Kubernetes v1.36 Preview: API Deprecations and Ingress NGINX Retirement
Kubernetes v1.36, scheduled for release in late April 2026, introduces significant changes focused on security enhancements and API lifecycle management. A major development is the official retirement of the Ingress NGINX project as of March 24, 2026, driven by Kubernetes SIG Network and the Security Response Committee to prioritize ecosystem safety. While existing deployments remain functional, no further updates or security patches will be issued. The release also marks the permanent removal of the gitRepo volume driver, a feature deprecated since v1.11 due to critical risks allowing root-level code execution by attackers. Additionally, the .spec.externalIPs field in Services is deprecated starting in v1.36, with full removal planned for v1.43, addressing long-standing man-in-the-middle attack vulnerabilities documented in CVE-2020-8554. Users are advised to migrate to safer alternatives like LoadBalancer services, NodePort, or the Gateway API. These changes align with Kubernetes' strict deprecation policy, ensuring stable APIs have adequate migration windows while removing insecure or obsolete components. This update underscores the platform's commitment to maintaining robust security standards and evolving its architecture without causing abrupt disruptions for users adhering to recommended migration paths.
Wire timeline
Kubernetes v1.36 Preview: API Deprecations and Ingress NGINX Retirement
Kubernetes v1.36, scheduled for release in late April 2026, introduces significant changes focused on security enhancements and API lifecycle management. A major development is the official retirement of the Ingress NGINX project as of March 24, 2026, driven by Kubernetes SIG Network and the Security Response Committee to prioritize ecosystem safety. While existing deployments remain functional, no further updates or security patches will be issued. The release also marks the permanent removal of the gitRepo volume driver, a feature deprecated since v1.11 due to critical risks allowing root-level code execution by attackers. Additionally, the .spec.externalIPs field in Services is deprecated starting in v1.36, with full removal planned for v1.43, addressing long-standing man-in-the-middle attack vulnerabilities documented in CVE-2020-8554. Users are advised to migrate to safer alternatives like LoadBalancer services, NodePort, or the Gateway API. These changes align with Kubernetes' strict deprecation policy, ensuring stable APIs have adequate migration windows while removing insecure or obsolete components. This update underscores the platform's commitment to maintaining robust security standards and evolving its architecture without causing abrupt disruptions for users adhering to recommended migration paths.
Kubernetes Blog