Kubernetes v1.36 Release Highlights

[chadmcrowell]

This is a discussion to collect the Release Highlights for the v1.36 release cycle.

Release Highlights are an essential part of the Kubernetes release cycle, providing a bird's-eye view of improvements, breaking changes, and user-facing changes coming in the upcoming release. The release Comms team is asking SIGs to comment on this discussion and highlight items we should include in release communications for v1.36.

Important

For each submission, please include a link to the KEP, the stage the feature is moving to, and a brief description of the KEP that will be used as an outline for the blog post content.

The deadline for v1.36 Release Highlights is Tuesday 31st March 2026.

Some references for the previous releases:

• Kubernetes v1.35 Release Highlights #2903
• Kubernetes v1.34 Release Highlights #2806

cc @kubernetes/release-team-leads
cc @chanieljdan @kirti763 @SophiaUgo @SwathiR03 @UtkarshUmre

[danwinship]

KEP-4858 "IP/CIDR Validation Improvements" is now Beta, meaning that non-canonical IP address formats (like "010.000.001.005" or "::ffff:10.0.1.5") and ambiguous CIDR values (like "192.168.1.5/24" in a context that's expecting either "192.168.1.0/24" or "192.168.1.5/32") are no longer considered valid in core Kubernetes objects, and attempts to set fields to such values will fail. This change was made because these types of values might be interpreted differently by different implementations, potentially allowing for security exploits (as in CVE-2021-29923).

While this is technically a breaking change, there's not really any good reason anybody should have been setting fields to such values before, and we've been emitting warnings about them for a few releases now, so hopefully this change should have no effect on anyone, other than guaranteeing better security and interoperability in the future.

[adrianmoisey]

Also for sig-network is KEP-5707 which is the deprecation of Service.spec.externalIPs.
Kubernetes 1.36 is only the start of this process, adding warnings to the use of this field, but it would be good to start talking about this sooner.

[xing-yang]

From SIG-Storage:
New Features:

• Volume Group Snapshot feature targets GA in Kubernetes 1.36 release. The support for volume group snapshots relies on a set of extension APIs for group snapshots. These APIs allow users to take crash consistent snapshots for a set of volumes. A key aim is to allow you to restore that set of snapshots to new volumes and recover your workload based on a crash consistent recovery point.
• Service Account Tokens via Secrets Field feature targets GA in v1.36. This feature adds an optional ability for CSI drivers to receive service account tokens via secrets field instead of volume context.
  Mutable Volume Attach Limits feature targets GA in v1.36. This feature allows CSI drivers to dynamically adjust the maximum number of attachable volumes at runtime.
• SELinux Relabeling with Mount Options for non-RWOP volumes.
  • Speeds up container startup by mounting volumes with the correct SELinux label
  • Selinux changepolicy feature gate targets GA in 1.36

Driver disabled:

• Starting Kubernetes v1.36 the gitRepo volume plugin has been disabled and cannot be enabled.

cc @saad-ali @msau42 @jsafrane

[soltysh]

For SIG-CLI:

• We're continuing working on kubectl user preferences expanding the capability of kubectl kuberc with credential plugins support.

[soltysh]

For SIG-Apps:

• KEP-5547 - is expanding the job controller to associate specific types of jobs with a Workload and PodGroup allowing to benefit from Workload Aware Scheduling optimizations. The feature is alpha.
• KEP-5540 - promotes to beta the ability to modify container resources in a suspended job.

[serathius]

Within SIG scalability, as part of kubernetes/kubernetes#134375 K8s 1.36 has increased the officially supported resource size in scalability test from 800MB to 1.5GB in kubernetes/test-infra#36400.

[aramase]

SIG Auth highlights

Stable Graduations:

• External Service Account Token Signing (KEP-740) - Graduates to stable. Allows integration with external key management solutions (HSMs, cloud KMS) for service account token signing, removing the requirement for the kube-apiserver to hold signing keys directly on disk.
• Fine-Grained Kubelet API Authorization (KEP-2862) - Graduates to stable. Introduces fine-grained authorization for the Kubelet API so that different request types (exec, logs, metrics, port-forward) can be authorized independently, enabling least-privilege access to node endpoints.
• DRA AdminAccess for ResourceClaims (KEP-5018) - Graduates to stable. Enables creation of ResourceClaims in privileged mode to grant access to devices already in use by other users for administrative tasks like health monitoring and status inspection.

Beta Features:

• Constrained Impersonation (KEP-5284) - Advances to beta. Introduces finer-grained controls for impersonation so that any impersonator can restrict themselves to a subset of their own permissions when impersonating, rather than gaining the full permissions of the target identity.

cc @kubernetes/sig-auth-leads

[omerap12]

SIG Autoscaling highlights:

• HPA scale to zero KEP-2021 (Alpha) - HPA supports scaling to/from zero pods for object/external metrics.

[sanposhiho]

SIG scheduling: Workload aware scheduling (WAS): our top priority right now is to make the scheduler workload aware. We put several KEPs to renovate the fundamental layer of scheduling to make it ready for WAS.

• Decouple PodGroup API
• Topology-aware workload scheduling
• DRA: ResourceClaim Support for Workloads
• Workload Aware Preemption
• Integrate Workload APIs with Job controller
• Gang Scheduling Support in Kubernetes

@dom4ha @pohly @johnbelamaric Please add any other sig-scheduling-owning DRA features that they should highlight. I haven't followed much.

[dom4ha]

I'd also add Opportunistic Batching performance improvement to the list.

Leaving DRA for the WG update, as it spans over a few sigs.

[pohly]

WG Device Management:

• KEP 5004: Extended Resource Requests via DRA graduated to beta. It makes it possible to use the traditional extended resource API to allocate devices managed by a DRA driver.
• KEP 4817: Resource Claim Status was extended with additional security protections which restrict permission of the node-local DRA driver to ResourceClaims which are also local to the node it runs on.
• KEP 5018: Namespace Controlled Admin Access graduated to GA. It enables access to a device that is currently in use.
• KEP 5055: Device Taints and Tolerations graduated to beta. Through taints, drivers and admins can prevent usage of devices and evict pods which currently use them, for example for maintenance or device health reasons.
• KEP 4816: Prioritized Alternatives in Device Requests graduated to GA. It enables specifying a list of different alternative ways of allocating devices for a ResourceClaim.
• KEP 5075: Consumable Capacity graduated to beta. DRA drivers can use it to describe devices that can be allocated multiple times up to certain limits that the DRA driver defines for each device.
• KEP 4815: Partitionable Devices graduated to beta. DRA driver can use it to describe devices that have multiple, mutually exclusive modes of operation or ways to split up a device into partitions.
• KEP 5304: Attributes Downward API was introduced as alpha. It enables DRA drivers to inject meta data about a prepared device into the containers using the device.
• KEP 5729: ResourceClaim Support for Workloads was introduce as alpha. It allows all pods in a work group to share the same ResourceClaim.
• KEP 4680: Resource Health Status in Pod Status graduated to beta. If a DRA driver exposes health information through gRPC, then the kubelet includes that health information in the status of pods using unhealthy devices.
• KEP 5517: Native Resource Requests was introduced as alpha. It improves allocating CPUs through DRA.
• KEP 5677: Resource Availability Visibility was introduced as alpha. It provides an API which can be used to query the current state of device pools as published by a DRA driver.
• KEP 5007: Device Binding Conditions graduated to beta. Binding conditions block binding of a pod to a node until a DRA driver using such conditions confirms that it is okay to proceed.
• KEP 5491: List Types for Attributes was introduced as alpha. It extends how DRA drivers can describe devices, adding list of values as new supported attribute type.

[skl]

SIG Instrumentation:

Graduating to beta:

• KEP-4827 Introduces a statusz page for all core components - The /statusz endpoint and its config.k8s.io API graduate to v1beta1 and are now enabled by default.
• KEP-4828 Introduces a flagz page for all core components - The /flagz endpoint and its config.k8s.io API graduate to v1beta1 and are now enabled by default.
• Many metrics promoted to beta

New alpha features:

• KEP-5808 - Prometheus Native Histogram Support - gated by a feature flag, has been added across all major components.
• Notable new alpha metrics - informer_processing_latency_seconds (to measure event handler execution time in RealFIFO), informer_queued_items (informer queue length), terminated_containers_total (track the number of containers failed or succeeded broken down by exit code).

cc @kubernetes/sig-instrumentation-leads

[fedebongio]

(I realized I was replying to a comment instead of replying to the main issue, apologies. Moving here for consitency)

From SIG API Machinery:

Graduating to Stable:

• Mutating Admission Policies (KEP-3962) — CEL-based Mutating Admission Policies graduate to GA (v1 API). This completes the CEL admission control story alongside the already-GA Validating Admission Policies, giving cluster operators a fully declarative, in-process alternative to admission webhooks for both validation and mutation — with no need to deploy or maintain external webhook infrastructure.

• Declarative Validation of Kubernetes Native Types (KEP-5073) — Brings CEL-based declarative validation rules to built-in Kubernetes types via validation-gen, replacing complex handwritten Go validation code with a more maintainable and author-friendly declarative model.

• Remove gogo protobuf dependency for Kubernetes API types (KEP-5589) — Completes the removal of the deprecated gogo protobuf library from Kubernetes API types (runtime dependency removed in v1.35, generation-time dependency removed in v1.36), migrating fully to the standard Go protobuf library.

Graduating to Beta:

• Mixed Version Proxy (KEP-4020) — Now enabled by default, this feature routes resource requests to capable peer API servers during version skew (e.g., upgrades) to prevent incorrect 404 errors. It also includes Peer-aggregated discovery, which provides a comprehensive, cluster-wide view of all resources served by any API server in the cluster.

New Features:

• Manifest-Based Admission Control Config (KEP-5793) (Alpha) — Adds file-based manifests to the kube-apiserver for configuring admission webhooks and policies on startup. These policies are guaranteed to be active before the API server begins processing requests and cannot be bypassed via the Kubernetes API, enabling platform-level security guarantees.
• Server Side Sharded Watch and List (KEP-5866)(Alpha) - Allows clients to request a filtered LIST/WATCH stream based on hash ranges, enabling the API server to filter events at the source so horizontally scaled controllers only receive the data they are responsible for.
• Stale Controller Mitigation KEP-5647 - Add metrics and read your own write semantics for certain key controllers to detect and mitigate staleness in the kube-controller-manager's informer cache.

cc @deads2k @jpbetz @sttts

[zylxjtu]

SIG Windows highlights:

Graduating to Stable:

• Node Log Query (Node log query enhancements#2258) — Graduates to stable in v1.36. The
  NodeLogQuery feature gate is now locked to true. This feature allows querying logs of node services via the kubelet
  /logs endpoint, supporting both Linux (via journald) and Windows (via the application log provider) nodes, as well as
  file-based logs under /var/log/ on both operating systems. The only remaining toggle is the kubelet configuration
  option enableSystemLogHandler, which defaults to false and should be enabled when actively debugging. Documentation
  PR: KEP-2258: Update Node log query documentation for GA in v1.36 website#54487.

cc @aravindhp @jrvaldes @marosset @claudiubelu

[haircommander]

(belated, sorry) SIG Node release highlights:

• DRA: We’ve had another very productive release for DRA, including multiple graduations, as well as some key beta features like Partitionable Devices, Resource Health Status and Extended Resources
• Some long worked-on features have graduated, including User Namespaces, PSI Support and OCI Volume Source
• Kubelet has improved behavior handling pods. CRI list streaming allows the kubelet to handle many containers without hitting gRPC memory limits. Memory QoS has been updated to allow an opt-out for memory.min

[lukasmetzner]

SIG Cloud Provider highlights:

• Introducing a new alpha counter metric route_controller_route_sync_total to the Cloud Controller Manager (CCM) route controller implementation at k8s.io/cloud-provider. This metric increments each time routes are synced with the cloud provider.