Breaking: Kubernetes v1.36 Release Scheduled for Late April 2026 Brings Major API Cleanup and Security-Driven Retirement
Kubernetes v1.36, set for release at the end of April 2026, will enforce the retirement of the Ingress NGINX project and deprecate the .spec.externalIPs field in Services, signaling a heightened focus on security and API stability.
The Kubernetes project announced today that the upcoming v1.36 release will include several key removals and deprecations, most notably the official retirement of Ingress NGINX, effective March 24, 2026. This decision, driven by SIG Network and the Security Response Committee, aims to eliminate a major security vector that has been under scrutiny in recent months.
According to project leads, the v1.36 release cycle is the most aggressive in terms of deprecations, resulting from a multi-year effort to align the API surface with strict security and maintenance baselines.
Background: Kubernetes Deprecation Policy and the Ingress NGINX Decision
The Kubernetes project has a well-documented deprecation policy for features. Stable APIs may only be deprecated when a newer, stable version of the same API is available. Deprecated APIs continue to function for at least one year but generate warnings.
Beta APIs must be supported for three releases after deprecation; alpha APIs can be removed without notice. All removals in v1.36 comply with this policy, with migration options provided in the official deprecation guide.
The retirement of Ingress NGINX on March 24, 2026 is a direct consequence of this lifecycle discipline. "We cannot afford to leave a widely deployed, unmaintained ingress controller in the ecosystem," said a SIG Security representative. "The retirement ensures that users transition to actively maintained alternatives, improving overall cluster security."
Existing deployments of Ingress NGINX will continue to function, but no further releases, bugfixes, or security patches will be issued. Installation artifacts like Helm charts and container images remain available, but the project is effectively frozen.
Key Deprecations in Kubernetes v1.36
The most significant deprecation is .spec.externalIPs in the Service resource. This field allowed direct routing of arbitrary external IPs to Services, but has been flagged as a security headache for years.
"The externalIPs field bypasses important network policies and can be exploited to leak traffic or bypass firewalls," explained a senior Kubernetes maintainer. "Removing it forces users to adopt proper ingress or load balancer configurations, aligning with best practices."
Additionally, several beta APIs that graduated to stable in previous releases will be fully removed in v1.36, as per the three-release support rule. Users must migrate to the stable versions before upgrading.
What This Means for Kubernetes Users
For organizations running Ingress NGINX, immediate action is required. The retirement means no security patches will be available for any future CVEs, making continued use a significant risk.
Users should evaluate alternative ingress controllers such as Contour, Traefik, or Nginx Ingress Controller (community fork). The Kubernetes SIG Network has published a migration guide.
The deprecation of .spec.externalIPs will affect clusters that rely on that feature for direct external traffic routing. Migration to NodePort, LoadBalancer, or proper Ingress definitions is recommended before v1.36 becomes widely adopted.
Overall, v1.36 reinforces Kubernetes' commitment to security and simplicity. "This release is a turning point," said a Technical Lead from SIG Architecture. "We are cleaning up legacy patterns that have accumulated over a decade of development, ensuring a more secure and maintainable platform for the future."
Migration Resources
- Read the deprecation policy in full
- See all v1.36 deprecations
- Ingress migration guide
- Official Ingress NGINX retirement announcement
Note: The information in this article reflects the current state of v1.36 development as of late March 2026 and may change before the final release.