Upgrade hop
Kubernetes 1.24 → 1.25
1.25 is itself end of life. If you are on 1.24 today, plan the whole path to a supported version (at least 1.35) with the upgrade planner.
1 · Fix removed APIs first
8 kinds stop being served in 1.25. Update manifests, charts and controllers to the replacement versions while the cluster still runs 1.24: the replacements are already served there.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| HorizontalPodAutoscaler | autoscaling/v2beta1 | 1.25 | autoscaling/v2 |
| CronJob | batch/v1beta1 | 1.25 | batch/v1 |
| EndpointSlice | discovery.k8s.io/v1beta1 | 1.25 | discovery.k8s.io/v1 |
| Event | events.k8s.io/v1beta1 | 1.25 | events.k8s.io/v1 |
| RuntimeClass | node.k8s.io/v1beta1 | 1.25 | node.k8s.io/v1 |
| Eviction | policy/v1beta1 | 1.25 | policy/v1 |
| PodDisruptionBudget | policy/v1beta1 | 1.25 | policy/v1 |
| PodSecurityPolicy | policy/v1beta1 | 1.25 | Pod Security Admission (no API replacement) |
Field-level changes for each of these are on the API pages and in the official Deprecated API Migration Guide.
Check your files with the manifest checker; in a live cluster, the API server metric apiserver_requested_deprecated_apis shows which deprecated APIs clients still call.
2 · Other changes that can bite
Removed in 1.25
- PodSecurityPolicy (policy/v1beta1) was removed; migrate to Pod Security Admission.
- The in-tree Flocker, Quobyte and StorageOS volume plugins were removed; switch to an equivalent CSI driver or other storage.
- Beta API versions on the official 1.25 removal list: batch/v1beta1 CronJob, discovery.k8s.io/v1beta1 EndpointSlice, events.k8s.io/v1beta1 Event, autoscaling/v2beta1 HPA, policy/v1beta1 PodDisruptionBudget, node.k8s.io/v1beta1 RuntimeClass.
- The in-tree vSphere volume driver no longer supports vSphere releases older than 7.0u2.
Deprecated in 1.25
- The in-tree GlusterFS volume plugin was deprecated; its CSI driver had not been maintained.
- The in-tree Portworx volume plugin was deprecated.
- The kubelet begins phasing out the KUBE-MARK-DROP, KUBE-MARK-MASQ and KUBE-POSTROUTING nat chains (IPTablesCleanup gate); not formally a deprecation, but don't depend on them.
Our summary of the 1.25 release announcement (CC BY 4.0). Read the full changelog for your components.
3 · Upgrade in this order
- Prepare. Move every node to 1.23 or newer if any are older: a 1.25 API server supports kubelets back to 1.23 only. Upgrade to the newest 1.24 patch,
1.24.17. - kube-apiserver to 1.25 (in HA clusters, one instance at a time; old and new may differ by one minor during the roll). Use the newest patch,
1.25.16. - kube-controller-manager, kube-scheduler, cloud-controller-manager to 1.25, once every API server is on 1.25.
- kubelet on each node (drain first). Optional in this hop: kubelets from 1.23 to 1.25 all work with a 1.25 control plane.
- kube-proxy: no newer than the API server, and within the same window as the kubelet it runs beside.
- kubectl: 1.24 to 1.26 all talk to a 1.25 API server.
From the official version skew policy. Managed services run the control-plane steps for you; node pools are still yours to schedule.