k8s.gcr.io frozen
No new images go to k8s.gcr.io; 1.27 is only on registry.k8s.io, and older-branch patch releases stopped going there after April. Consider running a local mirror.
Kubernetes minor release · “Chill Vibes”
Kubernetes 1.27
A large, calm release that froze the old k8s.gcr.io registry and made seccomp defaulting stable. It also cleaned out many feature gates and flags for features that had already gone GA.
End of life
End of life since 16 Jul 2024 (2.3 years ago). No more patches upstream.
Released11 Apr 2023
Maintenance mode—
End of life16 Jul 2024
Latest patch1.27.1617 Jul 2024
Patch releases16
Support span15.2 months
What 1.27 brought
SeccompDefault
Start the kubelet with --seccomp-default and pods get the runtime's RuntimeDefault seccomp profile instead of running unconfined.
Pod scheduling readiness
Pods can carry schedulingGates so the scheduler ignores them until the gates are removed, avoiding needless scheduling churn.
Node log access through the API
Admins can read service logs from nodes through the API when the NodeLogQuery gate and two kubelet settings are enabled.
ReadWriteOncePod access mode
Volumes can be limited to a single pod; the beta adds scheduler preemption for pods using such claims.
Faster SELinux volume relabeling
Volumes can be mounted with the right SELinux context at once rather than relabeling every file, for ReadWriteOncePod volumes with supporting CSI drivers.
Summarised in our own words from the official “Kubernetes v1.27: Chill Vibes” announcement (60 tracked enhancements), © The Kubernetes Authors, CC BY 4.0.
APIs that stopped being served in 1.27
Upgrading to 1.27 breaks any manifest, Helm chart or client that still uses these API versions. Move them to the version in the last column before you upgrade the control plane.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| CSIStorageCapacity | storage.k8s.io/v1beta1 | 1.27 | storage.k8s.io/v1 |
Other removals and deprecations
Removed
- storage.k8s.io/v1beta1 CSIStorageCapacity is no longer served; use storage.k8s.io/v1.
- Support for the alpha seccomp annotations was removed; set securityContext.seccompProfile instead.
- kube-apiserver --master-service-namespace was removed.
- kube-controller-manager --enable-taint-manager and --pod-eviction-timeout were removed; taint-based eviction stays on.
- Feature gates for features already GA were removed, including CSIMigration, CSIInlineVolume, EphemeralContainers, LocalStorageCapacityIsolation, NetworkPolicyEndPort, IdentifyPodOS, DaemonSetUpdateSurge and ControllerManagerLeaderMigration.
Deprecated
- The SecurityContextDeny admission plugin was deprecated in this release (stated in the 1.30 announcement, which removed it).
From the release announcement; our wording.
Upgrading
Version skew with a 1.27 API server
- kubelet, kube-proxy: 1.25 to 1.27
- kube-controller-manager, scheduler: 1.26 to 1.27
- kubectl: 1.26 to 1.28
From the official version skew policy as it stands today.
One minor at a time
The API server must not skip minor versions.