Changelog for Kubernetes 1.36

Versions

The deployed Kubernetes patch version varies based on when your cluster is deployed or upgraded. We strive to use the latest versions available.

Current release leverages Kubernetes 1.36. Official release blogpost found here with corresponding official changelog.

Optional addons

• ingress-nginx is provided with version v1.15.1
• cert-manager is provided with version v1.21.1
• envoy-gateway is provided as an opt-in addon with version v1.7.1, disabled by default.

Major changes

cloud-provider-openstack and cinder-csi aligned with Kubernetes 1.36

Both components are bumped to v1.36.0 to align with this Kubernetes release.

• Upstream changed the cloud-controller-manager DaemonSet to select control-plane nodes via affinity.nodeAffinity instead of nodeSelector. Our existing control-plane exclusion patch still applies and is unaffected.

calico upgraded to v3.32.1

Upstream renamed the adminnetworkpolicies and baselineadminnetworkpolicies CRDs into a single clusternetworkpolicies CRD. If you have manifests or tooling that reference the old CRD names directly, update them to the new one.

cert-manager upgraded to v1.21.1 — review before relying on the following

This upgrade crosses a cert-manager minor version and ships three breaking changes:

• The cert-manager-tokenrequest Role/RoleBinding has been removed from the chart. This only matters if something uses serviceAccountRef pointing at the cert-manager controller’s own ServiceAccount (e.g. Vault IRSA auth, or an old Route53 workflow).
• The metrics Service port was renamed from tcp-prometheus-servicemonitor to http-metrics. This only matters if something scrapes it by name.
• The cert-manager-edit ClusterRole no longer grants create/patch/update on Challenge/Order resources (security hardening, GHSA-8rvj-mm4h-c258). This only matters for tooling that creates those resources directly instead of via Certificate.

Routine addon bumps

• coredns upgraded from 1.13.1 to 1.14.6.
• metrics-server upgraded from v0.8.0 to v0.9.0.

Noteworthy changes in upcoming versions.

Announcement of changes in future versions.

Scheduled for upcoming releases:

• We’ll remove the legacy nodelocaldns where still deployed. Relevant only if the cluster was created before v1.26.
• Ingress-nginx controller will be fully deprecated from our management, following the news. The envoy-gateway addon, available since v1.35, is the first building block of its replacement.

Is downtime expected?

The cluster control plane should remain available during the upgrade; however, pods will be restarted when workloads are migrated to new nodes. Plan for short pod restarts during the upgrade.

Known issues.

Custom node taints and labels lost during upgrade.

Custom taints and labels on worker and control-plane nodes may be lost during the upgrade. We recommend auditing and reapplying any critical custom taints/labels via automation (e.g., cluster bootstrap, configuration management, or a post-upgrade job).

There is a label that is persistent across upgrades that can be used to direct workload to particular nodegroups. Example on how to use it:

spec:
  template:
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: nodegroup.node.cluster.x-k8s.io
                operator: In
                values:
                - worker1

Snapshots are not working.

There is currently a limitation in the snapshot controller: it is not topology-aware. As a result, snapshot behavior may be unreliable for topology-sensitive volumes. Avoid depending on snapshots for cross-zone/region recovery until a topology-aware snapshot controller is available or confirm your storage driver’s snapshot semantics.