Kubernetes 1.36 "Haru": user namespaces and mutating admission policies reach stable

2026-04-22 · Publisher : Kubernetes · Domain : Cloud & DevOps

On 22 April 2026, Kubernetes 1.36 ships 70 enhancements (18 stable): user namespaces and CEL mutating admission policies reach stable, gitRepo is removed and externalIPs is deprecated.

### Background On 22 April 2026, Kubernetes releases version **1.36 "ハル (Haru)"**, Japanese for spring: **70 enhancements**, including 18 stable, 25 beta and 25 alpha. The cycle involved 106 companies and 491 individuals; the wider cloud native ecosystem counts 370 and 2,235. ### Key facts - **User namespaces** reach stable: a container's root account is mapped to an unprivileged user on the host, limiting the consequences of a container breakout. - **Mutating admission policies** (MutatingAdmissionPolicy) reach stable: declarative mutations in CEL inside the API server, replacing many external webhooks. - Fine-grained kubelet API authorization reaches stable, avoiding the overly broad `nodes/proxy` permission for monitoring; volume group snapshots also reach stable. - In alpha: workload-aware scheduling, with a new PodGroup API handled atomically (all pods bound together, or none). - **Removal of the gitRepo volume**; deprecation of the Service `externalIPs` field; Ingress NGINX retired on 24 March 2026. ### Why it matters User namespaces and CEL policies are two security gains available without an extra product, to build into hardening baselines. Conversely, removing `gitRepo` and deprecating `externalIPs` call for an inventory of affected workloads before upgrading. The 7 May DRA article adds that DRA extends to native resources (CPU, memory) and pod groups, reinforcing the AI positioning. ### Takeaway Kubernetes 1.36 hardens isolation and admission by default, and cleans up risky mechanisms such as gitRepo.

Tags : Kubernetes, Cloud natif, Sécurité, Conteneurs, Open Source