Kubernetes 1.33 "Octarine": Key Features and Security Enhancements

Originally published at ssojet Kubernetes v1.33, known as "Octarine," was released on April 23, 2025. This version introduces 64 enhancements, consisting of 18 stable, 20 beta, and 24 alpha features. This release emphasizes improvements in scalability, security, and developer experience. Native Sidecar Containers Kubernetes 1.33 promotes the use of sidecar containers to stable status. Sidecars are crucial for deploying companion processes alongside application containers within the same Pod, commonly used in service mesh implementations and logging solutions. The sidecar pattern allows developers to handle additional capabilities such as networking and metrics gathering effectively. Example implementation: apiVersion: apps/v1 kind: Deployment metadata: name: myapp labels: app: myapp spec: replicas: 1 selector: matchLabels: app: myapp template: metadata: labels: app: myapp spec: containers: - name: myapp image: alpine:latest command: ['sh', '-c', 'while true; do echo "logging" >> /opt/logs.txt; sleep 1; done'] volumeMounts: - name: data mountPath: /opt initContainers: - name: logshipper image: alpine:latest restartPolicy: Always command: ['sh', '-c', 'tail -F /opt/logs.txt'] volumeMounts: - name: data mountPath: /opt volumes: - name: data emptyDir: {} With this stable implementation, Kubernetes manages the lifecycle of sidecar containers, ensuring they start before and terminate after the main application containers, addressing previous challenges with pod initialization. For more details, visit the Kubernetes documentation on sidecars. In-Place Pod Resizing Kubernetes 1.33 introduces in-place resource resizing for vertical scaling of Pods, now in beta. This feature allows administrators to adjust resource allocations (CPU and memory) without disrupting running applications. This capability is especially beneficial for stateful applications where pod recreation could introduce significant overhead. More information can be found in the Kubernetes Enhancement Proposal (KEP) for in-place resizing. Enhanced Security Features Kubernetes 1.33 enhances security with "bound service account token volumes," which have reached stable status. This feature ensures that API authentication uses industry-standard JWT tokens with proper audience and time bindings, significantly improving security. Additionally, user namespaces are now enabled by default for Linux-based clusters. This feature maps container user IDs to non-root host user IDs, enhancing isolation between containers and the host, which is crucial for multi-tenant environments. For further details, refer to the Bound Service Account Token Improvements and User Namespaces Support. Support for Multiple Service CIDRs The release includes an enhanced allocation system for Service IPs, allowing administrators to dynamically expand the IP address pool available for ClusterIP Services by creating additional ServiceCIDR objects. This improvement streamlines the management of service IPs across the cluster. Learn more about the Multiple Service CIDRs enhancement. Networking Improvements IPv4/IPv6 dual-stack networking continues to mature, providing additional configuration options and improved performance. Network policy logging has also been promoted to beta status, enhancing visibility into network traffic controls. Deprecations and Removals Kubernetes 1.33 deprecates the Endpoints API, transitioning to EndpointSlices, which offer better scalability. The gitRepo volume type has been removed due to security concerns, and host networking support for Windows Pods has been withdrawn due to technical challenges. For a comprehensive list of changes, refer to the official release notes. Security Enhancements with Calico Tigera's Calico Open Source 3.30 enhances security and observability in Kubernetes environments. Notable features include: Goldmane: A gRPC-based API for real-time traffic insights, improving service monitoring. Staged Policies: Allow for testing and auditing security policies before activation, reducing the risk of disruptions. Calico Ingress Gateway: A vendor-neutral implementation that enhances load balancing and rate limiting for better traffic management. For more information, visit the Calico blog. Implementing Secure SSO and User Management As Kubernetes continues to evolve, it is essential for enterprises to implement secure Single Sign-On (SSO) and user management solutions. SSOJet offers an API-first platform featuring directory sync, SAML, OIDC, and magic link authentication, ensuring a robust security posture for cloud-native applications. Explore our services at ssojet.com to learn how we can help streamline you

Apr 30, 2025 - 20:23

Kubernetes 1.33 "Octarine": Key Features and Security Enhancements

Originally published at ssojet

Kubernetes v1.33, known as "Octarine," was released on April 23, 2025. This version introduces 64 enhancements, consisting of 18 stable, 20 beta, and 24 alpha features. This release emphasizes improvements in scalability, security, and developer experience.

Native Sidecar Containers

Kubernetes 1.33 promotes the use of sidecar containers to stable status. Sidecars are crucial for deploying companion processes alongside application containers within the same Pod, commonly used in service mesh implementations and logging solutions. The sidecar pattern allows developers to handle additional capabilities such as networking and metrics gathering effectively.

Example implementation:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: alpine:latest
          command: ['sh', '-c', 'while true; do echo "logging" >> /opt/logs.txt; sleep 1; done']
          volumeMounts:
            - name: data
              mountPath: /opt
      initContainers:
        - name: logshipper
          image: alpine:latest
          restartPolicy: Always
          command: ['sh', '-c', 'tail -F /opt/logs.txt']
          volumeMounts:
            - name: data
              mountPath: /opt
      volumes:
        - name: data
          emptyDir: {}

With this stable implementation, Kubernetes manages the lifecycle of sidecar containers, ensuring they start before and terminate after the main application containers, addressing previous challenges with pod initialization.

For more details, visit the Kubernetes documentation on sidecars.

In-Place Pod Resizing

Kubernetes 1.33 introduces in-place resource resizing for vertical scaling of Pods, now in beta. This feature allows administrators to adjust resource allocations (CPU and memory) without disrupting running applications. This capability is especially beneficial for stateful applications where pod recreation could introduce significant overhead.

More information can be found in the Kubernetes Enhancement Proposal (KEP) for in-place resizing.

Enhanced Security Features

Kubernetes 1.33 enhances security with "bound service account token volumes," which have reached stable status. This feature ensures that API authentication uses industry-standard JWT tokens with proper audience and time bindings, significantly improving security.

Additionally, user namespaces are now enabled by default for Linux-based clusters. This feature maps container user IDs to non-root host user IDs, enhancing isolation between containers and the host, which is crucial for multi-tenant environments.

For further details, refer to the Bound Service Account Token Improvements and User Namespaces Support.

Support for Multiple Service CIDRs

The release includes an enhanced allocation system for Service IPs, allowing administrators to dynamically expand the IP address pool available for ClusterIP Services by creating additional ServiceCIDR objects. This improvement streamlines the management of service IPs across the cluster.

Learn more about the Multiple Service CIDRs enhancement.

Networking Improvements

IPv4/IPv6 dual-stack networking continues to mature, providing additional configuration options and improved performance. Network policy logging has also been promoted to beta status, enhancing visibility into network traffic controls.

Deprecations and Removals

Kubernetes 1.33 deprecates the Endpoints API, transitioning to EndpointSlices, which offer better scalability. The gitRepo volume type has been removed due to security concerns, and host networking support for Windows Pods has been withdrawn due to technical challenges.

For a comprehensive list of changes, refer to the official release notes.

Security Enhancements with Calico

Tigera's Calico Open Source 3.30 enhances security and observability in Kubernetes environments. Notable features include:

Goldmane: A gRPC-based API for real-time traffic insights, improving service monitoring.
Staged Policies: Allow for testing and auditing security policies before activation, reducing the risk of disruptions.
Calico Ingress Gateway: A vendor-neutral implementation that enhances load balancing and rate limiting for better traffic management.

For more information, visit the Calico blog.

Implementing Secure SSO and User Management

As Kubernetes continues to evolve, it is essential for enterprises to implement secure Single Sign-On (SSO) and user management solutions. SSOJet offers an API-first platform featuring directory sync, SAML, OIDC, and magic link authentication, ensuring a robust security posture for cloud-native applications.

Explore our services at ssojet.com to learn how we can help streamline your authentication processes while enhancing security measures for your Kubernetes deployments.