v1.14.32026-10-07patchsecurity~~~~~~~~~~~~*****!sharesource Cluster API released v1.14.3. The release bumps grpc to 1.83.2 to address security advisories, along with several OpenTelemetry, golang.org/x/net and genproto dependencies. Fixes include setting the cluster-name label on Clusters without ClusterClass, a race in the KCP proxy DialContext, and handling of etcd member matching and not-found owner references.
platform teams Platform teams running Cluster API should pick up the grpc dependency fix and the KCP and cluster labeling fixes. The release notes list no breaking changes, and the source does not describe any new capability.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- !Dependency: Bump grpc to 1.83.2 to address security advisoriessecurity
- ~Github.com/grpc-ecosystem/grpc-gateway/v2: v2.28.0 → v2.29.0changed
- ~Go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.43.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.43.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/metric: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/sdk/metric: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/sdk: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/trace: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/proto/otlp: v1.10.0 → v1.11.0changed
- ~Golang.org/x/net: v0.57.0 → v0.58.0changed
- ~Google.golang.org/genproto/googleapis/api: 3dc84a4 → 6ac0973changed
15 more lines
- ~Google.golang.org/genproto/googleapis/rpc: 3dc84a4 → 6ac0973changed
- ~Google.golang.org/grpc: v1.83.1 → v1.83.2changed
- *Cluster: Also set cluster-name label on Clusters without ClusterClassfixed
- *KCP: Fix race in KCP proxy DialContextfixed
- *KCP: Try to match etcd member to machine being deleted by KCPfixed
- *Machine/MachineSet: Gracefully handle not-found when resolving owner referencesfixed
- *Misc: Implement support for multiNamespaceInformer in controller util consistency storefixed
- *Testing: Fix flaky TestReconcileControlPlane by reading the Cluster with the API readerfixed
- ·Management Cluster: v1.33.x -> v1.37.xother
- ·Workload Cluster: v1.31.x -> v1.37.xother
- ·16 new commits mergedother
- ·6 bugs fixed 🐛other
- ·E2e: Extend e2e tests to detect double rolloutsother
- ·Runtime SDK: Improve discoveryother
- ·Testing: Restore apiVersionGetter after unit testsother
5 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump machine to highcpu-32maintenance
- ·Add verify for downloaded binariesmaintenance
- ·Improve Kubernetes version resolutionmaintenance
- ·Clusterctl: Bump cert-manager to v1.21.2maintenance
- ·Dependency: Update Otel version to v1.45.0maintenance
32 lines1 security13 changed6 fixed7 other5 maintenancetyped from the source notes
v1.13.72026-10-07patchsecurity~~~~~~~~~~~~~****!sharesource Cluster API v1.13.7 was released with 28 changes: one security item bumping grpc to 1.83.2 for security advisories, 14 dependency changes (including OpenTelemetry v1.45.0 and golang.org/x/net v0.58.0), and four fixes. The fixes cover cluster-name labels on Clusters without ClusterClass, KCP learner deletion after Node registration, a race in the KCP proxy DialContext, and a flaky test.
platform teams The security fix is a dependency bump, not a vulnerability in Cluster API's own code, so platform teams should upgrade for the advisory fix and the KCP race fix. The release notes list supported management cluster versions as v1.32.x to v1.36.x and workload cluster versions as v1.30.x to v1.36.x.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- !Dependency: Bump grpc to 1.83.2 to address security advisoriessecurity
- ~Github.com/go-logr/logr: v1.4.3 → v1.4.4changed
- ~Github.com/grpc-ecosystem/grpc-gateway/v2: v2.28.0 → v2.29.0changed
- ~Go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.43.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.43.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/metric: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/sdk/metric: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/sdk: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel/trace: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/otel: v1.44.0 → v1.45.0changed
- ~Go.opentelemetry.io/proto/otlp: v1.10.0 → v1.11.0changed
- ~Golang.org/x/net: v0.57.0 → v0.58.0changed
11 more lines
- ~Google.golang.org/genproto/googleapis/api: 3dc84a4 → 6ac0973changed
- ~Google.golang.org/genproto/googleapis/rpc: 3dc84a4 → 6ac0973changed
- ~Google.golang.org/grpc: v1.83.1 → v1.83.2changed
- *Cluster: Also set cluster-name label on Clusters without ClusterClassfixed
- *KCP: Avoid deleting learners after Node registrationfixed
- *KCP: Fix race in KCP proxy DialContextfixed
- *Testing: Fix flaky TestReconcileControlPlane by reading the Cluster with the API readerfixed
- ·Management Cluster: v1.32.x -> v1.36.xother
- ·Workload Cluster: v1.30.x -> v1.36.xother
- ·10 new commits mergedother
- ·4 bugs fixed 🐛other
5 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump machine to highcpu-32maintenance
- ·Add ignore two vulnerabilities reported by trivymaintenance
- ·Improve Kubernetes version resolutionmaintenance
- ·Clusterctl: Bump cert-manager to v1.21.2maintenance
- ·Dependency: Update Otel version to v1.45.0maintenance
28 lines1 security14 changed4 fixed4 other5 maintenancetyped from the source notes
v1.14.22026-09-08patchsecurity++~~~~~~~~~~~~~**!sharesource - !Add --tls-curve-preferences flag to manager optionssecurity
- ~Cel.dev/expr: v0.25.1 → v0.25.2changed
- ~Github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.32.0 → v1.33.0changed
- ~Github.com/googleapis/gax-go/v2: v2.0.5 → v2.17.0changed
- ~Github.com/spiffe/go-spiffe/v2: v2.6.0 → v2.7.0changed
- ~Go.opentelemetry.io/contrib/detectors/gcp: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel/metric: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel/sdk/metric: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel/sdk: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel/trace: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel: v1.43.0 → v1.44.0changed
- ~Golang.org/x/crypto: v0.53.0 → v0.56.0changed
23 more lines
- ~Golang.org/x/mod: v0.37.0 → v0.38.0changed
- ~Golang.org/x/net: v0.56.0 → v0.57.0changed
- ~Golang.org/x/sys: v0.46.0 → v0.47.0changed
- ~Golang.org/x/telemetry: 59b4966 → 49f421fchanged
- ~Golang.org/x/term: v0.44.0 → v0.45.0changed
- ~Golang.org/x/text: v0.40.0 → v0.41.0changed
- ~Golang.org/x/tools: v0.47.0 → v0.48.0changed
- ~Google.golang.org/genproto/googleapis/api: afd174a → 3dc84a4changed
- ~Google.golang.org/genproto/googleapis/rpc: afd174a → 3dc84a4changed
- ~Google.golang.org/grpc: v1.82.1 → v1.83.1changed
- +Cloud.google.com/go/auth: v0.18.2added
- +Github.com/google/s2a-go: v0.1.9added
- +Github.com/googleapis/enterprise-certificate-proxy: v0.3.11added
- *ClusterClass: Lifecycle hooks fixfixed
- *KCP: Avoid deleting learners after Node registrationfixed
- *KCP: Deduplicate KCP preflightchecksfixed
- *KCP: Fix KCP rollout issue after upgrade from CAPI v1.11fixed
- ·Management Cluster: v1.33.x -> v1.37.xother
- ·Workload Cluster: v1.31.x -> v1.37.xother
- ·9 new commits mergedother
- ·1 feature addition ✨other
- ·4 bugs fixed 🐛other
- ·E2e: Install the minimum required kind version for e2e testother
1 maintenance lines (dependency bumps, CI, tests, docs)
- ·Dependency: Bump google.golang.org/grpc + golang.org/x/crypto to fix CVEsmaintenance
36 lines1 security3 added21 changed4 fixed6 other1 maintenancetyped from the source notes
- ~Cel.dev/expr: v0.25.1 → v0.25.2changed
- ~Github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.32.0 → v1.33.0changed
- ~Github.com/coredns/corefile-migration: v1.0.34 → v1.0.35changed
- ~Github.com/googleapis/gax-go/v2: v2.0.5 → v2.17.0changed
- ~Github.com/spiffe/go-spiffe/v2: v2.6.0 → v2.7.0changed
- ~Go.opentelemetry.io/contrib/detectors/gcp: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel/metric: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel/sdk/metric: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel/sdk: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel/trace: v1.43.0 → v1.44.0changed
- ~Go.opentelemetry.io/otel: v1.43.0 → v1.44.0changed
- ~Golang.org/x/crypto: v0.53.0 → v0.55.0changed
25 more lines
- ~Golang.org/x/mod: v0.37.0 → v0.38.0changed
- ~Golang.org/x/net: v0.56.0 → v0.57.0changed
- ~Golang.org/x/sync: v0.21.0 → v0.22.0changed
- ~Golang.org/x/sys: v0.46.0 → v0.47.0changed
- ~Golang.org/x/telemetry: 59b4966 → 49f421fchanged
- ~Golang.org/x/term: v0.44.0 → v0.45.0changed
- ~Golang.org/x/text: v0.39.0 → v0.41.0changed
- ~Golang.org/x/tools: v0.47.0 → v0.48.0changed
- ~Google.golang.org/genproto/googleapis/api: afd174a → 3dc84a4changed
- ~Google.golang.org/genproto/googleapis/rpc: afd174a → 3dc84a4changed
- ~Google.golang.org/grpc: v1.82.1 → v1.83.1changed
- +Cloud.google.com/go/auth: v0.18.2added
- +Github.com/google/s2a-go: v0.1.9added
- +Github.com/googleapis/enterprise-certificate-proxy: v0.3.11added
- *API: Don't use cache with CRD migratorfixed
- *ClusterCache: Apply Options.ClusterFilter in SetupWithManagerfixed
- *ClusterClass: Lifecycle hooks fixfixed
- *Conditions: Fix deprecate condition utilsfixed
- *KCP: Fix KCP rollout issue after upgrade from CAPI v1.11fixed
- ·Management Cluster: v1.32.x -> v1.37.xother
- ·Workload Cluster: v1.30.x -> v1.37.xother
- ·15 new commits mergedother
- ·5 bugs fixed 🐛other
- ·E2e: Bump Kubernetes 1.37.0-rc.0other
- ·E2e: Install the minimum required kind version for e2e testother
7 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump gcb-docker-gcloud to a prod imagemaintenance
- ·Dependency: Bump corefile-migration to v1.0.35maintenance
- ·Dependency: Bump Go Version to 1.25.13maintenance
- ·Dependency: Bump google.golang.org/grpc to fix CVEsmaintenance
- ·E2e: Bump kind to v0.33.0maintenance
- ·E2e: Bump to Kubernetes v1.37.0maintenance
- ·E2e: Bump to Kubernetes v1.37.0-rc.1maintenance
44 lines3 added23 changed5 fixed6 other7 maintenancetyped from the source notes
- ~Github.com/coredns/corefile-migration: v1.0.34 → v1.0.35changed
- *API: Don't use cache with CRD migratorfixed
- *Bootstrap: Execute /etc/kubeadm.sh via /bin/bash for /etc noexec compatibilityfixed
- *Bootstrap: Fix ParseSecretName round-trip for purposes containing hyphensfixed
- *ClusterCache: Apply Options.ClusterFilter in SetupWithManagerfixed
- *Conditions: Fix deprecate condition utilsfixed
- ·Management Cluster: v1.33.x -> v1.37.xother
- ·Workload Cluster: v1.31.x -> v1.37.xother
- ·22 new commits mergedother
- ·5 bugs fixed 🐛other
- ·E2e: Bump Kubernetes 1.37.0-rc.0other
- ·Misc: Standardize cache package importsother
2 more lines
- ·Testing: Consider restart policy in containerHasTerminatedother
- ·Testing: Start testing against Kubernetes v1.38other
7 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump gcb-docker-gcloud to a prod imagemaintenance
- ·Dependency: Bump corefile-migration to v1.0.35maintenance
- ·Dependency: Bump Go Version to 1.26.6maintenance
- ·E2e: Bump kind to v0.33.0maintenance
- ·E2e: Bump to Kubernetes v1.37.0maintenance
- ·E2e: Bump to Kubernetes v1.37.0-rc.1maintenance
- ·Testing: Bump envtest to v1.37.0maintenance
21 lines1 changed5 fixed8 other7 maintenancetyped from the source notes
v1.14.02026-08-11minorbreakingsecurity++++++~~~~~~~--***!sharesource - !·CAPD: Mark docker resources as deprecatedother / breaking
- !·Dependency: Bump to controller-runtime v0.24 & controller-tools v0.21maintenance / breaking
- !*Machine/MachinePool/MachineSet/MachineDeployment/Cluster: Fix version validation in webhooksfixed / breaking
- !*Misc: Fix minor goroutine leak in util/cache after controller shutdownfixed / breaking
- !Improve the project security posture and increase its capability to deal with CVEs from direct/indirect dependenciessecurity
- !Dependency: Fix CVE-2026-39883security
- !Dependency: Bump cel-go to v0.29.0 and grpc to v1.82.1 to address security advisoriessecurity
- !Updated gitignoresecurity
- -Control-plane: Remove unused functions in internal/contractremoved
- -E2e: Drop syncer from in-memory serverremoved
- -KCP: Remove the check on the errors returned by etcd's status responseremoved
- -Machine: Drop KCP specific logic in Machine reconcileDeleteremoved
244 more lines
- -Misc: Delete unused nolint directivesremoved
- -Util: Remove deprecated coderemoved
- -Github.com/cenkalti/backoff/v4: v4.3.0removed
- -Github.com/gregjones/httpcache: 901d907removed
- -Github.com/grpc-ecosystem/go-grpc-prometheus: v1.2.0removed
- -Github.com/rivo/uniseg: v0.4.7removed
- -The v1beta1 API version in core Cluster API, CABPK and KCP is on track to be unserved in CAPI v1.16. All the consumers of this API version should migrate to v1beta2 ASAP.deprecated
- -Utils for the Cluster API v1beta1 condition types (condition helpers, patch helper etc.) will be removed as a next step.deprecated
- -All the status.deprecated fields existing in v1beta2 types (used for v1beta1 down conversions) types will be removed as a next step.deprecated
- -Support for the Cluster API v1beta1 contract versions is on track to be dropped in CAPI v1.16. Provider should start implementing the v1beta2 contract ASAP.deprecated
- -NOTE: CAPD is considered a test provider, API deprecation period does not applydeprecated
- -Util: Deprecate util/recorddeprecated
- ~CAPD: Refactor CAPDev reconcilerchanged
- ~Clusterctl: Improve clusterctl describechanged
- ~Devtools: Improve metrics configchanged
- ~Devtools: Move scripts under hack/scriptschanged
- ~E2e: Improve handling of missing kind versionschanged
- ~E2e: Make it easier to debug cert issues in clusterctl upgrade & self-hosted testschanged
- ~E2e: Rename in-memory e2e test flavor to in-memory-scalechanged
- ~Machine: Improve machine controller in-place update unit testschanged
- ~Misc: Improve conversion webhook aliasingchanged
- ~Testing/Documentation/e2e: Improve support for OwnerReferencesPermissionEnforcement admission controllerchanged
- ~Testing: Improve KCP remediation ack signal diagnostics and reset handlingchanged
- ~Testing: Make the clusterctl upgrade management cluster control plane count configurablechanged
- ~Util: Refactor consistency store to allow defer without previous store registrationchanged
- ~Github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.31.0 → v1.32.0changed
- ~Github.com/alecthomas/units: b94a6e3 → 0f3dac3changed
- ~Github.com/antlr4-go/antlr/v4: v4.13.0 → v4.13.1changed
- ~Github.com/cncf/xds/go: ee656c7 → dba9d58changed
- ~Github.com/coredns/corefile-migration: v1.0.31 → v1.0.34changed
- ~Github.com/coreos/go-oidc: v2.3.0+incompatible → v2.5.0+incompatiblechanged
- ~Github.com/coreos/go-systemd/v22: v22.5.0 → v22.7.0changed
- ~Github.com/envoyproxy/go-control-plane/envoy: v1.36.0 → v1.37.0changed
- ~Github.com/envoyproxy/protoc-gen-validate: v1.3.0 → v1.3.3changed
- ~Github.com/go-jose/go-jose/v4: v4.1.3 → v4.1.4changed
- ~Github.com/go-logr/logr: v1.4.3 → v1.4.4changed
- ~Github.com/godbus/dbus/v5: v5.0.4 → v5.1.0changed
- ~Github.com/golang-jwt/jwt/v5: v5.2.2 → v5.3.0changed
- ~Github.com/google/cel-go: v0.26.0 → v0.29.0changed
- ~Github.com/google/pprof: 294ebfa → 545e8a4changed
- ~Github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus: v1.0.1 → v1.1.0changed
- ~Github.com/grpc-ecosystem/go-grpc-middleware/v2: v2.3.0 → v2.3.3changed
- ~Github.com/mattn/go-runewidth: v0.0.16 → v0.0.19changed
- ~Github.com/moby/spdystream: v0.5.0 → v0.5.1changed
- ~Github.com/olekukonko/errors: v1.1.0 → v1.2.0changed
- ~Github.com/olekukonko/ll: v0.1.1 → v0.1.6changed
- ~Github.com/olekukonko/tablewriter: v1.0.9 → v1.1.4changed
- ~Github.com/onsi/ginkgo/v2: v2.28.1 → v2.32.0changed
- ~Github.com/onsi/gomega: v1.39.1 → v1.42.1changed
- ~Github.com/pmezard/go-difflib: v1.0.0 → 5d4384echanged
- ~Github.com/prometheus/common: v0.66.1 → v0.67.5changed
- ~Github.com/prometheus/procfs: v0.16.1 → v0.19.2changed
- ~Go.etcd.io/etcd/api/v3: v3.6.10 → v3.6.14changed
- ~Go.etcd.io/etcd/client/pkg/v3: v3.6.10 → v3.6.14changed
- ~Go.etcd.io/etcd/client/v3: v3.6.10 → v3.6.14changed
- ~Go.etcd.io/etcd/pkg/v3: v3.6.5 → v3.6.8changed
- ~Go.etcd.io/etcd/server/v3: v3.6.5 → v3.6.8changed
- ~Go.opentelemetry.io/contrib/detectors/gcp: v1.39.0 → v1.43.0changed
- ~Go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: v0.60.0 → v0.65.0changed
- ~Go.uber.org/zap: v1.27.1 → v1.28.0changed
- ~Golang.org/x/crypto: v0.50.0 → v0.53.0changed
- ~Golang.org/x/exp: 8a7402a → 944ab1fchanged
- ~Golang.org/x/mod: v0.34.0 → v0.37.0changed
- ~Golang.org/x/net: v0.53.0 → v0.56.0changed
- ~Golang.org/x/sync: v0.20.0 → v0.22.0changed
- ~Golang.org/x/sys: v0.43.0 → v0.46.0changed
- ~Golang.org/x/telemetry: 579e4da → 59b4966changed
- ~Golang.org/x/term: v0.42.0 → v0.44.0changed
- ~Golang.org/x/text: v0.36.0 → v0.40.0changed
- ~Golang.org/x/time: v0.9.0 → v0.14.0changed
- ~Golang.org/x/tools/go/expect: v0.1.0-deprecated → v0.1.1-deprecatedchanged
- ~Golang.org/x/tools: v0.43.0 → v0.47.0changed
- ~Google.golang.org/genproto/googleapis/api: 9d38bb4 → afd174achanged
- ~Google.golang.org/genproto/googleapis/rpc: 9d38bb4 → afd174achanged
- ~Google.golang.org/grpc: v1.80.0 → v1.82.1changed
- ~Google.golang.org/protobuf: v1.36.11 → f2248acchanged
- ~K8s.io/api: v0.35.3 → v0.36.3changed
- ~K8s.io/apiextensions-apiserver: v0.35.3 → v0.36.3changed
- ~K8s.io/apimachinery: v0.35.3 → v0.36.3changed
- ~K8s.io/apiserver: v0.35.3 → v0.36.3changed
- ~K8s.io/client-go: v0.35.3 → v0.36.3changed
- ~K8s.io/cluster-bootstrap: v0.35.3 → v0.36.3changed
- ~K8s.io/code-generator: v0.35.3 → v0.36.3changed
- ~K8s.io/component-base: v0.35.3 → v0.36.3changed
- ~K8s.io/klog/v2: v2.130.1 → v2.140.0changed
- ~K8s.io/kms: v0.35.3 → v0.36.3changed
- ~K8s.io/kube-openapi: 589584f → 43fb72cchanged
- ~K8s.io/utils: bc988d5 → b8788abchanged
- ~Sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.31.2 → v0.34.0changed
- ~Sigs.k8s.io/controller-runtime: v0.23.3 → v0.24.1changed
- ~Sigs.k8s.io/structured-merge-diff/v6: v6.3.2 → v6.4.2changed
- +Cluster API is now using Golang 1.26, CR v0.24, CT v0.21added
- +Introduced dedicated Golang module for API typesadded
- +This new API module ensures consumers of the API typesadded
- +Stronger compatibility guarantees.added
- +Considerably smaller and tightly controlled dependency tree, thus reducing exposure to CVEs from dependencies.added
- +Formalization of policies and rules for Golang version bump, allowing a better response to Golang CVEs.added
- +See also the wider effort about code organization proposal + (#13910).added
- +Enable safe joining of nodes on older kubernetes versions with kubeadmadded
- +This feature removes a constraint preventing scale up, remediation and autoscaling of worker nodes during cluster rollouts,added
- +Improved observability on upgrades, Kubernetes version in-use and runtime extensions errors.added
- +Surface upgrade plan in cluster statusadded
- +Surface aggregated machine versions in statusadded
- +Surface Runtime Extension errors in cluster conditionsadded
- +More work to improve robustness and reliability of controllersadded
- +Improve forward etcd leadership in KCP, allowing the system to better handle partial failures during control plane machine deletionadded
- +Tolerate missing InfraTemplates during control plane machine deletion, allowing the system to tolerate accidental resource deletionadded
- +Allow KCP remediation of unhealthy machines during intermediate steps of chained upgradesadded
- +KCP is now able to cleanup not started etcd members after a machine is remediatedadded
- +Implement stale controller mitigation in all the relevant controllers (#13720, #13737,added
- +Allow remediation of unhealthy Machines managed by old MachineSets during in-place updatesadded
- +Perform draining and volume detachment once until completionadded
- +Use regular patch instead of SSA to patch Cluster in topology controlleradded
- +More work for reducing Cluster API memory footprint and for improving performance at scaleadded
- +Introduce options for cache tuning in ClusterCache clients, use those options to better control memory footprint in core CAPI, CABPK and KCP (#13780,added
- +Implement managedFields interningadded
- +Misc:added
- +Allow patching of metadata.{labels,annotations} through ClusterClass patchesadded
- +Kubernetes version validation now enforces strict semver compatibilityadded
- +Several changes to reduce E2E test durations while we keep adding new tests and improving test coverage of the existing ones.added
- +Add experimental clusterctl convert commandadded
- +API: Introduce separate API moduleadded
- +API: Move OpenAPI schema out of the api package to avoid direct dependency on kube-openapi in the api moduleadded
- +API: Surface aggregated machine versions in statusadded
- +Bootstrap: Write kubeadm control plane version file for workers to use to fetch the matching kubeadm binaryadded
- +CAPD: Introduce per-reconciler concurrency flags in CAPDevadded
- +CAPD: Migrate ClusterClass changes e2e test from the docker to the in-memory backendadded
- +CAPD: Migrate templates to use Dev* instead of Docker*added
- +Cluster: Use regular patch instead of SSA to patch Cluster in topology controlleradded
- +ClusterCache: Expose and use DefaultTransform on CacheOptionsadded
- +ClusterCache: Use DefaultTransform in core CAPI, CABPK and KCPadded
- +ClusterClass/KCP/MachineSet: Implement stale controller mitigation in KCP / MS / Cluster topology controlleradded
- +ClusterClass: Allow patching of metadata.{labels,annotations} through ClusterClass patchesadded
- +Clusterctl: Add cluster-api-provider-kubeswift to the built-in infrastructure provider listadded
- +Clusterctl: Add configuration ExternallyProvisioned for clusterctladded
- +Clusterctl: Add experimental clusterctl convert commandadded
- +Dependency: Bump Go 1.26added
- +E2e: Migrate ClusterClass rollout e2e test from the docker to the in-memory backendadded
- +E2e: Migrate ClusterClass upgrade with different NS e2e test from the docker to the in-memory backendadded
- +E2e: Migrate e2e tests from using Docker* resources to Dev* resourcesadded
- +E2e: Migrate test extension to use Dev* instead of Docker*added
- +E2e: Update in-place updating a workload cluster e2e test to use in-memory backendadded
- +E2e: Use in-memory template for clusterctl upgrade testsadded
- +KCP: Improve forward etcd leadershipadded
- +MachineDeployment/util: Stale controller mitigation in reconcile wrapper & MD controller, enable store & fifo informer metricsadded
- +Misc: Implement managedFields interningadded
- +Misc: Implement new code structureadded
- +CAPD: Add support for controller restart to in-memory backendadded
- +Clusterctl: Add cloudscale-ch-cloudscale provideradded
- +Clusterctl: Add oxide as an infrastructure provideradded
- +Devtools: Add Headlamp to Tilt dev environmentadded
- +Devtools: Add log dashboardadded
- +Devtools: Add Log dashboard to grafanaadded
- +Devtools: Enable prealloc linter & fix findingsadded
- +E2e: Enable opt-out of OwnerReferencesPermissionEnforcement admission controller & opt-out in clusterctl upgrade testsadded
- +KCP: Add kubeadm cluster roleadded
- +KCP: Allow KCP remediation on chained upgrade intermediate stepsadded
- +Misc: Add finalizer only after we got owner/clusteradded
- +Github.com/clipperhouse/displaywidth: v0.10.0added
- +Github.com/clipperhouse/stringish: v0.1.1added
- +Github.com/clipperhouse/uax29/v2: v2.6.0added
- +K8s.io/streaming: v0.36.3added
- *CAPD: Fix a panic in CAPDev cache.Get()fixed
- *CAPD: Fix CAPD flakesfixed
- *CAPD: Fix E2E host port binding lookupfixed
- *CAPIM: Fix deadlock in in-memory serverfixed
- *ClusterClass: Fix Machine taint propagation in the Cluster topology controller for the v1beta1 contractfixed
- *Clusterctl: Detect cert-manager image changes during upgradefixed
- *Clusterctl: Fix v1beta1 describe output streamfixed
- *Clusterctl: Raise management cluster client QPS and Burstfixed
- *Clusterctl: Reject incomplete GitHub release asset URLsfixed
- *Clusterctl: Skip update check for clusterctl completionfixed
- *Clusterctl: Trim whitespace in --show-conditions filtersfixed
- *Devtools: Fix Grafana deploymentfixed
- *Devtools: Fix parallel build of binaries in Tiltfilefixed
- *Devtools: Fix Tilt kube-state-metrics deploymentfixed
- *E2e: Fix ClusterClass rollout test with k8s latestfixed
- *E2e: Fix PrettyPrint in WaitForControlPlaneToBeReadyfixed
- *E2e: Fix self-hosted testfixed
- *KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembersfixed
- *KCP: Fix KCP in-place update with InfraMachine webhooks with immutability validationfixed
- *KCP: KCP deletion should tolerate missing InfraTemplatesfixed
- *Machine/Bootstrap: Perform draining and volume detachment once until completionfixed
- *MachineDeployment: Fix nil pointer panic when paused with no matching MachineSetfixed
- *MachineSet: Delete unhealthy Machines of old MS during in-place updatesfixed
- *MachineSet: Fix retry to remove finalizer in MS topology reconcilerfixed
- *Testing: Fix TestHealthCheckTargets flakefixed
- *CABPK: Prevent CABPK to override controlling ownerRef for bootstrap secretsfixed
- *Clusterctl/Misc: Avoid building if LDFLAGS returns error checking for SemVerfixed
- *Devtools: Fix gosec lint findingsfixed
- *Misc: Correct typos in comments and error messagesfixed
- *Misc: Fix static check lint errorsfixed
- ·Management Cluster: v1.33.x -> v1.36.xother
- ·Workload Cluster: v1.31.x -> v1.36.xother
- ·258 new commits mergedother
- ·4 breaking changes :warning:other
- ·28 feature additions ✨other
- ·28 bugs fixed 🐛other
- ·API/Runtime SDK/IPAM/MachinePool/MachineSet/MachineDeployment: Fix typos in generated CRD descriptionsother
- ·API: Adjust IsMachineDeploymentUpgrading to detect in-place upgradesother
- ·API: Follow-ups for Surface aggregated machine versions in statusother
- ·API: Surface upgrade plan in cluster statusother
- ·Bootstrap: Limit size of files generated from templatesother
- ·CABPK: Use ClusterClass with RuntimeSDK in kubeadm join old Node e2e test & fix e2e test failuresother
- ·CAPD: Only add finalizer after InfraMachine has owner in CAPDevother
- ·CAPD: Partially revert fix self-hosted testother
- ·ClusterCache/Misc: Block ExecProvider/AuthProvider in ClusterCache, deprecate remote funcsother
- ·ClusterCache: Cleanup ClusterCache metrics for deleted Clustersother
- ·ClusterClass: Increase MD/MS topology reconciler concurrency to 25other
- ·Clusterctl: Bump Cert-manager v1.20.2other
- ·Clusterctl: Harden clusterctl moveother
- ·Clusterctl: Print help on argument validation errorsother
- ·Control-plane: Align scale validator to upstreamother
- ·Control-plane: Verify etcd serving certificate against the etcd CAother
- ·Dependency: 1.26.3other
- ·Dependency: Bump envtest 1.36other
- ·Devtools: Upgrade tempo & fix configurationother
- ·Devtools: Verify mdbook shaother
- ·E2e: Bump autoscaler version used for testingother
- ·E2e: Cleanup of ControlPlaneKubeletLocalMode handling in KCP adoption testother
- ·E2e: Cleanup unused e2e test templatesother
- ·E2e: Give resource versions more time to become stable in e2e testsother
- ·E2e: Increase clusterctl and e2e test dry-run cluster-template timeoutsother
- ·E2e: Start testing against Kubernetes v1.37other
- ·E2e: Start testing with K8s 1.36.0other
- ·E2e: Start testing with Kubernetes v1.36.0-rc.0other
- ·E2e: Start testing with Kubernetes v1.36.0-rc.1other
- ·E2e: Use only 1 worker machine per MD/MP in RuntimeSDK e2e testother
- ·E2e: Use Runtime SDK for kcp-infra-adoption e2e testother
- ·KCP: KCP cleanup etcd members not started after a machine is remediatedother
- ·KCP: KCP enforce context deadline on connection streamother
- ·MachineDeployment: Extend stale controller mitigation in MD controller to MS deletionother
- ·MachinePool: Unit testing to determine if provider allows individual machines to be deleted.other
- ·MachineSet: Cleanup orphaned BoostrapConfigs / InfraMachines in MS controllerother
- ·MachineSet: Consider MS skip preflight check annotation from BootstrapConfigTemplateother
- ·Misc: Replace reflect.Ptr with reflect.Pointerother
- ·Misc: Stop setting TypeMeta in typed objects (part II)other
- ·Misc: Update Kubernetes bump issue templateother
- ·Misc: Use pkgerrors as alias for github.com/pkg/errors & no alias for errorsother
- ·Runtime SDK: Add 20 MB read limits for Runtime SDK client & serverother
- ·Runtime SDK: Do not follow redirects when calling runtime extensionsother
- ·Runtime SDK: Surface Runtime Extension errors in conditionsother
- ·Testing: Update version matrix for GitHub workflows for release 1.13other
- ·Util: Switch CRD migrator to use merge patchother
39 maintenance lines (dependency bumps, CI, tests, docs)
- ·Remove YEAR from copyright header boilerplatemaintenance
- ·Prepare main branch for v1.14 developmentmaintenance
- ·Fix verify docker images archmaintenance
- ·Revert unset GOCACHE env varmaintenance
- ·Add cron buckets to prow generatormaintenance
- ·Add KCP infra adoption testmaintenance
- ·Add stable BuildKit cache mount IDsmaintenance
- ·Cleanup ./scripts foldermaintenance
- ·Cleanup golangci-lint excludesmaintenance
- ·Drop jobs on release-1.11maintenance
- ·Fix link in cloudbuild.yaml'smaintenance
- ·Fix linter findings in hack/toolsmaintenance
- ·Harden git workflowsmaintenance
- ·Make it possible to exclude CVEs with govulncheckmaintenance
- ·Migrate from import boss to depguardmaintenance
- ·Read permissions for pr-verify actionmaintenance
- ·Replace deprecated gaurav-nelson/github-action-markdown-link-check with tcort forkmaintenance
- ·Revert "Migrate away from custom GitHub action approval workflow"maintenance
- ·Stop running make lint-api multiple times in the GitHub actionmaintenance
- ·Clusterctl: Bump cert-manager to v1.20.3maintenance
- ·Clusterctl: Bump cert-manager to v1.21.0maintenance
- ·Clusterctl: Bump cert-manager to v1.21.1maintenance
- ·Control-plane: Add additional test cases for EnsureKubeadmPermissionsmaintenance
- ·Dependency: Bump go to v1.26.4maintenance
- ·Dependency: Bump Go to v1.26.5maintenance
- ·Dependency: Bump golang/x/net to 0.55.0maintenance
- ·Devtools: Bump headlamp CAPI plugin to 0.2.0-beta.0maintenance
- ·Devtools: Bump setup-envtest to v0.24.1maintenance
- ·E2e: Add options to runtimesdk e2e testmaintenance
- ·E2e: Bump Kubernetes version used for testing to v1.37.0-beta.0maintenance
- ·E2e: Bump to kind main to fix e2e testsmaintenance
- ·E2e: Bump to kind v0.32.0maintenance
- ·E2e: Fix E2E chained upgrademaintenance
- ·KCP: Update RemoveEtcdMember to accept a *etcd.Member instead of a member namemaintenance
- ·Add Code Freeze date field to provider_issues.go to be used for beta communicationmaintenance
- ·Add workaround for generate release notesmaintenance
- ·Optimize go build in make release-binarymaintenance
- ·Report consistency errors in release note draftmaintenance
- ·Testing: Add a test case to confirm that kcp can safely remove a member when it doesn't have a corresponding machine but it has no alarmmaintenance
295 lines4 security10 removed6 deprecated71 added79 changed32 fixed53 other40 maintenancetyped from the source notes
v1.13.52026-08-11patchsecurity+~~~~~~~~~~~~~~~**!sharesource - !Dependency: Bump golang.org/x/text to v0.39.0, cel-go to v0.29.0 and grpc to v1.82.1 to address security advisoriessecurity
- ~Github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.31.0 → v1.32.0changed
- ~Github.com/antlr4-go/antlr/v4: v4.13.0 → v4.13.1changed
- ~Github.com/cncf/xds/go: ee656c7 → dba9d58changed
- ~Github.com/coredns/corefile-migration: v1.0.32 → v1.0.34changed
- ~Github.com/envoyproxy/go-control-plane/envoy: v1.36.0 → v1.37.0changed
- ~Github.com/envoyproxy/protoc-gen-validate: v1.3.0 → v1.3.3changed
- ~Github.com/go-jose/go-jose/v4: v4.1.3 → v4.1.4changed
- ~Github.com/google/cel-go: v0.26.0 → v0.29.0changed
- ~Go.opentelemetry.io/contrib/detectors/gcp: v1.39.0 → v1.43.0changed
- ~Golang.org/x/exp: 8a7402a → 9b4947dchanged
- ~Golang.org/x/mod: v0.36.0 → v0.37.0changed
18 more lines
- ~Golang.org/x/net: v0.55.0 → v0.56.0changed
- ~Golang.org/x/telemetry: 42602be → 59b4966changed
- ~Golang.org/x/text: v0.38.0 → v0.39.0changed
- ~Golang.org/x/tools: v0.45.0 → v0.47.0changed
- ~Google.golang.org/genproto/googleapis/api: 9d38bb4 → afd174achanged
- ~Google.golang.org/genproto/googleapis/rpc: 9d38bb4 → afd174achanged
- ~Google.golang.org/grpc: v1.80.0 → v1.82.1changed
- +Clusterctl: Add oxide as an infrastructure provideradded
- *CAPD: Fix a panic in CAPDev cache.Get()fixed
- *ClusterClass: Fix Machine taint propagation in the Cluster topology controller for the v1beta1 contractfixed
- ·Management Cluster: v1.32.x -> v1.36.xother
- ·Workload Cluster: v1.30.x -> v1.36.xother
- ·13 new commits mergedother
- ·2 bugs fixed 🐛other
- ·Clusterctl: Harden clusterctl moveother
- ·E2e: Bump autoscaler version used for testingother
- ·E2e: Increase clusterctl and e2e test dry-run cluster-template timeoutsother
- ·KCP: KCP enforce context deadline on connection streamother
4 maintenance lines (dependency bumps, CI, tests, docs)
- ·Clusterctl: Bump cert-manager to v1.21.0maintenance
- ·Clusterctl: Bump cert-manager to v1.21.1maintenance
- ·E2e: Bump Kubernetes version used for testing to v1.37.0-beta.0maintenance
- ·KCP: Bump corefile-migration to v1.0.34maintenance
34 lines1 security1 added18 changed2 fixed8 other4 maintenancetyped from the source notes
- !Trivyignore CVE-2026-56852security
- !Dependency: Bump x/text to v0.39.0, otel to v1.41.0, cel-go to v0.29.0 and grpc to v1.82.1 to address security advisoriessecurity
- ~Github.com/antlr4-go/antlr/v4: v4.13.0 → v4.13.1changed
- ~Github.com/coredns/corefile-migration: v1.0.32 → v1.0.34changed
- ~Github.com/google/cel-go: v0.26.0 → v0.29.0changed
- ~Golang.org/x/exp: 8a7402a → 9b4947dchanged
- *CAPD: Fix a panic in CAPDev cache.Get()fixed
- ·Management Cluster: v1.31.x -> v1.36.xother
- ·Workload Cluster: v1.29.x -> v1.36.xother
- ·9 new commits mergedother
- ·1 bug fixed 🐛other
- ·Clusterctl: Harden clusterctl moveother
3 more lines
- ·E2e: Bump autoscaler version used for testingother
- ·E2e: Increase clusterctl and e2e test dry-run cluster-template timeoutsother
- ·KCP: KCP enforce context deadline on connection streamother
2 maintenance lines (dependency bumps, CI, tests, docs)
- ·Clusterctl: Bump cert-manager to v1.21.0maintenance
- ·KCP: Bump corefile-migration to v1.0.34maintenance
17 lines2 security4 changed1 fixed8 other2 maintenancetyped from the source notes
- ~Golang.org/x/crypto: v0.51.0 → v0.53.0changed
- ~Golang.org/x/mod: v0.35.0 → v0.36.0changed
- ~Golang.org/x/sync: v0.20.0 → v0.21.0changed
- ~Golang.org/x/sys: v0.45.0 → v0.46.0changed
- ~Golang.org/x/telemetry: be6f6cb → 42602bechanged
- ~Golang.org/x/term: v0.43.0 → v0.44.0changed
- ~Golang.org/x/text: v0.37.0 → v0.38.0changed
- ~Golang.org/x/tools: v0.44.0 → v0.45.0changed
- *Clusterctl: Raise management cluster client QPS and Burstfixed
- *E2e: Bump kind image in clusterctl v1.10 upgrade test to avoid containerd segvfixed
- *E2e: Fix PrettyPrint in WaitForControlPlaneToBeReadyfixed
- *MachineSet: Delete unhealthy Machines on old MS during in-place updatesfixed
4 more lines
- ·Management Cluster: v1.32.x -> v1.36.xother
- ·Workload Cluster: v1.30.x -> v1.36.xother
- ·7 new commits mergedother
- ·4 bugs fixed 🐛other
3 maintenance lines (dependency bumps, CI, tests, docs)
- ·Clusterctl: Bump cert-manager to v1.20.3maintenance
- ·Dependency: Bump Go version to v1.25.12maintenance
- ·Dependency: Bump golang.org/x/crypto version to v0.53.0maintenance
19 lines8 changed4 fixed4 other3 maintenancetyped from the source notes
- +Dependency: Add CVEs to .trivyignoreadded
- *E2e: Bump kind image in clusterctl v1.10 upgrade test to avoid containerd segvfixed
- *E2e: Fix PrettyPrint in WaitForControlPlaneToBeReadyfixed
- ·Management Cluster: v1.31.x -> v1.36.xother
- ·Workload Cluster: v1.29.x -> v1.36.xother
- ·5 new commits mergedother
- ·2 bugs fixed 🐛other
2 maintenance lines (dependency bumps, CI, tests, docs)
- ·Clusterctl: Bump cert-manager to v1.20.3maintenance
- ·Dependency: Bump Go version to v1.25.12maintenance
9 lines1 added2 fixed4 other2 maintenancetyped from the source notes
v1.13.32026-06-23patchsecurity++~~~~~~~~~**!sharesource - !Grant RBAC to support OwnerReferencesPermissionEnforcement admission controllersecurity
- ~E2e: Make the clusterctl upgrade management cluster control plane count configurablechanged
- ~Golang.org/x/crypto: v0.50.0 → v0.51.0changed
- ~Golang.org/x/mod: v0.34.0 → v0.35.0changed
- ~Golang.org/x/net: v0.53.0 → v0.55.0changed
- ~Golang.org/x/sys: v0.43.0 → v0.45.0changed
- ~Golang.org/x/telemetry: 579e4da → be6f6cbchanged
- ~Golang.org/x/term: v0.42.0 → v0.43.0changed
- ~Golang.org/x/text: v0.36.0 → v0.37.0changed
- ~Golang.org/x/tools: v0.43.0 → v0.44.0changed
- +ClusterCache: Expose DefaultTransform on CacheOptionsadded
- +Misc: Add finalizer only after we got owner/clusteradded
7 more lines
- *Clusterctl: Skip update check for clusterctl completionfixed
- *KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembersfixed
- ·Management Cluster: v1.32.x -> v1.36.xother
- ·Workload Cluster: v1.30.x -> v1.36.xother
- ·14 new commits mergedother
- ·1 feature addition ✨other
- ·3 bugs fixed 🐛other
7 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump gcb-docker-gcloud imagemaintenance
- ·Dependency: Bump go to v1.25.11maintenance
- ·Dependency: Bump golang/x/net to 0.55.0maintenance
- ·E2e: Bump to kind main to fix e2e testsmaintenance
- ·E2e: Bump to kind v0.32.0maintenance
- ·E2e: Bump to kind v0.32.0maintenance
- ·KCP: Update RemoveEtcdMember to accept a *etcd.Member instead of a member namemaintenance
26 lines1 security2 added9 changed2 fixed5 other7 maintenancetyped from the source notes
- !Grant RBAC to support OwnerReferencesPermissionEnforcement admission controllersecurity
- +Dependency: Add GO-2026-5026 to .govuln_excludeadded
- *Clusterctl: Skip update check for clusterctl completionfixed
- ·Management Cluster: v1.31.x -> v1.36.xother
- ·Workload Cluster: v1.29.x -> v1.36.xother
- ·5 new commits mergedother
- ·2 bugs fixed 🐛other
2 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump gcb-docker-gcloud imagemaintenance
- ·Dependency: Bump go to v1.25.11maintenance
9 lines1 security1 added1 fixed4 other2 maintenancetyped from the source notes
9 older releases
| v1.13.2 | 2026-05-13 | patch | +~** 14 lines |
| v1.12.8 | 2026-05-13 | patch | +~~** 15 lines |
| v1.11.11 | 2026-05-13 | patch | +~ 6 lines |
| v1.13.1 | 2026-04-28 | patch | ~~~~~~~~~~~ 16 lines |
| v1.13.0 | 2026-04-21 | minor | breakingsecurity ++++~~~~~~~~---****! 293 lines |
| v1.12.7 | 2026-04-21 | patch | ** 10 lines |
| v1.11.10 | 2026-04-21 | patch | * 7 lines |
| v1.12.5 | 2026-04-08 | minor | security +~~~~~~~~***! 26 lines |
| v1.11.8 | 2026-04-08 | patch | security +~~~~~~~**! 21 lines |