Recommended Free Tools
Kubernetes 1.35, code-named Timbernetes or “The World Tree Release,” arrived on December 17, 2025 with 60 enhancements: 17 stable, 19 beta, and 22 alpha. Its most useful operational change is stable in-place Pod resource resizing: CPU and memory requests or limits can be changed without intentionally recreating the Pod. That capability still needs runtime, workload, and capacity testing; it is not a blanket promise of zero disruption.
As of August 18, 2026, 1.35 is not the latest Kubernetes minor release. The versioned documentation is a static snapshot, and current documentation describes upgrades from 1.35 to 1.36. Treat 1.35 as a controlled lab target, an existing-cluster version, or a feature-specific evaluation—not the automatic choice for a new production cluster.
As an Amazon Associate I earn from qualifying purchases.
What this hands-on guide covers
This is a reproducible lab plan rather than a claim of a particular cluster run. It shows how to build a disposable 1.35 cluster, verify every component, exercise the most relevant changes, and decide whether an upgrade is justified. Keep stable, beta, and alpha capabilities separate: a stable API can still have ecosystem compatibility requirements, while beta and alpha features need progressively more caution.
| Capability | 1.35 maturity | What it means in practice |
|---|---|---|
| In-place Pod resource updates | Stable (GA) | Change CPU or memory resources on an existing Pod without deliberately recreating it; verify process and runtime behavior. |
trafficDistribution: PreferSameNode |
Stable | Express a same-node traffic preference with fallback when no local endpoint is available. |
Job managedBy |
Stable | Allow a compatible external controller to synchronize Job status; it does not replace the built-in controller by itself. |
| Native Pod certificates | Beta | Deliver and rotate certificates through the kubelet when signer and feature configuration are present. |
| Node-declared features | Alpha | Publish node capabilities in .status.declaredFeatures; not a production contract. |
The release announcement documents the release date, name, enhancement counts and feature maturity: Kubernetes v1.35 release announcement.
#1 Best Overall
Build a disposable test environment
Use a Linux VM or cloud VMs with kubeadm, or a local distribution that explicitly supports 1.35. A managed service is appropriate only when that provider, region, account and cluster mode still expose 1.35. For a direct upstream test, use at least two nodes so scheduling and locality are observable.
Minimum versus useful sizing
The 1.35 kubeadm documentation requires at least 2 GiB RAM per machine, two CPUs on the control plane, full node-to-node connectivity, unique hostnames, MAC addresses and product_uuid values, and the required Kubernetes ports open: kubeadm installation requirements. Those are prerequisites, not comfortable sizing. Reserve additional memory for the operating system, container runtime, DNS, CNI and test workloads.
Record the environment
- Exact Kubernetes patch version (the versioned downloads page lists v1.35.5 artifacts, but verify the currently available 1.35 patch before installing).
- Linux distribution, kernel and cgroup mode.
- Container runtime and version.
- CNI and version; CSI driver if storage is tested.
- Node count, CPU and memory, and whether the cluster is virtualized or cloud-hosted.
- Feature gates, admission policies and service-proxy implementation.
Do not use the frozen apt.kubernetes.io or yum.kubernetes.io repositories. Kubernetes says those repositories were deprecated and frozen in 2023; use the community-owned pkgs.k8s.io repository for the 1.35 minor series. Select the patch from Kubernetes 1.35 downloads rather than hard-coding a version that may disappear.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install Kubernetes 1.35 with kubeadm
Install matching client and node packages
Configure the official 1.35 pkgs.k8s.io repository for your Linux distribution, then install the selected patch. Package commands differ by distribution; the essential checks are:
sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl
kubeadm version
kubectl version --clientDisable or correctly configure swap, confirm the container runtime is supported, and check that the host uses cgroup v2. Kubernetes 1.35 documentation enables FailCgroupV1 by default for the kubelet on Linux, making cgroup v1 a compatibility concern.
stat -fc %T /sys/fs/cgroup
mount | grep cgroupA cgroup v2 host normally reports a unified cgroup filesystem. If the host is still on cgroup v1, move to a supported operating-system and runtime configuration and validate kubelet settings; do not simply disable safety checks in production.
Initialize the control plane
sudo kubeadm init
--kubernetes-version=v1.35.x
--pod-network-cidr=<CIDR-required-by-your-CNI>The Pod CIDR is CNI-specific. Follow the selected CNI’s official installation instructions and use its required CIDR; there is no universal value.
mkdir -p "$HOME/.kube"
sudo cp -i /etc/kubernetes/admin.conf "$HOME/.kube/config"
sudo chown "$(id -u):$(id -g)" "$HOME/.kube/config"
kubectl get nodes
kubectl get pods -AInstall the CNI, then join a second node with the kubeadm join command printed by initialization. A 1.35 kubeadm can work with kubelet versions 1.35, 1.34, 1.33 or 1.32 under the documented skew rules; joining-node restrictions still apply. See the kubeadm cluster guide.
Validate bootstrap
kubectl get nodes -o wide
kubectl get pods -A
kubectl cluster-info
kubectl version
kubectl get events --sort-by=.lastTimestampHealthy output has a Ready control-plane and worker, healthy CNI Pods, and core Pods in Running (or an expected completed state). The client and server should report the selected 1.35 patch. If a node stays NotReady, investigate CNI logs, swap, cgroup mode, blocked ports and runtime errors before testing features.
Test stable in-place Pod resizing
Use a Pod with an identifiable process. Capture identity and timing before changing resources; a successful API patch alone does not prove that the container survived or that the application is using the new limits.
Rank #3
Deploy the baseline
apiVersion: v1
kind: Pod
metadata:
name: resize-demo
spec:
containers:
- name: app
image: nginx:stable
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 256Mikubectl apply -f resize-demo.yaml
kubectl get pod resize-demo -o wide
kubectl get pod resize-demo -o jsonpath='{.metadata.uid}{"n"}'
kubectl get pod resize-demo -o jsonpath='{.status.containerStatuses[0].containerID}{"n"}'
kubectl get pod resize-demo -o jsonpath='{.status.startTime}{"n"}'
kubectl get pod resize-demo -o jsonpath='{.status.containerStatuses[0].restartCount}{"n"}'
kubectl get pod resize-demo -o jsonpath='{.spec.containers[0].resources}{"n"}'Increase resources and verify identity
kubectl patch pod resize-demo --type='strategic'
-p '{
"spec": {
"containers": [{
"name": "app",
"resources": {
"requests": {"cpu": "250m", "memory": "192Mi"},
"limits": {"cpu": "1", "memory": "512Mi"}
}
}]
}
}'Repeat the UID, container ID, start time and restart-count commands, then inspect the result:
kubectl get pod resize-demo -o yaml
kubectl describe pod resize-demo
kubectl get events --sort-by=.lastTimestamp
kubectl top pod resize-demo
kubectl top nodeCompare the before-and-after records. Report whether the Pod UID, container ID, process and start time remained intact in your patch and runtime combination. Also test a decrease, for example to the original values. The API capability does not create physical capacity: a larger request may be unsatisfiable on the node, a lower memory limit can trigger an OOM kill, and a CPU limit can increase throttling. A higher limit does not make an application allocate more memory automatically.
Test the failure paths
- Request more CPU or memory than any node can provide and record events and final resource values.
- Lower a memory limit while the process is active; inspect for OOM events and restarts.
- Observe whether a controller, operator or admission webhook overwrites the change.
- Check the workload’s QoS class, autoscaler behavior and monitoring freshness.
- For Deployments and StatefulSets, remember that a later reconciliation can replace a manually modified Pod from the template.
Placement is not necessarily recomputed as if the Pod were newly submitted. Stateful workloads, sidecars, admission policies and eviction behavior therefore need explicit testing before production use.
Test Service traffic locality with PreferSameNode
This stable option is a preference, not deterministic routing. The older PreferClose name remains for compatibility while PreferSameZone is clearer terminology for zone-level locality. A meaningful test needs at least two nodes, backend Pods on different nodes, and a client whose node is known.
Create the Service
apiVersion: v1
kind: Service
metadata:
name: locality-demo
spec:
selector:
app: locality-demo
trafficDistribution: PreferSameNode
ports:
- port: 80
targetPort: 8080Label backend responses with their Pod name and node, then place replicas on separate nodes. Run a request loop from a client Pod and record the returned endpoint, source node, and endpoint list. Repeat after removing the same-node endpoint. The expected question is whether local endpoints are preferred when available and whether traffic falls back when they are not—not whether every request must remain local.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Results depend on endpoint placement, kube-proxy or another service-proxy implementation, CNI behavior and client location. A one-node cluster, all replicas on one node, or an alternate proxy can conceal fallback behavior.
Evaluate beta and alpha features carefully
Native Pod certificates (beta)
In 1.35, the kubelet can obtain certificates through PodCertificateRequest, write credential material into the Pod filesystem and rotate it when signer and feature configuration are available. Configure and verify the signer before claiming issuance or rotation. Compare the result with cert-manager or SPIFFE/SPIRE: certificate delivery is not, by itself, a complete workload-identity or service-mesh security architecture. Keep this beta path isolated from production trust roots until its lifecycle, rotation failure behavior and node-admission restrictions are understood.
Job managedBy (stable)
managedBy is aimed at a compatible external controller, including multi-cluster systems such as MultiKueue. Setting the field without that controller does not create one and can leave an ordinary Job without the expected built-in management. Test it only with the controller and status-synchronization design you intend to operate.
Node-declared features (alpha)
With the relevant feature gates enabled, nodes can publish capabilities in .status.declaredFeatures. This can help scheduling or admission components reason about mixed-version nodes, but alpha APIs can change or disappear. Test version-skew scenarios in an isolated cluster and do not treat the field as a production compatibility contract.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Exercise an upgrade from 1.34
If you do not have a disposable 1.34 cluster, treat the following as a procedure checklist rather than a performed result. The documented sequence is control plane, nodes, clients, then manifest and resource adjustments: cluster upgrade guidance.
Before changing anything
- Back up etcd, or use the managed service’s tested backup and restore process.
- Run API-deprecation checks against manifests, Helm charts and operators.
- Verify CNI, CSI, ingress, device-plugin, admission-webhook and operator compatibility.
- Review PodDisruptionBudgets, drain behavior and capacity for replacement or surge nodes.
- Record current node, addon and workload health.
Control plane and node sequence
kubectl drain <node>
--ignore-daemonsets
--delete-emptydir-data
sudo kubeadm upgrade plan
sudo kubeadm upgrade apply v1.35.x
# Install the selected 1.35 kubelet and kubectl packages.
sudo systemctl daemon-reload
sudo systemctl restart kubelet
kubectl uncordon <node>Upgrade control-plane nodes sequentially in a multi-control-plane cluster, then drain and upgrade workers one at a time. Package commands vary by distribution. DaemonSets are ignored during drain, and a restrictive disruption budget can block it. Validate addons after each stage. Minor-version upgrades should not be described as trivially reversible; restoration or forward repair is generally safer than assuming a supported downgrade.
Common failure modes
| Symptom | Likely causes and response |
|---|---|
| Packages or patch not found | Legacy repository or unavailable patch; configure the correct pkgs.k8s.io 1.35 repository and recheck the downloads page. |
| Kubelet validation or startup failure | Cgroup v1, swap, runtime mismatch or missing kernel configuration; fix the host rather than bypassing checks. |
| Node remains NotReady | CNI CIDR conflict, blocked ports, unhealthy CNI Pods or runtime errors. |
| Resize appears accepted but workload changes | Insufficient capacity, OOM, CPU throttling, reconciliation by a controller, or stale monitoring; inspect events, identity and metrics. |
| Drain is blocked | PodDisruptionBudget, local storage, or an unhandled workload; plan capacity and explicitly review eviction policy. |
| Locality test is inconclusive | Only one node, no local endpoint, endpoint placement hidden, or service-proxy/CNI behavior different from the assumption. |
Self-managed or managed Kubernetes?
| Choice | Best fit | Main trade-off |
|---|---|---|
kubeadm |
Upstream learning, controlled infrastructure, edge and on-premises deployments | You own control-plane reliability, upgrades, backups, networking, storage and incidents. |
| Amazon EKS | AWS-native teams wanting a managed control plane | EKS support, worker compute, storage, networking, public IPv4 and other services are billed separately; AWS announced 1.35 availability on January 28, 2026: EKS 1.35 announcement. |
| Google Kubernetes Engine | Google Cloud, hybrid or multicloud operating models | Mode, region, nodes, networking and managed-vCPU pricing vary; confirm 1.35 availability in the chosen configuration: GKE pricing. |
| Azure Kubernetes Service | Azure and Microsoft-centered organizations | Free, Standard, Premium/LTS and Automatic tiers have different management and SLA behavior, with infrastructure billed separately: AKS pricing. |
| Local development distribution | Fast, disposable feature exploration | It may not reproduce production networking, storage, multi-node scheduling or cloud integrations. |
Do not buy a managed service solely to test one release feature unless its version exposure and managed defaults match the experiment. Separate control-plane charges from worker, storage, load-balancer, IP, data-transfer, support and observability costs.
What to record for a credible lab report
- Patch, OS, kernel, runtime, CNI, CSI and node specifications.
- Feature gates and admission configuration.
- Before-and-after Pod UID, container ID, start time, restart count, resource values and events.
- Node and Pod metrics from
kubectl top. - Endpoint placement and locality results, including fallback.
- Drain duration, blocked disruptions, addon errors and recovery steps.
- Whether each result was observed in this exact environment or is a procedural expectation.
Verdict: when does Kubernetes 1.35 make sense?
Run 1.35 in a disposable lab when you need to understand in-place resizing, service locality, or a provider’s 1.35 behavior. Consider an upgrade from 1.34 only after addon, API, cgroup and backup checks pass in staging. Existing 1.35 clusters should plan a supported move to the current minor release rather than treating 1.35 as a permanent destination.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteFor a new production cluster in August 2026, choose the currently supported minor release unless a documented dependency requires 1.35. The stable resize API is a meaningful improvement, but beta certificates, alpha node features, provider rollout differences and the surrounding CNI, CSI, ingress, operator and device-plugin ecosystem determine the real operational risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
