Kubeflow

26.03AI & ML

Mar 22, 2026Copy link

Kubeflow 26.03 is a manifests and version-alignment release that bumps most core platform components (Kubernetes 1.34+, Knative 1.20, Istio 1.29.0, cert-manager 1.19.4, oauth2-proxy 7.14.3, Dex 2.45.0, KFP 2.16.0, KServe 0.16.0, spark-operator 2.5.0) while tightening pod security enforcement to baseline and hardening network policies across core namespaces. Teams enforcing stricter PSS restricted policies should check Kubeflow Pipelines compatibility before upgrading.

• breakingPod security standard default raised to baseline

  Pod security enforcement across the manifests now defaults to the baseline profile rather than the prior looser setting. Review any workloads that relied on unrestricted pod security contexts before upgrading.

• breakingNetwork policies tightened across core namespaces

  Network policies for cert-manager, knative-serving, istio-system, dex, and oauth2-proxy have been tightened. Verify cross-namespace traffic still flows as expected after applying the new manifests, since previously permitted connections may now be blocked.

• breakingKFP v1/v2 compatibility gap under PSS restricted

  Kubeflow Pipelines v1 and v2 may not run cleanly in namespaces enforcing the PSS restricted profile. If you enforce restricted PSS on pipeline namespaces, test KFP workloads before rolling this out broadly.