Back to updates

K8s - 3

2026 (5)

April (5)

k8s: Kubernetes v1.36: Fine-Grained Kubelet API Authorization Graduates to GA

Kubernetes Official Blog

2026-04-24

Kubernetes v1.36 makes fine-grained kubelet API authorization GA. KubeletFineGrainedAuthz is now always enabled, allowing RBAC to target specific kubelet subresources like nodes/metrics and nodes/stats instead of the broad nodes/proxy permission.

k8s: Kubernetes v1.36: User Namespaces in Kubernetes are finally GA

Kubernetes Official Blog

2026-04-23

Kubernetes v1.36 makes User Namespaces GA on Linux, allowing Pods to run with hostUsers: false so container root is isolated from host root. The release also relies on ID-mapped mounts to avoid recursive chown on volumes, improving startup performance and preserving on-disk ownership.

k8s: SELinux Volume Label Changes goes GA (and likely implications in v1.37)

Kubernetes Official Blog

2026-04-22

Kubernetes v1.36 introduces stable Pod field `spec.securityContext.seLinuxChangePolicy` and a new optional `selinux-warning-controller` to help prepare for a likely v1.37 default-on `SELinuxMount` change. When SELinux is enabled, mounts can switch from recursive relabeling to mount-time labeling, which improves performance but can break some shared-volume patterns; clusters should audit for conflicts and opt out per Pod with `Recursive` if needed.

k8s: Kubernetes v1.36: ハル (Haru)

Kubernetes Official Blog

2026-04-22

Kubernetes v1.36 (Haru) ships 70 enhancements: 18 stable, 25 beta, and 25 alpha. Highlights include GA for fine-grained kubelet API authorization, user namespaces in pods, external ServiceAccount token signing, SELinux volume label changes, and removal of the gitRepo volume driver; Service.spec.externalIPs is deprecated for removal in v1.43.

k8s: Gateway API v1.5: Moving features to Stable

Kubernetes Official Blog

2026-04-21

Gateway API v1.5 promotes six features to the Standard channel and updates the release process to a release train model with feature freeze dates. It also includes a v1 bump for ReferenceGrant, plus notes on migration and compatibility for existing Experimental TLSRoute resources.