Kubernetes
v1.35.6Kubernetes CoreKubernetes v1.35.6 fixes critical issues in pod scheduling with multi-node claims, DRA device selection, CSI volume republishing, and endpoint handling; includes a Go runtime upgrade and performance improvements.
breakingUpgrade Go runtime to 1.25.11 in your build pipeline
Kubernetes v1.35.6 is built with Go 1.25.11. If you run custom controllers or operators on the same Go version, verify compatibility and rebuild. If your CI/CD locks Go versions, update your build configuration. This is standard but must be done; old Go versions may have security gaps you're inheriting.
securitySecret binary data in environment variables now handled correctly
A 1.34+ regression broke environment variable injection from Secrets containing non-UTF8 binary data (e.g., certificates, keys in base64-encoded Secrets). If you inject Secrets as env vars and those Secrets contain binary data, upgrade to v1.35.6. Test this quickly if you run database credentials or keys via Secrets—the bug may have silently broken injection.
enhancementDRA scheduling and CSI republishing now reliable for dynamic resource allocation
Three bugs are fixed: (1) scheduler no longer panics on DRA ResourceClaim with AllocationMode All and shared counters; (2) pods using multi-node and per-node claims no longer deadlock in Pending; (3) kubelet no longer deletes CSI mount directories on transient NodePublishVolume errors, preventing stale volume data. If you use DRA (dynamic resource allocation) or CSI with republish enabled, this release eliminates previously deadlocking scenarios. Upgrade to clear stuck pods and prevent future hangs.
Key changes (6)
- Upgraded to Go 1.25.11 for runtime stability and security patches
- Fixed pod scheduling deadlock when using both multi-node and per-node DRA claims
- Fixed kube-scheduler panic with DRA ResourceClaim AllocationMode consuming shared counters
- Fixed kubelet deleting CSI mount directories on periodic NodePublishVolume failures, causing stale volumes
- Fixed endpoint controller panic on services with empty IPFamilies field (pre-dual-stack services)
- Fixed environment variable handling for Secret objects containing binary non-UTF8 data