Kubernetes 1.36

All Cluster Stack 1.36 Releases

1. 2026-09-04

   1-36-v5

   1-36-v5

   Latest

   No vulnerabilities Last scanned 2 days ago

   Security

   • • Security: node-image OS packages refreshed — kernel 6.18.49, OpenSSL 3.5.8, expat 2.8.4, QEMU guest agent 11.0.4.

   Fix

   • • Storage: Hetzner CSI driver 2.23.0 — fixes a crash when listing volumes in a project that already has volumes.
   • • Networking: syself-node 0.1.6 — in case a control plane is down, connections from kubelets to other other - healthy - control planes stay open.
   • • Compute (bare metal): the receive page size on Broadcom NICs is now always initialised, fixing a driver-level networking issue.

   6 component updates

   • expat 2.8.3 → to 2.8.4
   • hcloud-csi-driver v2.22.1 → to v2.23.0
   • kernel 6.18.45 → to 6.18.49
   • openssl 3.5.7 → to 3.5.8
   • qemu_ga 11.0.3 → to 11.0.4
   • syself-node v0.1.5 → to v0.1.6
2. 2026-08-26

   1-36-v4

   1-36-v4

   No vulnerabilities Last scanned 2 days ago

   Fix

   • • Fixed bug in Cluster API templates affecting clusters using bare metal control planes and OIDC authentication
3. 2026-08-25

   1-36-v3

   1-36-v3

   No vulnerabilities Last scanned 2 days ago

   Update

   • • Platform: Kubernetes 1.36.3 to 1.36.4.
   • • Networking: Cilium 1.20.1 (agent, operator, hubble-relay, envoy), KubeGate 0.0.7.
   • • Storage: Hetzner CSI driver 2.22.1, with its attacher, provisioner, resizer, node-driver-registrar, and liveness-probe sidecars updated to match.
   • • Compute: NVIDIA device plugin 0.20.0.
   • • Observability: metrics-server's addon-resizer 1.8.24.

   Security

   • • Security: node-image OS packages refreshed — OpenSSH 10.5p1, containerd 2.3.4, crun 1.29.1, AppArmor 4.1.8, expat 2.8.3, the CA bundle, and the NVIDIA drivers, Intel microcode, and Linux firmware.

   22 component updates

   • apparmor 4.1.7 → to 4.1.8
   • ca_bundle 2026-07-16 → to 2026-08-13
   • cilium 1.20.0 → to 1.20.1
   • cilium_envoy v1.37.5-1782911245-7cffc778c923f68a77954a53b1a98d6b5353f004 → to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7
   • cilium_operator 1.20.0 → to 1.20.1
   • containerd 2.3.3 → to 2.3.4
   • crun 1.28 → to 1.29.1
   • expat 2.8.2 → to 2.8.3
   • go 1.25.12 → to 1.25.14
   • intel_microcode 20260512 → to 20260812
   • kernel 6.18.42 → to 6.18.45
   • kube_apiserver 1.36.3 → to 1.36.4
   • kube_controller_manager 1.36.3 → to 1.36.4
   • kube_scheduler 1.36.3 → to 1.36.4
   • kubegate v0.0.5 → to v0.0.7
   • kubernetes 1.36.3 → to 1.36.4
   • linux_firmware 20260622 → to 20260810
   • nfs_utils 2.9.1 → to 2.9.2
   • nvidia_driver_legacy 580.173.02 → to 580.178.04
   • nvidia_driver_new 595.71.05 → to 595.91.07
   • openssh 10.4p1 → to 10.5p1
   • yq 4.53.3 → to 4.53.6

In-Place Pod Resizing

Adjust a Pod's CPU and memory budget without a restart, so no redeploy and no dropped connections.

Pod-Level Resource Budgets

Set requests and limits once for the whole Pod, so sidecars and main containers share headroom instead of each reserving their own.

Resize Jobs Before They Run

Update CPU and memory requests on a suspended Job, then unsuspend. No more delete-and-recreate to fit your quota.

User Namespaces Now Stable

One field in your Pod spec maps container root to an unprivileged host user, so a breakout gains nothing.

Unprivileged Container Builds

ProcMount goes stable. Combined with user namespaces, nested container workloads no longer need a privileged Pod.

Hardware Faults in Pod Status

Device health surfaces directly in your Pod status, separating a failing device from a failing container image.