In-tree cloud providers off by default
Azure, GCE and vSphere in-tree integrations are disabled by default. Run an external cloud controller manager, or set DisableCloudProviders and DisableKubeletCloudCredentialProviders to false.
Kubernetes minor release · “Mandala (The Universe)”
Kubernetes 1.29
The release where clusters run without built-in cloud provider integrations by default, so external cloud controller managers become the norm. KMS v2 encryption at rest and ReadWriteOncePod volumes reached GA.
End of life
End of life since 28 Feb 2025 (20 months ago). No more patches upstream.
Released13 Dec 2023
Maintenance mode—
End of life28 Feb 2025
Latest patch1.29.1512 Mar 2025
Patch releases15
Support span14.6 months
What 1.29 brought
KMS v2 encryption at rest
KMS v2 is stable, improving performance, key rotation, health checks and observability. KMS v1 is now disabled by default and needs an explicit opt-in.
ReadWriteOncePod access mode
A volume claim with this mode can be used by exactly one pod across the whole cluster.
Legacy service account token cleanup
Unused auto-generated secret-based tokens are marked invalid after a year by default, then deleted after a further year without use.
nftables mode for kube-proxy
kube-proxy gains a new backend based on nftables, the successor to iptables.
Dynamic Service IP ranges
New ServiceCIDR and IPAddress objects let you add Service IP ranges without restarting kube-apiserver, easing IP exhaustion.
Summarised in our own words from the official “Kubernetes v1.29: Mandala” announcement (49 tracked enhancements), © The Kubernetes Authors, CC BY 4.0.
APIs that stopped being served in 1.29
Upgrading to 1.29 breaks any manifest, Helm chart or client that still uses these API versions. Move them to the version in the last column before you upgrade the control plane.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| FlowSchema | flowcontrol.apiserver.k8s.io/v1beta2 | 1.29 | flowcontrol.apiserver.k8s.io/v1 |
| PriorityLevelConfiguration | flowcontrol.apiserver.k8s.io/v1beta2 | 1.29 | flowcontrol.apiserver.k8s.io/v1 |
Other removals and deprecations
Removed
- flowcontrol.apiserver.k8s.io/v1beta2 FlowSchema and PriorityLevelConfiguration are no longer served; update manifests and clients before upgrading.
- Built-in cloud provider integrations are disabled by default; opting back in via feature gates is still possible.
Deprecated
- The Node field status.nodeInfo.kubeProxyVersion is deprecated because the kubelet sets it without knowing the real kube-proxy version.
From the release announcement; our wording.
API versions deprecated in 1.29
Still served in 1.29, but the API server answers with a deprecation warning and a removal is scheduled.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| FlowSchema | flowcontrol.apiserver.k8s.io/v1beta3 | 1.32 | flowcontrol.apiserver.k8s.io/v1 |
| PriorityLevelConfiguration | flowcontrol.apiserver.k8s.io/v1beta3 | 1.32 | flowcontrol.apiserver.k8s.io/v1 |
| ValidatingAdmissionPolicy | admissionregistration.k8s.io/v1alpha1 alpha · off |
1.32 | admissionregistration.k8s.io/v1 |
| ValidatingAdmissionPolicyBinding | admissionregistration.k8s.io/v1alpha1 alpha · off |
1.32 | admissionregistration.k8s.io/v1 |
| SelfSubjectReview | authentication.k8s.io/v1alpha1 alpha · off |
1.32 | authentication.k8s.io/v1 |
Stable (GA) API kinds new in 1.29
FlowSchema flowcontrol.apiserver.k8s.io/v1PriorityLevelConfiguration flowcontrol.apiserver.k8s.io/v1
Upgrading
Version skew with a 1.29 API server
- kubelet, kube-proxy: 1.26 to 1.29
- kube-controller-manager, scheduler: 1.28 to 1.29
- kubectl: 1.28 to 1.30
From the official version skew policy as it stands today.
One minor at a time
The API server must not skip minor versions.
1.29 on managed Kubernetes
| Service | Available | End of standard support | End of extended support |
|---|---|---|---|
| Upstream Kubernetes | 13 Dec 2023 | 28 Feb 2025 | — |
| Azure Kubernetes Service | 2024-03 | 31 Mar 2025 | 30 Apr 2026 |
As published by each provider; see managed Kubernetes support for what “extended” means on each and when we last checked.