Upgrade hop

Kubernetes 1.35 → 1.36

1 · Fix removed APIs first

No API versions are removed between 1.35 and 1.36.

The gitRepo volume plugin is permanently disabled and cannot be turned back on; move to init containers or git-sync style tools.
Outside the release itself: Ingress NGINX was retired on 24 March 2026 with no further fixes. Existing installs keep working and artifacts stay available.

Service .spec.externalIPs is deprecated because of a man-in-the-middle risk (CVE-2020-8554). Using it now warns; removal is planned for v1.43. Consider LoadBalancer, NodePort or Gateway API.

Our summary of the 1.36 release announcement (CC BY 4.0). Read the full changelog for your components.

Prepare. Move every node to 1.33 or newer if any are older: a 1.36 API server supports kubelets back to 1.33 only. Upgrade to the newest 1.35 patch, 1.35.10.
kube-apiserver to 1.36 (in HA clusters, one instance at a time; old and new may differ by one minor during the roll). Use the newest patch, 1.36.6.
kube-controller-manager, kube-scheduler, cloud-controller-manager to 1.36, once every API server is on 1.36.
kubelet on each node (drain first). Optional in this hop: kubelets from 1.33 to 1.36 all work with a 1.36 control plane.
kube-proxy: no newer than the API server, and within the same window as the kubelet it runs beside.
kubectl: 1.35 to 1.37 all talk to a 1.36 API server.

From the official version skew policy. Managed services run the control-plane steps for you; node pools are still yours to schedule.