npm / @pulumi/kubernetes
@pulumi/kubernetes
What changed in @pulumi/kubernetes 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
1 breaking2 security1 deprecations9 new APIs and options2 performance4 behavior and defaults3 tooling19 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@pulumi/kubernetes 441 changes
Breaking changes 1
New resources use client-side create; existing objects now return AlreadyExists instead of being silently updated, preventing data loss in create-then-delete scenarios.
Security 2
Updated the go-git dependency to address a security issue.
SecretPatch inputs are now automatically marked as secret.
Deprecations 1
allowNullValues is deprecated because null values are no longer stripped during unmarshaling.
New APIs and options 9
SDKs can now be generated from Kubernetes CRDs with extension parameters.
Rendered Helm chart output can include hook resources for application by another tool when renderYamlToDirectory is enabled.
Helm releases can adopt existing resources by skipping the resource-conflict check, equivalent to Helm's --take-ownership behavior.
The provider now implements the List provider RPC for non-nested resources.
Non-nested resources advertise listInputs for namespace, name, labelSelector, and fieldSelector; namespace is omitted for cluster-scoped kinds.
New provider configuration option forces server-side apply patch conflicts on a per-stack basis.
New provider configuration option restores previous upsert behavior for users intentionally adopting existing cluster resources; it defaults to false.
Adds a provider config option to regenerate YAML manifests idempotently on every pulumi up and show changes during Update().
Added the plainHttp option to the v4.Chart resource.
Performance 2
Deletions no longer take longer than necessary.
Memory usage was significantly reduced.
Behavior and default changes 4
Resources served through extensions now receive aliases for their base-provider tokens.
The Kubernetes schema and libraries were upgraded, potentially changing available resource definitions and behavior.
The enableConfigMapMutable option is now stable.
The enableSecretMutable option is now stable.
Tooling 3
Terraform conversion and import now recognize helm_release and emit kubernetes:helm.sh/v3:Release.
Array-of-objects in OpenAPI specs is flattened so nested fields such as spec.listeners generate typed arguments.
Upgrades the Kubernetes schema and libraries, potentially affecting supported Kubernetes resource definitions.
Fixes and other changes 19
CRD generation now allows hyphens, matching what the Pulumi engine supports.
Fixed a lookup condition where one parameterization package name could overwrite the other.
Fixed a crash during CRD schema generation when fields use nullable: true.
The provider is upgraded to Kubernetes v1.37.
JSONPath filters using !=, >= and <= now work correctly with waitFor.
The Kubernetes schema and libraries were upgraded to the v1.36.2 release line.
YAML rendering continues without a namespace and logs a warning when namespace scope cannot be determined offline.
Helm-installed CRDs can be resolved during preview.
Creating a service-account-token Secret with a non-existent ServiceAccount no longer panics.
CRD parameterization now reconstructs the CRD schema from saved state on subsequent runs.
Kubernetes schema and libraries were upgraded to Kubernetes v1.35.4.
Kubernetes schema and libraries were upgraded to Kubernetes v1.36.0.
The resources field is now typed as an array of Any, fixing array outputs and Python SDK failures.
Null values are preserved during unmarshaling, fixing Helm chart default deletion and valueYamlFiles null handling.
Kubernetes schema and libraries were upgraded to the v1.35.3 release line.
Fixes a regression that could cause Deployments to report diffs incorrectly.
Fixes await logic so rollouts are not reported complete before the controller processes updates and observedGeneration is current.
Helm resources now use the correct registry/config.json credentials file, while preferring registry.json when it exists for backward compatibility.
Incorrect deprecation warnings for VolumeAttributesClass were fixed.