# What changed in @pulumi/kubernetes

> 41 changes in @pulumi/kubernetes 4 from its official release notes, upgrade guides and advisories: 1 breaking, 1 deprecations, 2 security, 9 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/@pulumi/kubernetes/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @pulumi/kubernetes 4

### Breaking changes

- New resources use client-side create; existing objects now return AlreadyExists instead of being silently updated, preventing data loss in create-then-delete scenarios. (4.29.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.29.0)

### Security

- Updated the go-git dependency to address a security issue. (4.31.1) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.31.1)
- SecretPatch inputs are now automatically marked as secret. (4.24.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.24.0)

### Deprecations

- allowNullValues is deprecated because null values are no longer stripped during unmarshaling. (4.30.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.30.0)

### New APIs and options

- SDKs can now be generated from Kubernetes CRDs with extension parameters. (4.34.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.34.0)
- Rendered Helm chart output can include hook resources for application by another tool when renderYamlToDirectory is enabled. (4.33.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.33.0)
- Helm releases can adopt existing resources by skipping the resource-conflict check, equivalent to Helm's --take-ownership behavior. (4.33.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.33.0)
- The provider now implements the List provider RPC for non-nested resources. (4.31.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.31.0)
- Non-nested resources advertise listInputs for namespace, name, labelSelector, and fieldSelector; namespace is omitted for cluster-scoped kinds. (4.31.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.31.0)
- New provider configuration option forces server-side apply patch conflicts on a per-stack basis. (4.29.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.29.0)
- New provider configuration option restores previous upsert behavior for users intentionally adopting existing cluster resources; it defaults to false. (4.29.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.29.0)
- Adds a provider config option to regenerate YAML manifests idempotently on every pulumi up and show changes during Update(). (4.26.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.26.0)
- Added the plainHttp option to the v4.Chart resource. (4.24.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.24.0)

### Performance

- Deletions no longer take longer than necessary. (4.24.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.24.0)
- Memory usage was significantly reduced. (4.24.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.24.0)

### Behavior and default changes

- Resources served through extensions now receive aliases for their base-provider tokens. (4.34.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.34.0)
- The Kubernetes schema and libraries were upgraded, potentially changing available resource definitions and behavior. (4.31.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.31.0)
- The enableConfigMapMutable option is now stable. (4.24.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.24.0)
- The enableSecretMutable option is now stable. (4.24.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.24.0)

### Tooling

- Terraform conversion and import now recognize helm_release and emit kubernetes:helm.sh/v3:Release. (4.31.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.31.0)
- Array-of-objects in OpenAPI specs is flattened so nested fields such as spec.listeners generate typed arguments. (4.31.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.31.0)
- Upgrades the Kubernetes schema and libraries, potentially affecting supported Kubernetes resource definitions. (4.26.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.26.0)

### Fixes and other changes

- CRD generation now allows hyphens, matching what the Pulumi engine supports. (4.34.2) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.34.2)
- Fixed a lookup condition where one parameterization package name could overwrite the other. (4.34.2) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.34.2)
- Fixed a crash during CRD schema generation when fields use nullable: true. (4.34.1) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.34.1)
- The provider is upgraded to Kubernetes v1.37. (4.34.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.34.0)
- JSONPath filters using !=, >= and <= now work correctly with waitFor. (4.34.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.34.0)
- The Kubernetes schema and libraries were upgraded to the v1.36.2 release line. (4.33.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.33.0)
- YAML rendering continues without a namespace and logs a warning when namespace scope cannot be determined offline. (4.32.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.32.0)
- Helm-installed CRDs can be resolved during preview. (4.32.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.32.0)
- Creating a service-account-token Secret with a non-existent ServiceAccount no longer panics. (4.32.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.32.0)
- CRD parameterization now reconstructs the CRD schema from saved state on subsequent runs. (4.31.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.31.0)
- Kubernetes schema and libraries were upgraded to Kubernetes v1.35.4. (4.30.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.30.0)
- Kubernetes schema and libraries were upgraded to Kubernetes v1.36.0. (4.30.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.30.0)
- The resources field is now typed as an array of Any, fixing array outputs and Python SDK failures. (4.30.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.30.0)
- Null values are preserved during unmarshaling, fixing Helm chart default deletion and valueYamlFiles null handling. (4.30.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.30.0)
- Kubernetes schema and libraries were upgraded to the v1.35.3 release line. (4.29.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.29.0)
- Fixes a regression that could cause Deployments to report diffs incorrectly. (4.26.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.26.0)
- Fixes await logic so rollouts are not reported complete before the controller processes updates and observedGeneration is current. (4.26.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.26.0)
- Helm resources now use the correct registry/config.json credentials file, while preferring registry.json when it exists for backward compatibility. (4.24.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.24.0)
- Incorrect deprecation warnings for VolumeAttributesClass were fixed. (4.24.0) — [release notes](https://github.com/pulumi/pulumi-kubernetes/releases/tag/v4.24.0)