NEW YORK — What happened
The Cloud Native Computing Foundation (CNCF) has rolled out Kubernetes 1.35, focusing heavily on cluster security hardening, runtime class enforcement, and the graduation of ephemeral debugging containers into default operational tooling.
Why it matters
Troubleshooting production issues in secure container environments often forces platform engineers to compromise security by granting excessive privileges. Kubernetes 1.35 solves this dilemma by allowing safe, temporary injection of troubleshooting containers into running pods without altering the primary application definition or opening broad security holes.
Deep dive
The release tightens kernel namespace isolation defaults and integrates more closely with Linux kernel features like Landlock and enhanced seccomp profiles out of the box. Additionally, the control plane introduces refined garbage collection for orphaned volume attachments, reducing disk leak incidents in dynamic cloud environments.
Report check (claims vs what is verified vs still rumor)
Release notes verify the security policy enhancements and ephemeral container graduation. Rumors that Kubernetes 1.35 drops support for older container runtimes like containerd have been debunked; compatibility remains fully intact.
Open questions
Will enterprise security teams adopt the new default seccomp profiles immediately, or will legacy application dependencies require extensive exception management?