Kubernetes v1.36 'Haru' Ships: User Namespaces GA, DRA Upgraded for AI/GPU Workloads

Kubernetes v1.36, codenamed “Haru” (Japanese for spring), shipped on May 12, 2026 with 70 enhancements — 18 reaching Stable, 25 entering Beta, and 25 landing in Alpha. It is the most security-focused release since 1.30, and the most consequential for AI/GPU infrastructure since Dynamic Resource Allocation was introduced.

User Namespaces hits General Availability

The headline security feature: User Namespaces is now stable. This maps the root user inside a container to an unprivileged user on the host, meaning a container-escape exploit that achieves host root privilege no longer gets you root on the node. The attacker lands as an unprivileged user and faces standard Linux permission boundaries.

This has been the single most requested container security improvement for years. The delay was architectural — it required deep changes to how kubelet manages UID/GID mapping, and it had to work across multiple container runtimes (containerd, CRI-O). 1.36 closes that loop.

For security teams: User Namespaces should be enabled by default in new workloads. Any existing workload that doesn’t require real host root access should be migrated to use it.

Two other features also graduated to Stable: Mutating Admission Policies (a CEL-based replacement for Mutating Admission Webhooks with no network round-trip overhead) and Fine-Grained Kubelet API Authorization (letting operators control which kubelets can perform which API calls, critical for multi-tenant clusters).

DRA matures: CPU, memory, and PodGroup ResourceClaims

Dynamic Resource Allocation (DRA) was introduced to solve a real problem: Kubernetes’ device plugin API was never designed for the scheduling complexity that AI workloads demand. Assigning fractional GPUs, coordinating GPU topology across nodes, and handling specialized accelerators requires a richer contract between the scheduler and the hardware.

In 1.36, DRA extends beyond GPUs to native CPU and memory resources. More significantly, ResourceClaims can now be scoped to PodGroups — a cluster of pods that must be co-scheduled together or not at all. This is the fundamental primitive for gang scheduling AI training jobs. You have 8 pods that each need a specific GPU; either all 8 land on the right topology or none of them run.

This doesn’t solve every AI scheduling problem, but it provides the kernel that AI platform teams can build on. Expect cloud-native ML frameworks to start targeting DRA PodGroup claims in their next major releases.

Alpha features worth watching

The most practically useful Alpha landing: in-place PersistentVolume resize for AWS EBS. Today, growing a PVC on EBS requires detaching the volume and reattaching — causing downtime. The Alpha feature allows online resize without a pod restart. This matters more than it sounds for stateful workloads (databases, ML checkpoints) running on EBS.

Node Lifecycle Controller graduated to Beta, standardizing how nodes report health and drain gracefully.

Upgrade notes

The 1.36 release drops support for several deprecated APIs that were flagged in 1.33. Review the migration guide before upgrading production clusters — particularly if you’re still using older FlowSchema or ClusterCIDR API versions. The kubectl diff changes for admission policies are substantial if you have many webhooks.

1.36 is the release where Kubernetes’ security architecture meaningfully catches up with the threat model of 2026.