DEVOURED
Kubernetes v1.36: ハル (Haru)
Kubernetes v1.36 "Haru" ships with 70 enhancements including production-ready user namespaces for container isolation, volume group snapshots for crash-consistent backups, and the deprecation of the security-vulnerable externalIPs field.
What: Kubernetes v1.36 is a major release featuring 18 features graduating to stable (including fine-grained kubelet API authorization, user namespaces that map container root to unprivileged host users, and volume group snapshots for multi-volume backups), 25 beta features, and 25 alpha features like HPA scale-to-zero and native histogram metrics. The release deprecates Service spec externalIPs due to man-in-the-middle attack risks and permanently disables the gitRepo volume type to prevent critical root-level exploits.
Why it matters: The user namespaces graduation provides crucial defense-in-depth for multi-tenant environments by ensuring container breakouts grant no administrative power on the host, while the security deprecations close off documented attack vectors that have plagued clusters for years, forcing migration to safer alternatives like LoadBalancer services or Gateway API.
Takeaway: Audit your clusters for deprecated Service externalIPs (full removal planned for v1.43) and migrate any remaining gitRepo volumes to init containers or git-sync tools, then evaluate enabling user namespaces for production workloads to harden container isolation.
Deep dive
- User namespaces reach stable after years of development, allowing container root processes to map to non-privileged host users, providing a critical isolation layer that limits damage from container escapes
- Volume group snapshots go GA enabling crash-consistent snapshots across multiple PersistentVolumeClaims simultaneously, essential for distributed applications requiring coordinated recovery points
- Fine-grained kubelet API authorization replaces the overly broad nodes/proxy permission with least-privilege access control for monitoring and observability use cases
- External ServiceAccount token signing reaches stable, allowing clusters to offload JWT signing to external identity systems while maintaining standard Kubernetes authentication flows
- Mutating admission policies graduate to stable, providing CEL-based resource mutations directly in the API server without webhook latency or operational overhead
- Service externalIPs field deprecated due to CVE-2020-8554 man-in-the-middle vulnerabilities, with full removal targeted for v1.43; users should migrate to LoadBalancer, NodePort, or Gateway API
- gitRepo volume type permanently disabled to prevent attackers from running code as root on nodes, forcing migration to init containers or external git-sync approaches
- Resource health status promoted to beta, exposing allocatedResourcesStatus in Pod status so kubectl describe can reveal if crashes stem from Unhealthy hardware
- Workload Aware Scheduling introduces alpha gang scheduling features treating related pods as atomic groups, with all-or-nothing binding for distributed workloads
- HPA scale-to-zero enters alpha allowing HorizontalPodAutoscaler to idle workloads completely when using Object or External metrics, cutting infrastructure costs for batch processing
- Native histogram support moves beyond static Prometheus buckets with sparse, dynamically-adjusting histograms for high-fidelity latency distributions without manual bucket tuning
- Pressure Stall Information metrics reach stable, exposing CPU, memory, and I/O pressure via cgroupv2 to distinguish busy systems from those actively stalling under contention
- OCI volume source graduates to stable, allowing kubelet to pull and mount content directly from container registries, unifying image and data distribution workflows
- Ingress NGINX officially retired as of March 24, 2026, with no further releases or security fixes; existing deployments continue working but receive no support
- SELinux volume mounting goes GA with mount-time context labeling replacing recursive relabeling, but requires careful seLinuxChangePolicy configuration to avoid Pod startup failures when sharing volumes
- Dynamic Resource Allocation features continue maturing with stable admin access and prioritized lists, plus beta support for device taints, partitionable devices, and attachment-before-scheduling
- Observability enhancements include beta /statusz and /flagz endpoints across all core components, exposing build info and effective flags for debugging without log diving
- gogoprotobuf dependency removed by forking generation logic into k8s.io/code-generator, eliminating an unmaintained security liability while preserving API compatibility
Decoder
- kubelet: The agent running on each node that manages containers and communicates with the Kubernetes control plane
- DRA (Dynamic Resource Allocation): Framework for managing specialized hardware like GPUs with more flexibility than legacy device plugins
- CEL (Common Expression Language): Google's expression language used for validation and policy logic directly in Kubernetes APIs
- PSI (Pressure Stall Information): Linux kernel metric showing how long processes stall waiting for CPU, memory, or I/O resources
- cgroupv2: Second generation of Linux control groups providing unified hierarchy and improved resource management
- OCI (Open Container Initiative): Standards for container formats and runtimes; OCI artifacts extend the image format to any content
- User namespaces: Linux kernel feature mapping container UIDs/GIDs to different values on the host, isolating container root from host root
- Volume group snapshots: Coordinated snapshots across multiple storage volumes taken at the same instant for consistency
- externalIPs: Service field allowing traffic to arbitrary external IPs to reach cluster services, vulnerable to hijacking attacks
- gitRepo volume: Deprecated volume type that clones a git repository into a pod at startup, exploitable for privilege escalation
- HPA (HorizontalPodAutoscaler): Controller that automatically scales deployments based on metrics like CPU or custom signals
Original article
Kubernetes v1.36, codenamed "Haru," shipped with 70 enhancements, including 18 features graduating to stable, such as fine-grained kubelet API authorization, user namespaces for container isolation, and volume group snapshots for crash-consistent backups across multiple volumes. The release also deprecated the security-vulnerable externalIPs field in Service specs (slated for removal in v1.43) and permanently disabled the gitRepo volume type to prevent critical root-level exploits, while introducing alpha features like HPA scale-to-zero and native histogram support for high-resolution monitoring.
Explore all 55 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi