Kubernetes 1.36 Release Cycle Begins with IPVS Mode Officially Deprecated
The Kubernetes 1.36 release cycle kicks off with a significant change: IPVS mode in kube-proxy is officially deprecated and slated for removal, while patch releases for all supported versions address stability and security fixes.
The Kubernetes 1.36 release cycle officially began on January 12, 2026, with Ryota Sawada serving as Release Lead. The most operationally significant change announced for this release is the official deprecation of IPVS mode in kube-proxy, with removal planned for a subsequent version. Alongside the new release cycle, patch releases for all currently supported versions — v1.35.1, v1.34.4, v1.33.8, and v1.32.12 — shipped on February 10.
IPVS Deprecation
IPVS (IP Virtual Server) mode has been an alternative to the default iptables mode in kube-proxy since Kubernetes 1.11. IPVS uses the Linux kernel's Layer 4 load balancing capabilities, which provide better performance characteristics for clusters with very large numbers of services. In clusters with thousands of services, iptables rules grow linearly and can cause measurable latency in packet processing, while IPVS uses hash tables that maintain constant-time lookups regardless of service count.
Despite the theoretical performance advantages, IPVS mode has carried a higher maintenance burden for the Kubernetes project. It relies on kernel modules that are not universally available across all Linux distributions and container runtimes, and the interaction between IPVS rules and container networking policies has been a recurring source of bugs and compatibility issues. The Kubernetes networking special interest group (SIG Network) determined that the maintenance cost of IPVS mode no longer justifies its continued support, particularly as iptables mode has been optimized in recent releases and nftables support is under active development.
What Affected Teams Should Do
Clusters running kube-proxy in IPVS mode will continue to function in Kubernetes 1.36 — deprecation means the feature will emit warnings but still work. Removal is expected in a later version. Teams should audit their kube-proxy configurations now by checking the --proxy-mode flag or the kube-proxy ConfigMap. If the mode is set to ipvs, teams should begin planning migration to the default iptables mode or the emerging nftables mode.
For most clusters, switching from IPVS to iptables mode is transparent to application workloads. The primary consideration is clusters with exceptionally large service counts (thousands or more) where iptables performance overhead may be noticeable. These environments should test the transition in staging before applying it to production.
Release Timeline
The Kubernetes 1.36 release follows the standard timeline: Enhancements Freeze was February 11, Code Freeze is March 18, and the stable release is targeted for April 22, 2026. The enhancements freeze date marks the point after which no new features can be added to the release — only bug fixes and documentation updates. Teams evaluating new Kubernetes features should review the 1.36 enhancements tracking board to understand what capabilities will be available in the April release.
The February 10 patch releases for supported versions (v1.35.1, v1.34.4, v1.33.8, v1.32.12) address stability and security issues and should be applied to production clusters on their standard maintenance schedules.
Related Articles
GitHub Expands Developer Platform with Actions Artifacts v5 and Copilot Extensions GA
GitHub has shipped Actions Artifacts v5 with immutable storage and artifact attestation for tamper-proof build outputs, alongside the general availability of Copilot Extensions that let third-party tools integrate directly into the Copilot chat experience. The platform also expanded GitHub Models with seven new providers.
Docker Engine 29.3 Ships with Native gRPC Support and BuildKit v0.28
Docker Engine 29.3.0 introduces native gRPC support on listening sockets, BuildKit v0.28.0, and a new bind-create-src option for flexible volume mounting. The release lowers the minimum API version to v1.40 for broader backward compatibility and fixes DNS configuration corruption during daemon reloads.
GitHub Adds Dependabot Pre-Commit Support and 28 New Secret Scanning Detectors
GitHub has shipped two major supply chain security features: Dependabot now parses .pre-commit-config.yaml files and opens PRs to update hook versions, while secret scanning gains 28 new detectors from 15 providers including Snowflake, Supabase, and Vercel. Push protection is now enabled by default for 39 secret types.