Kubernetes 1.36 Haru: AI-Ready Upgrades and Long-Awaited Security Fixes

The Kubernetes community shipped version 1.36, codenamed Haru, on April 22, 2026. This release packs 70 enhancements—18 stable, 25 beta, and 27 alpha—built over 15 weeks by 491 contributors from 106 companies.

Dynamic Resource Allocation (DRA) reaches production status, giving cluster operators global control over hardware like GPUs. New beta features include partitionable devices for splitting compute resources, taints for picky hardware, and health tracking. This matters for AI teams managing expensive accelerators across distributed clusters.

User namespaces finally graduate to stable, solving a long-standing security gap. Container root no longer maps to host root, closing escape vectors like the infamous CVE-2019-5736. Mutating Admission Policies also hit GA, letting teams handle resource mutations declaratively without maintaining webhook servers.

Storage gets meaningful upgrades. VolumeGroupSnapshot goes stable, enabling crash-consistent backups across multiple PVCs—critical for databases and stateful AI workloads. OCI VolumeSource stabilizes too, letting operators mount ML models directly from container registries without custom scripts.

The Horizontal Pod Autoscaler now supports scale-to-zero as an alpha feature, triggering pod removal when external metrics show no traffic. Vito Botta noted on LinkedIn this eliminates the need for KEDA or custom controllers for this specific use case. Workload Aware Scheduling also debuts in alpha, with gang scheduling and topology hints designed for distributed AI training jobs.

Some removals demand attention. The gitRepo volume type is gone permanently. Service.spec.externalIPs is deprecated with removal planned for version 1.43. Ingress NGINX was retired March 24 after maintainers stepped away due to security flaws. Teams should migrate to Gateway API v1.5.

Kubernetes 1.36 runs until June 2027. Operators should test DRA for AI cluster management, audit deprecated features, and update security policies around user namespaces. The release clears a path toward treating Kubernetes as the operating system for AI workloads.

Source: Webpronews