Back to updates

V1.35 - 1

2026 (5)

January (5)

k8s: Kubernetes v1.35: Restricting executables invoked by kubeconfigs via exec plugin allowList added to kuberc

Kubernetes Official Blog

2026-01-09

Kubernetes v1.35 introduces a beta credential plugin policy and allowlist to give users control over executables invoked by kubeconfig exec plugins. You can set policy via the client-go ExecProvider.PluginPolicy or by configuring kubectl's kuberc with credentialPluginPolicy (AllowAll, DenyAll, Allowlist) and credentialPluginAllowlist entries to restrict which plugins may run.

k8s: Kubernetes v1.35: Mutable PersistentVolume Node Affinity (alpha)

Kubernetes Official Blog

2026-01-08

Kubernetes v1.35 (alpha) makes PersistentVolume.spec.nodeAffinity mutable. This allows administrators to update PV node affinity to match changes in underlying storage (for example zonal→regional migrations or disk-generation upgrades) without recreating the PV. The feature is gated (MutablePVNodeAffinity), disabled by default, and requires updating the storage provider first. Be aware of scheduling race conditions when tightening affinity; future kubelet/CSI integration and VolumeAttributesClass automation are planned. Feedback is requested via SIG Storage channels.

k8s: Kubernetes v1.35: A Better Way to Pass Service Account Tokens to CSI Drivers

Kubernetes Official Blog

2026-01-07

Kubernetes v1.35 introduces a beta opt-in for delivering CSI-requested service account tokens in the NodePublishVolumeRequest secrets field rather than volume_context. This change (controlled by serviceAccountTokenInSecrets in the CSIDriver spec) fixes accidental token exposure in logs, is opt-in to preserve compatibility, and includes guidance and a safe rollout sequence for CSI driver authors.

k8s: Kubernetes v1.35: Extended Toleration Operators to Support Numeric Comparisons (Alpha)

Kubernetes Official Blog

2026-01-05

Kubernetes v1.35 introduces Extended Toleration Operators (alpha) that add numeric comparison operators Gt and Lt to spec.tolerations. This lets tolerations compare numeric taint values (e.g., failure-probability, gpu-compute-score, disk-iops, cost-per-hour) so schedulers can make threshold-based placement decisions while preserving taint/toleration semantics (centralized node-side policy and eviction via NoExecute). The feature is gated, supports all taint effects, has specific numeric format rules, and is experimental — feedback and further enhancements (CEL, autoscaling integration, graduation) are planned.

k8s: Kubernetes v1.35: New level of efficiency with in-place Pod restart

Kubernetes Official Blog

2026-01-02

Kubernetes v1.35 introduces an alpha feature, Restart All Containers (enabled with the RestartAllContainersOnContainerExits feature gate), which adds a RestartAllContainers action to container restart rules to perform a fast, in-place full Pod restart that preserves Pod UID, IP, sandbox and volumes while re-running init, sidecar and application containers.

2025 (7)

December (7)

k8s: Kubernetes 1.35: Enhanced Debugging with Versioned z-pages APIs

Kubernetes Official Blog

2025-12-31

Kubernetes 1.35 adds opt-in, versioned, machine-parseable JSON responses for the existing /statusz and /flagz z-pages used by control plane components. The endpoints remain backward compatible (plain text by default); consumers request structured output by sending an Accept header with a versioned media type. Structured responses enable easier automation for health checks, config validation, and debugging tools. The feature is alpha, requires feature gates and proper RBAC/authentication, and is intended for debugging rather than production-critical automation.

k8s: Kubernetes v1.35: Watch Based Route Reconciliation in the Cloud Controller Manager

Kubernetes Official Blog

2025-12-30

Kubernetes v1.35 introduces an alpha feature gate (CloudControllerManagerWatchBasedRoutesReconciliation) in k8s.io/cloud-provider that changes the CCM route controller from a fixed-interval reconciliation to a watch/informer-based trigger model. The change reduces unnecessary cloud API calls by reconciling routes only when relevant node or CIDR/address fields change, with an additional randomized periodic reconcile every 12–24 hours. The reconciliation logic itself is unchanged and the feature is enabled via --feature-gate.

k8s: Kubernetes v1.35: Introducing Workload Aware Scheduling

Kubernetes Official Blog

2025-12-29

Kubernetes v1.35 introduces workload-aware scheduling with a new Workload API (scheduling.k8s.io/v1alpha1) to describe multi-Pod scheduling requirements, an initial gang scheduling implementation for all-or-nothing placement, and opportunistic batching (Beta) to speed scheduling of identical Pods. Gang scheduling uses podGroups, a workloadRef on Pods, and a Permit gate with a 5-minute timeout; opportunistic batching reuses feasibility checks for identical Pods but has strict identical-field restrictions. The release also outlines a broader roadmap (workload-level preemption, autoscaling integration, topology-aware scheduling) and explains required feature gates and how to test and give feedback.

k8s: Kubernetes v1.35: Fine-grained Supplemental Groups Control Graduates to GA

Kubernetes Official Blog

2025-12-23

Kubernetes v1.35 graduates fine-grained supplemental groups control to GA via a new Pod field, supplementalGroupsPolicy, letting clusters choose whether to merge group memberships from the container image (/etc/group) or enforce only groups declared in the Pod (Strict) to reduce implicit, hard-to-audit GIDs and improve security (especially for volume access).

k8s: Kubernetes v1.35: Kubelet Configuration Drop-in Directory Graduates to GA

Kubernetes Official Blog

2025-12-22

Kubernetes v1.35 graduates the kubelet configuration drop-in directory to GA: the --config-dir kubelet flag is now production-ready and automatically merges drop-in files with the main kubelet configuration. This simplifies managing different kubelet settings across heterogeneous node pools and supports staged rollouts and targeted overrides without complex tooling.

k8s: Kubernetes 1.35: In-Place Pod Resize Graduates to Stable

Kubernetes Official Blog

2025-12-19

Kubernetes 1.35 graduates In-Place Pod Resize (In-Place Pod Vertical Scaling) to stable (GA). The feature makes CPU and memory requests and limits mutable on a running Pod (via a resize subresource), often without restarting containers. This enables non-disruptive resource adjustments, more powerful autoscaling (e.g., VPA InPlaceOrRecreate), transient boosts like CPU startup boost, and better resource efficiency. The release also adds prioritized retries, allows memory limit decreases (best-effort OOM protection), alpha support for Pod Level Resources, and new kubelet metrics/events. Work remains on runtime support, scheduler/kubelet races, expanded feature support, and integrations with autoscalers and other projects.

k8s: Kubernetes v1.35: Job Managed By Goes GA

Kubernetes Official Blog

2025-12-18

Kubernetes v1.35 promotes .spec.managedBy for Jobs to GA, enabling external controllers (e.g., MultiKueue) to take full responsibility for Job reconciliation and enabling multi-cluster batch scheduling patterns while leaving built-in Job controller behavior intact for other Jobs.