Sidecar containers
Sidecars are init containers with restartPolicy: Always. They start before app containers, run for the Pod's whole life, can use probes, and stop automatically after the main containers exit.
Kubernetes minor release · “Octarine (The Color of Magic)”
Kubernetes 1.33
Octarine, named after Discworld's colour of magic, makes sidecar containers and the nftables kube-proxy backend GA, moves in-place Pod resizing to beta and user namespaces to on-by-default beta, and deprecates the Endpoints API.
End of life
End of life since 28 Jun 2026 (4 months ago). No more patches upstream.
Released23 Apr 2025
Maintenance mode—
End of life28 Jun 2026
Latest patch1.33.1312 Jun 2026
Patch releases13
Support span14.2 months
What 1.33 brought
In-place Pod resource resize
CPU and memory of running Pods can be changed without replacing them, allowing vertical scaling of stateful processes without downtime.
nftables backend for kube-proxy
The nftables backend is stable and scales better, but iptables remains the default on Linux for compatibility. A migration guide explains how to switch.
Multiple Service CIDRs
ServiceCIDR and IPAddress are stable APIs, so admins can add ClusterIP address space at any time by creating new ServiceCIDR objects.
Traffic distribution PreferClose
Topology-aware routing and the Service trafficDistribution field with PreferClose are stable, letting kube-proxy keep traffic in-zone to cut latency and cross-zone transfer costs.
User namespaces for Linux Pods
User namespace support is now on-by-default beta. Existing Pods are unaffected unless they opt in by setting pod.spec.hostUsers.
Summarised in our own words from the official “Kubernetes v1.33: Octarine” announcement (64 tracked enhancements), © The Kubernetes Authors, CC BY 4.0.
APIs that stopped being served in 1.33
Only alpha or off-by-default beta APIs were removed: they matter only if you switched them on with --runtime-config.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| SelfSubjectReview | authentication.k8s.io/v1beta1 beta · off by default | 1.33 | authentication.k8s.io/v1 |
Other removals and deprecations
Removed
- The Node field .status.nodeInfo.kubeProxyVersion is removed, after being deprecated and disabled by default in v1.31.
- In-tree gitRepo volume driver removed: such Pods are still admitted, but kubelet will not run them unless the GitRepoVolumeDriver gate is re-enabled. Full removal planned for v1.39.
- Host network support for Windows Pods, alpha since v1.26, is withdrawn and removed. HostProcess containers are not affected.
Deprecated
- The stable v1 Endpoints API is deprecated in favour of EndpointSlices; only workloads or scripts that read or write Endpoints directly need to migrate.
From the release announcement; our wording.
Stable (GA) API kinds new in 1.33
IPAddress networking.k8s.io/v1ServiceCIDR networking.k8s.io/v1
Upgrading
Version skew with a 1.33 API server
- kubelet, kube-proxy: 1.30 to 1.33
- kube-controller-manager, scheduler: 1.32 to 1.33
- kubectl: 1.32 to 1.34
From the official version skew policy as it stands today.
One minor at a time
The API server must not skip minor versions.
1.33 on managed Kubernetes
| Service | Available | End of standard support | End of extended support |
|---|---|---|---|
| Upstream Kubernetes | 23 Apr 2025 | 28 Jun 2026 | — |
| Amazon EKS | 29 May 2025 | 29 Jul 2026 | 29 Jul 2027 |
| Google Kubernetes Engine | 4 Jun 2025 | 12 Aug 2026 | 12 Jun 2027 |
| Azure Kubernetes Service | 2025-06 | 31 Jul 2026 | 31 Jul 2027 |
As published by each provider; see managed Kubernetes support for what “extended” means on each and when we last checked.