Deprecate `service.spec.externalIPs`

[danwinship]

Enhancement Description

• One-line enhancement description (can be used as a release note): Deprecate service.spec.externalIPs
• Kubernetes Enhancement Proposal:
• Discussion Link: CVE-2020-8554: Man in the middle using LoadBalancer or ExternalIPs kubernetes#97076 (comment) and following.
• PRs by stage and milestone:
  • Deprecated - v1.36
    • KEP (k/enhancements) update PR(s): KEP-5707: Add initial KEP for deprecate service.spec.externalIPs #5873
    • Code (k/k) update PR(s):
    • Docs (k/website) update PR(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

/sig network
/help

[adrianmoisey]

I'm happy to pick this up
/assign

[danwinship]

/label lead-opted-in

[adrianmoisey]

/remove-help

[whtssub]

Hello @adrianmoisey @danwinship 👋, v1.36 Enhancements team here.

This is a reminder of the upcoming PRR freeze on Wednesday 4th February 2026 (AoE) / Thursday 5th February 2026, 12:00 UTC.

This enhancement is targeting stage deprecation for v1.36 (correct me, if otherwise)

Here's where this enhancement currently stands:

• PR open or merged with the KEP's PRR questionnaire filled out.
• PR open or merged with kep.yaml updated with the stage, latest-milestone, and milestone struct filled out.
• PR open or merged with a PRR approval file with the PRR approver listed for the stage the KEP is targeting.

Note that the PR is not required to be approved or merged by the PRR freeze deadline. Having the PRR questionnaire filled out by the deadline will help ensure that the PRR team has enough time to review your KEP before Enhancements Freeze on Wednesday 11th February 2026 (AoE) / Thursday 12th February 2026, 12:00 UTC. For more information on the PRR process, see here.

With all the PRR freeze requirements in place, this enhancement is now marked as Tracked for PRR freeze! Please keep the issue description up-to-date with appropriate stages as well.

/label tracked/yes