Kubernetes v1.35: Timbernetes — Only the Important Parts (Part 3): New Features in Beta
Pod certificates for workload identity and securityNative workload identity with automated certificate rotation.
Expose node topology labels via Downward APIThe `kubelet` can now inject standard topology labels, such as `
topology.kubernetes.io/zone` and `
topology.kubernetes.io/region`, into Pods as environment variables or projected volume files.
Native support for storage version migrationWith this release, the built-in controller automatically handles update conflicts and consistency tokens, providing a safe, streamlined, and reliable way to ensure stored data remains current with minimal operational overhead.
Mutable Volume attach limitsCSINode.spec.drivers[*].allocatable.count is now mutable so that a node’s available volume attachment capacity can be updated dynamically.
Opportunistic batchingThe batching mechanism consists of two operations that can be invoked whenever needed - create and nominate. Create leads to the creation of a new set of batch information from the scheduling results of Pods that have a valid signature. Nominate uses the batching information from create to set the nominated node name from a new Pod whose signature matches the canonical Pod’s signature.
maxUnavailable for StatefulSetsYou can use it to define the maximum number of pods that can be unavailable during an update.
Configurable credential plugin policy in kuberckuberc gains additional functionality which allows users to configure credential plugin policy.
KYAMLKYAML is a safer and less ambiguous subset of YAML designed specifically for Kubernetes.
Configurable tolerance for HorizontalPodAutoscalersThis enhancement allows users to define a custom tolerance window on a per-resource basis within the HPA `behavior` field.
Support for user namespaces in PodsKubernetes is adding support for user namespaces, allowing pods to run with isolated user and group ID mappings instead of sharing host IDs.
VolumeSource: OCI artifact and/or imageSupport for the `image` volume type allowing Pods to declaratively pull and unpack OCI container image artifacts into a volume. This lets you package and deliver data-only artifacts such as configs, binaries, or machine learning models using standard OCI registry tools.
Enforced `kubelet` credential verification for cached imagesThis KEP introduces a mechanism where the `kubelet` enforces credential verification for cached images. Before allowing a Pod to use a locally cached image, the `kubelet` checks if the Pod has the valid credentials to pull it.
Fine-grained Container restart rulesKubernetes v1.35 addresses this by enabling `restartPolicy` and `restartPolicyRules` within the container API itself. This allows users to define restart strategies for individual regular and init containers that operate independently of the Pod's overall policy.
CSI driver opt-in for service account tokens via secrets fieldKubernetes v1.35 introduces an opt-in mechanism for CSI drivers to receive ServiceAccount tokens via the dedicated secrets field in the NodePublishVolume request
Deployment status: count of terminating replicasKubernetes v1.35 promotes the `terminatingReplicas` field within the Deployment status to beta. This field provides a count of Pods that have a deletion timestamp set but have not yet been removed from the system.
