What to Expect From Kubernetes 1.36
Kubernetes 1.36 is scheduled to be released on Wednesday, 22nd April 2026. But in advance of its arrival on what is, after all, a religiously observed release cycle (roughly three times a year), what can we expect?
As the industry heads to CloudNativeCon + KubeCon Europe in Amsterdam later this month, there is already talk of significant security updates.
Linux User Namespaces
Among the updates, we can expect Linux User Namespaces support to be bolstered. This technology works to deliver container isolation and allow software engineering teams to run processes at “root” status inside a pod as they are concurrently mapped to a non-privileged user on the host. This is said to mitigate the risk of container escape vulnerabilities.
There is also excitement (probably not the right word) around Ingress-Nginx retirement. As a recap, we are talking about an Ingress Controller (an API gateway managing external access to cluster services) using Nginx as a reverse proxy to manage external access to cluster services and handle routing, load balancing and Secure Sockets Layer (SSL) termination via Kubernetes Ingress resources.
As the upstream project now retires the Ingress-Nginx controller, existing versions will still work, but without any additional security patches.
Shift to Gateway API
Discussion now moves to Gateway API, defined as an “expressive and role-oriented” successor to Ingress, that will deliver more sophisticated and advanced routing management, better traffic splitting, as well as multi-tenant networking for Kubernetes service connectivity.
“The retirement of Ingress-Nginx is the clearest signal yet that Kubernetes networking is growing up. Ingress served the community well as a starting point, but Gateway API offers something fundamentally better: Proper separation of infrastructure and application concerns, cross-namespace routing, and a model that actually scales with how teams work. For developers, the transition will take effort, but the payoff is a traffic management layer that’s consistent, extensible, and no longer held together by annotations,” said Marko Budiselić, co-founder and CTO at Memgraph.
Developers are also said to be interested in WatchCache improvements. As all good network engineers will know, WatchCache is a Kubernetes API server component that caches what are classified as “recently observed resource versions” with the aim of optimising list and watch query performance.
Taints and Tolerations in DRA
Nigel Douglas is the head of developer relations at Cloudsmith, a cloud-native software artifact management platform. He’s focused on a number of Kubernetes 1.36 updates, including the DRA API. To define this technology in full, the Dynamic Resource Allocation (DRA) is a Kubernetes API that enables Kubernetes pods to go ahead and request specialized hardware for their execution needs by using dynamic, vendor-specific third-party drivers.
“The DRA API is seeing a lot of exciting enhancements,” said Douglas. “In this particular update, it’s bringing more granularity and automation to hardware management, which lets admins take specific devices offline for maintenance without disrupting the entire cluster. Introducing taints and tolerations for hardware benefits all, from automatically rescheduling pods away from failing devices while still letting specialised test pods access them for daily troubleshooting activities.”
Douglas also points out that for years now, software application development teams have been forced into the so-called “fat image anti-pattern”, where they’re basically bundling massive ML models, static assets, and binary plugins directly into their application images, which ultimately creates a nightmare for security patching and bloats deployment times.
By graduating this to Stable, Douglas suggests that we’re now seeing a native, high-performance way to decouple user data from logic. Developers can now push Hugging Face LLM weights or commercial signatures as independent OCI artifacts and mount them as a VolumeSource just as easily as a ConfigMap. This (he says) drastically shrinks the potential attack surface for platform teams who are managing these deployments. It could just be a massive win for the ecosystem.
Manifest-Based Admission Control Configuration
Finally, the Cloudsmith DevOps guru wants to point to Manifest-based Admission Control configuration, a technology that lets platform teams secure their actual admission control configs.
“When we think about moving mission-critical policies from the API to static files on the control plane disk, platform teams can now prevent the scary security blind spot where the cluster was vulnerable during startup. Based on what we hear, this means vital guardrails (like blocking privileged containers) are now immune to accidental kubectl delete commands or etcd crashes,” concluded Douglas.
Is it Safe?
Will everything migrate safely then?
We might try to answer that by listening to Heinan Cabouly, a DevOps team lead & architect who is also a platform engineering specialist at contactless continuous monitoring patient healthcare company Neteera.
Cabouly recounts the story of his team upgrading to Kubernetes 1.35 on a Tuesday afternoon.
“[It was all] routine. Planned. Tested in staging. Change control approved. I’d done this upgrade cycle a dozen times – rolling control plane update, node group rotation, final validation sweep. It looked normal all the way through,” wrote Cabouly, on his Medium blog. “By Wednesday morning, half my EKS node groups were stuck in NotReady. Pods evicting. Karpenter spinning replacement nodes that were also refusing to come up. PagerDuty firing. Slack lit up across three channels. On-call rotation pulled in at 6 a.m. The root cause wasn’t a misconfiguration. Not a bad Helm chart. Not a Karpenter bug.”
Without recounting his full story (available via his name link above), it’s worth noting just how far best laid plans can be disrupted by real-world deployment scenarios and real-world (often real-time) production workloads. Kubernetes 1.36 is on the way, and there will be much joy, but there will also be some pain. Now, wash your hands.
