Cluster API v1.13.0
breakingsecurity++++~~~~~~~~---****!
Changes
- !API/Runtime SDK: Bump Runtime Hooks v1alpha1 types to core CAPI v1beta2other / breaking
- !API: Remove v1alpha3 + v1alpha4 apiVersionsremoved / breaking
- !CABPK: Remove deprecated --cluster-concurrency flag in CABPKremoved / breaking
- !CAPD: Mark docker resources as deprecatedother / breaking
- !ClusterCache: Remove deprecated ClusterCache GetClientCertificatePrivateKeyremoved / breaking
- !ClusterClass: Remove deprecated ShouldSkipImmutabilityChecksremoved / breaking
- !Clusterctl: Remove deprecated --disable-grouping clusterctl describe cluster flagremoved / breaking
- !Clusterctl: Remove deprecated provider CRD migration from clusterctl upgraderemoved / breaking
- !Dependency: Bump to controller-runtime main & controller-tools v0.20maintenance / breaking
- !Misc: Remove deprecated ParseMajorMinorPatchTolerant / ParseMajorMinorPatchremoved / breaking
- Dependency: Fix CVE-2026-39883security
- ClusterCache: Remove stack traces from ClusterCache errorsremoved
251 more lines
- Clusterctl: Drop handling of old cert-manager annotation in clusterctlremoved
- ClusterResourceSet: Remove ClusterResourceSet ensureKubernetesServiceCreatedremoved
- E2e: Drop handling for clusterctl < v1.7.2 in e2e tests & frameworkremoved
- E2e: Drop unused e2e test template & handling for Kubernetes < v1.25 in e2e CCremoved
- E2e: Remove handling for Kubernetes <= v1.28 in clusterctl upgrade testremoved
- KCP: Drop unnecessary etcd call in KCPremoved
- KCP: Remove live list Machine call in KCPremoved
- KCP: Remove the ControlPlaneKubeletLocalMode for kubeadm 1.36 laterremoved
- Logging: Drop or reduce verbosity for noisy logsremoved
- Github.com/ProtonMail/go-crypto: 7d5c6f0removed
- Github.com/bwesterb/go-ristretto: v1.2.3removed
- Github.com/cloudflare/circl: v1.6.1removed
- Github.com/google/go-github/v53: v53.2.0removed
- Github.com/zeebo/errs: v1.4.0removed
- Go.uber.org/automaxprocs: v1.6.0removed
- V1alpha3 and v1alpha4 apiVersions have been removeddeprecated
- Reminder: v1beta1 is on track to be unserved in CAPI v1.16deprecated
- Reminder: Provider should start implementing the v1beta2 contract ASAP.deprecated
- API: Deprecate custom Condition typesdeprecated
- The implementation of the Taint propagation proposal is now completedchanged
- Runtime Hooks are now embedding v1beta2 Cluster typeschanged
- Machine now reports info about machine placement in the status.failureDomain fieldchanged
- RolloutAfter for control plane and MachineDeployments can now be controlled from Cluster.spec.topologychanged
- MachineWaitForVolumeDetachConsiderVolumeAttachments feature graduated to GAchanged
- PriorityQueue feature graduated to beta and it is now enabled by defaultchanged
- ReconcilerRateLimiting feature graduated to beta and it is now enabled by defaultchanged
- Starting from this release ReconcilerRateLimiting feature also requires PriorityQueue to be enabled. This ensures that ReconcilerRateLimiting works consistently with controller runtime ExponentialBackoff.changed
- CAPD: Improve condition if CAPD Machine is not yet ready for bootstrap execchanged
- CAPD: Move RBAC for devmachinetemplates from main.go to controller.gochanged
- ClusterClass: Improve topology diffchanged
- Devtools: Make kind image configurable via env var for make tilt-upchanged
- E2e: Improve scale test for re-entrancy and improve observability stackchanged
- E2e: Make clusterctl upgrade test to work when there are no machineschanged
- Testing: Improve error reporting of envtest CleanupAndWaitchanged
- Testing: Improve pod log streaming to avoid duplicate logschanged
- Util: Improve patch helper for no-op caseschanged
- Cel.dev/expr: v0.24.0 → v0.25.1changed
- Cloud.google.com/go/compute/metadata: v0.6.0 → v0.9.0changed
- Github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.26.0 → v1.31.0changed
- Github.com/cncf/xds/go: 2f00578 → ee656c7changed
- Github.com/coredns/corefile-migration: v1.0.29 → v1.0.31changed
- Github.com/envoyproxy/go-control-plane/envoy: v1.32.4 → v1.36.0changed
- Github.com/envoyproxy/go-control-plane: v0.13.4 → v0.14.0changed
- Github.com/envoyproxy/protoc-gen-validate: v1.2.1 → v1.3.0changed
- Github.com/fatih/color: v1.18.0 → v1.19.0changed
- Github.com/go-jose/go-jose/v4: v4.0.4 → v4.1.3changed
- Github.com/golang/glog: v1.2.4 → v1.2.5changed
- Github.com/google/go-querystring: v1.1.0 → v1.2.0changed
- Github.com/google/pprof: f64d9cf → 294ebfachanged
- Github.com/grpc-ecosystem/grpc-gateway/v2: v2.26.3 → v2.28.0changed
- Github.com/onsi/ginkgo/v2: v2.27.2 → v2.28.1changed
- Github.com/onsi/gomega: v1.38.2 → v1.39.1changed
- Github.com/prometheus/client_golang: v1.22.0 → v1.23.2changed
- Github.com/prometheus/common: v0.62.0 → v0.66.1changed
- Github.com/prometheus/procfs: v0.15.1 → v0.16.1changed
- Github.com/spf13/cobra: v1.10.1 → v1.10.2changed
- Github.com/spiffe/go-spiffe/v2: v2.5.0 → v2.6.0changed
- Github.com/valyala/fastjson: v1.6.4 → v1.6.10changed
- Go.etcd.io/bbolt: v1.4.2 → v1.4.3changed
- Go.etcd.io/etcd/api/v3: v3.6.6 → v3.6.10changed
- Go.etcd.io/etcd/client/pkg/v3: v3.6.6 → v3.6.10changed
- Go.etcd.io/etcd/client/v3: v3.6.6 → v3.6.10changed
- Go.etcd.io/etcd/pkg/v3: v3.6.4 → v3.6.5changed
- Go.etcd.io/etcd/server/v3: v3.6.4 → v3.6.5changed
- Go.opentelemetry.io/auto/sdk: v1.1.0 → v1.2.1changed
- Go.opentelemetry.io/contrib/detectors/gcp: v1.34.0 → v1.39.0changed
- Go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.58.0 → v0.65.0changed
- Go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.34.0 → v1.43.0changed
- Go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.34.0 → v1.43.0changed
- Go.opentelemetry.io/otel/metric: v1.35.0 → v1.43.0changed
- Go.opentelemetry.io/otel/sdk/metric: v1.34.0 → v1.43.0changed
- Go.opentelemetry.io/otel/sdk: v1.34.0 → v1.43.0changed
- Go.opentelemetry.io/otel/trace: v1.35.0 → v1.43.0changed
- Go.opentelemetry.io/otel: v1.35.0 → v1.43.0changed
- Go.opentelemetry.io/proto/otlp: v1.5.0 → v1.10.0changed
- Go.yaml.in/yaml/v2: v2.4.2 → v2.4.3changed
- Golang.org/x/crypto: v0.45.0 → v0.50.0changed
- Golang.org/x/mod: v0.29.0 → v0.34.0changed
- Golang.org/x/net: v0.47.0 → v0.53.0changed
- Golang.org/x/oauth2: v0.33.0 → v0.36.0changed
- Golang.org/x/sync: v0.18.0 → v0.20.0changed
- Golang.org/x/sys: v0.38.0 → v0.43.0changed
- Golang.org/x/telemetry: 078029d → 579e4dachanged
- Golang.org/x/term: v0.37.0 → v0.42.0changed
- Golang.org/x/text: v0.31.0 → v0.36.0changed
- Golang.org/x/tools: v0.38.0 → v0.43.0changed
- Google.golang.org/appengine: v1.6.7 → v1.6.5changed
- Google.golang.org/genproto/googleapis/api: a0af3ef → 9d38bb4changed
- Google.golang.org/genproto/googleapis/rpc: a0af3ef → 9d38bb4changed
- Google.golang.org/grpc: v1.72.3 → v1.80.0changed
- Google.golang.org/protobuf: v1.36.7 → v1.36.11changed
- Gopkg.in/evanphx/json-patch.v4: v4.12.0 → v4.13.0changed
- K8s.io/api: v0.34.2 → v0.35.3changed
- K8s.io/apiextensions-apiserver: v0.34.2 → v0.35.3changed
- K8s.io/apimachinery: v0.34.2 → v0.35.3changed
- K8s.io/apiserver: v0.34.2 → v0.35.3changed
- K8s.io/client-go: v0.34.2 → v0.35.3changed
- K8s.io/cluster-bootstrap: v0.34.2 → v0.35.3changed
- K8s.io/code-generator: v0.34.2 → v0.35.3changed
- K8s.io/component-base: v0.34.2 → v0.35.3changed
- K8s.io/gengo/v2: 85fd79d → ec3ebc5changed
- K8s.io/kms: v0.34.2 → v0.35.3changed
- K8s.io/kube-openapi: f3f2b99 → 589584fchanged
- K8s.io/utils: 4c0f3b2 → bc988d5changed
- Sigs.k8s.io/controller-runtime: v0.22.4 → v0.23.3changed
- Sigs.k8s.io/json: cfa47c3 → 2d32026changed
- Sigs.k8s.io/structured-merge-diff/v6: v6.3.0 → v6.3.2changed
- Bumped to Go 1.25, controller-runtime v0.23, k8s.io/* v0.35, controller-gen v0.20added
- KCP now allows to recover from different kind of failures as well as from multiple failures:added
- Increased tolerance to unexpected state of control plane components (accidental node deletion, manual removal of etcd members, accidental deletion of kubeadm control plane labels, and more)added
- Better visibility on common symptoms of kubeadm join errors (failed to promote etcd member, failed to apply kubeadm control plane labels and taints)added
- Multiple improvements to improve controllers memory and CPU footprint, performance and stability at scaleadded
- API: Backport newly introduced v1beta2 API fields to v1beta1added
- CABPK: Optimize cache configuration of CABPK & standardize cache/client setupadded
- CAPD: Implement DevMachinePoolsadded
- CAPD: Improve CAPD wait for multi-user targetadded
- CAPD: Support externally managed LBadded
- Cluster: Only set ownerReference on InfraCluster/ControlPlane when Topology is definedadded
- ClusterCache: Add ClusterFilter to ClusterCache Optionsadded
- ClusterClass: Implement support for taintsadded
- Clusterctl: Allow overriding image name in clusterctl configadded
- Core: Optimize cache configuration of core CAPIadded
- Dependency: Bump Go to v1.25.5added
- Dependency: Bump to controller-runtime v0.23added
- Devtools: Add a flag to skip image preloadingadded
- KCP/CABPK: Allow diskSetup to include partition layoutadded
- KCP/MachineDeployment/Cluster: Add rolloutAfter to cluster.spec.topologyadded
- KCP: Allow remediation of multiple failures in KCPadded
- KCP: Bump coredns/corefile-migration to v1.0.30added
- KCP: Implement support for machine taintsadded
- KCP: Optimize cache configuration of KCPadded
- Machine: Add Machine status.failureDomainadded
- Machine: Promote MachineWaitForVolumeDetachConsiderVolumeAttachments feature to GAadded
- Metrics/e2e: Add infra CRDs to dashboards, improve/fix dashboards, enable native histogramsadded
- Misc: Disable DWARF and symbol table to decrease binary/image sizeadded
- Misc: Enable PriorityQueue per defaultadded
- Misc: Promote ReconcileRateLimiting to beta (enabled per default)added
- Misc: Tune controller concurrency and cache timeout for scaleadded
- Testing: Add example / debug suite for envtestadded
- Util: Extend conversion tests to cover the "no spec" caseadded
- Util: Refresh cache entries on cache hit in SSA cachesadded
- API: Introduce conversion.MarshalDataUnsafeNoCopy to avoid unnecessary memory allocations during conversionadded
- ClusterClass: Add validation in ClusterClass for CP MachineInfraadded
- Clusterctl: Add cloudscale-ch-cloudscale provideradded
- Devtools: Add additional_uncategorized_resources for Tiltadded
- Devtools: Add labels to cluster deployment form fieldsadded
- Devtools: Add other to prow job generatoradded
- Devtools: Enable native histograms in Grafana / Prometheusadded
- E2e: Add json struct tags to ContainerImageadded
- Util: Add safeguard to patchHelper to avoid sending empty patches to the apiserveradded
- Github.com/cenkalti/backoff/v5: v5.0.3added
- Github.com/google/go-github/v82: v82.0.0added
- Golang.org/x/tools/go/expect: v0.1.0-deprecatedadded
- Golang.org/x/tools/go/packages/packagestest: v0.1.1-deprecatedadded
- Gonum.org/v1/gonum: v0.17.0added
- API: Fix v1beta1 ControlPlane contract to handle .status.initialized correctlyfixed
- CAPD: Fix "Failed to exec DockerMachine bootstrap" errors in CAPDfixed
- CAPD: Remove finalizers during deletion if ownerRef was never set for cluster controllersfixed
- CAPIM: Extend CAPD in-memory backend to set CP taint to fix scale testsfixed
- CAPIM: Fix in-memory watch unit testfixed
- Cluster: Fix panic in Cluster conversionfixed
- ClusterClass/KCP/MachineSet/MachineDeployment: Mitigate managedFields apiserver issue for SSAfixed
- ClusterClass: Allow adding spec via ClusterClass JSON patchesfixed
- ClusterClass: Do not overwrite global http.DefaultClient TLSConfigfixed
- ClusterClass: Fix upgradePlan computation in GetUpgradePlanFromClusterClassVersionsfixed
- Dependency: Bump dependencies to fix CVE GO-2026-4394 (go.opentelemetry.io/otel/sdk pkg)fixed
- E2e: Add wait-resource-versions-{become,remain}-stable intervals to e2e configfixed
- E2e: Clean up namespace in e2e testsfixed
- E2e: Fix cross-ns scale testfixed
- E2e: Fix goroutine & memory leak in inmemory providerfixed
- E2e: Fix node-label calculation in test extension & fix upgrade testfixed
- E2e: Fix WaitForMachinesReady intervalfixed
- E2e: Increase reconcile timeout for KCP & DockerMachinefixed
- E2e: Only retry creating objects that failedfixed
- E2e: Tolerate NotFound errors during Namespace deletion in scale test cleanupfixed
- KCP/MachineSet: Preserve existing object names for backward compatibility with pre-v1.7 in-place updatesfixed
- KCP: Grant delete permissions to Secrets.fixed
- KCP: KCP deletion should tolerate missing InfraTemplatesfixed
- KCP: Use errors.Errorf instead of errors.Wrapf since the err is nilfixed
- Machine/MachineSet/MachineDeployment: Fix UpToDate calculation for rolloutAfterfixed
- MachineSet: Use MachineSet template values in completeMoveMachine for in-place updatesfixed
- Misc: Fix bug while setting status for deprecated fieldsfixed
- Runtime SDK: Improve client cert/key rotation of the RuntimeSDK clientfixed
- Testing/e2e: Fix unit test flakes, improve clusterctl download error in e2e testsfixed
- Testing: Fix flaky by waiting for CRD finalizer processingfixed
- Testing: Fix flaky TestClusterReconciler unit testfixed
- Testing: Fix TestReconcile flakefixed
- Testing: Fix webhook envtest tests for Kubernetes < v1.35fixed
- Upgrades: Remove conflicting rules field from aggregated ClusterRolesfixed
- Util: Fix a panic in conditions.Delete method if the sources condition list is emptyfixed
- Util: Fix exponential backoff with ReconcilerRateLimitingfixed
- Util: Fix patchHelper unit test flakesfixed
- CAPIM: Fix inMemory watchfixed
- Machine: Avoid unsetting nodeDeletionTimeoutSeconds during Machine deletionfixed
- MachinePool: Fix reconcileDelete returning unnecessary errorfixed
- Management Cluster: v1.32.x -> v1.35.xother
- Workload Cluster: v1.30.x -> v1.35.xother
- 279 new commits mergedother
- 10 breaking changes :warning:other
- 30 feature additions ✨other
- 39 bugs fixed 🐛other
- API: Postpone date when we stop serving v1beta1other
- API: Relax validation for Machine .status.addresses to maximum of 128 instead of 32 itemsother
- API: Relax validation for Machine .status.addresses to maximum of 256 instead of 128 itemsother
- CAPD/CAPIM: Implement .status.failureDomain for DockerMachine & DevMachineother
- CAPD: Implement pause for DockerMachinePoolother
- CAPD: Reduce verbosity of CAPD exec logother
- CAPD: Use select with time.After instead of time.Sleepother
- ClusterClass: Simplify GetUpgradePlanFromClusterClassVersionsother
- Clusterctl: Bump cert-manager v1.19.4other
- Clusterctl: Bump Cert-manager v1.20.2other
- ClusterResourceSet: Set WithOwnedV1Beta1Conditions for ClusterResourceSet patchother
- Community meeting: Add AndiDog as machine pool area reviewerother
- Dependency: Bump go 1.25.7other
- Dependency: Bump go v1.25.8other
- Dependency: Bump go v1.25.9other
- Dependency: Bump the all-go-mod-patch-and-minor group across 3 directories with 4 updatesother
- Dependency: Switch from docker to moby dependenciesother
- Devtools: Updated dev observability stackother
- E2e: 0 in e2e testsother
- E2e: Do not expect Machines for MachinePools not supporting Machinesother
- E2e: Extend test extension to improve test coverageother
- E2e: Skip test using outdated docker clientother
- E2e: Small cleanup in the RuntimeSDK testother
- E2e: Start testing against Kubernetes v1.36other
- E2e: Start testing with Kubernetes v1.36.0-beta.0other
- E2e: Start testing with Kubernetes v1.36.0-rc.0other
- E2e: Start testing with Kubernetes v1.36.0-rc.1other
- E2e: Use crane to pre-pull images instead of docker pullother
- KCP: KCP should handle missing control plane labelother
- KCP: KCP should read only KCP machinesother
- KCP: KCP should report missing certificatesother
- KCP: KCP should report missing Node labels and taintother
- KCP: Migrate from Requeue to RequeueAfter in kcpother
- Logging: Log flags on controller startupother
- Logging: Use klog.Obj in log messagesother
- MachineHealthCheck: Decrease verbosity for MHC log entryother
- MachineHealthCheck: Increase MHC rate limiting and filter eventsother
- Misc: Increase default kube-api qps/burstother
- Misc: Removing cluster-api-provider-nested as it is read-onlyother
- Misc: Removing v1beta1 from admissionReviewVersions & conversionReviewVersionsother
- Runtime SDK: Add httpClientCache to runtime clientother
- Runtime SDK: Allow chained upgrade with runtimeSDK feature flag falseother
- Testing: Extend managedField mitigation unit testother
- Testing: Increase envtest manager graceful shutdown timeout & print goroutines on errorother
- Testing: Simplify TestGetNode unit testother
- Testing: Update version matrix for GitHub workflows for release 1.12other
- Util: Export controller utilother
- Util: Optimise patch callsother
- Util: Reduce dep tree for util/patchother
- Util: Stop using patch helper when enforcing finalizersother
30 maintenance lines (dependency bumps, CI, tests, docs)
- Core: Update autoscaling from zero enhancement proposal with node labels and taints configuration clarificationmaintenance
- Prepare main branch for v1.13maintenance
- Bump trivy to v0.69.2 to fix CImaintenance
- Bump golangci-lint v2.7.0maintenance
- Bump Kubernetes version used for testing to v1.35.0-rc.0maintenance
- Bump Kubernetes version used for testing to v1.35.0-rc.1maintenance
- Drop security scan on 1.10maintenance
- Dump resources in scale testmaintenance
- Improve Fake API servermaintenance
- Inmemory APIserver fails for unsupported fieldSelectorsmaintenance
- Migrate away from custom GitHub action approval workflowmaintenance
- Revive the debug endpoint for CAPDev in-memorymaintenance
- Use env test 1.35.0maintenance
- ClusterClass: Fix test compute control plane versionmaintenance
- Clusterctl: Bump cert-manager to v1.20.0maintenance
- Clusterctl: Bump cert-manager to v1.20.1maintenance
- Clusterctl: Update cert-manager to v1.19.3maintenance
- Clusterctl: Update to cert-manager v1.19.2maintenance
- Dependency: Bump Go to v1.24.11maintenance
- Dependency: Bump Go to v1.25.6maintenance
- Dependency: Bump go-github to v82maintenance
- Dependency: Bump golang.org/x/net to v0.51 to fix CVEmaintenance
- Devtools: Bump CAPI Visualizer to v1.5.0maintenance
- E2e: Add retry in test framework when getting manifest YAMLsmaintenance
- E2e: Bump autoscaler version used for testing to v1.34.2maintenance
- E2e: Bump autoscaler version used for testing to v1.35.0maintenance
- E2e: Bump kind to v0.31.0maintenance
- E2e: Bump Kubernetes version used for testing to v1.35.0maintenance
- E2e: Bump to etcd-v3.6.6-0maintenance
- KCP: Fix flaky KCP testmaintenance
293 lines1 security23 removed4 deprecated48 added88 changed40 fixed58 other31 maintenancetyped from the source notes