# Kubernetes v1.36: Deprecation and removal of Service ExternalIPs

DevFeed: [Kubernetes v1.36: Deprecation and removal of Service ExternalIPs](<https://devfeed.tech/articles/kubernetes-v1-36-deprecation-and-removal-of-service-externalips-4552.md>)

Original publisher: [Read original article](<https://kubernetes.io/blog/2026/05/14/kubernetes-v1-36-deprecation-and-removal-of-service-externalips/>)

Author: Adrian Moisey; Dan Winship

Published: 2026-05-14T18:35:00Z

Content type: article

Language: en

Sources: [Kubernetes Blog](<https://devfeed.tech/sources/kubernetes-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Security](<https://devfeed.tech/topics/security.md>), [Network](<https://devfeed.tech/topics/network.md>), [API](<https://devfeed.tech/topics/api.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [ip](<https://devfeed.tech/tags/ip.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [network](<https://devfeed.tech/tags/network.md>), [release](<https://devfeed.tech/tags/release.md>), [security](<https://devfeed.tech/tags/security.md>), [update](<https://devfeed.tech/tags/update.md>)

## AI overview

Kubernetes 1.36 formally deprecates the Service API's .spec.externalIPs field because its trust assumptions can enable security exploits, including CVE-2020-8554. The article explains the scope of the deprecation, recommends the DenyServiceExternalIPs admission controller, and discusses alternatives for non-cloud clusters needing load-balancer-like functionality.

## Source excerpt

The .spec.externalIPs field for Service was an early attempt to provide cloud-load-balancer-like functionality for non-cloud clusters. Unfortunately, the API assumes that every user in the cluster is fully trusted, and in any situation where that is not the case, it enables various security exploits, as described in CVE-2020-8554. Since Kubernetes 1.21, the Kubernetes project has recommended that all users disable .spec.externalIPs. To make that easier, Kubernetes also added an admission controller (DenyServiceExternalIPs) that can be enabled to do this. At the time, SIG Network felt that blocking the functionality by default was too large a breaking change to consider. However, the security problems are still there, and as a project we're increasingly unhappy with the "insecure by default" state of the feature. Additionally, there are now several better alternatives for non-cloud clusters wanting load-balancer-like functionality. As a result, the .spec.externalIPs field for Service is now formally deprecated in Kubernetes 1.36. We expect that a future minor release of Kubernetes will drop implementation of the behavior from kube-proxy, and will update the Kubernetes conformance criteria to require that conforming implementations do not provide support. A note on terminology, and what hasn't been deprecated The phrase external IP is somewhat overloaded in Kubernetes: The Service API has a field .spec.externalIPs that can be used to add additional IP addresses that a Service will respond on. The Node API's .status.addresses field can list addresses of several different types, one of which is called ExternalIP. The kubectl tool, when displaying information about a Service of type LoadBalancer in the default output format, will show the load balancer IP address under the column heading EXTERNAL-IP. This deprecation is about the first of those. If you are not setting the field externalIPs in any of your Services, then it does not apply to you. That said, as a precaution