Kubernetes 1.27: What's New, Release History & Support Lifecycle

What Is New in Kubernetes 1.27

Kubernetes 1.27, "Chill Vibes," delivers a solid set of enhancements focused on stability, storage, security, and workload management. This release introduces a significant feature for stateful workloads and continues the project's trend of refining existing functionality.

How does StatefulSet get more flexible in 1.27?

The new .spec.ordinals.start field for StatefulSets is a game-changer for blue/green and canary deployments. It allows you to change the starting index of Pod ordinals, which was previously fixed at 0.

In practice, this means you can deploy a new StatefulSet with a starting ordinal of 100, leaving your existing Pods (app-0, app-1) untouched. This enables much safer and more controlled stateful workload updates without complex scripting or manual intervention.

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  ordinals:
    start: 100
  replicas: 2
  # ... other spec

What storage enhancements should I know about?

The ReadWriteOncePod access mode has been promoted to stable. This is crucial for workloads that require exclusive write access to a volume, ensuring that only one Pod can mount a PVC for writing, preventing data corruption in multi-writer scenarios.

For security, KMS v2 improvements have entered beta, offering a performance-optimized and more secure method for at-rest encryption of Secrets. It provides key rotation without a full cluster restart and uses a stronger encryption context.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: single-writer-pvc
spec:
  accessModes:
  - ReadWriteOncePod # Guarantees exclusive access
  # ... other spec

How is security being streamlined?

The LegacyServiceAccountTokenCleanUp feature gate is now in beta. This automates the cleanup of auto-generated Secret-based ServiceAccount tokens, which are deprecated in favor of the more secure and efficient TokenRequest API. This helps reduce the attack surface by removing unused credentials.

Performance gets a boost with faster SELinux volume relabeling. The kubelet now uses a faster recursive `chcon` operation instead of a `find | chcon` pipeline, significantly speeding up pod startup times on nodes with SELinux enabled, especially for volumes with many files.

What's new for application deployment and management?

PodFailurePolicy moves to beta, giving you fine-grained control over how Jobs handle Pod failures. You can define rules to ignore specific exit codes or pod conditions, which is invaluable for handling transient errors in complex batch jobs without marking the entire Job as failed.

In the observability space, the Node Log Query feature is alpha. It allows you to query container logs directly through the kubelet API, providing a potential alternative for host-level logging without needing to SSH into nodes.

apiVersion: batch/v1
kind: Job
metadata:
  name: job-with-pod-failure-policy
spec:
  podFailurePolicy:
    rules:
    - action: Ignore
      onExitCodes:
        containerName: main
        operator: In
        values: [42]
  # ... other spec

What has been deprecated or removed?

The cleanup of in-tree cloud provider code continues. The Azure disk and file in-tree storage drivers have been removed entirely; you must use the CSI drivers. The vSphere in-tree storage driver is also scheduled for removal, and its associated CSI migration flags are now enabled by default and cannot be turned off.

For developers, the last remnants of the kubectl run generator mechanism are officially deprecated. The --generator flag and generating Pods via kubectl run should be replaced with explicit kubectl create commands.