Kubernetes 1.36

All Cluster Stack 1.36 Releases

1. 2026-09-29

   1-36-v7

   1-36-v7

   Latest

   No vulnerabilities Last scanned yesterday

   Security

   • • Security: node-image kernel updated to 6.18.54 and OS packages refreshed — Intel microcode 20260925, Linux firmware 20260916, containerd 2.3.6, crun 1.30.1, runc 1.5.2, open-iscsi 2.1.13, PAM 1.7.3, expat 2.8.5, libtirpc 1.3.8, and the CA bundle.

   Update

   • • Platform: Kubernetes 1.36.4 to 1.36.5.
   • • Networking: Cilium 1.20.2 (agent, operator, envoy).
   • • Compute: NVIDIA driver 595.104.02.
   • • Time zone data updated to 2026d.

   17 component updates

   Name	Version
   ca_bundle	2026-09-25 from 2026-08-13
   cilium	1.20.2 from 1.20.1
   cilium_envoy	v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 from v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7
   cilium_operator	1.20.2 from 1.20.1
   containerd	2.3.6 from 2.3.4
   crun	1.30.1 from 1.29.1
   expat	2.8.5 from 2.8.4
   intel_microcode	20260925 from 20260812
   kernel	6.18.54 from 6.18.49
   kubernetes	1.36.5 from 1.36.4
   libtirpc	1.3.8 from 1.3.7
   linux_firmware	20260916 from 20260810
   nvidia_driver	595.104.02 from 595.91.07
   open_iscsi	2.1.13 from 2.1.12
   pam	1.7.3 from 1.7.2
   runc	1.5.2 from 1.5.1
   tzdata	2026d from 2026c

2. 2026-09-18

   1-36-v6

   1-36-v6

   No critical or high vulnerabilities Last scanned yesterday

   Fix

   • • GPU nodes: node image now ships the NVIDIA GSP firmware, so Turing and newer cards (RTX 4000 SFF Ada, RTX 6000 Ada, RTX PRO 4000 Blackwell, RTX PRO 6000 Blackwell i.e. every Hetzner GEX server) initialize correctly and show up as allocatable nvidia.com/gpu devices.
3. 2026-09-04

   1-36-v5

   1-36-v5

   No critical or high vulnerabilities Last scanned yesterday

   Security

   • • Security: node-image OS packages refreshed — kernel 6.18.49, OpenSSL 3.5.8, expat 2.8.4, QEMU guest agent 11.0.4.

   Fix

   • • Storage: Hetzner CSI driver 2.23.0 — fixes a crash when listing volumes in a project that already has volumes.
   • • Networking: syself-node 0.1.6 — in case a control plane is down, connections from kubelets to other other - healthy - control planes stay open.
   • • Compute (bare metal): the receive page size on Broadcom NICs is now always initialised, fixing a driver-level networking issue.

   6 component updates

   Name	Version
   expat	2.8.4 from 2.8.3
   hcloud-csi-driver	v2.23.0 from v2.22.1
   kernel	6.18.49 from 6.18.45
   openssl	3.5.8 from 3.5.7
   qemu_ga	11.0.4 from 11.0.3
   syself-node	v0.1.6 from v0.1.5

In-Place Pod Resizing

Adjust a Pod's CPU and memory budget without a restart, so no redeploy and no dropped connections.

Pod-Level Resource Budgets

Set requests and limits once for the whole Pod, so sidecars and main containers share headroom instead of each reserving their own.

Resize Jobs Before They Run

Update CPU and memory requests on a suspended Job, then unsuspend. No more delete-and-recreate to fit your quota.

User Namespaces Now Stable

One field in your Pod spec maps container root to an unprivileged host user, so a breakout gains nothing.

Unprivileged Container Builds

ProcMount goes stable. Combined with user namespaces, nested container workloads no longer need a privileged Pod.

Hardware Faults in Pod Status

Device health surfaces directly in your Pod status, separating a failing device from a failing container image.