Kubernetes 1.32 release risks for Rancher and OpenShift teams

Kubernetes 1.32 removes the flowcontrol.apiserver.k8s.io/v1beta3 API version for FlowSchema and PriorityLevelConfiguration. I find that teams choosing between Rancher and OpenShift must weigh these API removals against the specific security vulnerabilities present in the containerd runtime.

API removals and container runtime vulnerabilities

The v1.32 release stops serving the v1beta3 version of FlowSchema and PriorityLevelConfiguration. You must migrate manifests and API clients to use the v1 version, which has existed since v1.29. The v1 version changes how the PriorityLevelConfiguration spec.limited.nominalConcurrencyShares field behaves. It only defaults to 30 when unspecified, and an explicit value of 0 no longer changes the field to 30. If your team uses OpenShift, you face a heavy infrastructure footprint because the platform bundles Red Hat support, DevSecOps tooling, RHEL CoreOS, and multi-node control plane requirements. OpenShift costs scale with CPU cores or nodes and typically hit $150 to $500 per core per year. This makes the v1.32 API migration an expensive operational hurdle when you factor in the higher TCO.

Rancher users face a different set of risks regarding the containerd runtime. A critical security vulnerability, CVE-2026-50195, affects containerd’s CRI checkpoint import process because it fails to validate image references. An attacker with permissions to create Pods can use a crafted checkpoint image to poison the node’s local image cache. This poisoning causes other pods using an "IfNotPresent" pull policy to execute malicious code. I see this as a direct threat to teams using Rancher because Rancher relies on upstream-native flexibility rather than the opinionated security of a full-stack platform. You must manage the complexity of these upgrades yourself.

Containerd also has critical flaws that allow attackers to bypass Kubernetes security boundaries. CVE-2026-53488 allows the CRI plugin to propagate labels from an image config to a container without validation, which may result in executing an arbitrary command on the host. CVE-2026-53492 allows an attacker to inject arbitrary CDI configurations, such as host mounts and device nodes, into restored containers by improperly trusting CDI annotations.

Comparing management models and migration hurdles

OpenShift creates deep vendor dependencies through proprietary Custom Resource Definitions. If you attempt to leave OpenShift, you hit walls built by proprietary Red Hat blueprints like DeploymentConfig, Route, and BuildConfig. OpenShift uses Route objects instead of standard Kubernetes Ingress to manage web traffic. It also uses Security Context Constraints (SCCs) to enforce permissions instead of the native Pod Security Admission (PSA) standards. You should avoid OpenShift if you want to avoid being locked into a specific ecosystem.

Rancher works well for Kubernetes-mature teams because it provides a lightweight distribution called RKE. I would suggest Rancher if your team already understands upstream Kubernetes and wants to manage multiple clusters from a single interface. Rancher integrates with GitLab, Jenkins, Prometheus, and cloud providers like AWS and GCP. However, the tradeoff involves a more complex configuration and an extra management plane to run.

Moving from OpenShift to Rancher requires a phased side-by-side migration. You must convert Routes to Ingress and map SCCs to Pod Security Admission. You also have to rewrite DeploymentConfigs to use standard Kubernetes Deployments. Because Rancher does not have the automatic image-change trigger functionality built directly into the workload resource, you must use Rancher Fleet to monitor external registries for new image tags. I have seen teams struggle with the storage migration because taking a raw snapshot of a hard drive rarely translates between different storage engines. You must use a tool like Velero to perform file-system level migrations.

Support structures and security updates

Red Hat provides structured, enterprise-wide support for OpenShift across the full platform stack, including Kubernetes, Operators, networking, and storage. You get better responsiveness when you purchase higher support levels. If you use Rancher, you get support through SUSE engineers. This model focuses on Kubernetes expertise. Some users report slower handling of high-severity issues during outages.

The containerd release schedule follows a four-month cadence for minor releases, with new releases scheduled for April, August, and December. Since containerd v2.3 in April 2026, this synchronization helps ensure new features match the Kubernetes release schedule. However, the security of your containers depends on how you manage your runtime. In GKE, for example, the container runtime is not vulnerable by default because node images do not include the criu binary. If you install custom runtime software that includes the criu binary, you must take manual action.

I notice that the complexity of managing the containerd runtime security remains high for any team, regardless of whether they pick Rancher or OpenShift. How will your team handle the transition from proprietary Red Hat blueprints to standard Kubernetes manifests during the next major version jump? You should validate all upgrades in development environments first. Do not skip minor versions when upgrading.