In-place Pod resource updates
CPU and memory of running Pods can be changed without restarting the Pod or its containers, giving non-disruptive vertical scaling.
Kubernetes minor release · “Timbernetes (The World Tree Release)”
Kubernetes 1.35
Timbernetes makes in-place Pod resource updates GA and Pod certificates beta, retires cgroup v1 support so kubelet needs cgroup v2, deprecates kube-proxy's ipvs mode, and is the last release that supports containerd 1.x.
Supported
Supported for another 4 months, until 28 Feb 2027.
Released17 Dec 2025
Maintenance mode28 Dec 2026
End of life28 Feb 2027
Latest patch1.35.1028 Oct 2026
Patch releases10
Support span14.4 months
What 1.35 brought
Pod certificates
The kubelet creates keys, requests X.509 certificates through PodCertificateRequest and writes them into the Pod, giving native workload identity and automatic rotation for mTLS without bearer tokens.
Pod generation tracking
Pods now carry metadata.generation and status.observedGeneration, so you can see whether the kubelet has acted on the latest spec change, such as a resize.
OCI image volumes on by default
Image volumes are enabled by default, letting Pods mount data-only OCI artifacts like configs or ML models. Needs a compatible runtime such as containerd 2.1 or later.
Credential check for cached images
Kubelet now verifies a Pod may pull a private image even when it is already cached on the node. On by default; KubeletEnsureSecretPulledImages turns it off.
Gang scheduling
A new Workload API and PodGroup concept let the scheduler place a group of Pods all-or-nothing, avoiding half-started training or HPC jobs.
Summarised in our own words from the official “Kubernetes v1.35: Timbernetes (The World Tree Release)” announcement (60 tracked enhancements), © The Kubernetes Authors, CC BY 4.0.
APIs that stopped being served in 1.35
Only alpha or off-by-default beta APIs were removed: they matter only if you switched them on with --runtime-config.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| VolumeAttributesClass | storage.k8s.io/v1alpha1 alpha · off |
1.35 | storage.k8s.io/v1 |
Other removals and deprecations
Removed
- cgroup v1 support is retired: on nodes without cgroup v2 the kubelet will fail to start, so migrate those nodes before upgrading.
Deprecated
- kube-proxy ipvs mode is deprecated. It still works but logs a warning at startup; nftables is the recommended replacement on Linux.
- v1.35 is the last release supporting containerd 1.x; move to containerd 2.0 or later before the next upgrade.
- Outside the release itself: Ingress NGINX gets only best-effort maintenance until March 2026, then will be archived. Gateway API is the recommended path.
From the release announcement; our wording.
API versions deprecated in 1.35
Still served in 1.35, but the API server answers with a deprecation warning and a removal is scheduled.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| MutatingAdmissionPolicy | admissionregistration.k8s.io/v1alpha1 alpha · off |
1.38 | admissionregistration.k8s.io/v1 |
| MutatingAdmissionPolicyBinding | admissionregistration.k8s.io/v1alpha1 alpha · off |
1.38 | admissionregistration.k8s.io/v1 |
| LeaseCandidate | coordination.k8s.io/v1alpha2 alpha · off |
1.38 | — |
| DeviceClass | resource.k8s.io/v1beta1 beta · off by default | 1.38 | resource.k8s.io/v1 |
| ResourceClaim | resource.k8s.io/v1beta1 beta · off by default | 1.38 | resource.k8s.io/v1 |
| ResourceClaimTemplate | resource.k8s.io/v1beta1 beta · off by default | 1.38 | resource.k8s.io/v1 |
| ResourceSlice | resource.k8s.io/v1beta1 beta · off by default | 1.38 | resource.k8s.io/v1 |
Upgrading
Version skew with a 1.35 API server
- kubelet, kube-proxy: 1.32 to 1.35
- kube-controller-manager, scheduler: 1.34 to 1.35
- kubectl: 1.34 to 1.36
From the official version skew policy as it stands today.
One minor at a time
The API server must not skip minor versions.
1.35 on managed Kubernetes
| Service | Available | End of standard support | End of extended support |
|---|---|---|---|
| Upstream Kubernetes | 17 Dec 2025 | 28 Feb 2027 | — |
| Amazon EKS | 27 Jan 2026 | 27 Mar 2027 | 27 Mar 2028 |
| Google Kubernetes Engine | 11 Feb 2026 | 11 Apr 2027 | 11 Feb 2028 |
| Azure Kubernetes Service | 2026-03 | 31 Mar 2027 | 31 Mar 2028 |
As published by each provider; see managed Kubernetes support for what “extended” means on each and when we last checked.