What Is New in Kubernetes 1.26
Kubernetes 1.26, named "Electrifying", delivers a substantial set of enhancements focused on storage, scheduling, security, and beta/stable promotions of existing features.
| Category | Key Highlights |
|---|---|
| New Features | Dynamic Resource Allocation (Alpha), KMS v2 improvements (Beta), Pod Scheduling Readiness |
| Graduations to Stable | CPUManager, Evented PLEG (for better node performance), Kubelet Credential Providers |
| Improvements & Changes | Legacy registry redirect, CRI v1 API default, per-service load balancer class |
| Deprecations & Removals | Several in-tree storage drivers deprecated in favor of CSI |
How does Kubernetes 1.26 improve resource management?
The headline feature for resource management is the introduction of Dynamic Resource Allocation (DRA) as an alpha feature. This moves beyond the traditional model of only handling compute resources like CPU and memory.
DRA provides a framework for pods to request specialized hardware resources-like GPUs, NICs, or FPGAs-dynamically. Instead of relying on extended resources in node.status.allocatable, it uses a separate API for claiming, allocating, and releasing these resources. In practice, this allows for more sophisticated and precise resource sharing among pods, which is crucial for AI/ML and high-performance computing workloads.
What storage changes should I be aware of in 1.26?
This release continues the strong push towards the Container Storage Interface (CSI) by deprecating several in-tree storage volume plugins. The GlusterFS and Portworx in-tree plugins are now officially deprecated and must be replaced with their CSI driver equivalents.
For cloud users, a significant quality-of-life improvement is the introduction of a loadBalancerClass field at the service level. This allows you to specify a specific load balancer implementation per service, giving you finer control over networking in environments with multiple load balancer providers.
Are there any key security upgrades in this version?
Yes, the KMS v2 improvements have graduated to beta, offering a stronger foundation for etcd encryption at rest. The v2 protocol provides performance enhancements, key rotation without downtime, and improved health checks, making it a more robust option for securing your cluster's data.
Additionally, the Kubelet Credential Provider feature has been promoted to stable. This allows kubelets to dynamically fetch image registry credentials, eliminating the need to store static credentials on node filesystems and thereby reducing the attack surface.
What core features have graduated to stable?
Several important features have reached stability in 1.26, signaling they are production-ready. The CPUManager, which handles CPU affinity and pinning for performance-sensitive workloads, is now stable.
Evented PLEG (Pod Lifecycle Event Generator) has also graduated to stable. This reduces node-level latency and improves reliability by using a watch-based mechanism instead of periodic polling to detect container changes, which matters for large-scale clusters.
Have there been any significant API or CLI changes?
The Kubernetes container registry is finally moving to registry.k8s.io. While the old k8s.gcr.io will continue to work via redirects, you should start updating your manifests and tooling to the new domain for long-term compatibility.
Under the hood, the Container Runtime Interface (CRI) now defaults to the v1 API. Runtimes must support this API version, so ensure your container runtime is up to date to avoid any issues during cluster upgrades.
FAQ
What is the most impactful feature for stateful workloads in 1.26?
For stateful workloads, the deprecation of in-tree storage drivers is the most impactful change. You need to ensure you are using the CSI drivers for GlusterFS and Portworx, as the in-tree versions will be removed in a future release.
Does the new Dynamic Resource Allocation (DRA) replace Resource Claims?
DRA is the evolution of the resource claim concept. It provides a more flexible and extensible API framework for managing resources beyond just CPU and memory, like specialized hardware devices.
I use KMS for etcd encryption; should I upgrade to v2?
Yes, if you are implementing etcd encryption at rest, planning a move to the KMS v2 API (now beta) is recommended. It offers key rotation without downtime and better performance, making your encryption setup more robust.
What happens if I don't switch from k8s.gcr.io to registry.k8s.io?
Your pulls will be transparently redirected for now, but the old domain will eventually be phased out. Updating your manifests and cluster configurations now prevents potential pull failures in the future.
How does Evented PLEG becoming stable affect my cluster?
Evented PLEG reduces the reliance on periodic node polling, which can improve node reliability and reduce latency, especially in larger clusters with many pods. This can lead to more consistent pod startup times.