--- title: Kubernetes v1.36 (Haru): what's new in security, AI... description: Kubernetes v1.36 (Haru) ships 70 enhancements across security, AI/ML workload support, and scheduling. Security highlights include User Namespaces reaching GA,... canonical: https://daily.dev/posts/kubernetes-v1-36-haru-what-s-new-in-security-ai-workloads-and-scheduling-xfz3hfesv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kubernetes v1.36 (Haru): what's new in security, AI workloads, and scheduling | daily.dev og:description: Kubernetes v1.36 (Haru) ships 70 enhancements across security, AI/ML workload support, and scheduling. Security highlights include User Namespaces reaching GA,... og:url: https://daily.dev/posts/kubernetes-v1-36-haru-what-s-new-in-security-ai-workloads-and-scheduling-xfz3hfesv og:image: https://api.daily.dev/og/posts/XFZ3HFESV.png og:image:alt: Kubernetes v1.36 (Haru): what's new in security, AI workloads, and scheduling og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes v1.36 (Haru): what's new in security, AI workloads, and scheduling **[Collections](https://daily.dev/sources/collections)** · 3 min read · 10 upvotes · 0 comments ## Summary Kubernetes v1.36 (Haru) ships 70 enhancements across security, AI/ML workload support, and scheduling. Security highlights include User Namespaces reaching GA, Mutating Admission Policies via CEL replacing webhook servers, and Fine-Grained Kubelet API Authorization. Dynamic Resource Allocation (DRA) for GPUs moves to beta by default, enabling fractional GPU access, MIG partitioning, and device recovery. The most architecturally significant addition is alpha workload-aware scheduling: a new PodGroup API enables gang scheduling, workload-aware preemption, and topology-aware placement for distributed training jobs. Notable removals include the gitRepo volume plugin, IPVS mode in kube-proxy, FlexVolume, and the retired Ingress NGINX project. ## Content Kubernetes v1.36, codenamed Haru, ships 70 enhancements: 18 graduating to stable, 25 entering beta, and 25 new alpha features. The release focuses on three areas: security hardening, better support for AI/ML workloads, and API scalability. ## Security changes Three security features reach general availability in this release. **User Namespaces** maps container root to unprivileged host users, reducing the blast radius of container escapes. **Mutating Admission Policies via CEL** lets you write admission logic directly in the API server using Common Expression Language, replacing the need to run and maintain separate webhook servers. **Fine-Grained Kubelet API Authorization** tightens what each caller can do against the kubelet API. ## Dynamic Resource Allocation for GPUs and accelerators The old integer-GPU model is being replaced. Multiple Dynamic Resource Allocation (DRA) enhancements reach beta and are enabled by default in v1.36. DRA introduces primitives for partitioning, sharing, and recovering accelerators rather than treating them as simple countable integers. This matters for workloads that need fractional GPU access, MIG partitioning, or graceful recovery when a device fails. ## Workload-aware scheduling (alpha) This is probably the most architecturally interesting part of the release, even though everything here ships as alpha. The release separates two previously conflated concepts: the **Workload API** is now a static template, while the new **PodGroup API** holds runtime state. The kube-scheduler gets a dedicated PodGroup scheduling cycle that treats a group of pods as a single atomic unit rather than scheduling them individually. What this enables: - **Gang scheduling**: all pods in a group are scheduled together or not at all, preventing the partial-failure problem where a distributed training job gets half its workers placed and then stalls waiting for the rest - **Workload-aware preemption**: when the scheduler needs to free resources, it preempts entire PodGroups rather than individual pods, so you don't end up with orphaned workers from a partially-evicted job - **Topology-aware scheduling**: co-locates pods within physical or logical domains (same rack, same NUMA node, etc.) to reduce communication latency for tightly-coupled workloads - **DRA ResourceClaim support**: PodGroups can share GPU, TPU, and NIC devices across many pods, and the previous 256-item limit on resource claims is lifted The Job controller also gains native integration via the `WorkloadWithJob` feature gate, which automatically creates Workload and PodGroup objects for qualifying indexed parallel Jobs. The plan is to graduate these APIs to beta in v1.37, alongside multi-level workload hierarchies and elastic job support. ## Removals worth knowing about A few things are gone in this release: - The **gitRepo volume plugin**, deprecated since v1.11, is removed - **IPVS mode in kube-proxy** is removed - **FlexVolume** support is removed - The **Ingress NGINX project** was retired in March 2026 and will receive no further security patches If you're running any of these, migration planning is overdue. ## Similar posts on daily.dev - [New Features We Find Exciting in the Kubernetes 1.36 Release](https://daily.dev/posts/new-features-we-find-exciting-in-the-kubernetes-1-36-release-1b2qr04hy) · MetalBear · 10 upvotes · 2 comments - [Kubernetes v1.36 Promotes Stability, Compatibility & Reproducibility](https://daily.dev/posts/kubernetes-v1-36-promotes-stability-compatibility-reproducibility-q5x4goaqb) · Cloud Native Now · 14 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/kubernetes-v1-36-haru-what-s-new-in-security-ai-workloads-and-scheduling-xfz3hfesv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kubernetes v1.36 (Haru): what's new in security, AI workloads, and scheduling","url":"https://daily.dev/posts/kubernetes-v1-36-haru-what-s-new-in-security-ai-workloads-and-scheduling-xfz3hfesv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-v1-36-haru-what-s-new-in-security-ai-workloads-and-scheduling-xfz3hfesv"},"datePublished":"2026-05-17T20:28:23.843Z","dateModified":"2026-05-17T20:29:08.291Z","description":"Kubernetes v1.36 (Haru) ships 70 enhancements across security, AI/ML workload support, and scheduling. Security highlights include User Namespaces reaching GA,...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kubernetes-v1-36-haru-what-s-new-in-security-ai-workloads-and-scheduling-xfz3hfesv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":10},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Kubernetes v1.36 (Haru): what's new in security, AI workloads, and scheduling"}]} ```