Skip to content
GitHub

Kubernetes 1.36 — Haru

Cert impact: watch — exam pin still 1.35, but several items that cert modules called “coming in 1.36” are now Stable. Prefer this page over stale “future GA” callouts. Upstream status: Actively supported GA: 2026-04-22 · Theme: ハル (Haru)

Kubernetes v1.36 sits in the middle of the supported window. Official summary: ~70 enhancements with 18 Stable graduations (release blog).

Who should read this

Section titled “Who should read this”
AudienceWhy
SecurityUser namespaces Stable; fine-grained kubelet authz; mutating admission policies
Storage / backupVolume group snapshots Stable; SELinux mount labeling Stable
AI / artifactsOCI image/artifact volumes Stable
Everyone operating clustersgitRepo volumes permanently disabled

Stable highlights (learner-visible)

Section titled “Stable highlights (learner-visible)”
ThemeWhat shippedWhy it matters
IsolationUser namespaces in Pods Stable (hostUsers: false)Container root ≠ host root
AdmissionMutatingAdmissionPolicy Stable (CEL, webhook-free mutations)Replace many mutating webhooks
VolumesOCI VolumeSource (image/artifact volumes) StableMount registry content without baking into the app image
AuthExternal ServiceAccount token signing Stable; fine-grained kubelet API authz StableLeast-privilege kubelet access; external IAM signing
StorageVolumeGroupSnapshot Stable; faster SELinux volume labeling StableCrash-consistent multi-PVC snapshots; faster Pod starts on SELinux
DRAAdmin access + prioritized device lists StableProduction DRA governance
ObservabilityNodeLogQuery Stable; PSI metrics StableBetter node log query + pressure signals

Removals / breaking

Section titled “Removals / breaking”
  • gitRepo volume plugin is disabled and cannot be re-enabled (KEP-5040). Migrate to initContainers or git-sync style tools before upgrading nodes to 1.36+.

Practice

Section titled “Practice”
  • kind image: kindest/node:v1.36.4 — matrix
  • Diff lab idea: apply a Pod with gitRepo on 1.35 (if still accepted) vs 1.36 (must fail); document the migration.
  • Diff lab idea: OCI image volume mount vs ConfigMap for a static asset.

Stale callouts to fix elsewhere

Section titled “Stale callouts to fix elsewhere”

When touching cert modules, replace “Image volume / MutatingAdmissionPolicy will be GA in 1.36” language with Stable as of 1.36 and link here. Do that surgically — not as a full cert rewrite.

Sources

Section titled “Sources”