Kubernetes v1.36 Haru新特性实战：Ingress NGINX退役迁移与DRA GPU调度

Kubernetes v1.36 Haru新特性实战：Ingress NGINX退役迁移与DRA GPU调度

Kubernetes v1.36代号”Haru(春)”，2026年4月22日正式发布。这一版本带来了两个对生产环境影响深远的变化：Ingress NGINX正式进入退役周期、DRA（Dynamic Resource Allocation）GPU调度进入Beta。对运维团队来说，前者意味着必须在下一个版本周期内完成Ingress迁移，后者则提供了更灵活的GPU资源管理方式。这篇文章直接切入实操层面，覆盖迁移路径和DRA配置。

Ingress NGINX退役迁移方案

Ingress NGINX在v1.36中标记为deprecated，v1.37将移除。社区推荐迁移到Gateway API。这不是简单的API替换——Gateway API的语义模型与Ingress差异较大，需要逐层迁移。

核心差异对比

迁移步骤

第一步：安装Gateway API CRD和控制器

# 安装Gateway API CRD
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml

# 安装Envoy Gateway作为Gateway API实现
helm repo add eg https://envoyproxy.github.io/gateway-charts
helm install eg eg/envoy-gateway -n envoy-gateway-system --create-namespace

第二步：创建GatewayClass和Gateway

# GatewayClass：定义控制器类型
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: eg
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
---
# Gateway：定义监听端口和TLS
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: prod-gateway
  namespace: infra
spec:
  gatewayClassName: eg
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            shared-gateway-access: "true"
  - name: https
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - name: prod-cert
        namespace: cert-manager
    allowedRoutes:
      namespaces:
        from: All

第三步：将Ingress规则转换为HTTPRoute

# 旧版Ingress配置
# apiVersion: networking.k8s.io/v1
# kind: Ingress
# metadata:
#   name: app-ingress
#   annotations:
#     nginx.ingress.kubernetes.io/rewrite-target: /$2
# spec:
#   rules:
#   - http:
#       paths:
#       - path: /api(/|$)(.*)
#         pathType: ImplementationSpecific
#         backend:
#           service:
#             name: api-svc
#             port: {number: 8080}

# 转换后的HTTPRoute
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-route
  namespace: app
spec:
  parentRefs:
  - name: prod-gateway
    namespace: infra
  rules:
  - matches:
    - path:
        type: RegularExpression
        value: /api(/|$)(.*)
    filters:
    - type: URLRewrite
      urlRewrite:
        path:
          type: ReplacePrefixMatch
          replacePrefixMatch: /
    backendRefs:
    - name: api-svc
      port: 8080

第四步：双轨运行验证

# 通过权重分配实现灰度切换
# Gateway API支持按权重分配到不同后端
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-canary
spec:
  parentRefs:
  - name: prod-gateway
    namespace: infra
  rules:
  - backendRefs:
    - name: api-svc  # 旧Ingress → Service
      port: 8080
      weight: 80
    - name: api-svc-via-gw  # 新Gateway → Service
      port: 8080
      weight: 20

双轨运行至少2周，观察4xx/5xx错误率无异常后，逐步将权重切到100%。删除旧Ingress资源。

DRA GPU调度配置实战

DRA（Dynamic Resource Allocation）在v1.36进入Beta，允许Pod请求GPU时声明更细粒度的需求：显存大小、GPU型号、拓扑亲和性等。相比传统的device-plugin模式，DRA解决了三个痛点：

– 多GPU型号混合集群无法用nvidia.com/gpu区分
– 不支持按显存大小分配，只能整卡分配
– 缺乏GPU拓扑感知调度，跨NUMA通信性能差

DRA控制器部署

# 安装NVIDIA DRA驱动
helm repo add nvidia https://helm.ngc.nvidia.com/nvidia
helm install nvidia-dra-driver nvidia/gpu-feature-discovery \
  -n nvidia-dra --create-namespace \
  --set image.repository=nvidia/k8s-dra-driver-gpu

GPU资源声明示例

apiVersion: resource.k8s.io/v1beta1
kind: ResourceClass
metadata:
  name: gpu-a100
driverName: gpu.dra.nvidia.com
---
apiVersion: resource.k8s.io/v1beta1
kind: ResourceClaimTemplate
metadata:
  name: a100-40gb
spec:
  spec:
    resourceClassName: gpu-a100
    parameters:
      apiVersion: gpu.dra.nvidia.com/v1beta1
      kind: GpuClaimParameters
      spec:
        memory: 40Gi       # 要求40GB显存
        gpuModel: A100      # 指定型号
        numaAffinity: true  # NUMA亲和调度

Pod中使用DRA GPU

apiVersion: v1
kind: Pod
metadata:
  name: training-job
spec:
  containers:
  - name: trainer
    image: pytorch:2.6-cuda12
    resources:
      claims:
      - name: gpu-claim
  resourceClaims:
  - name: gpu-claim
    template:
      spec:
        resourceClassName: gpu-a100
        parameters:
          apiVersion: gpu.dra.nvidia.com/v1beta1
          kind: GpuClaimParameters
          spec:
            memory: 40Gi
            gpuModel: A100
            numaAffinity: true

v1.36其他值得关注的变更

Pod User Namespaces
Pod内用户命名空间隔离进入Stable。容器内root用户映射到宿主的非特权UID，即使容器内进程以UID 0运行，在宿主上也无特权。配置方式：

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  hostUsers: false  # 启用user namespace隔离
  containers:
  - name: app
    image: app:latest
    securityContext:
      runAsUser: 0  # 容器内root
      # 宿主上映射为UID 100000+，无特权

Mutating Admission Policies
基于CEL的Mutating Admission Policy进入Alpha，可以用声明式策略修改入站资源，替代部分Mutating Webhook。性能比Webhook好10倍以上（无HTTP开销）：

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingAdmissionPolicy
metadata:
  name: add-default-labels
spec:
  matchConstraints:
    objectSelector:
      matchLabels:
        needs-defaults: "true"
  mutations:
  - patchType: ApplyConfiguration
    applyConfiguration:
      expression: |
        Object.metadata.labels.?team.orValue("platform") == "platform"
        ? Object.metadata.labels.team = "platform"
        : Object

Kubernetes v1.36的变更推进速度比预期更快，Ingress NGINX退役的窗口期不到半年。建议在v1.36上线后立即启动Gateway API迁移评估，DRA GPU调度可以和新集群部署同步推进。