Kubernetes 1.36 Release Notes

Indexes

• New and Enhanced Features
• API Changes and Removals
• Enhanced Kubernetes 1.36 on CCE
• References

New and Enhanced Features

• Fine-grained kubelet API authorization (GA)

  In Kubernetes 1.36, fine-grained kubelet API authorization has graduated to GA. This feature adds independent RBAC authorization subresources (configz, healthz, and pods) to the kubelet API, while retaining the original nodes/proxy subresources for backward compatibility. For details, see Fine-grained Kubelet API Authorization.

• Volume Group Snapshot (GA)

  In Kubernetes 1.36, volume group snapshots have reached GA. This feature allows you to use a label selector to group multiple PVCs and create a crash-consistent group snapshot for a set of volumes, preventing data inconsistency caused by point-in-time snapshots of multiple volumes. CCE storage add-ons will support this feature in the near future. For details, see Volume Group Snapshot.

• Mutable CSI node allocatable count (GA)

  In Kubernetes 1.36, this feature has reached GA. This feature allows dynamic modification of the CSINode.Spec.Drivers[*].Allocatable.Count field. When volume mounting fails due to insufficient capacity, the capacity information is automatically corrected to prevent the scheduler from suspending pods based on outdated data. For details, see Mutable CSINode Allocatable Property.

• External service account token signing (GA)

  In Kubernetes 1.36, external service account token signing has advanced to GA. This feature allows kube-apiserver to connect to an external key management system through Unix domain sockets and offloads the service account JWT token signing logic to the external system. For details, see Support external signing of service account tokens.

• Mutating admission policies (GA)

  In Kubernetes 1.36, mutating admission policies have reached GA. This feature introduces two new API resources: MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding, so that built-in mutating admission capabilities can be implemented based on CEL expressions. This feature serves as a lightweight alternative to traditional mutating admission webhooks. For details, see Mutating Admission Policies.

• Node log query (GA)

  In Kubernetes 1.36, node log query has reached GA. This feature extends the kubelet /proxy/logs API to allow users to remotely query system service logs of a node using the kubectl API without logging in to the node. For details, see Node log query.

• User namespaces (GA)

  In Kubernetes 1.36, user namespaces have advanced to GA. This feature enables user namespace isolation using the pod.spec.hostUsers field, improving pod security isolation. This feature has certain requirements on the OS kernel and runtime. It is recommended that you use this feature on the HCE 3.0, which will be supported by CCE soon. For details, see Support User Namespaces.

• PSI metric exposure (GA)

  In Kubernetes 1.36, exposing PSI metrics has advanced to GA. This feature allows kubelet to collect PSI metrics for CPU, memory, and I/O usage from runc and cAdvisor using cgroups v2. The metrics are directly exposed through the kubelet /stats/summary API and the cAdvisor Prometheus monitoring API. For details, see Expose PSI Metrics.

• OCI volume source (GA)

  In Kubernetes 1.36, OCI volume source has advanced to GA. This feature adds image volumes for pods, so users can directly mount OCI images or artifacts as read-only volumes. To use this feature, containerd must be v2.1 or later. For details, see OCI VolumeSource.

• Faster SELinux volume relabeling (GA)

  In Kubernetes 1.36, this feature has advanced to GA. This feature optimizes the mechanism for handling storage volume permissions in SELinux enforcing mode. It replaces recursive file relabeling with the mount -o context option to apply the correct SELinux label to the volume during mounting. For details, see Speed up SELinux volume relabeling using mounts.

• IP/CIDR validation improvements (beta)

  In Kubernetes 1.36, this feature has graduated to beta. This feature tightens the validation rules for IP and CIDR fields in Kubernetes native APIs. For details, see IP/CIDR Validation Improvements.

• Updating resources (CPU, memory, and extended resources) of suspended jobs (beta)

  In Kubernetes 1.36, the feature of updating suspended jobs' resources (CPU, memory, and extended resources) has moved to beta. This feature allows you to directly modify the requests and limits of CPU, memory, GPU, and extended resources in the pod template of a suspended job (spec.suspend is set to true). For details, see Allow updating pod template resources (CPU, memory, GPU, extended resources) of suspended jobs.

• Constrained impersonation (Beta)

  In Kubernetes 1.36, constrained impersonation has graduated to beta. This feature hardens fine-grained permissions of the existing identity impersonation mechanism of the clusters to implement dual authentication and verification of the simulated subject identity and target resource operations. For details, see Constrained Impersonation.

• statusz and flagz (beta)

  In Kubernetes 1.36, statusz and flagz have graduated to beta. Basic component information and effective command parameters can be exposed through the statusz and flagz endpoints. For details, see Component Statusz and Component Flagz.

• Mixed version proxy (beta)

  In Kubernetes 1.36, the UnknownVersionInteroperabilityProxy feature gate has graduated to beta. This feature lets an API Server automatically proxy resource requests to other peer API Servers that have the corresponding service capabilities, preventing the 404 error. For details, see Mixed Version Proxy.

• Relaxed validation for Service names (beta)

  In Kubernetes 1.36, the relaxed validation for Service names has graduated to beta. This feature changes the validation rule for Service names from NameIsDNS1035Label to NameIsDNSLabel, allowing Service names to start with a digit. For details, see Relaxed validation for Services names.

• Restart all containers on container exits (beta)

  In Kubernetes 1.36, this feature has graduated to beta. This feature allows you to configure a specific exit code for a container to trigger a restart of all containers in the pod. For details, see Restart All Containers on Container Exits.

• Node declared features (Beta)

  In Kubernetes 1.36, this feature has graduated to beta. This feature adds the node.status.declaredFeatures status field, which allows kubelet to automatically report new Kubernetes capabilities supported by the node based on its feature gates and static configuration. For details, see Node Declared Features.

• In-place pod-level resources resize (beta)

  In Kubernetes 1.36, this feature has advanced to beta. This feature allows you to change pod resource requests and limits in place. It is only available on cgroup v2 nodes. For details, see In-Place Pod-Level Resources Resize.

API Changes and Removals

• In Kubernetes 1.36, the gitRepo volume driver is permanently disabled and cannot be re-enabled.
• In Kubernetes 1.36, the Service .spec.externalIPs field is deprecated. If it is still used, an alarm will be reported.
• In Kubernetes 1.36, the etcd monitoring metric is renamed from etcd_bookmark_counts to etcd_bookmark_total.
• In Kubernetes 1.36, the workload and PodGroup APIs of the scheduling.k8s.io/v1alpha2 version are released in the scheduling domain, and the APIs of the v1alpha1 version are completely deprecated.
• In Kubernetes 1.36, the in-place pod-level resources resize feature has advanced to beta and is enabled by default. This feature allows you to directly adjust the container resources of running pods.
• In Kubernetes 1.36, StrictIPCIDRValidation is enabled by default to strictly verify IP addresses and CIDR blocks and intercept network addresses in invalid formats.
• In Kubernetes 1.36, the kube-controller-manager metric is renamed from volume_operation_total_errors to volume_operation_errors_total.

Enhanced Kubernetes 1.36 on CCE

During a version maintenance period, CCE periodically updates Kubernetes 1.36 with enhanced functions.

For details about cluster version updates, see Patch Versions.

References

For more details about the performance comparison and functional enhancements between Kubernetes 1.36 and other versions, see Kubernetes 1.36 Release Notes.