Kubernetes v1.36.6-0 Release Notes

Overview

Thalassa Cloud Kubernetes v1.36.6-0 ships Kubernetes v1.36.6 with containerd 2.3.7 and Cilium v1.20.4. This release updates the Thalassa Cloud Controller Manager to v0.15.1.

Security Fixes

• Kubernetes 1.36.6 is built with Go 1.26.10. That Go release stops trust of the compromised eMudhra intermediate CA certificates (CVE-2026-111943).
• Kubernetes 1.36.5 and later include the fix for CVE-2026-2270. A user with write access to StatefulSet and ControllerRevision objects could make the controller create a Pod in another namespace.
• containerd 2.3.7 includes CVE-2026-95839 and related fixes. The release also stops the CRI from following symlinks for container log files, rejects image references that contain .., and limits socket domains in the default seccomp profile.
• Cilium v1.20.4 is an out-of-band security release. It uses Go 1.26.10 for the same CA certificate issue (CVE-2026-111943). It also fixes a Cilium 1.20.3 regression where Gateway API BackendTLSPolicy handling could raise CPU use and stop traffic forwarding.
• runc 1.5.2 includes a workaround for a Linux kernel bug, present since kernel 6.17, that can crash runc when it configures cgroup v2 device rules. Read the runc v1.5.2 release notes.

What’s New

Component updates

• Kubernetes 1.36.6
• containerd 2.3.7
• CNI Plugins 1.9.1
• crictl 1.36.0
• runc 1.5.2
• Cilium 1.20.4
• Thalassa Cloud Controller Manager 0.15.1
• Thalassa CSI Plugin 0.9.0
• Base OS Ubuntu 24.04

Kubernetes 1.36.6

• kube-proxy leaves nf_conntrack_max unchanged when the current value is already higher than the value kube-proxy would set. This fixes a regression in Kubernetes 1.36.
• A Job that reuses the name of a recently deleted Job is reconciled again.
• The scheduler evaluates Pod affinity and anti-affinity namespace selectors that use negative operators correctly.

Read the Kubernetes 1.36 changelog.

Thalassa Cloud Controller Manager 0.15.1

• Hardens egress rules on managed load balancer security groups
• Corrects a listener log message
• Allows ICMP on managed load balancer security groups (v0.15.0)
• Supports loadBalancerSourceRanges (v0.14.1)

See the v0.15.1 release notes.

Component Versions