminated in the job controller enhancements#3939
• SIG Storage
  • Support recovery from volume expansion failure enhancements#1790
  • Kubernetes VolumeAttributesClass ModifyVolume enhancements#3751
• SIG Auth
  • Structured Authentication Config enhancements#3331
  • Authorize with Field and Label Selectors enhancements#4601
  • Only allow anonymous auth for configured endpoints. enhancements#4633
• SIG Scheduling
  • Per-plugin callback functions for accurate requeueing in kube-scheduler enhancements#4247
• WG Device Management
  • DRA: structured parameters enhancements#4381
• SIG API Machinery
  • Consistent Reads from Cache enhancements#2340
  • Ordered namespace deletion enhancements#5080
  • Streaming Encoding for LIST Responses enhancements#5116
  • Resilient Watchcache Initialization enhancements#4568
• SIG Network
  • Relaxed DNS search string validation enhancements#4427
• SIG Windows
  • Support for Direct Service Return (DSR) and overlay networking in Windows kube-proxy  enhancements#5100
• SIG Node
  • Discover cgroup driver from CRI enhancements#4033
  • Node memory swap support enhancements#2400
  • Kubelet OpenTelemetry Tracing enhancements#2831
  • Allow almost all printable ASCII characters in environment variables enhancements#4369
  • Introducing Sleep Action for PreStop Hook enhancements#3960, Allow zero value for Sleep Action of PreStop Hook enhancements#4818
  • Decouple TaintManager from NodeLifecycleController enhancements#3902

New features in Beta (16)

• SIG CLI
  • Separate kubectl user preferences from cluster configs enhancements#3104
• SIG Auth
  • API for external signing of Service Account tokens enhancements#740
  • Projected service account tokens for Kubelet image credential providers enhancements#4412
  • DRA: AdminAccess for ResourceClaims and ResourceClaimTemplates enhancements#5018
• SIG Scheduling
  • Asynchronous API calls during scheduling enhancements#5229
• WG Device Management
  • DRA: AdminAccess for ResourceClaims and ResourceClaimTemplates enhancements#5018
  • DRA: Prioritized Alternatives in Device Requests enhancements#4816
  • DRA: Extend PodResources to include resources from Dynamic Resource Allocation enhancements#3695
• SIG API Machinery
  • Mutating Admission Policies enhancements#3962
  • Snapshottable API server cache enhancements#4988
  • Declarative Validation Of Kubernetes Native Types With validation-gen enhancements#5073
  • Allow informers for getting a stream of data instead of chunking enhancements#3157
• SIG Network
  • PreferSameNode Traffic Distribution (formerly PreferLocal traffic policy / Node-level topology) enhancements#3015
• SIG Autoscaling
  • Pod level resources enhancements#2837
• SIG Windows
  • Windows Node Graceful Shutdown enhancements#4802
• SIG Node
  • In-Place Update of Pod Resources enhancements#1287

New features in Alpha (9)

• SIG CLI
  • KYAML enhancements#5295
• SIG Auth
  • Pod Certificates enhancements#4317
  • Add PSA to block setting .host field from ProbeHandler and LifecycleHandler enhancements#4940
• SIG Scheduling
  • Use NominatedNodeName to express the expected pod placement enhancements#5278
• WG Device Management
  • Add Resource Health Status to the Pod Status for Device Plugin and DRA enhancements#4680
  • DRA: Handle extended resource requests via DRA Driver enhancements#5004
  • DRA: Consumable Capacity enhancements#5075
  • DRA: Device Binding Conditions enhancements#5007
• SIG Node
  • Container restart rules to customize the pod restart policy enhancements#5307

[aibarbetta]

Hi all, the Release Announcement PR is open kubernetes/website#51877
It mentions all the KEPs listed in my previous comment. Could you please review your respective KEPs for technical accuracy? Additionally, please let us know if anything else needs to be added to the KEPs section, particularly any specific changes that were delivered as part of v1.34.

[aibarbetta]

cc @soltysh @xing-yang @aramase @macsko @johnbelamaric @fedebongio @aojea @raywainman @marosset @SergeyKanzhelev