Kubernetes

How Kubernetes versioning, EOL & security support work

Kubernetes ships new minor releases (1.X) on a regular cadence managed by its Release Team, and only a small, rolling set of the most recent minor versions is covered by official support at any given time. Within a supported minor version, patch releases are cut on a roughly monthly cadence, faster right after a new minor ships, and critical fixes can trigger an out-of-cycle release.

Kubernetes runs a coordinated disclosure process through its Security Response Committee: reports go through its bug bounty program or privately to security@kubernetes.io, and a public disclosure date is negotiated with the reporter. Fixes are shipped as patch releases to in-support branches; a version that has already reached end of life sits outside this process, so it will not receive a fix even for a newly disclosed vulnerability.

Sources: Kubernetes Patch Releases policy, Kubernetes security vulnerability disclosure process

Data sourced from endoflife.date.