RATATOSKRATATOSK
Sign in

Kubernetes

v1.36.6Kubernetes Core
Oct 28, 2026

OTHER 6

A maintenance release with a Go toolchain update, several correctness fixes, and a broader request-header limit for API servers. It also includes fixes affecting resource claim status updates, Job reconciliation, scheduler namespace selectors, and kube-proxy sysctl handling.

All 6 other recorded changesfixes 4 · constraints 1 · value changes 1

fixes (4)

  • - Fixed a bug where Pod .status.resourceClaimStatuses could flap between partial lists of claims, when multiple claims were used in the pod. ([#142021](https://github.com/kubernetes/kubernetes/pull/142021), [@troychiu](https://github.com/troychiu)) [SIG Apps and Node]
  • - Fixed an issue where a Job recreated with the same name as a recently deleted Job could remain unreconciled because it inherited pending Pod expectations from the previous Job. ([#142391](https://github.com/kubernetes/kubernetes/pull/142391), [@6democratickim9](https://github.com/6democratickim9)) [SIG Apps and Testing]
  • - Fixed kube-scheduler evaluation of pod affinity and anti-affinity namespace selectors using negative operators, so pods in excluded namespaces no longer affect node filtering or scoring. ([#141563](https://github.com/kubernetes/kubernetes/pull/141563), [@rahulbabu95](https://github.com/rahulbabu95)) [SIG Scheduling and Testing]
  • - Kube-proxy no longer tries to set the nf_conntrack_max sysctl if its value is already higher than the value kube-proxy wants it to be. This fixes a regression in 1.36 on systems where kube-proxy does not have permission to modify the sysctls, since the new maximum value for nf_conntrack_max could cause kube-proxy to now want a different (lower) value than it had before. ([#142199](https://github.com/kubernetes/kubernetes/pull/142199), [@danwinship](https://github.com/danwinship)) [SIG Network]

constraints (1)

  • - Kube-apiserver and other servers built on k8s.io/apiserver now accept up to 16384 request header values. Without this, Go 1.27's default of 500 rejects impersonated or proxied users with about 500 or more groups with HTTP 431. Releases built with Go 1.26 had no separate header-count limit. ([#142771](https://github.com/kubernetes/kubernetes/pull/142771), [@cwedgwood](https://github.com/cwedgwood)) [SIG API Machinery and Auth]

value changes (1)

  • - Kubernetes is now built with Go 1.26.10 ([#143203](https://github.com/kubernetes/kubernetes/pull/143203), [@dims](https://github.com/dims)) [SIG Release]
Add Kubernetes to your stack

A weekly email arrives when a release needs action. Weeks with nothing to act on, like this one, send no email.

Add to stack →
Official release note ↗All Kubernetes releases →