Kubernetes v1.36, slated for late April 2026, will introduce significant removals, deprecations, and numerous enhancements. The project adheres to a strict deprecation policy, ensuring stable APIs are only removed after a newer stable version is available and have a minimum lifetime. A recent example of this policy is the retirement of the Ingress NGINX project as of March 24, 2026, with no further support or security updates. For v1.36, the .spec.externalIPs field in Service is being deprecated due to security concerns (CVE-2020-8554), with full removal planned in v1.43, urging migration to LoadBalancer, NodePort, or Gateway API. The gitRepo volume driver, deprecated since v1.11, will be permanently disabled in v1.36 due to a critical security vulnerability allowing root code execution. Workloads currently using gitRepo must migrate to alternatives like init containers or external git-sync tools.Key enhancements in v1.36 include the General Availability (GA) of faster SELinux labeling for volumes, which uses mount options for consistent performance and reduced Pod startup delays. This feature, introduced as beta in v1.28, now defaults to all volumes with Pods specifying spec.SELinuxMount. External signing of ServiceAccount tokens, a beta feature, is expected to graduate to stable in v1.36, allowing clusters to integrate with external key management systems for improved security. Dynamic Resource Allocation (DRA) also sees advancements, with Device taints and tolerations graduating to beta, enabling specialized hardware resources to be restricted to specific workloads. Additionally, DRA will support partitionable devices, allowing a single hardware accelerator to be split into multiple logical units, improving resource utilization for costly resources like GPUs. These changes highlight a continued focus on security, efficiency, and advanced resource management within Kubernetes.
gitRepovolume driver, deprecated since v1.11, will be permanently disabled in v1.36 due to a critical security vulnerability allowing root code execution. Workloads currently usinggitRepomust migrate to alternatives like init containers or external git-sync tools.Key enhancements in v1.36 include the General Availability (GA) of faster SELinux labeling for volumes, which uses mount options for consistent performance and reduced Pod startup delays. This feature, introduced as beta in v1.28, now defaults to all volumes with Pods specifyingspec.SELinuxMount. External signing of ServiceAccount tokens, a beta feature, is expected to graduate to stable in v1.36, allowing clusters to integrate with external key management systems for improved security. Dynamic Resource Allocation (DRA) also sees advancements, with Device taints and tolerations graduating to beta, enabling specialized hardware resources to be restricted to specific workloads. Additionally, DRA will support partitionable devices, allowing a single hardware accelerator to be split into multiple logical units, improving resource utilization for costly resources like GPUs. These changes highlight a continued focus on security, efficiency, and advanced resource management within Kubernetes.