platformchangelog.dev
43 tools
feedrelease

Cluster API ·

Cluster API v1.13.8

security~***!!!

Cluster API v1.13.8 was released with 16 changes, including three security-labeled items: a bump of Go to 1.26.9 and ignored golang.org/x/net advisories, a typo fix in the trivy DB mirror, and ignored x/net trivy findings. Fixes cover bootstrap script execution via /bin/bash for noexec /etc mounts, cluster-name labeling when a BeforeClusterCreate hook blocks, and the ControlPlaneInitialized reason when the control plane does not exist. The release also blocks exec/auth providers and file-based credentials in ClusterCache kubeconfigs.

What changes for platform teams

Platform teams running Cluster API should check whether the ClusterCache kubeconfig restriction affects existing credential setups, since exec/auth providers and file-based credentials are now blocked. The security items are dependency bumps and advisory ignores rather than fixes to the tool's own code, so they do not by themselves require urgent action.

Changes

  • Bump go to 1.26.9 and ignore golang.org/x/net advisoriessecurity
  • Fix typo in trivy DB mirrorsecurity
  • Ignore x/net trivy findingssecurity
  • Github.com/coredns/corefile-migration: v1.0.35 → v1.0.36changed
  • Bootstrap: Execute /etc/kubeadm.sh via /bin/bash for /etc noexec compatibilityfixed
  • Cluster: Also set cluster-name label even if BeforeClusterCreate hook is blockingfixed
  • Cluster: Fix ControlPlaneInitialized reason when the control plane does not existfixed
  • Management Cluster: v1.32.x -> v1.36.xother
  • Workload Cluster: v1.30.x -> v1.36.xother
  • 11 new commits mergedother
  • 3 bugs fixed 🐛other
  • ClusterCache: Block exec/auth providers and file-based credentials in kubeconfigsother
1 more lines
  • E2e: Pin kind binary version and download exact versionother
3 maintenance lines (dependency bumps, CI, tests, docs)
  • Bump go to 1.26.10maintenance
  • Fallback to alternate locations for Trivy DBmaintenance
  • Dependency: Bump corefile-migration to v1.0.36maintenance
16 lines3 security1 changed3 fixed6 other3 maintenancetyped from the source notes

Full release notes ↗ · all Cluster API releases

written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Report a mistake

context

Tools

Cluster API

Other Cluster API releases

How this was written

The change list is the project's own release notes, sorted into change types by fixed rules. The summary was written from the original by the model named above, checked by fixed publishing rules, and read by an editor after publication. See the methodology.

Back to the feed