Kubernetes v1.36: Deprecation and removal of Service ExternalIPs
Kubernetes 1.36 formally deprecates the .spec.externalIPs field on Service, which the project says enables security exploits when users are not fully trusted (CVE-2020-8554). Kubernetes now emits warnings when the field is used. The project plans to disable support in kube-proxy at v1.40 at the earliest, with an opt-back-in, and fully at v1.43 at the earliest.
What changes for platform teams
Platform teams should check whether any Services set externalIPs and migrate to a LoadBalancer controller such as MetalLB, or to Gateway API, where administrators control IP assignment. Enabling the DenyServiceExternalIPs admission controller is recommended as a precaution against new uses.
Read the original at Kubernetes Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules