CCE has passed the Certified Kubernetes Conformance Program and is a certified Kubernetes offering. This section describes the updates in CCE Kubernetes 1.25.
Resource Changes and Deprecations
Kubernetes 1.25 Release Notes
- PodSecurityPolicy is replaced by Pod Security Admission. For details about the migration, see Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller.
- SeccompDefault is in Beta. To enable this feature, you need to add the startup parameter --seccomp-default=true to kubelet. In this way, seccomp is set to RuntimeDefault by default, improving the system security. Clusters of v1.25 no longer use seccomp.security.alpha.kubernetes.io/pod and container.seccomp.security.alpha.kubernetes.io/annotation to use seccomp. Replace them with the securityContext.seccompProfile field in the pod or container. For details, see Configure a Security Context for a Pod or Container.
After the feature is enabled, the system calls required by the application may be restricted by the runtime. Ensure that the debugging is performed in the test environment and the application is not affected.
- EndPort in Network Policy is stable. This feature is incorporated in version 1.21. EndPort is added to NetworkPolicy for you to specify a port range.
- Since clusters of v1.25, Kubernetes does not support certificate authentication generated using the SHA1WithRSA or ECDSAWithSHA1 algorithm. You are advised to use the SHA256 algorithm.
Kubernetes 1.24 Release Notes
- Beta APIs are disabled by default. When some long-term beta APIs are removed from Kubernetes, 90% cluster administrators do not care about the beta APIs. Beta features are not recommended in the production environment. However, due to the default enabling policy, these APIs are enabled in the production environment, incurring risks. Therefore, in v1.24 and later versions, beta APIs are disabled by default except for the enabled beta APIs.
- The LegacyServiceAccountTokenNoAutoGeneration feature is in beta state. By default, this feature is enabled and no more secret token will be automatically generated for the service account. If you want to use a token that never expires, you need to create a secret and mount it. For details, see Service account token secrets.
- service.alpha.kubernetes.io/tolerate-unready-endpoints is replaced by Service.spec.publishNotReadyAddresses.
- The Service.Spec.LoadBalancerIP tag is deprecated and may be removed in later versions. Use a customized annotation.
References
For more details about the performance comparison and function evolution between Kubernetes 1.25 and other versions, see the following documents: