Kubernetes v1.36, codenamed Haru, landed April 22 with 70 enhancements—18 stable, 25 beta, 27 alpha. Built over 15 weeks by 491 contributors from 106 companies, this release shifts the platform’s center of gravity toward AI/ML workloads and operational hardening.
Dynamic Resource Allocation (DRA) graduates to stable, giving cluster admins global, secure, and persistent control over hardware like GPUs and NICs. New beta features include partitionable devices (split a GPU across pods), taints/tolerations for finicky hardware, consumable capacity tracking, and health status surfaced in pod conditions. Alpha additions—native ResourceClaims for workloads, downward API exposure, and availability visibility—signal the WG Device Management team’s intent to make Kubernetes the substrate for distributed training.
User namespaces finally reach GA, decoupling container root from host root. This closes privilege-escalation vectors like CVE-2019-5736. SIG Node calls it a milestone after years of KEP-127 iteration. Mutating Admission Policies also hit stable, replacing webhook servers with declarative CEL expressions for cleaner mutation pipelines (KEP-3962).
On the storage side, VolumeGroupSnapshot is now stable, enabling crash-consistent snapshots across multiple PVCs via CSI—a boon for stateful databases. OCI VolumeSource stabilizes too, letting you mount ML models directly from container registries without custom pull logic. SIG Storage also shipped mutable CSINode allocatable properties and millisecond SELinux relabeling (KEP-3476, KEP-1710).
For batch and autoscaling: Jobs with suspended mutability enter beta, allowing resource tweaks mid-run. The Horizontal Pod Autoscaler scale-to-zero feature hits alpha, using external metrics to kill pods when traffic drops—no more KEDA or custom controllers for that pattern (KEP-2021, seven years in the making).
Workload Aware Scheduling debuts in alpha, introducing gang scheduling, topology hints, and preemption that groups pods. The PodGroup API decouples scheduling logic for AI/ML jobs, preparing Kubernetes for distributed training topologies.
Watch the removals: gitRepo volumes are gone permanently (disabled since 1.11, KEP-5040). Service.spec.externalIPs is deprecated with warnings; removal in 1.43 addresses CVE-2020-8554. Ingress NGINX was retired March 24 after fatal flaws and maintainer burnout—migrate to Gateway API v1.5.
Fine-grained kubelet auth and external ServiceAccount token signing are stable. Constrained impersonation enters beta for least-privilege patterns. PSI on cgroupv2 exports memory pressure metrics. Node log queries via kubectl now work without SSH, including Windows nodes.
Scalability tests now target 1.5GB resource limits, up from 800MB. Mixed-version proxy support betas for smoother upgrades. This release runs to June 2027 EOL. Operators should start testing DRA for GPU clusters, audit deprecated features, and plan Gateway API migration. Haru clears the path—next summit awaits.
Source: Webpronews