Releases — RATATOSK

Kubernetesv1.36.0Kubernetes CoreApr 22, 2026

ACTION 11CHECK 25PLAN 6OTHER 293View full analysis

A broad operator-significant release with API, configuration, CLI default, scheduling, runtime, feature-gate, metric, and dependency changes. Upgrade review and testing matter for users of removed or deprecated interfaces, changed defaults, custom scheduler integrations, CRDs, audit logging, and affected metrics.

Action needed (11)

breakingStrictIPCIDRValidation enabled by default
The StrictIPCIDRValidation feature gate in kube-apiserver is enabled by default.
breakingThe default debug profile, changed to general
The default debug profile changes from legacy to general.
breakingWatchCacheInitializationPostStartHook enabled by default
The WatchCacheInitializationPostStartHook feature gate is enabled by default.
breakingKubeletPSI graduation to GA
The KubeletPSI feature graduated to GA and is enabled by default.
breakingRelaxedServiceNameValidation at beta, enabled by default
The RelaxedServiceNameValidation feature gate graduated to beta and is enabled by default.
breakingRestartAllContainersOnContainerExits at beta, enabled by default
The RestartAllContainersOnContainerExits feature gate graduated to beta and is enabled by default.
breakingSuspended-job feature gates enabled by default
The MutablePodResourcesForSuspendedJobs and MutableSchedulingDirectivesForSuspendedJobs feature gates are enabled by default.
breakingAtomicFIFO informer store updates
Default informer behavior now updates store state with all objects in a list or relist before invoking individual-item handler methods. This behavior is associated with AtomicFIFO.
breakingUnlockWhileProcessing informer behavior
Informers can now enqueue new watch events while already-queued events are being processed. This behavior is associated with UnlockWhileProcessing.
breakingClientsAllowCARotation functionality enabled by default
This functionality is enabled by default and can be disabled through the ClientsAllowCARotation feature gate.
breakingClientsAllowTLSCacheGC functionality enabled by default
This functionality is enabled by default and can be controlled through the ClientsAllowTLSCacheGC feature gate.

Check if affected (25)

breakingThe volume_operation_total_errors metric, renamed
Applies if you use volume_operation_total_errors.
The metric volume_operation_total_errors is renamed to volume_operation_errors_total.
breakingThe git-repo volume plugin, disabled
Applies if you use the git-repo volume plugin.
The git-repo volume plugin is disabled by default, with no option to turn it back on.
breakingAllowlistEntry.Name, renamed to AllowlistEntry.Command
Applies if you configure AllowlistEntry.Name.
AllowlistEntry.Name is renamed to AllowlistEntry.Command in the credential plugin allowlist.
+ 22 more on the release page

Plan ahead (6)

deprecatedService .spec.externalIPs deprecation
Applies if you configure Service .spec.externalIPs.
Warnings and deprecation were added for the Service .spec.externalIPs field.
deprecatedDirect access to metav1.FieldsV1.Raw, deprecated
Applies if you use metav1.FieldsV1.Raw.
Direct access to the Raw field of metav1.FieldsV1 is deprecated.
deprecatedMinNodeScore and MaxNodeScore, deprecated
Applies if you use MinNodeScore or MaxNodeScore.
MinNodeScore and MaxNodeScore are deprecated in favor of MinScore and MaxScore.
+ 3 more on the release page

Source ↗