--- name: containers-cs_versions_134 title: 1.34 version information and update actions description: Review information about version 1.34 of IBM Cloud® Kubernetes Service. For more information about Kubernetes project version 1.34, see the Kubernetes change log. last-updated: 2026-05-06 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # 1.34 version information and update actions {: #cs_versions_134} Review information about version 1.34 of IBM Cloud® Kubernetes Service. For more information about Kubernetes project version 1.34, see the [Kubernetes change log](https://kubernetes.io/releases/notes/.){: external}. {: shortdesc} ![This badge indicates Kubernetes version 1.34 certification for IBM Cloud Kubernetes Service](images/certified-kubernetes-color.svg){: caption="Kubernetes version 1.34 certification badge" caption-side="bottom"} IBM Cloud Kubernetes Service is a Certified Kubernetes product for version 1.34 under the CNCF Kubernetes Software Conformance Certification program. _Kubernetes® is a registered trademark of The Linux Foundation in the United States and other countries, and is used pursuant to a license from The Linux Foundation._ ## Release timeline {: #release_timeline_134} The following table includes the expected release timeline for version 1.34 of IBM Cloud® Kubernetes Service. You can use this information for planning purposes, such as to estimate the general time that the version might become unsupported. {: shortdesc} Dates that are marked with a dagger (`†`) are tentative and subject to change. {: important} | Version | Supported? | Release date | Unsupported date | |------|------|----------|----------| | 1.34 | Yes | 20 November 2025 | 20 January 2027 `†` | {: caption="Release timeline for IBM Cloud Kubernetes Service version 1.34" caption-side="bottom"} ## Preparing to update {: #prep-up-134} This information summarizes updates that are likely to have an impact on deployed apps when you update a cluster to version 1.34. For a complete list of changes, review the [community Kubernetes change log](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.34.md){: external} and [IBM version change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_134&format=markdown) for version 1.34. You can also review the [Kubernetes helpful warnings](https://kubernetes.io/blog/2020/09/03/warnings/){: external}. {: shortdesc} [Portworx](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_about&format=markdown) does not yet support version 1.34. Do not upgrade your cluster to version 1.34 if your apps use Portworx. {: important} [CoreDNS](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dns&format=markdown) The default DNS cache time in both CoreDNS and NodeLocal DNS configurations has been increased from 30 seconds to 120 seconds. {: important} ### Update before master {: #before_134} The following table shows the actions that you must take before you update the Kubernetes master. | Type | Description | | --- | --- | | **Cluster autoscaler**: Only version 2.0.0 and later of the [cluster autoscaler](https://cloud.ibm.com/docs/containers?topic=containers-cluster-scaling-classic-vpc&format=markdown) is supported in version 1.34. | Upgrade your cluster autoscaler to at least version 2.0.0 before updating your cluster to version 1.34. | | **Pod Topology Spread**: The implementation of `matchLabelKeys` in `topologySpreadConstraints` now merges into `labelSelector`. | Do not upgrade directly from v1.32 to v1.34 if using this feature; upgrade to v1.33 first. Ensure pods created at v1.32 using `matchLabelKeys` are scheduled or removed before upgrading to v1.34. | | **Pod Security Admission**: The `baseline` and `restricted` policies now block the `.host` field in probes and lifecycle handlers (e.g., `livenessProbe`, `httpGet`). | Remove `.host` from your pod configurations if using these policies. | | **AppArmor**: AppArmor profiles in `SecurityContext` are no longer synced to the deprecated `container.apparmor.security.beta.kubernetes.io/` annotations. | Update tools to read from `SecurityContext`. | | **Leader Election**: The `endpoint-controller` and `workload-leader-election` FlowSchemas were removed. | Workloads relying on `configmapsleases` or `endpointsleases` for leader election must migrate to the `leases` lock type. | | **Metrics**: `apiserver_cache_list_fetched_objects_total`, `apiserver_cache_list_returned_objects_total`, `apiserver_cache_list_total` | Replace `resource_prefix` label with API `group` and `resource` labels. | | **Metrics**: `apiserver_selfrequest_total` | Add a API `group` label. | | **Metrics**: `apiserver_watch_events_sizes` and `apiserver_watch_events_total` | Replace API `kind` label with `resource` label. | | **Metrics**: `apiserver_request_body_size_bytes`, `apiserver_storage_events_received_total`, `apiserver_storage_list_evaluated_objects_total`, `apiserver_storage_list_fetched_objects_total`, `apiserver_storage_list_returned_objects_total`, `apiserver_storage_list_total`, `apiserver_watch_cache_events_dispatched_total`, `apiserver_watch_cache_events_received_total`, `apiserver_watch_cache_initializations_total`, `apiserver_watch_cache_resource_version`, `watch_cache_capacity`, `apiserver_init_events_total`, `apiserver_terminated_watchers_total`, `watch_cache_capacity_increase_total`, `watch_cache_capacity_decrease_total`, `apiserver_watch_cache_read_wait_seconds`, `apiserver_watch_cache_consistent_read_total`, `apiserver_storage_consistency_checks_total`, `etcd_bookmark_counts`, `storage_decode_errors_total` | Extract the API group from `resource` label and put it in new `group` label. For more information, see [#131845](https://github.com/kubernetes/kubernetes/pull/131845) SIG API Machinery, Etcd, Instrumentation and Testing. | | **Containerd 2.0 Docker Schema 1**: Docker Schema 1 image format (application/vnd.docker.distribution.manifest.v1+prettyjws) is no longer supported by default. | Ensure your images are Docker Schema 2 or OCI compliant. | | **Containerd 2.0 - CRI API**: The CRI v1alpha2 API has been removed. | Ensure Kubernetes components and tools interacting with containerd are using the CRI v1 API. | | **Containerd 2.0 - Runtimes**: Runtime V1 and Runc V1 shims have been removed. | Verify your workloads are compatible with containerd's Runtime V2 shims. | | **Containerd 2.0 Unprivileged Ports and ICMP**: Unprivileged ports and ICMP are now enabled by default. | Review your application security contexts and remove additional capabilities or sysctls (like `NET_BIND_SERVICE` or `net.ipv4.ping_group_range`) that were previously required for these features. Consult the [upstream changelogs](https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md#unprivileged-ports-and-icmp-by-default-for-cri) for the details. | {: caption="Changes to make before you update the master to Kubernetes 1.34" caption-side="bottom"} ### Update after master {: #after_134} No actions required.