Changelog for Kubernetes 1.35

Versions

The deployed Kubernetes patch version varies based on when your cluster is deployed or upgraded. We strive to use the latest versions available.

Current release leverages Kubernetes 1.35. Official release blogpost found here with corresponding official changelog.

Optional addons

• ingress-nginx is provided with version v1.15.0
• cert-manager is provided with version v1.20.0
• envoy-gateway is introduced as a new, opt-in addon with version v1.7.1, disabled by default. This is the first step towards the API Gateway replacement for ingress-nginx announced in the 1.34 changelog.

Major changes

NTP is now configured on nodes

Nodes now receive NTP configuration via cloud-init. Previously nodes had no NTP configuration at all.

• Defaults to the Swedish NTP pool (0/1/2.se.pool.ntp.org) if not set.
• Configurable per-cluster via spec.networkOptions.ntpServers.
• This behavior is gated to activate once a cluster reaches Kubernetes v1.35.1.

resolv.conf is cleaned up on nodes

The OpenStack-injected openstacklocal search domain is now stripped from each node’s resolv.conf. Previously, this extra search domain caused every pod DNS lookup to expand with all search domains (ndots:5), generating unnecessary DNS queries and increasing the risk of timeouts.

• This behavior is gated to activate once a cluster reaches Kubernetes v1.35.1.

Noteworthy changes in upcoming versions.

Announcement of changes in future versions.

Scheduled for upcoming releases:

• We’ll remove the legacy nodelocaldns where still deployed. Relevant only if the cluster was created before v1.26.
• Ingress-nginx controller will be fully deprecated from our management, following the news. The envoy-gateway addon introduced in this release is the first building block of its replacement.

Is downtime expected?

The cluster control plane should remain available during the upgrade; however, pods will be restarted when workloads are migrated to new nodes. Plan for short pod restarts during the upgrade.

Known issues.

Custom node taints and labels lost during upgrade.

Custom taints and labels on worker and control-plane nodes may be lost during the upgrade. We recommend auditing and reapplying any critical custom taints/labels via automation (e.g., cluster bootstrap, configuration management, or a post-upgrade job).

There is a label that is persistent across upgrades that can be used to direct workload to particular nodegroups. Example on how to use it:

spec:
  template:
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: nodegroup.node.cluster.x-k8s.io
                operator: In
                values:
                - worker1

Snapshots are not working.

There is currently a limitation in the snapshot controller: it is not topology-aware. As a result, snapshot behavior may be unreliable for topology-sensitive volumes. Avoid depending on snapshots for cross-zone/region recovery until a topology-aware snapshot controller is available or confirm your storage driver’s snapshot semantics.