Kubernetes v1.36 advances 18 features to stable, including storage and security capabilities
The latest Kubernetes release completes migrations away from deprecated dependencies and adds new ways to inspect and secure clusters.
Disclaimer
This article was produced by Scroll Insights News Desk using automated systems and published under our standing editorial policy. It is compiled from the primary sources linked above and is provided for general information only — it is not legal, financial, investment, tax or professional advice, and no decision should be taken on it without independent verification against those sources. Errors can be reported to corrections@scrollinsights.com and are corrected on the record.
Kubernetes v1.36 advances 18 features to general availability, 25 to beta, and adds 25 new alpha capabilities across 70 total enhancements.
Dynamic Resource Allocation gets cluster control improvements
Dynamic Resource Allocation (DRA) advances to stable with admin access controls and prioritized scheduling lists, two capabilities that allow cluster operators to restrict how workloads claim shared devices. DRA beta features including partitionable devices, consumable capacity, device taints and tolerations, and ResourceClaim device status are enabled by default, providing finer control over GPU, accelerator, and custom hardware allocation.
Storage operations now support direct container image mounting
OCI volume source support reaches stable, enabling kubelets to pull and mount content directly from OCI-compliant registries without intermediate extraction steps. VolumeGroupSnapshot support also graduates to GA after several cycles in beta. Additionally, the mutable CSINode allocatable feature reaches stable, allowing Container Storage Interface drivers to dynamically update the maximum number of volumes a node can handle.
Pod security and isolation strengthen
User Namespaces in pods graduate to stable, isolating pod UIDs and GIDs from the host and other pods. KubeletFineGrainedAuthz reaches general availability after entering beta in v1.33, providing fine-grained control over kubelet API access. ConstrainedImpersonation advances to beta, restricting how users can impersonate others within the cluster. Support for external ServiceAccount token signers also reaches stable.
Observability and validation tooling mature
Node log query reaches GA and is enabled by default, requiring only the enableSystemLogQuery kubelet configuration option. ComponentStatusz graduates to beta with a /statusz endpoint enabled by default that exposes start time, uptime, Go version, binary version, and compatibility metadata in human-readable text or structured JSON, YAML, or CBOR formats. ComponentFlagz advances to beta, standardizing a /flagz endpoint showing effective command-line flags for each component.
Pressure Stall Information metrics for CPU, memory, and I/O graduate to stable. The allocatedResourcesStatus field for Pod health reporting advances to beta, and MutatingAdmissionPolicies reaches stable, allowing administrators to define resource mutations using the Common Expression Language.
Developer workflows and job management expand
MutablePodResourcesForSuspendedJobs reaches beta and is enabled by default, permitting container CPU, memory, GPU, and extended resource updates while a Job is suspended. Declarative validation with validation-gen graduates to stable, letting developers define validation logic within Go struct tags.
Kubectl configuration gains policy controls for credential plugins through allowlist and denylist rules in .kuberc, while StrictIPCIDRValidation advances to beta for API IP and CIDR field validation. Kubernetes v1.36 also completes removal of the gogoprotobuf dependency by internalizing generation logic within k8s.io/code-generator.