v1.36.0

Cloud Provider Azure v1.36.0

Full Changelog: v1.35.0..v1.36.0

Changes by Kind

Feature

  • ACR credential provider now supports KSA-based authentication with identity bindings. Configure via: –ib-sni-name, –ib-apiserver-ip, –ib-default-client-id, –ib-default-tenant-id. (#9907, @qweeah)
  • Feat: support AllowCrossTenantReplication in AccountOptions (#10148, @andyzhangx)
  • Support config-gated in-place mutation of FirstPartyUsage IP tags on existing public IPs via enableIPTagMutationForExistingPublicIP config flag, avoiding unnecessary IP address changes and service disruption when the service.beta.kubernetes.io/azure-pip-ip-tags annotation changes. (#10133, @nilo19)
  • The build system now auto-detects and supports podman as the container CLI. When podman is available it is used for image build, push, and manifest operations. Set CONTAINER_CLI=docker to force docker usage. (#10108, @nilo19)

Bug or Regression

  • Chore: bump acr refresh token cache TTL to avoid acr throttling issue (#9974, @mainred)

  • Fix(multi-slb): support IP sharing across multiple services

    When a service specifies an IP address that already exists on a load balancer, the service is now placed on that load balancer instead of picking one with the fewest rules, provided the service is eligible for that load balancer. The load balancer configuration annotation cannot be combined with an IP specification. Migration to a different load balancer is blocked if the frontend IP is still referenced by other resources.

    Switching internal/external issues (10050 and 10117) will be fixed in another change. (#9937, @Liunardy)

  • Fix(multi-slb): support switching internal/external when IP sharing across multiple services

    Correctly clean up stale rules and probes when services sharing a frontend IP switch between external and internal in multi-SLB mode. (#10211, @Liunardy)

  • Fix: PrivateEndpointNetworkPolicies setting issue (#9980, @andyzhangx)

  • Fix: network isolated clusters should always use managed identity credential (#9841, @norshtein)

  • Fix: route standalone VM providerID/ipConfigID to availability set handler instead of unconditionally assuming VMSS when DisableAvailabilitySetNodes is true (#10194, @andyzhangx)

Dependencies

Added

  • buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go: 8976f5b
  • buf.build/go/protovalidate: v0.12.0
  • github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v7: v7.3.0
  • github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v9: v9.0.0
  • k8s.io/streaming: v0.36.0

Changed

Removed

  • github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6: v6.2.0
  • github.com/cenkalti/backoff/v4: v4.3.0
  • github.com/gregjones/httpcache: 901d907
  • github.com/grpc-ecosystem/go-grpc-prometheus: v1.2.0
  • github.com/zeebo/errs: v1.4.0
  • k8s.io/cri-api: v0.35.0
Last modified May 15, 2026: Update release notes for v1.36.0 (#10356) (8bc0fc271)