Back to updates

K8s - 2

2026 (12)

April (8)

k8s: Kubernetes v1.36: Tiered Memory Protection with Memory QoS

Kubernetes Official Blog

2026-04-29

Kubernetes v1.36 updates the alpha Memory QoS feature to separate throttling from reservation, add tiered memory protection by Pod QoS class, expose kubelet metrics, and warn on kernels older than 5.9. With the new policy, Guaranteed Pods get memory.min, Burstable Pods get memory.low, and BestEffort Pods get no protection; throttling via memory.high still applies.

k8s: Kubernetes v1.36: Staleness Mitigation and Observability for Controllers

Kubernetes Official Blog

2026-04-28

Kubernetes v1.36 adds client-go and kube-controller-manager changes to reduce controller actions based on stale caches, and adds metrics for observing cache freshness. The initial rollout targets DaemonSet, StatefulSet, ReplicaSet, and Job controllers, with feature gates available to disable the behavior.

k8s: Kubernetes v1.36: Mutable Pod Resources for Suspended Jobs (beta)

Kubernetes Official Blog

2026-04-27

Kubernetes v1.36 promotes Mutable Pod Resources for Suspended Jobs to beta. It lets controllers change CPU, memory, GPU, and other container resource requests/limits in a suspended Job’s pod template before resuming it, without recreating the Job.

k8s: Kubernetes v1.36: Fine-Grained Kubelet API Authorization Graduates to GA

Kubernetes Official Blog

2026-04-24

Kubernetes v1.36 makes fine-grained kubelet API authorization GA. KubeletFineGrainedAuthz is now always enabled, allowing RBAC to target specific kubelet subresources like nodes/metrics and nodes/stats instead of the broad nodes/proxy permission.

k8s: Kubernetes v1.36: User Namespaces in Kubernetes are finally GA

Kubernetes Official Blog

2026-04-23

Kubernetes v1.36 makes User Namespaces GA on Linux, allowing Pods to run with hostUsers: false so container root is isolated from host root. The release also relies on ID-mapped mounts to avoid recursive chown on volumes, improving startup performance and preserving on-disk ownership.

k8s: SELinux Volume Label Changes goes GA (and likely implications in v1.37)

Kubernetes Official Blog

2026-04-22

Kubernetes v1.36 introduces stable Pod field `spec.securityContext.seLinuxChangePolicy` and a new optional `selinux-warning-controller` to help prepare for a likely v1.37 default-on `SELinuxMount` change. When SELinux is enabled, mounts can switch from recursive relabeling to mount-time labeling, which improves performance but can break some shared-volume patterns; clusters should audit for conflicts and opt out per Pod with `Recursive` if needed.

k8s: Kubernetes v1.36: ハル (Haru)

Kubernetes Official Blog

2026-04-22

Kubernetes v1.36 (Haru) ships 70 enhancements: 18 stable, 25 beta, and 25 alpha. Highlights include GA for fine-grained kubelet API authorization, user namespaces in pods, external ServiceAccount token signing, SELinux volume label changes, and removal of the gitRepo volume driver; Service.spec.externalIPs is deprecated for removal in v1.43.

k8s: Gateway API v1.5: Moving features to Stable

Kubernetes Official Blog

2026-04-21

Gateway API v1.5 promotes six features to the Standard channel and updates the release process to a release train model with feature freeze dates. It also includes a v1 bump for ReferenceGrant, plus notes on migration and compatibility for existing Experimental TLSRoute resources.

March (4)

k8s: Kubernetes v1.36 Sneak Peek

Kubernetes Official Blog

2026-03-30

Kubernetes v1.36 is planned for April 22, 2026 and includes API deprecations/removals plus several feature graduations. Notable changes are deprecating Service .spec.externalIPs, disabling the gitRepo volume driver, and promoting SELinux volume labeling and external ServiceAccount token signing to GA.

k8s: Announcing Ingress2Gateway 1.0: Your Path to Gateway API

Kubernetes Official Blog

2026-03-20

Ingress2Gateway 1.0 is a stable migration assistant for moving from Ingress to Gateway API, with expanded Ingress-NGINX annotation support and more detailed warnings for unsupported or lossy translations. The release emphasizes controller-level integration tests and safer migration workflows, including manual review, validation in a dev cluster, and gradual traffic shifting.

k8s: Running Agents on Kubernetes with Agent Sandbox

Kubernetes Official Blog

2026-03-20

Kubernetes SIG Apps is developing Agent Sandbox, a new API for singleton, stateful AI agent workloads that need persistent identity, isolation, and suspend/resume behavior. The project adds a Sandbox CRD plus extensions like warm pools to reduce cold starts and support untrusted code execution.

k8s: Securing Production Debugging in Kubernetes

Kubernetes Official Blog

2026-03-18

The post recommends securing production Kubernetes debugging with least-privilege RBAC, short-lived identity-bound credentials, and a just-in-time access gateway instead of shared bastions, cluster-admin access, or long-lived SSH keys. It outlines practical patterns for namespace-scoped roles, group-based bindings, OIDC or client-certificate auth, and gateway-mediated sessions with audit logging and automatic expiration.