Kubernetes v1.35.8 - Preemption Queue Race And Go 1.26

Kubernetes v1.35.8 shipped on 20 August 2026 as a patch on the 1.35 line. The change operators will feel is a kube-scheduler preemption race: a preemptor Pod could sit in the unschedulable queue after its victims were already gone. The same tag rebuilds 1.35 with Go 1.26 and bumps golang.org/x/text and golang.org/x/net for security fixes.

The full release notes and downloads are on the GitHub release page.

The GitHub tag body is a pointer, not the itemized list. Binaries, image names, and the changelog since v1.35.7 live in CHANGELOG-1.35.md. Announce traffic is on kubernetes-announce. This tag is not a prerelease.

#140637 is the release-1.35 cherry pick of #139162. The changelog line is one sentence. The stuck state is the part that pages people.

The failure mode is a gated Pod that never wakes up:

  1. A preemptor is waiting for victim Pods to leave a node.
  2. A cluster change requeues that preemptor. DefaultPreemption PreEnqueue returns Unschedulable and gates the Pod.
  3. Victim deletes do not produce the queue hint the plugins were supposed to emit. A queue hint bug in a plugin is enough.
  4. Gated Pods previously ignored periodic flushes, so the unschedulable queue was a dead end. The Pod sat there until someone noticed.

The patch makes gated Pods react to flushes. That is a failsafe, not a rewrite of preemption scoring. If a queue hint is missing, the flush still gives the preemptor another scheduling cycle instead of waiting forever.

This shows up on clusters that use PriorityClass to run interactive or SLA work over batch jobs. The symptom is a high priority Job or Pod that stays Pending with PodScheduled=False after the lower priority victims have already terminated. Restarting kube-scheduler was the blunt workaround. The flush path is the proper one.

Batch ETL workers that sit at lower priority are the usual victims. They still get preempted. The fix is that the winner is allowed to schedule once the victims are gone.

#140920 updates the 1.35 branch to Go 1.26. The PR title pins 1.26.5. The published changelog says Kubernetes 1.35 is now built with Go 1.26.

The previous patch, v1.35.7, was built with Go 1.25.12. That is a toolchain minor bump on a patch tag. There is no extra feature list attached. Treat it as a rebuild of kube-apiserver, kube-scheduler, kube-controller-manager, kube-proxy, and kubectl.

Images are published as manifest lists under registry.k8s.io, including registry.k8s.io/kube-apiserver:v1.35.8 and registry.k8s.io/kube-scheduler:v1.35.8. Architectures listed in the changelog are amd64, arm64, ppc64le, and s390x.

If you vendor Kubernetes libraries in an operator or a custom controller, match the Go 1.26 line before you assume the patch is a drop in binary swap. The changelog does not document a Go API break. It also does not promise one.

#141225 is the other dependency change. The changelog groups it under Bug or Regression, not Feature. The PR names two Go vuln IDs: GO-2026-5970 on golang.org/x/text (infinite loop on invalid input) and GO-2026-5026 on golang.org/x/net.

Recorded module versions in the changelog:

  • golang.org/x/text: v0.31.0 to v0.39.0
  • golang.org/x/net: v0.47.0 to v0.56.0
  • golang.org/x/crypto: v0.45.0 to v0.53.0

golang.org/x/mod, golang.org/x/sync, golang.org/x/sys, golang.org/x/telemetry, golang.org/x/term, and golang.org/x/tools move in the same bump. Nothing is added. Nothing is removed.

The SIG list on that PR is long: API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling, Security, Storage. That is the blast radius of a stdlib adjacent module bump, not a claim that every SIG shipped a functional fix. Scanner findings on kubectl and apiserver images are the practical reason to take it.

v1.35.8 has no urgent upgrade notes of its own. There are no API removals and no documented breaking changes versus v1.35.7.

Pull new control plane images. Confirm kube-scheduler is on v1.35.8 if you are chasing the stuck preemptor. Confirm kubectl client binaries if your scanner is still reporting the old golang.org/x/net and golang.org/x/text versions.

Server tarballs and node tarballs are on https://dl.k8s.io/v1.35.8/. SHA512 sums are in the changelog. Source archives are kubernetes.tar.gz and kubernetes-src.tar.gz.

If you skip this patch, the preemption race remains. Periodic scheduler flushes will not unstick a gated preemptor. That is the only functional regression this tag closes.