Cluster API v1.14.0
breakingsecurity++++++~~~~~~~--***!
Changes
- !CAPD: Mark docker resources as deprecatedother / breaking
- !Dependency: Bump to controller-runtime v0.24 & controller-tools v0.21maintenance / breaking
- !Machine/MachinePool/MachineSet/MachineDeployment/Cluster: Fix version validation in webhooksfixed / breaking
- !Misc: Fix minor goroutine leak in util/cache after controller shutdownfixed / breaking
- Improve the project security posture and increase its capability to deal with CVEs from direct/indirect dependenciessecurity
- Dependency: Fix CVE-2026-39883security
- Dependency: Bump cel-go to v0.29.0 and grpc to v1.82.1 to address security advisoriessecurity
- Updated gitignoresecurity
- Control-plane: Remove unused functions in internal/contractremoved
- E2e: Drop syncer from in-memory serverremoved
- KCP: Remove the check on the errors returned by etcd's status responseremoved
- Machine: Drop KCP specific logic in Machine reconcileDeleteremoved
244 more lines
- Misc: Delete unused nolint directivesremoved
- Util: Remove deprecated coderemoved
- Github.com/cenkalti/backoff/v4: v4.3.0removed
- Github.com/gregjones/httpcache: 901d907removed
- Github.com/grpc-ecosystem/go-grpc-prometheus: v1.2.0removed
- Github.com/rivo/uniseg: v0.4.7removed
- The v1beta1 API version in core Cluster API, CABPK and KCP is on track to be unserved in CAPI v1.16. All the consumers of this API version should migrate to v1beta2 ASAP.deprecated
- Utils for the Cluster API v1beta1 condition types (condition helpers, patch helper etc.) will be removed as a next step.deprecated
- All the status.deprecated fields existing in v1beta2 types (used for v1beta1 down conversions) types will be removed as a next step.deprecated
- Support for the Cluster API v1beta1 contract versions is on track to be dropped in CAPI v1.16. Provider should start implementing the v1beta2 contract ASAP.deprecated
- NOTE: CAPD is considered a test provider, API deprecation period does not applydeprecated
- Util: Deprecate util/recorddeprecated
- CAPD: Refactor CAPDev reconcilerchanged
- Clusterctl: Improve clusterctl describechanged
- Devtools: Improve metrics configchanged
- Devtools: Move scripts under hack/scriptschanged
- E2e: Improve handling of missing kind versionschanged
- E2e: Make it easier to debug cert issues in clusterctl upgrade & self-hosted testschanged
- E2e: Rename in-memory e2e test flavor to in-memory-scalechanged
- Machine: Improve machine controller in-place update unit testschanged
- Misc: Improve conversion webhook aliasingchanged
- Testing/Documentation/e2e: Improve support for OwnerReferencesPermissionEnforcement admission controllerchanged
- Testing: Improve KCP remediation ack signal diagnostics and reset handlingchanged
- Testing: Make the clusterctl upgrade management cluster control plane count configurablechanged
- Util: Refactor consistency store to allow defer without previous store registrationchanged
- Github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.31.0 → v1.32.0changed
- Github.com/alecthomas/units: b94a6e3 → 0f3dac3changed
- Github.com/antlr4-go/antlr/v4: v4.13.0 → v4.13.1changed
- Github.com/cncf/xds/go: ee656c7 → dba9d58changed
- Github.com/coredns/corefile-migration: v1.0.31 → v1.0.34changed
- Github.com/coreos/go-oidc: v2.3.0+incompatible → v2.5.0+incompatiblechanged
- Github.com/coreos/go-systemd/v22: v22.5.0 → v22.7.0changed
- Github.com/envoyproxy/go-control-plane/envoy: v1.36.0 → v1.37.0changed
- Github.com/envoyproxy/protoc-gen-validate: v1.3.0 → v1.3.3changed
- Github.com/go-jose/go-jose/v4: v4.1.3 → v4.1.4changed
- Github.com/go-logr/logr: v1.4.3 → v1.4.4changed
- Github.com/godbus/dbus/v5: v5.0.4 → v5.1.0changed
- Github.com/golang-jwt/jwt/v5: v5.2.2 → v5.3.0changed
- Github.com/google/cel-go: v0.26.0 → v0.29.0changed
- Github.com/google/pprof: 294ebfa → 545e8a4changed
- Github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus: v1.0.1 → v1.1.0changed
- Github.com/grpc-ecosystem/go-grpc-middleware/v2: v2.3.0 → v2.3.3changed
- Github.com/mattn/go-runewidth: v0.0.16 → v0.0.19changed
- Github.com/moby/spdystream: v0.5.0 → v0.5.1changed
- Github.com/olekukonko/errors: v1.1.0 → v1.2.0changed
- Github.com/olekukonko/ll: v0.1.1 → v0.1.6changed
- Github.com/olekukonko/tablewriter: v1.0.9 → v1.1.4changed
- Github.com/onsi/ginkgo/v2: v2.28.1 → v2.32.0changed
- Github.com/onsi/gomega: v1.39.1 → v1.42.1changed
- Github.com/pmezard/go-difflib: v1.0.0 → 5d4384echanged
- Github.com/prometheus/common: v0.66.1 → v0.67.5changed
- Github.com/prometheus/procfs: v0.16.1 → v0.19.2changed
- Go.etcd.io/etcd/api/v3: v3.6.10 → v3.6.14changed
- Go.etcd.io/etcd/client/pkg/v3: v3.6.10 → v3.6.14changed
- Go.etcd.io/etcd/client/v3: v3.6.10 → v3.6.14changed
- Go.etcd.io/etcd/pkg/v3: v3.6.5 → v3.6.8changed
- Go.etcd.io/etcd/server/v3: v3.6.5 → v3.6.8changed
- Go.opentelemetry.io/contrib/detectors/gcp: v1.39.0 → v1.43.0changed
- Go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: v0.60.0 → v0.65.0changed
- Go.uber.org/zap: v1.27.1 → v1.28.0changed
- Golang.org/x/crypto: v0.50.0 → v0.53.0changed
- Golang.org/x/exp: 8a7402a → 944ab1fchanged
- Golang.org/x/mod: v0.34.0 → v0.37.0changed
- Golang.org/x/net: v0.53.0 → v0.56.0changed
- Golang.org/x/sync: v0.20.0 → v0.22.0changed
- Golang.org/x/sys: v0.43.0 → v0.46.0changed
- Golang.org/x/telemetry: 579e4da → 59b4966changed
- Golang.org/x/term: v0.42.0 → v0.44.0changed
- Golang.org/x/text: v0.36.0 → v0.40.0changed
- Golang.org/x/time: v0.9.0 → v0.14.0changed
- Golang.org/x/tools/go/expect: v0.1.0-deprecated → v0.1.1-deprecatedchanged
- Golang.org/x/tools: v0.43.0 → v0.47.0changed
- Google.golang.org/genproto/googleapis/api: 9d38bb4 → afd174achanged
- Google.golang.org/genproto/googleapis/rpc: 9d38bb4 → afd174achanged
- Google.golang.org/grpc: v1.80.0 → v1.82.1changed
- Google.golang.org/protobuf: v1.36.11 → f2248acchanged
- K8s.io/api: v0.35.3 → v0.36.3changed
- K8s.io/apiextensions-apiserver: v0.35.3 → v0.36.3changed
- K8s.io/apimachinery: v0.35.3 → v0.36.3changed
- K8s.io/apiserver: v0.35.3 → v0.36.3changed
- K8s.io/client-go: v0.35.3 → v0.36.3changed
- K8s.io/cluster-bootstrap: v0.35.3 → v0.36.3changed
- K8s.io/code-generator: v0.35.3 → v0.36.3changed
- K8s.io/component-base: v0.35.3 → v0.36.3changed
- K8s.io/klog/v2: v2.130.1 → v2.140.0changed
- K8s.io/kms: v0.35.3 → v0.36.3changed
- K8s.io/kube-openapi: 589584f → 43fb72cchanged
- K8s.io/utils: bc988d5 → b8788abchanged
- Sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.31.2 → v0.34.0changed
- Sigs.k8s.io/controller-runtime: v0.23.3 → v0.24.1changed
- Sigs.k8s.io/structured-merge-diff/v6: v6.3.2 → v6.4.2changed
- Cluster API is now using Golang 1.26, CR v0.24, CT v0.21added
- Introduced dedicated Golang module for API typesadded
- This new API module ensures consumers of the API typesadded
- Stronger compatibility guarantees.added
- Considerably smaller and tightly controlled dependency tree, thus reducing exposure to CVEs from dependencies.added
- Formalization of policies and rules for Golang version bump, allowing a better response to Golang CVEs.added
- See also the wider effort about code organization proposal + (#13910).added
- Enable safe joining of nodes on older kubernetes versions with kubeadmadded
- This feature removes a constraint preventing scale up, remediation and autoscaling of worker nodes during cluster rollouts,added
- Improved observability on upgrades, Kubernetes version in-use and runtime extensions errors.added
- Surface upgrade plan in cluster statusadded
- Surface aggregated machine versions in statusadded
- Surface Runtime Extension errors in cluster conditionsadded
- More work to improve robustness and reliability of controllersadded
- Improve forward etcd leadership in KCP, allowing the system to better handle partial failures during control plane machine deletionadded
- Tolerate missing InfraTemplates during control plane machine deletion, allowing the system to tolerate accidental resource deletionadded
- Allow KCP remediation of unhealthy machines during intermediate steps of chained upgradesadded
- KCP is now able to cleanup not started etcd members after a machine is remediatedadded
- Implement stale controller mitigation in all the relevant controllers (#13720, #13737,added
- Allow remediation of unhealthy Machines managed by old MachineSets during in-place updatesadded
- Perform draining and volume detachment once until completionadded
- Use regular patch instead of SSA to patch Cluster in topology controlleradded
- More work for reducing Cluster API memory footprint and for improving performance at scaleadded
- Introduce options for cache tuning in ClusterCache clients, use those options to better control memory footprint in core CAPI, CABPK and KCP (#13780,added
- Implement managedFields interningadded
- Misc:added
- Allow patching of metadata.{labels,annotations} through ClusterClass patchesadded
- Kubernetes version validation now enforces strict semver compatibilityadded
- Several changes to reduce E2E test durations while we keep adding new tests and improving test coverage of the existing ones.added
- Add experimental clusterctl convert commandadded
- API: Introduce separate API moduleadded
- API: Move OpenAPI schema out of the api package to avoid direct dependency on kube-openapi in the api moduleadded
- API: Surface aggregated machine versions in statusadded
- Bootstrap: Write kubeadm control plane version file for workers to use to fetch the matching kubeadm binaryadded
- CAPD: Introduce per-reconciler concurrency flags in CAPDevadded
- CAPD: Migrate ClusterClass changes e2e test from the docker to the in-memory backendadded
- CAPD: Migrate templates to use Dev* instead of Docker*added
- Cluster: Use regular patch instead of SSA to patch Cluster in topology controlleradded
- ClusterCache: Expose and use DefaultTransform on CacheOptionsadded
- ClusterCache: Use DefaultTransform in core CAPI, CABPK and KCPadded
- ClusterClass/KCP/MachineSet: Implement stale controller mitigation in KCP / MS / Cluster topology controlleradded
- ClusterClass: Allow patching of metadata.{labels,annotations} through ClusterClass patchesadded
- Clusterctl: Add cluster-api-provider-kubeswift to the built-in infrastructure provider listadded
- Clusterctl: Add configuration ExternallyProvisioned for clusterctladded
- Clusterctl: Add experimental clusterctl convert commandadded
- Dependency: Bump Go 1.26added
- E2e: Migrate ClusterClass rollout e2e test from the docker to the in-memory backendadded
- E2e: Migrate ClusterClass upgrade with different NS e2e test from the docker to the in-memory backendadded
- E2e: Migrate e2e tests from using Docker* resources to Dev* resourcesadded
- E2e: Migrate test extension to use Dev* instead of Docker*added
- E2e: Update in-place updating a workload cluster e2e test to use in-memory backendadded
- E2e: Use in-memory template for clusterctl upgrade testsadded
- KCP: Improve forward etcd leadershipadded
- MachineDeployment/util: Stale controller mitigation in reconcile wrapper & MD controller, enable store & fifo informer metricsadded
- Misc: Implement managedFields interningadded
- Misc: Implement new code structureadded
- CAPD: Add support for controller restart to in-memory backendadded
- Clusterctl: Add cloudscale-ch-cloudscale provideradded
- Clusterctl: Add oxide as an infrastructure provideradded
- Devtools: Add Headlamp to Tilt dev environmentadded
- Devtools: Add log dashboardadded
- Devtools: Add Log dashboard to grafanaadded
- Devtools: Enable prealloc linter & fix findingsadded
- E2e: Enable opt-out of OwnerReferencesPermissionEnforcement admission controller & opt-out in clusterctl upgrade testsadded
- KCP: Add kubeadm cluster roleadded
- KCP: Allow KCP remediation on chained upgrade intermediate stepsadded
- Misc: Add finalizer only after we got owner/clusteradded
- Github.com/clipperhouse/displaywidth: v0.10.0added
- Github.com/clipperhouse/stringish: v0.1.1added
- Github.com/clipperhouse/uax29/v2: v2.6.0added
- K8s.io/streaming: v0.36.3added
- CAPD: Fix a panic in CAPDev cache.Get()fixed
- CAPD: Fix CAPD flakesfixed
- CAPD: Fix E2E host port binding lookupfixed
- CAPIM: Fix deadlock in in-memory serverfixed
- ClusterClass: Fix Machine taint propagation in the Cluster topology controller for the v1beta1 contractfixed
- Clusterctl: Detect cert-manager image changes during upgradefixed
- Clusterctl: Fix v1beta1 describe output streamfixed
- Clusterctl: Raise management cluster client QPS and Burstfixed
- Clusterctl: Reject incomplete GitHub release asset URLsfixed
- Clusterctl: Skip update check for clusterctl completionfixed
- Clusterctl: Trim whitespace in --show-conditions filtersfixed
- Devtools: Fix Grafana deploymentfixed
- Devtools: Fix parallel build of binaries in Tiltfilefixed
- Devtools: Fix Tilt kube-state-metrics deploymentfixed
- E2e: Fix ClusterClass rollout test with k8s latestfixed
- E2e: Fix PrettyPrint in WaitForControlPlaneToBeReadyfixed
- E2e: Fix self-hosted testfixed
- KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembersfixed
- KCP: Fix KCP in-place update with InfraMachine webhooks with immutability validationfixed
- KCP: KCP deletion should tolerate missing InfraTemplatesfixed
- Machine/Bootstrap: Perform draining and volume detachment once until completionfixed
- MachineDeployment: Fix nil pointer panic when paused with no matching MachineSetfixed
- MachineSet: Delete unhealthy Machines of old MS during in-place updatesfixed
- MachineSet: Fix retry to remove finalizer in MS topology reconcilerfixed
- Testing: Fix TestHealthCheckTargets flakefixed
- CABPK: Prevent CABPK to override controlling ownerRef for bootstrap secretsfixed
- Clusterctl/Misc: Avoid building if LDFLAGS returns error checking for SemVerfixed
- Devtools: Fix gosec lint findingsfixed
- Misc: Correct typos in comments and error messagesfixed
- Misc: Fix static check lint errorsfixed
- Management Cluster: v1.33.x -> v1.36.xother
- Workload Cluster: v1.31.x -> v1.36.xother
- 258 new commits mergedother
- 4 breaking changes :warning:other
- 28 feature additions ✨other
- 28 bugs fixed 🐛other
- API/Runtime SDK/IPAM/MachinePool/MachineSet/MachineDeployment: Fix typos in generated CRD descriptionsother
- API: Adjust IsMachineDeploymentUpgrading to detect in-place upgradesother
- API: Follow-ups for Surface aggregated machine versions in statusother
- API: Surface upgrade plan in cluster statusother
- Bootstrap: Limit size of files generated from templatesother
- CABPK: Use ClusterClass with RuntimeSDK in kubeadm join old Node e2e test & fix e2e test failuresother
- CAPD: Only add finalizer after InfraMachine has owner in CAPDevother
- CAPD: Partially revert fix self-hosted testother
- ClusterCache/Misc: Block ExecProvider/AuthProvider in ClusterCache, deprecate remote funcsother
- ClusterCache: Cleanup ClusterCache metrics for deleted Clustersother
- ClusterClass: Increase MD/MS topology reconciler concurrency to 25other
- Clusterctl: Bump Cert-manager v1.20.2other
- Clusterctl: Harden clusterctl moveother
- Clusterctl: Print help on argument validation errorsother
- Control-plane: Align scale validator to upstreamother
- Control-plane: Verify etcd serving certificate against the etcd CAother
- Dependency: 1.26.3other
- Dependency: Bump envtest 1.36other
- Devtools: Upgrade tempo & fix configurationother
- Devtools: Verify mdbook shaother
- E2e: Bump autoscaler version used for testingother
- E2e: Cleanup of ControlPlaneKubeletLocalMode handling in KCP adoption testother
- E2e: Cleanup unused e2e test templatesother
- E2e: Give resource versions more time to become stable in e2e testsother
- E2e: Increase clusterctl and e2e test dry-run cluster-template timeoutsother
- E2e: Start testing against Kubernetes v1.37other
- E2e: Start testing with K8s 1.36.0other
- E2e: Start testing with Kubernetes v1.36.0-rc.0other
- E2e: Start testing with Kubernetes v1.36.0-rc.1other
- E2e: Use only 1 worker machine per MD/MP in RuntimeSDK e2e testother
- E2e: Use Runtime SDK for kcp-infra-adoption e2e testother
- KCP: KCP cleanup etcd members not started after a machine is remediatedother
- KCP: KCP enforce context deadline on connection streamother
- MachineDeployment: Extend stale controller mitigation in MD controller to MS deletionother
- MachinePool: Unit testing to determine if provider allows individual machines to be deleted.other
- MachineSet: Cleanup orphaned BoostrapConfigs / InfraMachines in MS controllerother
- MachineSet: Consider MS skip preflight check annotation from BootstrapConfigTemplateother
- Misc: Replace reflect.Ptr with reflect.Pointerother
- Misc: Stop setting TypeMeta in typed objects (part II)other
- Misc: Update Kubernetes bump issue templateother
- Misc: Use pkgerrors as alias for github.com/pkg/errors & no alias for errorsother
- Runtime SDK: Add 20 MB read limits for Runtime SDK client & serverother
- Runtime SDK: Do not follow redirects when calling runtime extensionsother
- Runtime SDK: Surface Runtime Extension errors in conditionsother
- Testing: Update version matrix for GitHub workflows for release 1.13other
- Util: Switch CRD migrator to use merge patchother
39 maintenance lines (dependency bumps, CI, tests, docs)
- Remove YEAR from copyright header boilerplatemaintenance
- Prepare main branch for v1.14 developmentmaintenance
- Fix verify docker images archmaintenance
- Revert unset GOCACHE env varmaintenance
- Add cron buckets to prow generatormaintenance
- Add KCP infra adoption testmaintenance
- Add stable BuildKit cache mount IDsmaintenance
- Cleanup ./scripts foldermaintenance
- Cleanup golangci-lint excludesmaintenance
- Drop jobs on release-1.11maintenance
- Fix link in cloudbuild.yaml'smaintenance
- Fix linter findings in hack/toolsmaintenance
- Harden git workflowsmaintenance
- Make it possible to exclude CVEs with govulncheckmaintenance
- Migrate from import boss to depguardmaintenance
- Read permissions for pr-verify actionmaintenance
- Replace deprecated gaurav-nelson/github-action-markdown-link-check with tcort forkmaintenance
- Revert "Migrate away from custom GitHub action approval workflow"maintenance
- Stop running make lint-api multiple times in the GitHub actionmaintenance
- Clusterctl: Bump cert-manager to v1.20.3maintenance
- Clusterctl: Bump cert-manager to v1.21.0maintenance
- Clusterctl: Bump cert-manager to v1.21.1maintenance
- Control-plane: Add additional test cases for EnsureKubeadmPermissionsmaintenance
- Dependency: Bump go to v1.26.4maintenance
- Dependency: Bump Go to v1.26.5maintenance
- Dependency: Bump golang/x/net to 0.55.0maintenance
- Devtools: Bump headlamp CAPI plugin to 0.2.0-beta.0maintenance
- Devtools: Bump setup-envtest to v0.24.1maintenance
- E2e: Add options to runtimesdk e2e testmaintenance
- E2e: Bump Kubernetes version used for testing to v1.37.0-beta.0maintenance
- E2e: Bump to kind main to fix e2e testsmaintenance
- E2e: Bump to kind v0.32.0maintenance
- E2e: Fix E2E chained upgrademaintenance
- KCP: Update RemoveEtcdMember to accept a *etcd.Member instead of a member namemaintenance
- Add Code Freeze date field to provider_issues.go to be used for beta communicationmaintenance
- Add workaround for generate release notesmaintenance
- Optimize go build in make release-binarymaintenance
- Report consistency errors in release note draftmaintenance
- Testing: Add a test case to confirm that kcp can safely remove a member when it doesn't have a corresponding machine but it has no alarmmaintenance
295 lines4 security10 removed6 deprecated71 added79 changed32 fixed53 other40 maintenancetyped from the source notes