Kubernetes 1.36 introduces 60 enhancements with a strong focus on security. Key breaking changes include the deprecation of service.spec.externalIPs (a long-standing man-in-the-middle attack vector), updates to PodCertificateRequest combining PKIXPublicKey and ProofOfPossession into StubPKCS10Request, stricter IP/CIDR validation enabled by default, and new DRA permission requirements for resourceclaims/status. New alpha features include manifest-based admission control config to eliminate the circular dependency of storing security rules in etcd. Features graduating to stable include user namespace support in pods, external signing of service account tokens, mutating admission policies via CEL, SELinux label change speedups, OCI artifact volume sources, and DRA AdminAccess. Operators upgrading to 1.36 should audit externalIPs usage, update PodCertificateRequest configs, review IP/CIDR values, and check DRA RBAC permissions.
