Kubernetes v1.34: What You Need to Know

Kubernetes v1.34, codenamed “Of Wind & Will (O’ WaW)”, brings a wide range of enhancements aimed at making clusters more efficient, secure, and easier to manage. 

This release delivers 58 enhancements with 23 graduating to Stable, 22 entering Beta, and 13 in Alpha, reflecting the platform’s continued maturation as enterprises scale their container orchestration needs. As anticipated, this release focuses heavily on hardening existing capabilities rather than introducing radical new features—a clear signal of Kubernetes’ evolution toward enterprise-grade reliability.

The standout theme is resource optimization for AI/ML workloads, particularly around GPU management. Dynamic Resource Allocation (DRA) graduating to General Availability represents a game-changer for organizations struggling with GPU scarcity and utilization. As GPU resources become increasingly scarce and expensive across all cloud providers, DRA’s ability to enable GPU sharing, partial allocation, and intelligent scheduling addresses one of today’s most critical infrastructure bottlenecks.

Behind the scenes, the “boring” performance improvements are equally critical—streaming API responses, watch cache optimizations, and scheduler throughput enhancements that keep massive enterprise clusters running smoothly when it matters most. Notably, this version introduces no breaking changes, greatly reducing upgrade risks for production environments.

Here’s a breakdown of the most exciting new features for cluster operators. You can also check out a breakdown of the previous Kubernetes release (v1.33) by our own Udi Hofesh to compare and see the incredible velocity and momentum of the world’s largest open-source project after Linux.  

Resource Management and Node Operations

Dynamic Resource Allocation (GA).
The Dynamic Resource Allocation (DRA) framework has graduated to General Availability. This lets workloads request hardware devices such as GPUs or FPGAs through Kubernetes APIs in a way that mirrors how Persistent Volumes are provisioned. The resource.k8s.io/v1 APIs (ResourceClaim, DeviceClass, ResourceClaimTemplate, ResourceSlice) are now stable, giving operators a consistent way to expose and manage device resources across clusters.

Linux Swap Support (GA).
Kubernetes now officially supports swap on Linux nodes. In the LimitedSwap mode, Pods can use swap within their memory requests, preventing abrupt evictions when a node runs out of RAM. By default, swap remains disabled (NoSwap), but operators can enable it to improve stability for workloads with infrequently accessed memory.

Pod-Level Resource Requests and Limits (Beta).
Instead of only defining CPU/memory requests per container, you can now set them at the Pod level. This allows for a “shared budget” across all containers, reducing over-provisioning and improving scheduling accuracy. The Horizontal Pod Autoscaler has also been updated to recognize these new Pod-scoped requests and limits.

DRA Extensions (Beta).
Several DRA features have entered Beta:

• Admin Access Mode: allows cluster admins to inspect allocated devices for monitoring or troubleshooting.
  
• Prioritized Alternatives: workloads can specify fallback resource options (e.g., “one large GPU or two smaller GPUs”).
  
• Kubelet Resource Reporting: device assignments are now visible through the PodResources API, improving node-level observability.
  

Storage Improvements.
Two storage features are now GA:

• Volume Expansion Recovery: failed resize operations can be rolled back and retried.
  
• VolumeAttributesClass: operators can adjust runtime volume parameters (such as provisioned IOPS) if supported by the CSI driver, enabling dynamic tuning of storage performance.
  

Security and Access Control

Short-Lived ServiceAccount Tokens for Image Pulls (Beta).
Pods can now pull images using short-lived, projected ServiceAccount tokens instead of long-lived node credentials. This reduces the attack surface and ensures tokens are rotated automatically per workload.

External ServiceAccount Token Signing (Beta).
The API server can delegate ServiceAccount token signing to an external key management system via a gRPC interface. This improves compliance and security by centralizing signing in HSMs or cloud KMS services.

Authorization by Object Selector (GA).
You can now enforce authorization policies that only apply if a specific label or field selector is provided. For example, operators can permit listing Pods only when requests are scoped to certain labels.

Restrict Anonymous Requests (GA).
Instead of the old all-or-nothing model, you can now explicitly define which API endpoints are allowed anonymously (such as /healthz). This tightens cluster security while still supporting basic unauthenticated probes.

Mutating Admission Policies (Beta).
Operators no longer need to run custom webhooks for request mutation. With this new feature, policies can be written declaratively using CEL and applied directly in the API server, simplifying admission control and reducing operational overhead.

Pod Security Updates.

• Restricted Probes (Alpha): Pods using the Restricted security profile can no longer set a custom host field in probes or lifecycle hooks. This prevents probes from being used to bypass network policies.
  
• Pod Certificates (Alpha): Pods can now request X.509 certificates via a new PodCertificateRequest API. This lays the groundwork for stronger mTLS-based Pod identity.
  

Scheduling and Reliability

Job Pod Replacement (GA).
A new .spec.podReplacementPolicy allows Jobs to create replacement Pods only after the previous one has fully terminated, avoiding resource contention and unintended parallel execution.

Namespace Deletion Ordering (GA).
Resources within a namespace are now deleted in a deterministic order. Pods are terminated before their associated policies (like NetworkPolicies) are removed, preventing security gaps and addressing issues like CVE-2024-7598.

Scheduler Improvements.

• Plugin Callback Requeue (GA): scheduler plugins can now trigger retries when conditions change, reducing wasted scheduling attempts.
  
• Non-Blocking API Calls (Beta): the scheduler can continue processing while waiting on API server responses, improving throughput.
  
• Nominated Node Name for Expectation (Alpha): the scheduler now records intended node placement even before binding, giving autoscalers and other controllers better visibility.
  

API Server Performance.

• Streaming List Responses (GA): large list responses are streamed to clients, lowering API server memory usage.
  
• Watch Cache Snapshots (Beta): list requests at older resource versions can be served from in-memory snapshots, reducing etcd load.
  
• Streaming Informers (Beta): clients can consume very large lists as streams, reducing client-side memory pressure.
  

Developer Experience

KYAML (Alpha).
Kubernetes now supports KYAML, a restricted YAML dialect that eliminates many common YAML pitfalls (e.g., ambiguous parsing). You can try it by setting KUBECTL_KYAML=true and using kubectl get -o kyaml.

Kubectl Preferences (.kuberc, Beta).
Users can now configure CLI preferences in a .kuberc file (separate from kubeconfig). This allows operators to define default flags, output formats, and aliases.

Per-Container Restart Policies (Alpha).
Pods can now specify different restart behaviors per container, including exit code–based rules. This enables finer-grained fault handling, especially for multi-container workloads.

Other Notables.
Environment variable names are now less restricted (all printable characters except = are valid), and the Taint Manager has been refactored into its own controller for cleaner reliability.

Final Thoughts

Kubernetes v1.34 focuses on maturing long-requested features while strengthening the security and reliability of cluster operations. With Dynamic Resource Allocation, swap support, pod-level resource limits, and significant scheduling and API server improvements, operators have new levers to optimize workloads at scale. Meanwhile, the security updates, ranging from short-lived tokens to external key signing, offer stronger guarantees in multi-tenant and regulated environments.For the full set of details, you can review the official release blog and the release notes.