What Is New in Kubernetes 1.21
Kubernetes 1.21 delivers a substantial update with a focus on stability and maturing existing features. This release graduates several key features to stable and introduces new alpha functionality for advanced use cases.
| Category | Key Highlights |
|---|---|
| Stable Features | CronJob, Immutable Secrets/ConfigMaps, PodDisruptionBudget |
| Alpha Features | Graceful Node Shutdown, PersistentVolume Health Monitor, Recursive Ownership in Jobs |
| API Changes | Pod Security Policy Deprecation, Indexed Jobs, Service Internal Traffic Policy |
| Command Line & Tools | kubectl debug, Memory Manager for NUMA |
Which features reached stability in this release?
CronJob, Immutable Secrets and ConfigMaps, and PodDisruptionBudget have all been promoted to General Availability (GA). This means their APIs are locked in and ready for production use without fear of breaking changes.
The batch/v1 API for CronJob is now stable. In practice, this simplifies scheduling automated tasks without needing third-party tools. Immutable Secrets and ConfigMaps prevent accidental updates that could cause pod crashes, a welcome change for config management.
PodDisruptionBudget GA ensures you can safely drain nodes for maintenance without taking down critical applications. This is a cornerstone for performing reliable cluster operations and upgrades.
What new alpha features should I be aware of?
Alpha features introduce new capabilities that are disabled by default and require explicit feature gate enabling. The Graceful Node Shutdown allows the kubelet to detect an impending system shutdown and gracefully terminate pods, which is crucial for stateful workloads on bare metal.
Another alpha feature is the PersistentVolume Health Monitor. This allows the CSI driver to mark a PersistentVolume as unhealthy if underlying storage problems are detected, enabling automated remediation.
Recursive ownership for Jobs is also in alpha. This allows a Job to create objects that are automatically cleaned up when the Job itself is deleted, helping to prevent resource leaks from complex job workflows.
Are there any major deprecations or removals?
Yes, PodSecurityPolicy (PSP) has been officially deprecated in favor of the new Pod Security Admission feature that is planned for beta in 1.22. If you're using PSPs for pod security, start planning your migration path now.
Several Kubernetes ecosystem tools and libraries have also removed support for the deprecated extensions/v1beta1, apps/v1beta1, and apps/v1beta2 API versions. You should ensure all your manifests and tooling are using the stable apps/v1 API.
The TopologyKeys field in Service definitions and the --experimental-allocatable-ignore-eviction kubelet flag have also been removed after being deprecated in previous releases.
What improvements were made to the scheduler?
The scheduler now supports Indexed Jobs, which allows parallel pods within a Job to have a stable, predictable index. This is incredibly useful for parallel batch processing where each pod needs to know its specific assignment.
Performance profiling for the scheduler has been enhanced with new metrics. You can now get a detailed breakdown of the time spent on each extension point within the scheduling cycle, which is a game-changer for debugging slow scheduling.
How does kubectl improve the debugging experience?
The kubectl debug command graduated to stable. This command is a Swiss Army knife for debugging. You can use it to attach an ephemeral debug container to a running pod or create a copy of a pod with its configuration altered for troubleshooting.
For example, to troubleshoot a misbehaving pod, you can run a busybox sidecar in its namespaces: kubectl debug -it pod/mypod --image=busybox --target=mypod. This is far cleaner than trying to SSH into a node and using nsenter manually.
FAQ
Is it safe to upgrade to 1.21 if I use CronJobs?
Yes, absolutely. The CronJob API moving to batch/v1 is a stable milestone. Your existing batch/v1beta1 manifests will continue to work, but it's a good time to update them to the stable API version for long-term compatibility.
What should I use instead of the deprecated PodSecurityPolicy?
Start evaluating the Pod Security Admission controller, which is built into the API server. It uses the newer Pod Security Standards, which are designed to be simpler and more intuitive than PSPs. Open Policy Agent (OPA) Gatekeeper is another popular alternative for complex policy needs.
How do I enable the Graceful Node Shutdown alpha feature?
You need to enable the GracefulNodeShutdown feature gate on the kubelet and configure the ShutdownGracePeriod and ShutdownGracePeriodCriticalPods parameters. Remember that alpha features are not enabled by default and are not recommended for production clusters.
What is the benefit of Immutable Secrets and ConfigMaps going GA?
It prevents accidental or malicious updates to configuration data that is mounted into pods. Once marked as immutable, the kubelet doesn't need to watch for changes on these objects, which also reduces the load on the API server for large clusters.
Can I use the new Indexed Jobs for parallel processing?
Yes, if you enable the IndexedJob feature gate. Each pod in the job will have a defined index ($JOB_COMPLETION_INDEX) available, which you can use to assign each pod a specific segment of a larger data processing task, like processing a shard of data.