Kubernetes
v1.36.2Kubernetes CoreKubernetes v1.36.2 is a patch release fixing critical bugs in Dynamic Resource Allocation (DRA) scheduler, CSI volume republishing, and endpoint controller, plus a Go 1.26.4 build update.
breakingDRA device allocation bug affects multi-device workloads
Kubernetes 1.36.0–1.36.1 has a scheduler bug that assigns mutually exclusive device partitions to multiple Pods when drivers use SharedCounters with multi-allocatable devices. This can cause workload failures, device conflicts, crashes, or data loss. If you use DRA with multi-allocatable devices (especially GPUs or custom accelerators with shared counters), upgrade to 1.36.2 immediately. Review recent Pod scheduling decisions for conflicts.
securityBinary non-UTF8 Secret data in container env vars now handled correctly
Kubernetes 1.34+ had a regression where containers could not properly read environment variables set from Secret API objects containing binary non-UTF8 data. This is fixed in 1.36.2. If your workloads use non-text Secret data in environment variables, upgrade to prevent decode errors or silent failures.
enhancementCSI volume republish failures no longer corrupt mount state
Kubelet was incorrectly deleting CSI mount directories when periodic NodePublishVolume calls (triggered by requiresRepublish=true) failed, leaving pods with stale volume content. This is fixed in 1.36.2. If you run CSI drivers with requiresRepublish=true, this patch eliminates a data consistency risk—upgrade to prevent potential data issues on transient network or storage errors.
Key changes (7)
- Built with Go 1.26.4 for improved runtime stability
- Fixed DRA scheduler bug that could assign mutually exclusive device partitions to multiple Pods, risking workload failures or data loss
- Fixed kube-scheduler panic when DRA ResourceClaim with allocationMode: All selects shared counter devices
- Fixed kubelet incorrectly deleting CSI mount directories on periodic NodePublishVolume errors, leaving stale volume content
- Fixed regression where suspended Job spec modifications were rejected if JobSuspended condition was not yet set
- Fixed endpoint controller panic on services with empty IPFamilies field
- Fixed container environment variable handling for binary non-UTF8 data from Secrets