AppArmor via securityContext
Containers can be confined with AppArmor by setting appArmorProfile.type in the securityContext. Clusters still using the older annotations should move to the field.
Kubernetes minor release · “Elli”
Kubernetes 1.31
Elli is the first release after Kubernetes turned ten. It finishes moving cloud-provider code out of the core, puts cgroup v1 into maintenance mode, makes AppArmor GA and moves the nftables kube-proxy backend to beta.
End of life
End of life since 11 Nov 2025 (12 months ago). No more patches upstream.
Released13 Aug 2024
Maintenance mode—
End of life11 Nov 2025
Latest patch1.31.1412 Nov 2025
Patch releases14
Support span14.9 months
What 1.31 brought
Load balancer connection draining in kube-proxy
kube-proxy lets load balancers drain connections from terminating nodes behind LoadBalancer Services with externalTrafficPolicy: Cluster. No configuration needed; it has been on by default since v1.30.
nftables backend for kube-proxy
The NFTablesProxyMode feature gate is now on by default. The mode needs Linux kernel 5.13 or newer, may not suit every network plugin, and treats some NodePort cases differently from iptables.
Multiple Service CIDRs
Admins can grow, shrink or replace the Service IP range without downtime, instead of being locked to the kube-apiserver flag chosen at cluster creation. Still off by default.
Reclaim policy always honored
A PersistentVolume's Delete reclaim policy is now enforced no matter whether the PV or its PVC is deleted first, so backend storage no longer leaks.
OCI images as volumes
With the ImageVolume feature gate, a Pod can mount the contents of an OCI image or artifact as a volume, a building block for AI/ML data delivery.
Summarised in our own words from the official “Kubernetes v1.31: Elli” announcement (45 tracked enhancements), © The Kubernetes Authors, CC BY 4.0.
APIs that stopped being served in 1.31
No API versions were removed in 1.31.
Other removals and deprecations
Removed
- The last in-tree cloud provider integrations are gone; every cluster now needs an external cloud provider integration.
- In-tree CephFS volume plugin removed, so cephfs volumes no longer work. Switch to the CephFS CSI driver and redeploy affected apps.
- In-tree Ceph RBD volume plugin and its CSI migration removed, so rbd volumes no longer work. Switch to the RBD CSI driver.
- kubelet flag --keep-terminated-pod-volumes, deprecated since 2017, removed.
- Alpha InTreePlugin*Unregister feature gates for AWS, Azure Disk, Azure File, GCE, OpenStack and vSphere removed as redundant.
- AzureDiskLimits, CinderLimits, EBSLimits and GCEPDLimits dropped from the scheduler's default plugin list.
Deprecated
- Node field .status.nodeInfo.kubeProxyVersion deprecated because the kubelet cannot report it reliably; DisableNodeKubeProxyVersion now defaults to true, so the kubelet stops filling it.
- All non-CSI volume-limit scheduler plugins deprecated; custom scheduler configs should use NodeVolumeLimits instead.
- cgroup v1 support enters maintenance mode: no new features, security fixes still provided, other bug fixes best-effort. Start moving nodes to cgroup v2.
- SHA-1 signed certificates for webhooks or aggregated API servers only work with GODEBUG=x509sha1=1, and that opt-in disappears with Go 1.24.
From the release announcement; our wording.
API versions deprecated in 1.31
Still served in 1.31, but the API server answers with a deprecation warning and a removal is scheduled.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| ValidatingAdmissionPolicy | admissionregistration.k8s.io/v1beta1 beta · off by default | 1.34 | admissionregistration.k8s.io/v1 |
| ValidatingAdmissionPolicyBinding | admissionregistration.k8s.io/v1beta1 beta · off by default | 1.34 | admissionregistration.k8s.io/v1 |
Upgrading
Version skew with a 1.31 API server
- kubelet, kube-proxy: 1.28 to 1.31
- kube-controller-manager, scheduler: 1.30 to 1.31
- kubectl: 1.30 to 1.32
From the official version skew policy as it stands today.
One minor at a time
The API server must not skip minor versions.
1.31 on managed Kubernetes
| Service | Available | End of standard support | End of extended support |
|---|---|---|---|
| Upstream Kubernetes | 13 Aug 2024 | 11 Nov 2025 | — |
| Amazon EKS | 26 Sep 2024 | 26 Nov 2025 | 26 Nov 2026 |
| Google Kubernetes Engine | 22 Oct 2024 | 16 Jan 2026 | 22 Oct 2026 |
| Azure Kubernetes Service | 2024-11 | 1 Nov 2025 | 30 Nov 2026 |
As published by each provider; see managed Kubernetes support for what “extended” means on each and when we last checked.