Kubernetes 1.36 — Haru
Цей контент ще не доступний вашою мовою.
Cert impact:
watch— exam pin still 1.35, but several items that cert modules called “coming in 1.36” are now Stable. Prefer this page over stale “future GA” callouts. Upstream status: Actively supported GA: 2026-04-22 · Theme: ハル (Haru)
Kubernetes v1.36 sits in the middle of the supported window. Official summary: ~70 enhancements with 18 Stable graduations (release blog).
Who should read this
Section titled “Who should read this”| Audience | Why |
|---|---|
| Security | User namespaces Stable; fine-grained kubelet authz; mutating admission policies |
| Storage / backup | Volume group snapshots Stable; SELinux mount labeling Stable |
| AI / artifacts | OCI image/artifact volumes Stable |
| Everyone operating clusters | gitRepo volumes permanently disabled |
Stable highlights (learner-visible)
Section titled “Stable highlights (learner-visible)”| Theme | What shipped | Why it matters |
|---|---|---|
| Isolation | User namespaces in Pods Stable (hostUsers: false) | Container root ≠ host root |
| Admission | MutatingAdmissionPolicy Stable (CEL, webhook-free mutations) | Replace many mutating webhooks |
| Volumes | OCI VolumeSource (image/artifact volumes) Stable | Mount registry content without baking into the app image |
| Auth | External ServiceAccount token signing Stable; fine-grained kubelet API authz Stable | Least-privilege kubelet access; external IAM signing |
| Storage | VolumeGroupSnapshot Stable; faster SELinux volume labeling Stable | Crash-consistent multi-PVC snapshots; faster Pod starts on SELinux |
| DRA | Admin access + prioritized device lists Stable | Production DRA governance |
| Observability | NodeLogQuery Stable; PSI metrics Stable | Better node log query + pressure signals |
Removals / breaking
Section titled “Removals / breaking”gitRepovolume plugin is disabled and cannot be re-enabled (KEP-5040). Migrate to initContainers or git-sync style tools before upgrading nodes to 1.36+.
Practice
Section titled “Practice”- kind image:
kindest/node:v1.36.4— matrix - Diff lab idea: apply a Pod with
gitRepoon 1.35 (if still accepted) vs 1.36 (must fail); document the migration. - Diff lab idea: OCI image volume mount vs ConfigMap for a static asset.
Stale callouts to fix elsewhere
Section titled “Stale callouts to fix elsewhere”When touching cert modules, replace “Image volume / MutatingAdmissionPolicy will be GA in 1.36” language with Stable as of 1.36 and link here. Do that surgically — not as a full cert rewrite.
Sources
Section titled “Sources”- Kubernetes v1.36: Haru — official release blog (verified 2026-09-12)
- CHANGELOG-1.36.md
- Releases index