Kubernetes - 2

2026 (7)

January (7)

k8s: Uniform API server access using clientcmd

Kubernetes Official Blog

2026-01-19

This article explains how to use the clientcmd library (part of client-go) to make Go CLI tools access the Kubernetes API with the same kubeconfig/kubectl semantics users expect. It covers loading rules, configuration overrides, building and binding flags, merging behavior, creating a merged ClientConfig (interactive or non-interactive), and obtaining a kubernetes client, plus relevant gotchas and an example.

k8s: Kubernetes v1.35: Restricting executables invoked by kubeconfigs via exec plugin allowList added to kuberc

Kubernetes Official Blog

2026-01-09

Kubernetes v1.35 introduces a beta credential plugin policy and allowlist to give users control over executables invoked by kubeconfig exec plugins. You can set policy via the client-go ExecProvider.PluginPolicy or by configuring kubectl's kuberc with credentialPluginPolicy (AllowAll, DenyAll, Allowlist) and credentialPluginAllowlist entries to restrict which plugins may run.

aks: Release 2026-01-04

Release notes from AKS

2026-01-09

AKS release 2026-01-04: Ubuntu 24.04 becomes the default OS SKU starting Kubernetes v1.35; multiple OS/node image updates and security/component upgrades; deprecations and retirements announced (Ubuntu 18.04 removed, Azure Linux 2.0 end-of-support and removal, Basic Load Balancer retired, Kubernetes 1.31 deprecated); several new previews and behavioral changes; important dates and migration actions required.

k8s: Kubernetes v1.35: Mutable PersistentVolume Node Affinity (alpha)

Kubernetes Official Blog

2026-01-08

Kubernetes v1.35 (alpha) makes PersistentVolume.spec.nodeAffinity mutable. This allows administrators to update PV node affinity to match changes in underlying storage (for example zonal→regional migrations or disk-generation upgrades) without recreating the PV. The feature is gated (MutablePVNodeAffinity), disabled by default, and requires updating the storage provider first. Be aware of scheduling race conditions when tightening affinity; future kubelet/CSI integration and VolumeAttributesClass automation are planned. Feedback is requested via SIG Storage channels.

k8s: Kubernetes v1.35: A Better Way to Pass Service Account Tokens to CSI Drivers

Kubernetes Official Blog

2026-01-07

Kubernetes v1.35 introduces a beta opt-in for delivering CSI-requested service account tokens in the NodePublishVolumeRequest secrets field rather than volume_context. This change (controlled by serviceAccountTokenInSecrets in the CSIDriver spec) fixes accidental token exposure in logs, is opt-in to preserve compatibility, and includes guidance and a safe rollout sequence for CSI driver authors.

k8s: Kubernetes v1.35: Extended Toleration Operators to Support Numeric Comparisons (Alpha)

Kubernetes Official Blog

2026-01-05

Kubernetes v1.35 introduces Extended Toleration Operators (alpha) that add numeric comparison operators Gt and Lt to spec.tolerations. This lets tolerations compare numeric taint values (e.g., failure-probability, gpu-compute-score, disk-iops, cost-per-hour) so schedulers can make threshold-based placement decisions while preserving taint/toleration semantics (centralized node-side policy and eviction via NoExecute). The feature is gated, supports all taint effects, has specific numeric format rules, and is experimental — feedback and further enhancements (CEL, autoscaling integration, graduation) are planned.

k8s: Kubernetes v1.35: New level of efficiency with in-place Pod restart

Kubernetes Official Blog

2026-01-02

Kubernetes v1.35 introduces an alpha feature, Restart All Containers (enabled with the RestartAllContainersOnContainerExits feature gate), which adds a RestartAllContainers action to container restart rules to perform a fast, in-place full Pod restart that preserves Pod UID, IP, sandbox and volumes while re-running init, sidecar and application containers.

2025 (5)

December (5)

azure: [Launched] Generally Available: Cloud-native apps on Kubernetes pricing calculator scenario

Azure Updates

2025-12-31

Microsoft announced the general availability of a new 'Cloud-native apps on Kubernetes' pricing calculator scenario that helps teams estimate total cost of ownership for a production-ready Azure Kubernetes Service (AKS) cluster and associated Azure services.

k8s: Kubernetes 1.35: Enhanced Debugging with Versioned z-pages APIs

Kubernetes Official Blog

2025-12-31

Kubernetes 1.35 adds opt-in, versioned, machine-parseable JSON responses for the existing /statusz and /flagz z-pages used by control plane components. The endpoints remain backward compatible (plain text by default); consumers request structured output by sending an Accept header with a versioned media type. Structured responses enable easier automation for health checks, config validation, and debugging tools. The feature is alpha, requires feature gates and proper RBAC/authentication, and is intended for debugging rather than production-critical automation.

k8s: Kubernetes v1.35: Watch Based Route Reconciliation in the Cloud Controller Manager

Kubernetes Official Blog

2025-12-30

Kubernetes v1.35 introduces an alpha feature gate (CloudControllerManagerWatchBasedRoutesReconciliation) in k8s.io/cloud-provider that changes the CCM route controller from a fixed-interval reconciliation to a watch/informer-based trigger model. The change reduces unnecessary cloud API calls by reconciling routes only when relevant node or CIDR/address fields change, with an additional randomized periodic reconcile every 12–24 hours. The reconciliation logic itself is unchanged and the feature is enabled via --feature-gate.

k8s: Kubernetes v1.35: Introducing Workload Aware Scheduling

Kubernetes Official Blog

2025-12-29

Kubernetes v1.35 introduces workload-aware scheduling with a new Workload API (scheduling.k8s.io/v1alpha1) to describe multi-Pod scheduling requirements, an initial gang scheduling implementation for all-or-nothing placement, and opportunistic batching (Beta) to speed scheduling of identical Pods. Gang scheduling uses podGroups, a workloadRef on Pods, and a Permit gate with a 5-minute timeout; opportunistic batching reuses feasibility checks for identical Pods but has strict identical-field restrictions. The release also outlines a broader roadmap (workload-level preemption, autoscaling integration, topology-aware scheduling) and explains required feature gates and how to test and give feedback.

k8s: Kubernetes v1.35: Fine-grained Supplemental Groups Control Graduates to GA

Kubernetes Official Blog

2025-12-23

Kubernetes v1.35 graduates fine-grained supplemental groups control to GA via a new Pod field, supplementalGroupsPolicy, letting clusters choose whether to merge group memberships from the container image (/etc/group) or enforce only groups declared in the Pod (Strict) to reduce implicit, hard-to-audit GIDs and improve security (especially for volume access).