Skip to content

Reference

Scope

Look-up facts for upstream Kubernetes: supported release branches and EOL dates, the version skew policy, GA graduations and removals per minor release (v1.33 to v1.37), container runtime compatibility, ports, scalability thresholds and SLOs, and a hardening checklist. Tasks live in How-to Guides. The reasons behind the design live in Explanation.

Release and Support Matrix

Upstream patches the three most recent minor releases. Each minor branch gets about 12 months of full patch support, then 2 months of maintenance mode (critical fixes only), for roughly 14 months in total. Dates come from the Kubernetes website release data (data/releases/schedule.yaml and eol.yaml). Patch versions come from the CHANGELOG-1.xx.md files.

Branch Codename Released Latest patch (2026-09) Maintenance mode from End of life Status (2026-09-25)
1.37 Garhwal 2026-08-26 1.37.1 (target 2026-09-15) 2027-08-28 2027-10-28 Supported (latest)
1.36 Haru 2026-04-22 1.36.5 (target 2026-09-15) 2027-04-28 2027-06-28 Supported
1.35 Timbernetes 2025-12-17 1.35.9 (target 2026-09-15) 2026-12-28 2027-02-28 Supported
1.34 Of Wind & Will 2025-08-27 1.34.12 (target 2026-09-15) 2026-08-27 2026-10-27 Maintenance mode, EOL next month
1.33 Octarine 2025-04-23 1.33.13 (final) — 2026-06-28 End of life
1.32 Penelope 2024-12-11 1.32.13 (final) — 2026-02-28 End of life
1.31 Elli 2024-08-13 1.31.14 (final) — 2025-11-11 End of life

Release dates and codenames

The 1.34 to 1.37 release dates, maintenance-mode dates, and EOL dates come from schedule.yaml, and the final patches for 1.31 to 1.33 come from eol.yaml. The 1.31 to 1.33 release dates and the codenames come from the release blog posts. The .1, .5, .9, and .12 patches above appear in the CHANGELOG files. The schedule lists 2026-09-15 as their target date.

Upcoming patch release targets (all supported branches): 2026-10-13 and 2026-11-10. Kubernetes v1.38: TBD. At the usual cadence of about three minor releases a year, it would land around December 2026, but no date was checked.

The next diagram shows the support windows of the branches that are currently supported or recently EOL.

gantt
    title Kubernetes minor release support windows
    dateFormat YYYY-MM-DD
    axisFormat %Y-%m
    section 1.34
    Patch support     :a1, 2025-08-27, 2026-08-27
    Maintenance mode  :a2, 2026-08-27, 2026-10-27
    section 1.35
    Patch support     :b1, 2025-12-17, 2026-12-28
    Maintenance mode  :b2, 2026-12-28, 2027-02-28
    section 1.36
    Patch support     :c1, 2026-04-22, 2027-04-28
    Maintenance mode  :c2, 2027-04-28, 2027-06-28
    section 1.37
    Patch support     :d1, 2026-08-26, 2027-08-28
    Maintenance mode  :d2, 2027-08-28, 2027-10-28

Managed-Service Version Windows

Managed providers publish their own calendars, and these usually run longer than upstream's. Examples: EKS standard plus extended support, GKE Extended channel, and AKS LTS on the Premium tier. Extended or LTS support costs about $0.60 per cluster-hour on all three providers (as of 2026-09). Check each provider's calendar before you plan an upgrade.

Version Skew Policy

Source: Version Skew Policy.

Component Allowed skew relative to kube-apiserver
kube-apiserver (HA) Newest and oldest instances within 1 minor version
kubelet Must not be newer. May be up to 3 minor versions older (2 for kubelet < 1.25)
kube-proxy Must not be newer. May be up to 3 minor versions older. May be up to 3 older or newer than the kubelet on its node
kube-controller-manager, kube-scheduler, cloud-controller-manager Must not be newer. May be up to 1 minor version older
kubectl Within 1 minor version (older or newer)

Upgrade order

Upgrade kube-apiserver first, then controller-manager, scheduler and cloud-controller-manager, then kubelets and kube-proxy. You cannot skip minor versions on a kubeadm control plane: 1.35 to 1.37 means two upgrades.

Feature Graduations by Release

These are the GA (stable) graduations that matter most to operators. The source is the CHANGELOG-1.xx.md "API Change" and "Feature" sections for each .0 release.

Release Notable GA / default-on changes
1.33 (2025-04) Sidecar containers (SidecarContainers) GA. kube-proxy nftables mode GA (iptables stays the default). In-place Pod resize moves to beta, on by default. User namespaces on by default (beta). v1 Endpoints API deprecated in favour of EndpointSlice
1.34 (2025-08) Dynamic Resource Allocation (DRA) core GA (resource.k8s.io/v1, structured parameters). VolumeAttributesClass GA. Structured authentication config GA (apiserver.config.k8s.io/v1). KubeletCgroupDriverFromCRI GA. PodLevelResources beta. KYAML output for kubectl added (alpha)
1.35 (2025-12) In-place Pod vertical scaling (InPlacePodVerticalScaling) GA. PodObservedGenerationTracking GA. failCgroupV1 defaults to true, so kubelet refuses to start on cgroup v1. kube-proxy ipvs mode deprecated. Image volume source beta, on by default
1.36 (2026-04) User namespaces (UserNamespacesSupport) GA. MutatingAdmissionPolicy GA (v1). ImageVolume GA. DRA admin access and prioritized list GA. Kubelet PSI metrics GA. Fine-grained kubelet API authorization GA. ProcMountType GA. gitRepo volume plugin disabled permanently
1.37 (2026-08) SELinuxMount GA and on by default (action required on SELinux hosts). Pod certificates (PodCertificateRequest) GA. ClusterTrustBundle GA. StorageVersionMigration GA (storagemigration.k8s.io/v1). metrics.k8s.io promoted to v1. DRA device taints/tolerations and DRA extended resources GA. kubectl get -o kyaml stable. HPA scale-to-zero enabled by default. KubeletInUserNamespace (rootless kubelet) beta. Workload-aware scheduling APIs (Workload, PodGroup) at scheduling.k8s.io/v1beta1. StatefulSet Recreate update strategy (alpha)

Release sizes from the release announcements: v1.36 has 70 enhancements (18 stable, 25 beta, 25 alpha). v1.37 has 67 enhancements (16 stable, 23 beta, 27 alpha, 1 deprecation or removal).

Deprecations and Removals

Item Status Timeline / action
dockershim Removed Removed in 1.24. Use containerd or CRI-O
kube-proxy userspace mode Removed Removed in 1.26
KMS v1 encryption provider Deprecated Deprecated since 1.28. Use KMS v2
v1 Endpoints API Deprecated (not removed) Deprecated in 1.33. Use EndpointSlice
SidecarContainers feature gate Removed GA and locked in 1.33. Gate removed in 1.37
cgroup v1 Deprecated Since 1.35 kubelet fails to start on cgroup v1 by default (failCgroupV1: true). The opt-out still works in 1.37. Removal is planned for a future release
kube-proxy ipvs mode Deprecated Deprecated in 1.35. Warns on startup in 1.37. Reported plan: disabled by default in 1.40, removed in 1.43. Migrate to nftables
kube-proxy default mode Changing iptables is still the default. 1.37 warns when no mode is set, because the Linux default will move to nftables in a future release. kubeadm now sets mode: iptables explicitly
kube-dns add-on Deprecated (1.37) CoreDNS has been the default since 1.13. Reported plan: no kube-dns builds after 1.40
gitRepo volume Disabled Disabled with no opt-in from 1.36
Service .spec.externalIPs Deprecated Warnings since 1.36
scheduling.k8s.io/v1alpha2 Removed Dropped in 1.37. Delete v1alpha2 Workload/PodGroup objects before you upgrade from 1.36
cAdvisor legacy kubelet flags Removed 1.37 kubelet fails to start if deprecated cAdvisor flags are set (only --housekeeping-interval is kept)
kubelet --pod-infra-container-image Removed Removed in 1.35. Remove the flag before you upgrade kubelet
Deprecated kubelet config flags (containerd 1.7 fallback) Deferred Removal moved 1.36 -> 1.37 -> 1.38 to match the end of containerd 1.7 support
Ingress NGINX controller (kubernetes/ingress-nginx) Retired Retirement announced 2025-11-11. Best-effort maintenance ended March 2026. No further releases or security fixes. Existing images and charts remain available. Migrate to a Gateway API implementation

Timelines marked reported

The ipvs (1.40/1.43) and kube-dns (1.40) targets come from the v1.37 release coverage (Kubernetes blog, The Register), not from a KEP I could read. Check the KEP before you plan around them.

Container Runtime Compatibility

From the containerd RELEASES.md Kubernetes support matrix. A runtime must implement CRI v1.

Kubernetes Recommended containerd versions
1.34 2.1.3+, 2.0.6+, 1.7.28+, 1.6.39+
1.35 2.2.0+, 2.1.5+, 1.7.28+
1.36 2.3.0+, 2.2.0+
1.37 2.4.0+, 2.3.0+
containerd branch Status (2026-09) Released End of life
1.7 LTS, extended support (GKE-focused) 2023-03-10 September 2026
2.0 LTS, extended support (GKE-focused) 2024-11-05 March 2027
2.1 End of life 2025-05-07 2026-07-03
2.2 Active 2025-11-05 2026-11-06
2.3 LTS 2026-04-30 2028-04-30
2.4 Active 2026-09-16 2027-05-16

kubeadm preflight

kubeadm 1.37 checks that the runtime supports the CRI RuntimeConfig RPC, which is how kubelet learns the cgroup driver. On kubelet older than 1.38 a failed check is only a warning. CRI-O versions track Kubernetes minors one to one (CRI-O 1.37 for Kubernetes 1.37).

Bundled Component Versions (v1.37)

Component Default version in v1.37.0 Source
etcd 3.7.0 (etcd client library 3.6.10) CHANGELOG-1.37 Dependencies
CoreDNS 1.14.6 CHANGELOG-1.37 Feature
Go gRPC 1.82.1 CHANGELOG-1.37 Dependencies

Gateway API

Gateway API ships as CRDs from kubernetes-sigs/gateway-api, separately from Kubernetes releases.

Fact Value
Latest release (2026-09) v1.6.2 (per CHANGELOG/1.6-CHANGELOG.md)
GA in v1.6 TCPRoute, UDPRoute (v1). Their v1alpha2 versions are deprecated
Standard channel since v1.5 TLSRoute, ListenerSet, Gateway client-certificate validation
Upgrade guard (v1.5+) safe-upgrades.gateway.networking.k8s.io ValidatingAdmissionPolicy stops Experimental CRDs being installed over Standard ones
Core resources GatewayClass, Gateway, HTTPRoute, GRPCRoute, ReferenceGrant, BackendTLSPolicy

Key Ports

From Ports and Protocols. Defaults may be changed by your distribution.

Component Port Protocol Direction Purpose / used by
kube-apiserver 6443 TCP Inbound (control plane) Kubernetes API, used by everything
etcd 2379-2380 TCP Inbound (control plane) Client API (2379) and peer traffic (2380). Used by kube-apiserver and etcd
kubelet 10250 TCP Inbound (all nodes) Kubelet API: exec, logs, metrics. Used by the control plane
kube-scheduler 10259 TCP Inbound (control plane) HTTPS health and metrics, local only
kube-controller-manager 10257 TCP Inbound (control plane) HTTPS health and metrics, local only
kube-proxy 10256 TCP Inbound (workers) Health check, used by load balancers
NodePort Services 30000-32767 TCP/UDP Inbound (workers) Default NodePort range

Scalability Thresholds

The SIG Scalability thresholds and the large-cluster guide define the envelope inside which upstream SLOs are tested. These are not hard limits.

Quantity Per namespace Per cluster
Nodes n/a 5,000
Pods 3,000 150,000
Pods per node min(110, 10 x cores) min(110, 10 x cores)
Total containers — 300,000
Namespaces n/a 10,000
Services 5,000 10,000
Endpoints per Service 250 n/a
Deployments 2,000 TBD
Non-Event objects per resource type — 150,000
Event objects — 1,000,000
Size per object 1.5 MB 1.5 MB
Total size per resource type — 1.5 GB
Secrets, ConfigMaps TBD upstream TBD upstream

Official Scalability SLOs

From SIG Scalability SLOs. All SLOs are measured as the 99th percentile per cluster-day, within the thresholds above.

SLI SLO
Mutating API call latency (single object) <= 1 s
Read-only API call latency, scope=resource <= 1 s
Read-only API call latency, scope=namespace or cluster <= 30 s
Stateless pod startup latency (excluding image pull and init containers) <= 5 s

Beyond Upstream Thresholds

Provider / user Reported scale Source
GKE 65,000-node clusters supported. An experimental 130,000-node cluster was run in 2025 on a Spanner-based storage backend instead of etcd Google Cloud blog
EKS Ultra-scale clusters of up to 100,000 nodes AWS announcement (2025)
OpenAI 7,500-node clusters for ML training (2021) OpenAI engineering blog

Indicative Performance Figures

Unsourced guidance

Earlier revisions of this note had the figures below without test conditions, hardware, or versions. They are rules of thumb, not benchmarks. Only the etcd fsync target (p99 WAL fsync under 10 ms) comes from etcd's hardware guidance. Run your own tests (for example with kube-burner or ClusterLoader2) before you plan capacity.

etcd cluster size WAL fsync p99 Read latency p99 Write QPS DB size
< 100 nodes < 5 ms < 10 ms 1,000 2 GiB
100-500 nodes < 10 ms < 25 ms 5,000 4 GiB
500-5,000 nodes < 10 ms < 50 ms 10,000 8 GiB
Scheduler metric Indicative value Conditions
Throughput ~100 pods/s Default scheduler, large cluster
Scheduling latency p99 < 100 ms No complex affinity
With pod anti-affinity 20-50 pods/s Anti-affinity across nodes. 1.37 adds an InterPodAffinityHostnameFastPath gate for hostname topology
Preemption overhead +50-100 ms When preemption runs
CNI Pod-to-pod latency TCP throughput Encryption overhead
Cilium (eBPF) ~50 us ~9.5-9.8 Gbps 15-20% (WireGuard)
Calico (eBPF mode) ~60 us ~9.2-9.5 Gbps 20-25% (WireGuard)
Flannel (VXLAN) ~80 us ~8.5 Gbps No native encryption
Host networking ~30 us ~10 Gbps n/a

For measured CNI data, see CNI Comparison.

Security Checklist

Area Recommendation
Authentication Use OIDC (structured authentication config, GA 1.34) for humans. Avoid long-lived client certificates
RBAC Apply least privilege. Audit bindings regularly. Restrict nodes/logs and nodes/proxy (1.37 kubelet logs its effective config at startup)
Pod Security Enforce baseline or restricted with Pod Security Admission
User namespaces Set hostUsers: false on workloads that allow it (GA 1.36)
Network Apply a default-deny NetworkPolicy. Restrict egress
Secrets Enable encryption at rest (KMS v2 or secretbox). Use external secret stores in production
Admission Use ValidatingAdmissionPolicy / MutatingAdmissionPolicy (CEL, in-tree), or Kyverno / OPA Gatekeeper
Images Sign and verify images. Restrict registries. Pin digests
Audit Enable audit logging with suitable policy levels
Kubelet Disable anonymous auth. Set readOnlyPort: 0. Use webhook authz
etcd TLS with client auth. Keep etcd off the node network
Ingress Retire Ingress NGINX (no security fixes since March 2026)

Glossary

Term Meaning
CRI Container Runtime Interface: the gRPC API between kubelet and runtimes (containerd, CRI-O)
CNI Container Network Interface: the plugin spec for pod networking
CSI Container Storage Interface: the plugin spec for volumes
DRA Dynamic Resource Allocation: claim-based device allocation (ResourceClaim, ResourceSlice, DeviceClass)
KEP Kubernetes Enhancement Proposal
PSA Pod Security Admission (built-in enforcement of Pod Security Standards)
WAS Workload-aware scheduling (Workload, PodGroup APIs, gang scheduling)
KYAML Strict, less error-prone YAML subset output by kubectl get -o kyaml

Sources