Fine-grained kubelet API authorization
Access to the kubelet HTTPS API can be granted narrowly, so monitoring and observability tools no longer need the broad nodes/proxy permission.
Kubernetes minor release · “ハル (Haru)”
Kubernetes 1.36
Haru promotes user namespaces, mutating admission policies, OCI image volumes, external ServiceAccount token signing and fine-grained kubelet API authorization to GA, deprecates Service externalIPs, and permanently disables the gitRepo volume plugin.
Supported
Supported for another 8 months, until 28 Jun 2027.
Released22 Apr 2026
Maintenance mode28 Apr 2027
End of life28 Jun 2027
Latest patch1.36.628 Oct 2026
Patch releases6
Support span14.2 months
What 1.36 brought
User namespaces in Pods
Container root can be mapped to an unprivileged host user, limiting what an escaped process can do on the node. Now stable for production use.
Mutating admission policies
Mutations written in CEL run inside the API server, replacing many custom mutating webhooks along with their latency and operational upkeep.
OCI artifact and image volumes
The kubelet can pull content from any OCI registry and mount it as a Pod volume, so data, models or static files ship like images.
Volume group snapshots
Crash-consistent snapshots can be taken across several PersistentVolumeClaims at once and restored to new volumes.
Workload Aware Scheduling
The Job controller works with a revised Workload API and a new PodGroup API; a PodGroup scheduling cycle binds all Pods in a group together, or none.
Summarised in our own words from the official “Kubernetes v1.36: ハル (Haru)” announcement (70 tracked enhancements), © The Kubernetes Authors, CC BY 4.0.
APIs that stopped being served in 1.36
No API versions were removed in 1.36.
Other removals and deprecations
Removed
- The gitRepo volume plugin is permanently disabled and cannot be turned back on; move to init containers or git-sync style tools.
- Outside the release itself: Ingress NGINX was retired on 24 March 2026 with no further fixes. Existing installs keep working and artifacts stay available.
Deprecated
- Service .spec.externalIPs is deprecated because of a man-in-the-middle risk (CVE-2020-8554). Using it now warns; removal is planned for v1.43. Consider LoadBalancer, NodePort or Gateway API.
From the release announcement; our wording.
API versions deprecated in 1.36
Still served in 1.36, but the API server answers with a deprecation warning and a removal is scheduled.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| LeaseCandidate | coordination.k8s.io/v1beta1 beta · off by default | 1.39 | — |
| DeviceClass | resource.k8s.io/v1beta2 beta · off by default | 1.39 | resource.k8s.io/v1 |
| DeviceTaintRule | resource.k8s.io/v1alpha3 alpha · off |
1.39 | resource.k8s.io/v1 |
| ResourceClaim | resource.k8s.io/v1beta2 beta · off by default | 1.39 | resource.k8s.io/v1 |
| ResourceClaimTemplate | resource.k8s.io/v1beta2 beta · off by default | 1.39 | resource.k8s.io/v1 |
| ResourceSlice | resource.k8s.io/v1beta2 beta · off by default | 1.39 | resource.k8s.io/v1 |
Stable (GA) API kinds new in 1.36
MutatingAdmissionPolicy admissionregistration.k8s.io/v1MutatingAdmissionPolicyBinding admissionregistration.k8s.io/v1
Upgrading
Version skew with a 1.36 API server
- kubelet, kube-proxy: 1.33 to 1.36
- kube-controller-manager, scheduler: 1.35 to 1.36
- kubectl: 1.35 to 1.37
From the official version skew policy as it stands today.
One minor at a time
The API server must not skip minor versions.
1.36 on managed Kubernetes
| Service | Available | End of standard support | End of extended support |
|---|---|---|---|
| Upstream Kubernetes | 22 Apr 2026 | 28 Jun 2027 | — |
| Amazon EKS | 2 Jun 2026 | 2 Aug 2027 | 2 Aug 2028 |
| Google Kubernetes Engine | 9 Jun 2026 | 9 Aug 2027 | 9 Jun 2028 |
| Azure Kubernetes Service | 2026-06 | 30 Jun 2027 | 30 Jun 2028 |
As published by each provider; see managed Kubernetes support for what “extended” means on each and when we last checked.