PodSecurityPolicy deprecated
PSP still works for now but is deprecated and planned for removal in 1.25; a simpler built-in replacement is being developed.
Kubernetes minor release · “Power to the Community”
Kubernetes 1.21
With 51 enhancements, the first release of 2021 made CronJobs and immutable Secrets/ConfigMaps stable, turned dual-stack networking on by default, and deprecated PodSecurityPolicy ahead of its planned removal in 1.25.
End of life
End of life since 28 Jun 2022 (4.3 years ago). No more patches upstream.
Released8 Apr 2021
Maintenance mode—
End of life28 Jun 2022
Latest patch1.21.1417 Jun 2022
Patch releases14
Support span14.7 months
What 1.21 brought
CronJobs reach stable
The CronJob API, in beta since 1.8, graduates to stable.
Immutable Secrets and ConfigMaps
A field can lock a Secret or ConfigMap against changes, protecting pods from bad config pushes and reducing API server watch load.
Dual-stack networking on by default
IPv4/IPv6 dual-stack moves to beta and is enabled by default, so pods, services and nodes can get both address families.
Graceful node shutdown
The kubelet detects an impending shutdown through systemd and gives running pods the chance to terminate cleanly.
EndpointSlice and PodDisruptionBudget
EndpointSlice, sysctl support and PodDisruptionBudgets are listed among the features that graduated to stable.
Summarised in our own words from the official “Kubernetes 1.21: Power to the Community” announcement (51 tracked enhancements), © The Kubernetes Authors, CC BY 4.0.
APIs that stopped being served in 1.21
No API versions were removed in 1.21.
Other removals and deprecations
Deprecated
- PodSecurityPolicy is deprecated; it stays functional for several releases and is planned for removal in 1.25.
- The Service topologyKeys field and the alpha features that used it are deprecated in favour of topology-aware hints (alpha).
From the release announcement; our wording.
API versions deprecated in 1.21
Still served in 1.21, but the API server answers with a deprecation warning and a removal is scheduled.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| CronJob | batch/v1beta1 | 1.25 | batch/v1 |
| EndpointSlice | discovery.k8s.io/v1beta1 | 1.25 | discovery.k8s.io/v1 |
| PodDisruptionBudget | policy/v1beta1 | 1.25 | policy/v1 |
| CSIStorageCapacity | storage.k8s.io/v1alpha1 alpha · off |
1.24 | storage.k8s.io/v1 |
| VolumeAttachment | storage.k8s.io/v1alpha1 alpha · off |
1.24 | storage.k8s.io/v1 |
Stable (GA) API kinds new in 1.21
CronJob batch/v1EndpointSlice discovery.k8s.io/v1PodDisruptionBudget policy/v1
Upgrading
Version skew with a 1.21 API server
- kubelet, kube-proxy: 1.19 to 1.21
- kube-controller-manager, scheduler: 1.20 to 1.21
- kubectl: 1.20 to 1.22
From the official version skew policy as it stands today.
One minor at a time
The API server must not skip minor versions.