Kubernetes v1.35 ships in-place pod resizing, gang scheduling and cgroup v1 removal

Kubernetes v1.35 arrives with roughly 60 enhancements

Kubernetes v1.35 has shipped under the release nickname "Timbernetes", and according to a dev.to overview by Cloudraft it carries about 60 enhancements covering security, scalability and the deliberate removal of legacy code. The post positions this as one of the more practical releases in recent years for anyone running stateful systems, distributed AI jobs or long-running services on the platform.

Live resource resizing reaches general availability

The change with the widest day-to-day effect is general availability of in-place pod resource updates: CPU and memory allocations can now be changed on a running pod, so a database or training job can be tuned during a traffic spike without being redeployed. Two companion fields, .metadata.generation and .status.observedGeneration on pods, are now stable, giving monitoring tools a dependable signal for when the kubelet has actually applied a spec change.

Other reliability work in v1.35 includes:

• Native pod certificates, offering built-in mutual TLS with automatic rotation so teams can drop external certificate managers and sidecars from zero-trust setups.
• A maxUnavailable setting for StatefulSets, allowing updates to roll out in parallel — as a count or a percentage — while availability targets are preserved.
• A max-allowable-numa-nodes option in the Topology Manager that stabilises servers with more than eight NUMA nodes, hardware typical of large multi-GPU AI and HPC systems.
• In-tree storage version migration, now beta and enabled by default, which removes an external tooling dependency and lowers upgrade risk for long-lived clusters.

Scheduling built for distributed AI

The largest cluster of new features targets training and inference at scale:

• Gang scheduling, delivered through a new Workload API and a PodGroup concept, places a set of pods together or not at all. The dev.to post presents this as a fix for partial placements that leave GPUs allocated but idle.
• Container-level restart policies give each container its own restart rule, so a failing sidecar no longer forces a full pod restart — useful in ML pipelines.
• Opportunistic batching lets the scheduler group identical pods via scheduling signatures, reducing latency when a large AI job bursts onto the cluster.
• Nodes can advertise capabilities through .status.declaredFeatures, and the scheduler can then avoid placements the hardware cannot satisfy.
• Extended toleration operators support numeric comparisons against taints, enabling routing decisions based on node reliability scores.
• OCI artifact volumes, now in beta, pull ML models and configuration directly into volumes without init containers.
• Service traffic distribution replaces the ambiguous PreferClose setting with PreferSameNode and PreferSameZone options for low-latency inference.
• Suspended jobs can have their resources adjusted after an out-of-memory event without being recreated (alpha).

Removals that will complicate upgrades

The post's summary of deprecations lists four items requiring action:

• cgroup v1 support is gone; older Linux nodes will fail kubelet startup until they move to cgroup v2.
• v1.35 is the final release supporting the legacy CRI path in containerd 1.x, so clusters need to move to containerd 2.0 or newer.
• IPVS mode in kube-proxy is deprecated and will emit warning logs; nftables is the recommended replacement.
• Ingress NGINX is retired, with best-effort support ending in March 2026 and the Gateway API positioned as the migration target.

Security and tooling refinements

User namespaces reach beta, letting containers run as root inside a pod while mapping to unprivileged host users — a substantial cut in privilege-escalation risk for multi-tenant clusters. Kubelet cached image verification, also in beta, enforces image pull permissions on cached images as well, which the post flags as important for shared GPU fleets. CSI tokens move to the secrets field to prevent accidental credential exposure, and constrained impersonation (alpha) adds finer-grained authorization controls.

On the tooling side, KYAML — a restricted YAML subset, in beta and on by default — aims to catch common manifest errors in GitOps pipelines. Kuberc gains credential plugin policies for tighter control over authentication in CI, comparable resource versions are stable and enable more reliable controller watch patterns, and the /flagz and /statusz endpoints gain structured, versioned JSON output in alpha. Deployments also gain a terminatingReplicas field that shows pods being cleaned up mid-rollout.

Why it matters

According to the dev.to write-up, v1.35 is less about novelty than about closing operational gaps: resizes without restarts, gang scheduling that stops wasted GPU capacity, and parallel StatefulSet rollouts all map onto real production incidents. The trade-off is enforced modernisation. Clusters with cgroup v1 nodes or containerd 1.x will not upgrade cleanly, and Ingress NGINX users face a support cutoff in March 2026. Teams running GPU-heavy or stateful workloads should treat the upgrade as a planning exercise, and the full changelog referenced in the post is the place to confirm details before acting.