Kubernetes 1.35 lands 60 enhancements, 17 of them stable: treat the upgrade as a compatibility audit

The node-declaration framework is written up as a feature, but its problem statement reads like a bug report. SIG Node's own description is that when a control plane enables features the nodes do not yet support, which the version skew policy permits, kube-scheduler can place a Pod requiring those features onto an incompatible older node ^[8]. The remedy is for each node to publish what it supports so the scheduler, admission controllers and third-party components can act on the declaration ^[9]. In v1.35 that remedy is alpha, filed as KEP 5328 by SIG Node ^[10][11]. The description of the hazard ships now; the guard rail ships in a state most people will not enable on a production fleet.

The graduation with the widest blast radius is the resize one, and the release note says plainly what it replaces: changing a Pod's CPU or memory used to require recreating the Pod, which disrupted stateful and batch workloads ^[6]. Any controller that treated a fresh Pod as the signal that resources had changed is now watching for an event that need not fire. So is any chargeback pipeline that samples requests once at admission. Nothing breaks on upgrade. The assumption underneath does.

Certificates are the other place where an existing investment has to be re-decided rather than merely patched. Getting credentials into a Pod previously meant an external controller such as cert-manager or SPIFFE/SPIRE, CRD orchestration and Secret management, with rotation bolted on through sidecars or init containers ^[12]. The kubelet now generates the key, asks via PodCertificateRequest and writes the bundle into the Pod filesystem ^[13], while kube-apiserver enforces node restriction at admission time, which the release calls the most common pitfall for third-party signers ^[14]. The issuance path carries no bearer token ^[15], and the work is KEP 4317 from SIG Auth ^[16].

Twenty-eight percent of this release arrives as settled behaviour ^[1]. The other 41 enhancements sit behind gates until someone turns them on ^[2], which is why the audit budget belongs to the stable set, to the deprecations and removals the announcement flags without enumerating in its highlights ^[4], and to behaviour changes that look cosmetic until they are in the data path. The trafficDistribution field for Services is stable with a new PreferSameNode option that strictly prioritises endpoints on the local node and falls back to remote ones ^[17]. That is a routing change with a name, and it belongs on the same checklist as the API removals.

Three named releases landed in 2025 ^[2], roughly one every four months ^[3]. Anyone tracking upstream is running this compatibility exercise three times a year, and the parts that make it expensive are not the alpha features everyone reads about.