PodSecurityPolicy replaced by Pod Security Admission
PSP, deprecated in 1.21, is removed. Its built-in successor, Pod Security Admission, is now stable; clusters relying on PSP must migrate before upgrading.
Kubernetes minor release · “Combiner”
Kubernetes 1.25
A security-focused release: PodSecurityPolicy is gone and Pod Security Admission becomes stable. Ephemeral containers, cgroups v2 support and core CSI migration also reached GA, and project images moved to registry.k8s.io.
End of life
End of life since 28 Oct 2023 (3.0 years ago). No more patches upstream.
Released23 Aug 2022
Maintenance mode—
End of life28 Oct 2023
Latest patch1.25.1616 Nov 2023
Patch releases16
Support span14.2 months
Release team note: 1.25.16 was released in November 2023 (after the EOL date) to fix CVE-2023-5528
What 1.25 brought
Ephemeral containers
Short-lived debug containers can be added to a running pod, useful when kubectl exec is impossible because a container crashed or lacks tools.
cgroups v2 support
Kubernetes fully supports the Linux cgroups v2 API, which some distributions now use by default; cgroups v1 remains supported.
Core CSI migration
Routing in-tree volume plugins to CSI drivers is stable, including GCE PD and AWS EBS. vSphere stays beta (on by default); Portworx is beta, off by default.
New image registry registry.k8s.io
The project's container registry moved from k8s.gcr.io to registry.k8s.io.
CRD validation with CEL
Custom resources can declare validation rules written in Common Expression Language directly in the CRD schema.
Summarised in our own words from the official “Kubernetes v1.25: Combiner” announcement (40 tracked enhancements), © The Kubernetes Authors, CC BY 4.0.
APIs that stopped being served in 1.25
Upgrading to 1.25 breaks any manifest, Helm chart or client that still uses these API versions. Move them to the version in the last column before you upgrade the control plane.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| HorizontalPodAutoscaler | autoscaling/v2beta1 | 1.25 | autoscaling/v2 |
| CronJob | batch/v1beta1 | 1.25 | batch/v1 |
| EndpointSlice | discovery.k8s.io/v1beta1 | 1.25 | discovery.k8s.io/v1 |
| Event | events.k8s.io/v1beta1 | 1.25 | events.k8s.io/v1 |
| RuntimeClass | node.k8s.io/v1beta1 | 1.25 | node.k8s.io/v1 |
| Eviction | policy/v1beta1 | 1.25 | policy/v1 |
| PodDisruptionBudget | policy/v1beta1 | 1.25 | policy/v1 |
| PodSecurityPolicy | policy/v1beta1 | 1.25 | Pod Security Admission (no API replacement) |
Other removals and deprecations
Removed
- PodSecurityPolicy (policy/v1beta1) was removed; migrate to Pod Security Admission.
- The in-tree Flocker, Quobyte and StorageOS volume plugins were removed; switch to an equivalent CSI driver or other storage.
- Beta API versions on the official 1.25 removal list: batch/v1beta1 CronJob, discovery.k8s.io/v1beta1 EndpointSlice, events.k8s.io/v1beta1 Event, autoscaling/v2beta1 HPA, policy/v1beta1 PodDisruptionBudget, node.k8s.io/v1beta1 RuntimeClass.
- The in-tree vSphere volume driver no longer supports vSphere releases older than 7.0u2.
Deprecated
- The in-tree GlusterFS volume plugin was deprecated; its CSI driver had not been maintained.
- The in-tree Portworx volume plugin was deprecated.
- The kubelet begins phasing out the KUBE-MARK-DROP, KUBE-MARK-MASQ and KUBE-POSTROUTING nat chains (IPTablesCleanup gate); not formally a deprecation, but don't depend on them.
From the release announcement; our wording.
Upgrading
Version skew with a 1.25 API server
- kubelet, kube-proxy: 1.23 to 1.25
- kube-controller-manager, scheduler: 1.24 to 1.25
- kubectl: 1.24 to 1.26
From the official version skew policy as it stands today.
One minor at a time
The API server must not skip minor versions.