Kubernetes 1.36 Release Notes

Indexes

• New and Enhanced Features
• API Changes and Removals
• Enhanced Kubernetes 1.36 on CCE
• References

New and Enhanced Features

• Fine-grained kubelet API authorization (GA)

  In Kubernetes 1.36, fine-grained kubelet API authorization has graduated to GA. This feature adds independent RBAC authorization subresources (configz, healthz, and pods) to the kubelet API, while retaining the original nodes/proxy subresources for backward compatibility. For details, see Fine-grained Kubelet API Authorization.

• Mutable CSI node allocatable count (GA)

  In Kubernetes 1.36, this feature has reached GA. This feature allows dynamic modification of the CSINode.Spec.Drivers[*].Allocatable.Count field. When volume mounting fails due to insufficient capacity, the capacity information is automatically corrected to prevent the scheduler from suspending pods based on outdated data. For details, see Mutable CSINode Allocatable Property.

• Mutating admission policies (GA)

  In Kubernetes 1.36, mutating admission policies have reached GA. This feature introduces two new API resources: MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding, so that built-in mutating admission capabilities can be implemented based on CEL expressions. This feature serves as a lightweight alternative to traditional mutating admission webhooks. For details, see Mutating Admission Policies.

• Node log query (GA)

  In Kubernetes 1.36, node log query has reached GA. This feature extends the kubelet /proxy/logs API to allow users to remotely query system service logs of a node using the kubectl API without logging in to the node. For details, see Node log query.

• PSI metric exposure (GA)

  In Kubernetes 1.36, exposing PSI metrics has advanced to GA. This feature allows kubelet to collect PSI metrics for CPU, memory, and I/O usage from runc and cAdvisor using cgroups v2. The metrics are directly exposed through the kubelet /stats/summary API and the cAdvisor Prometheus monitoring API. For details, see Expose PSI Metrics.

• OCI volume source (GA)

  In Kubernetes 1.36, the OCI volume source has advanced to GA. This feature adds image volumes for pods, so users can directly mount OCI images or artifacts as read-only volumes. To use this feature, containerd must be v2.1 or later. For details, see OCI VolumeSource.

• IP/CIDR validation improvements (beta)

  In Kubernetes 1.36, this feature has graduated to beta. This feature tightens the validation rules for IP and CIDR fields in Kubernetes native APIs. For details, see IP/CIDR Validation Improvements.

• Updating resources (CPU, memory, and extended resources) of suspended jobs (beta)

  In Kubernetes 1.36, the feature of updating suspended jobs' resources (CPU, memory, and extended resources) has moved to beta. This feature allows you to directly modify the requests and limits of CPU, memory, GPU, and extended resources in the pod template of a suspended job (spec.suspend is set to true). For details, see Allow updating pod template resources (CPU, memory, GPU, extended resources) of suspended jobs.

• Constrained impersonation (Beta)

  In Kubernetes 1.36, constrained impersonation has graduated to beta. This feature hardens fine-grained permissions of the existing identity impersonation mechanism of the clusters to implement dual authentication and verification of the simulated subject identity and target resource operations. For details, see Constrained Impersonation.

• statusz and flagz (beta)

  In Kubernetes 1.36, statusz and flagz have graduated to beta. Basic component information and effective command parameters can be exposed through the statusz and flagz endpoints. For details, see Component Statusz and Component Flagz.

• Mixed version proxy (beta)

  In Kubernetes 1.36, the UnknownVersionInteroperabilityProxy feature gate has graduated to beta. This feature lets an API Server automatically proxy resource requests to other peer API Servers that have the corresponding service capabilities, preventing the 404 error. For details, see Mixed Version Proxy.

• Relaxed validation for Service names (beta)

  In Kubernetes 1.36, the relaxed validation for Service names has graduated to beta. This feature changes the validation rule for Service names from NameIsDNS1035Label to NameIsDNSLabel, allowing Service names to start with a digit. For details, see Relaxed validation for Services names.

• Restart all containers on container exits (beta)

  In Kubernetes 1.36, this feature has graduated to beta. This feature allows you to configure a specific exit code for a container to trigger a restart of all containers in the pod. For details, see Restart All Containers on Container Exits.

• Node declared features (Beta)

  In Kubernetes 1.36, this feature has graduated to beta. This feature adds the node.status.declaredFeatures status field, which allows kubelet to automatically report new Kubernetes capabilities supported by the node based on its feature gates and static configuration. For details, see Node Declared Features.

API Changes and Removals

• In Kubernetes 1.36, the gitRepo volume driver is permanently disabled and cannot be re-enabled.
• In Kubernetes 1.36, the Service .spec.externalIPs field is deprecated. If it is still used, an alarm will be reported.
• In Kubernetes 1.36, the etcd monitoring metric was renamed from etcd_bookmark_counts to etcd_bookmark_total.
• In Kubernetes 1.36, the workload and PodGroup APIs of the scheduling.k8s.io/v1alpha2 version are released in the scheduling domain, and the APIs of the v1alpha1 version are completely deprecated.
• In Kubernetes 1.36, StrictIPCIDRValidation is enabled by default to strictly verify IP addresses and CIDR blocks and intercept network addresses in invalid formats.
• In Kubernetes 1.36, the kube-controller-manager metric was renamed from volume_operation_total_errors to volume_operation_errors_total.

Enhanced Kubernetes 1.36 on CCE

During a version maintenance period, CCE periodically updates Kubernetes 1.36 with enhanced functions.

For details about cluster version updates, see Patch Versions.

References

For more details about the performance comparison and functional enhancements between Kubernetes 1.36 and other versions, see Kubernetes 1.36 Release Notes.