Cluster API v1.13.7
security~~~~~~~~~~~~~****!
Cluster API v1.13.7 was released with 28 changes: one security item bumping grpc to 1.83.2 for security advisories, 14 dependency changes (including OpenTelemetry v1.45.0 and golang.org/x/net v0.58.0), and four fixes. The fixes cover cluster-name labels on Clusters without ClusterClass, KCP learner deletion after Node registration, a race in the KCP proxy DialContext, and a flaky test.
What changes for platform teams
The security fix is a dependency bump, not a vulnerability in Cluster API's own code, so platform teams should upgrade for the advisory fix and the KCP race fix. The release notes list supported management cluster versions as v1.32.x to v1.36.x and workload cluster versions as v1.30.x to v1.36.x.
Changes
- Dependency: Bump grpc to 1.83.2 to address security advisoriessecurity
- Github.com/go-logr/logr: v1.4.3 → v1.4.4changed
- Github.com/grpc-ecosystem/grpc-gateway/v2: v2.28.0 → v2.29.0changed
- Go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.43.0 → v1.45.0changed
- Go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.43.0 → v1.45.0changed
- Go.opentelemetry.io/otel/metric: v1.44.0 → v1.45.0changed
- Go.opentelemetry.io/otel/sdk/metric: v1.44.0 → v1.45.0changed
- Go.opentelemetry.io/otel/sdk: v1.44.0 → v1.45.0changed
- Go.opentelemetry.io/otel/trace: v1.44.0 → v1.45.0changed
- Go.opentelemetry.io/otel: v1.44.0 → v1.45.0changed
- Go.opentelemetry.io/proto/otlp: v1.10.0 → v1.11.0changed
- Golang.org/x/net: v0.57.0 → v0.58.0changed
11 more lines
- Google.golang.org/genproto/googleapis/api: 3dc84a4 → 6ac0973changed
- Google.golang.org/genproto/googleapis/rpc: 3dc84a4 → 6ac0973changed
- Google.golang.org/grpc: v1.83.1 → v1.83.2changed
- Cluster: Also set cluster-name label on Clusters without ClusterClassfixed
- KCP: Avoid deleting learners after Node registrationfixed
- KCP: Fix race in KCP proxy DialContextfixed
- Testing: Fix flaky TestReconcileControlPlane by reading the Cluster with the API readerfixed
- Management Cluster: v1.32.x -> v1.36.xother
- Workload Cluster: v1.30.x -> v1.36.xother
- 10 new commits mergedother
- 4 bugs fixed 🐛other
5 maintenance lines (dependency bumps, CI, tests, docs)
- Bump machine to highcpu-32maintenance
- Add ignore two vulnerabilities reported by trivymaintenance
- Improve Kubernetes version resolutionmaintenance
- Clusterctl: Bump cert-manager to v1.21.2maintenance
- Dependency: Update Otel version to v1.45.0maintenance
Full release notes ↗ · all Cluster API releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules