Kubernetes v1.36: What’s New, Deprecated, and Retired

As the Kubernetes community gears up for the v1.36 release—expected at the end of April 2026—developers and administrators are facing a mix of exciting enhancements, essential deprecations, and significant removals. This release is one of the most impactful in recent memory, driving home the project’s commitment to security, stability, and lifecycle management. Whether you’re a cluster operator or an application developer, understanding these changes is critical to maintaining a healthy, up-to-date environment. Let’s dive into the most notable updates and what they mean for your workflows.

The Kubernetes API Removal and Deprecation Process

Kubernetes follows a well-documented, community-vetted deprecation policy that ensures APIs are phased out responsibly. The core principle: stable APIs can only be deprecated when a newer, stable version of that same API exists. Each stability level has a minimum lifetime before removal becomes possible, giving teams ample time to migrate.

Understanding the Policy

• GA (General Availability) / Stable: These APIs may be marked as deprecated but cannot be removed within the same major version of Kubernetes. A deprecation notice is served for at least one year before removal.
• Beta / Pre-release: Beta APIs must be supported for three releases after being deprecated. This provides a predictable window for users to transition.
• Alpha / Experimental: Alpha APIs may be removed in any release without prior notice. In some cases, a feature may be withdrawn entirely if a different implementation supersedes it.

All removals—whether due to graduation, failure, or security concerns—must comply with this policy. When an API is removed, the Kubernetes project provides migration options in the deprecation guide, ensuring teams can move forward without disruption.

A Recent Example: Ingress NGINX Retirement

On March 24, 2026, SIG Network and the Security Response Committee announced the retirement of the Ingress NGINX project. As of that date, no further releases, bugfixes, or security patches will be issued. Existing deployments will continue to operate, and installation artifacts (like Helm charts and container images) remain available, but the project is effectively in maintenance mode with no active support.

This decision aligns with Kubernetes’ lifecycle discipline—sometimes the best way to ensure ecosystem safety is to retire a project that can no longer meet modern security requirements. The community has been strongly encouraged to evaluate alternative ingress controllers that follow current best practices. You can read the full official retirement announcement for complete details.

Key Deprecations and Removals in v1.36

Beyond the Ingress NGINX retirement, v1.36 introduces several API deprecations that will affect how services and networking are configured. The most notable is the deprecation of the .spec.externalIPs field in the Service resource.

Deprecation of .spec.externalIPs in Service

The externalIPs field has long been a convenient but controversial way to route arbitrary external IP addresses to Kubernetes Services. It allowed you to bypass typical network policies and direct traffic from a specific IP to your Service without creating a full LoadBalancer or Ingress setup. While handy, this feature created significant security headaches—it could be used to route traffic to Services that administrators might not intend to expose, and it complicated audit logs and network segmentation.

With its deprecation in v1.36, this field will still work for now (and for at least the next three releases), but it will emit deprecation warnings. The project recommends migrating to more explicit and secure alternatives, such as:

• Using externalTrafficPolicy and loadBalancerIP for externally facing services.
• Leveraging Ingress controllers or Gateway API for fine-grained routing.
• Implementing network policies to restrict source IPs at the pod level.

For a complete list of v1.36 deprecations and removal timelines, refer to the deprecation policy and the official Kubernetes documentation.

Preparing for v1.36: Migration and Best Practices

To ensure a smooth upgrade, start by auditing your current cluster for use of deprecated features. Tools like kubectl convert and the kube-score static analysis can flag deprecated API versions. For the externalIPs deprecation, review all Service manifests and replace them with stable alternatives. Additionally, if you rely on Ingress NGINX, begin evaluating replacements such as Contour, Traefik, or the NGINX Ingress Controller maintained by NGINX, Inc.

Remember: Kubernetes deprecations are designed to give you time—but waiting until the last minute can lead to unnecessary downtime. Start planning your migration today. The v1.36 release marks another step forward in the platform’s evolution, reinforcing security and maintainability for the entire ecosystem.