Kubernetes 1.35 changes the kubelet default `failCgroupV1` to `true`, so the kubelet refuses to start on a cgroup v1 node.
Setting `failCgroupV1: false` restores the old behavior, but the override buys one release rather than a permanent exemption.
Kubernetes 1.35 is also the last release supporting containerd 1.x, and IPVS mode in kube-proxy is scheduled for removal in 1.36.