Kubernetes Security: 2025 Stable Features and 2026 preview

2025 Kubernetes security: Stable graduates The future is now: What to expect in 2026 Conclusion Posted on December 15, 2025 by Matteo Bisi, DevSecOps Team Leader, ReeVo Cloud & Cyber Security CNCF projects highlighted in this post It’s time to recap the key Kubernetes security highlights from 2025 and outline features likely to graduate to stable in early 2026. From a DevSecOps perspective, 2025 brought several meaningful security improvements that directly influenced day-2 operations and production hardening efforts. With Kubernetes v1.35 scheduled for release on December 17, now is an ideal moment to review the past year’s progress and prepare for what’s ahead. 2025 marked important progress in Kubernetes security, with key features graduating to stable status between versions 1.32 and 1.35. These advancements enhance authentication, authorization, workload isolation, and overall hardening for production cloud-native environments. Here are the most impactful stable graduates from 2025: Looking at the alpha and beta features in Kubernetes 1.35 gives us a clear indication of what’s likely to graduate to stable in 2026. These are the advancements that will further solidify Kubernetes as a secure platform: User namespaces continue to progress, reaching beta and on-by-default status in recent releases—an important hardening capability for improving workload isolation. Looking ahead, advancements in secrets management such as Pod certificates for mTLS (beta in v1.35, KEP-4317) and robust image pull authorization (beta, KEP-2535) are poised to strengthen credential handling and workload identity across Kubernetes environments. Tracking the alpha-to-stable lifecycle remains a helpful practice for DevSecOps teams. Evaluating emerging features in pre-production environments can support informed adoption and help organizations stay ahead of evolving security needs. Share.