See the full kOps 1.37 release notes for details, including breaking changes and deprecations.

Highlights

• Kubernetes 1.37 support, with etcd 3.7.3 as the default for Kubernetes 1.37 clusters
• Private asset repositories in cloud object storage: s3://, gs://, and azureblob:// URLs for KOPS_BASE_URL and spec.assets.fileRepository, with nodes authenticating through their instance identity
• Smaller and more resilient node bootstrap: the nodeup download drops from about 120 MB to under 10 MB, through a smaller binary and xz compression, and bootstrap retries failed tasks
• Container runtime: containerd 2.3.6 and runc 1.5.1 by default, with containerd configuration version 4; containerd versions older than 2.1.0 are no longer supported
• Karpenter expansion: Karpenter v1.15.1, kOps-managed interruption handling (SQS queue and EventBridge rules), root volume settings in EC2NodeClass, instanceRequirements support, and mixed GPU and non-GPU instance groups
• Narrower AWS IAM permissions for the instance roles (Route 53, KMS, EC2, SQS), and no inline policies for roles that need no permissions
• etcd-manager changes: bundled etcd images mounted as image volumes, and support for custom etcd versions from a user-supplied image on new clusters
• Networking: Calico v3.32.3 with the move to ClusterNetworkPolicy, network policy support for AWS VPC CNI, kube-router v2.12.0 with an experimental nftables network policy backend, and kindnet v1.0.3
• Azure: bootstrap requests authenticated with signed instance metadata, kops rolling-update cluster detection of outdated VMs, and two cloud-controller-manager replicas on highly available control planes
• Akamai (Linode): the experimental provider now manages SSH keys, networks, subnets, instances, and block-storage volumes
• Component updates: etcd-manager v3.0.20261022 with etcd 3.5.35/3.6.16/3.7.3, Cilium v1.18.16, AWS VPC CNI v1.23.2, CoreDNS v1.15.0, AWS Load Balancer Controller v3.6.2, cert-manager v1.21.3, cluster-autoscaler v1.37.0
• Removed: support for Kubernetes 1.31, gossip DNS (and protokube), AWS Classic Load Balancers for the API, and Kopeio networking. Migrate with kOps 1.36 before the upgrade

What's Changed

• Support etcd 3.7.0-rc.0 and allow overriding the etcd version in the scalability scenario by @Jefftree in #18458
• Enable misspell in golangci-lint by @ameukam in #17578
• e2e: Filter random AZ selection by instance type availability by @rifelpet in #18463
• azure: Use IMDS attested metadata document for node identity by @hakman in #18163
• gce: fix backend service ownership filtering during delete by @carterpewpew in #18460
• aws: Reconcile target group health check changes on existing target groups by @hakman in #18467
• gce: Reconcile HTTP health check changes on existing health checks by @hakman in #18468
• Improve Google Storage Bucket support. by @cheftako in #18466
• Enable gosec and gocritic by @ameukam in #18470
• Add serathius as scalability test owner by @Jefftree in #18475
• feat(linode): implement SSH key management and associated tasks by @moshevayner in #18383
• Added support for APIServer using LB by @cheftako in #18459
• chore(channels): bump k8s versions in alpha channel by @moshevayner in #18477
• Upgrade Karpenter to v1.13.0 by @hakman in #18479
• scaletest: Report experiment variant into scalability run metadata by @Jefftree in #18476
• channels: Add Kubernetes 1.36.0 support by @hakman in #18480
• gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18484
• e2e: Skip ImageVolume tests on COS 121 by @rifelpet in #18483
• Register Karpenter nodes with karpenter.sh/unregistered taint by @hakman in #18486
• Add missing EC2 read permissions to Karpenter IAM policy by @hakman in #18487
• scaletest: report experiment variant after kubetest2 runs by @Jefftree in #18485
• nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18478
• API only CLI by @cheftako in #18482
• Fixing LB behavior when you have both APIServer and Control Plane. by @cheftako in #18496
• Remove namespace from DO ClusterRole by @rifelpet in #18498
• chore(channels): promote to stable, bump node images, update recommended kOps versions by @hakman in #18501
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #18505
• scaletest: bind etcd metrics to all interfaces by @Jefftree in #18503
• e2e: test the PR's own channels, not master's by @hakman in #18504
• tests/e2e: refine externalTrafficPolicy=Local and hostNetwork skips by @rifelpet in #18509
• Allow setting missing slice elements from the command line by @hakman in #18511
• Add managed Karpenter EC2NodeClass and NodePool by @hakman in #18497
• tests/e2e: skip implement-NodePort ETP=Local test on more CNIs by @rifelpet in #18515
• chore(channels): pin Azure noble image to a deployable version by @hakman in #18516
• Switching from comparison on Role to helper. by @cheftako in #18514
• tests/e2e: also skip implement-NodePort ETP=Local test on calico+GCE by @rifelpet in #18517
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #18518
• Make cloud-controller-manager pods tolerate all taints by @rifelpet in #18510
• Add an experimental roles feature flag. by @cheftako in #18519
• azure: Scope nodes-to-API NSG rules to the NAT gateway public IP by @hakman in #18522
• fix: use JoinHostPost to tolerate IPv6 addresses by @justinsb in #18526
• azure: Bump azuredisk-csi-driver to v1.34.4 by @hakman in #18527
• chore: update syntax of CLAUDE.md by @justinsb in #18532
• azure: Bump azure-cloud-controller-manager to v1.36.2 by @hakman in #18529
• azure: Grant control-plane VMSS Contributor instead of Owner by @hakman in #18533
• coredns: Honor node taints in hostname topologySpreadConstraint by @hakman in #18535
• hetzner: fix Cluster Autoscaler node group membership by @hakman in #18538
• Expose GCP project as PROJECT env for ClusterLoader2 on GCE by @rifelpet in #18537
• tests/e2e: skip implement-NodePort ETP=Local test on calico+Azure by @hakman in #18540
• Update cluster-autoscaler to v1.36.0 by @hakman in #18541
• gce: register all zonal MIGs of a multi-zone instance group with cluster-autoscaler by @hakman in #18543
• Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18546
• pkg/assets: keep container registry clients out of runtime binaries by @hakman in #18554
• clusterapi: fix build by making gen.go a library package by @hakman in #18553
• Support running custom etcd versions by setting version and image by @hakman in #18525
• Default to etcd 3.7.0 for Kubernetes 1.37+ by @Jefftree in #18557
• feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @wkrysmann in #18556
• dump: grant SSH access to Karpenter nodes via EC2 Instance Connect by @hakman in #18563
• etcd-manager: upgrade to v3.0.20260707 by @hakman in #18560
• dns-controller: always apply the addon, empty when unused by @hakman in #18567
• Replace fi.PtrTo with new() builtin by @hakman in #18549
• Build with disable_grpc_modules tag to shrink binaries by @hakman in #18552
• nodeup: reduce binary size by decoupling from cloudup awsup by @hakman in #18571
• nodeup: remove the full Kubernetes API scheme and cloud providers from the binary by @hakman in #18572
• scalability: expose events-etcd metrics ...

What's Changed

• Automated cherry pick of #18711: Update Go to 1.26.6 and bump golang.org/x modules by @hakman in #18712
• Automated cherry pick of #18727: Disable kindnet DNS caching by default by @rifelpet in #18729
• Automated cherry pick of #18724: nodeup: install kernel-modules-extra on RHEL10-family nodes by @rifelpet in #18733
• Automated cherry pick of #18701: Update Calico to v3.31.6 by @rifelpet in #18758
• Automated cherry pick of #18780: fix(pki): drop legacy keyset aliases by @hakman in #18782
• Manual cherry pick of #18788: chore(deps): update Go to 1.27.1 and golang.org/x modules by @hakman in #18793
• Automated cherry pick of #18789: fix: discover NLB IPs with Terraform by @hakman in #18791
• Automated cherry pick of #18819: containerd: set override_path for registry mirrors with a path by @hakman in #18824
• Automated cherry pick of #18827: Move olemarkus and zetaab to emeritus approvers by @hakman in #18848
• build: bump Go to 1.27.3 and update golang.org/x dependencies by @hakman in #18891
• Automated cherry pick of #18899: openstack: Increase timeout for instances by @hakman in #18913
• [release-1.36] Update etcd and etcd-manager by @hakman in #18916
• Automated cherry pick of #18579: aws: Add metrics port 9999 to pod-identity-webhook Service
  #18805: aws: update pod-identity-webhook to v0.6.17
  #18924: aws: update pod-identity-webhook to v0.6.19 by @hakman in #18926
• Automated cherry pick of #18887: fix(metal): disable aws-cli request checksums for mock S3 uploads
  #18941: feat(kubelet): add nodeStatusReportFrequency to the kubelet spec by @hakman in #18947
• Manual cherry pick: tests: derive the expected integration test files from the test data by @hakman in #18957
• Automated cherry pick of #18955: fix(aws): only update ASG MaxInstanceLifetime when it changes by @hakman in #18959
• Manual cherry pick: test: name the kOps version of the integration tests by @hakman in #18960
• Automated cherry pick of #18829: fix: reject partial Terraform updates
  #18850: aws: Keep warm pool permissions when updating only the control plane
  #18851: Fix Azure and Hetzner API load balancers when updating some instance groups
  #18855: Keep the nvidia and gVisor addons when updating only some instance groups
  #18952: aws: Keep Karpenter NodePools when updating only some instance groups by @hakman in #18962
• Automated cherry pick of #18856: Keep the GCE API load balancer when updating only some instance groups by @hakman in #18966
• Automated cherry pick of #18970: Update Cilium to v1.18.16 by @hakman in #18972
• Automated cherry pick of #18969: Update Calico to v3.32.3 by @hakman in #18978
• Automated cherry pick of #18679: coredns: Tighten PDB to maxUnavailable 33% and always allow unhealthy pod eviction
  #18980: Update coredns to v1.15.0 by @hakman in #18982
• Automated cherry pick of #18635: Enable nri mounting on kindnet in kops
  #18817: Update kindnet to v1.0.2
  #18984: Update kindnet to v1.0.3 by @hakman in #18986
• Automated cherry pick of #18775: Update CCM and CSI versions
  #18974: chore: Update CSI drivers to latest upstream releases
  #18988: chore: Update CCMs to latest upstream releases by @hakman in #18990
• Automated cherry pick of #18894: bump aws lb controller to v3.6 and allow the customization of the defaultloadbalancerscheme
  #18919: Update AWS Load Balancer Controller to v3.6.2 by @hakman in #18994
• Automated cherry pick of #18968: Update cluster-autoscaler to v1.37.0 by @hakman in #18992
• Automated cherry pick of #18929: Update aws-iam-authenticator to v0.7.24 by @hakman in #18993
• Manual cherry pick: Upgrade Karpenter to v1.15.1 by @hakman in #18995
• Automated cherry pick of #18996: Update metrics-server to v0.9.1 by @hakman in #19000
• Automated cherry pick of #18997: Update cert-manager to v1.21.3 by @hakman in #19003
• Automated cherry pick of #19001: chore: Remove unused metadata-proxy addon by @hakman in #19004
• Automated cherry pick of #18998: Update external-dns to v0.24.0 by @hakman in #19007
• Automated cherry pick of #19008: Default to cluster-autoscaler v1.37.0 for k8s 1.34+ and v1.34.6 for older by @hakman in #19010
• Manual cherry pick: Switching from comparison on Role to helper by @hakman in #19014
• Automated cherry pick of #18857: Fix security groups when updating only some instance groups by @hakman in #19018
• Automated cherry pick of #18860: Keep the cluster-autoscaler node groups when updating only some instance groups by @hakman in #19019
• Release 1.36.3 by @hakman in #19023

Full Changelog: v1.36.2...v1.36.3

See the full kOps 1.37 release notes for details, including breaking changes and deprecations.

What's Changed

• docs: update 1.36 release notes by @hakman in #18592
• fix: retry listing cloud resources in kops delete cluster by @hakman in #18595
• hack: parallelize GitHub release promotion and add checksum validation by @hakman in #18594
• feat(linode): Refactor VPC model into broader Network model, and add subnet task by @moshevayner in #18590
• chore: Remove support for Kubernetes 1.31 by @hakman in #18598
• docs: update 1.36 release notes post-release by @hakman in #18599
• nodeup: don't mutate the cluster spec when clearing authenticator config by @hakman in #18600
• azure: allow kindnet pod CIDR to reach the kube-apiserver by @hakman in #18604
• Replace gsutil with gcloud storage by @hakman in #18609
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #18611
• Adding suitable control plane machine for gce by @YahiaBadr in #18612
• Allow specifying number of nodes that can be unready during validation by @Jefftree in #18614
• chore(networking): bump aws-cni to v1.22.3 by @moshevayner in #18615
• Tolerate unready nodes during scalability test validation by @Jefftree in #18616
• aws: remove support for Classic Load Balancer for the API by @hakman in #18617
• chore(channels): bump k8s and Ubuntu AMI versions in alpha channel by @moshevayner in #18621
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #18626
• gce: open control-plane node-exporter port (tcp/9100) by @Jefftree in #18620
• aws: add option for IP-based node names by @hakman in #18632
• aws: allow shared subnets to omit the zone by @hakman in #18630
• hetzner: Ignore WellKnownServices when comparing load balancers by @krillerdk in #18631
• Enable nri mounting on kindnet in kops by @michaelasp in #18635
• azure: support terraform provider azurerm v5 by @hakman in #18636
• Update hcloud-go/v2 to latest version (v2.47.0) by @krillerdk in #18638
• gce: download nodeup from private GCS buckets with curl by @hakman in #18623
• aws: do not set the primary network interface to "Unmanaged=yes" by @hakman in #18642
• rolling-update: restore 5s delay between pod eviction retries by @hakman in #18641
• Remove support for gossip DNS by @hakman in #18601
• etcd-manager: compute kops-utils-cp image at use time by @hakman in #18645
• chore(channels): Promote alpha to stable channel by @moshevayner in #18647
• aws: Default to AWS CCM v1.36.1 for all k8s versions by @rifelpet in #18649
• chore(networking): bump aws-cni to version 1.22.4 by @moshevayner in #18648
• Remove gossip leftovers by @hakman in #18650
• Remove the protokube binary by @hakman in #18653
• docs: gossip removal in kOps 1.37 and migration guide by @hakman in #18651
• Narrow instance cloud permissions to actual consumers by @hakman in #18654
• Narrow instance describe permissions by @hakman in #18656
• Clean up remaining gossip removal leftovers by @hakman in #18658
• Adding dynamic channel labels by @cheftako in #18640
• fix(channels): only treat known ready conditions as health signals by @argoyle in #18657
• aws: download nodeup from private S3 buckets with curl by @hakman in #18661
• scaletest: Align kops scalability configuration with kube-up for scheduler QPS/BURST by @ronaldngounou in #18080
• azure: download nodeup from Blob Storage with curl by @hakman in #18666
• Do not upload stale images. by @cheftako in #18665
• scaletest: Align kops scalability configuration with kube-up for CCM concurrentNodeSyncs by @ronaldngounou in #18082
• docs: remove seccomp feature gate by @eshaanm25 in #17954
• Install CNI plugins bundle for chained Cilium by @rdebnath-x-ion in #18589
• Validate Kubernetes feature gate input during cluster creation by @fallintoplace in #18408
• Register completion func for kubernetes-feature-gates flag by @hakman in #18667
• azure: detect VMs needing update from latestModelApplied by @hakman in #18669
• aws: Generate EC2NodeClass block device mapping for root volume by @danports in #18655
• iam: do not mutate Policy.Statement in AsJSON() by @hakman in #18672
• tests/e2e: use gs:// base URL only for kops versions supporting it by @hakman in #18670
• aws: Restrict KMS permissions to service-mediated calls by @hakman in #18671
• Cap the kops-controller bootstrap retry backoff, and verify the e2e upgrade actually rolls by @rifelpet in #18675
• kube-dns: use policy/v1 for PodDisruptionBudget by @hakman in #18678
• coredns: Tighten PDB to maxUnavailable 33% and always allow unhealthy pod eviction by @hakman in #18679
• tests/e2e: drop the deprecated KOPS_CONTROL_PLANE_SIZE fallback by @rifelpet in #18682
• tests/e2e: honor KOPS_EXTRA_FLAGS in the karpenter scenario by @rifelpet in #18681
• containerd: default to 2.3.4 / runc 1.4.3 by @hakman in #18683
• Fix node bootstrap in IPv6-only clusters with --dns=none by @rifelpet in #18684
• tests/e2e: resolve SSH keys the same way on every cloud by @rifelpet in #18686
• tests/integration: remove stale privateweave fixtures by @hakman in #18689
• feat(linode): Add Linode (Akamai) instance management capabilities by @moshevayner in #18622
• Makefile: build with grpcnotrace to reduce binary size by @hakman in #18687
• etcd-manager: remove kops-utils-cp and use image volumes on all supported Kubernetes versions by @hakman in #18688
• upup/pkg/fi: use literal method names for task dispatch by @hakman in #18690
• gce: open the etcd events metrics port in the node-to-master firewall by @Jefftree in #18685
• refactor: Rename Linode references to Akamai (Linode) across the codebase by @moshevayner in #18691
• chore(networking): bump aws-cni to version 1.23.0 by @moshevayner in #18692
• iam: grant ec2:DescribeSecurityGroups for AWS VPC CNI by @hakman in #18693
• refactor(linode): build SSH keys with instances by @moshevayner in #18694
• fix(akamai): Fix Akamai (Linode) Instance tag filter function by @moshevayner in #18696
• digitalocean: delete SSH keys when deleting a cluster by @rifelpet in #18697
• aws: report the SSH user for Rocky Linux instances by @rifelpet in #18698
• tests/e2e: determine the SSH user from the cluster when not configured by @rifelpet in #18699
• feat(akamai): Add volume task and extend cloud interface & mock for volume mgmt by @moshevayner in #18700
• Update Calico to v3.31.6 by @hakman in #18701
• Update Cilium to v1.18.12 by @hakman in #18702
• Upgrade kube-router to v2.11.0 by @hakman in #18703
• Update Flannel to v0.28.9 by @hakman in #18704
• Update default CNI plugins version to v1.7.1 / v1.8.0 / v1.9.1 by @hakman in #18705
• Upgrade kube-router to v2.11.1 and add UseNFTablesForN...

What's Changed

• Automated cherry pick of #18636: azure: support terraform provider azurerm v5 by @hakman in #18637
• Automated cherry pick of #18638: Update hcloud-go/v2 to latest version (v2.47.0) by @hakman in #18639
• Automated cherry pick of #18641: rolling-update: restore 5s delay between pod eviction retries by @hakman in #18643
• Automated cherry pick of #18642: aws: do not set the primary network interface to "Unmanaged=yes" by @hakman in #18644
• Automated cherry pick of #18645: etcd-manager: compute kops-utils-cp image at use time by @hakman in #18646
• Automated cherry pick of #18649: aws: Default to AWS CCM v1.36.1 for all k8s versions by @rifelpet in #18652
• Automated cherry pick of #18657: fix(channels): only treat known ready conditions as health signals by @hakman in #18659
• Automated cherry pick of #18655: Generate EC2NodeClass block device mapping for root volume by @hakman in #18673
• Release 1.36.2 by @hakman in #18674

Full Changelog: v1.36.1...v1.36.2

What's Changed

• Automated cherry pick of #18600: nodeup: don't mutate the cluster spec when clearing authenticator config by @rifelpet in #18602
• Automated cherry pick of #18631: hetzner: Ignore WellKnownServices when comparing load balancers by @hakman in #18633
• Release 1.36.1 by @hakman in #18634

Full Changelog: v1.36.0...v1.36.1

What's Changed

• Support etcd 3.7.0-rc.0 and allow overriding the etcd version in the scalability scenario by @Jefftree in #18458
• Enable misspell in golangci-lint by @ameukam in #17578
• e2e: Filter random AZ selection by instance type availability by @rifelpet in #18463
• azure: Use IMDS attested metadata document for node identity by @hakman in #18163
• gce: fix backend service ownership filtering during delete by @carterpewpew in #18460
• aws: Reconcile target group health check changes on existing target groups by @hakman in #18467
• gce: Reconcile HTTP health check changes on existing health checks by @hakman in #18468
• Improve Google Storage Bucket support. by @cheftako in #18466
• Enable gosec and gocritic by @ameukam in #18470
• Add serathius as scalability test owner by @Jefftree in #18475
• feat(linode): implement SSH key management and associated tasks by @moshevayner in #18383
• Added support for APIServer using LB by @cheftako in #18459
• chore(channels): bump k8s versions in alpha channel by @moshevayner in #18477
• Upgrade Karpenter to v1.13.0 by @hakman in #18479
• scaletest: Report experiment variant into scalability run metadata by @Jefftree in #18476
• channels: Add Kubernetes 1.36.0 support by @hakman in #18480
• gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18484
• e2e: Skip ImageVolume tests on COS 121 by @rifelpet in #18483
• Register Karpenter nodes with karpenter.sh/unregistered taint by @hakman in #18486
• Add missing EC2 read permissions to Karpenter IAM policy by @hakman in #18487
• scaletest: report experiment variant after kubetest2 runs by @Jefftree in #18485
• nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18478
• API only CLI by @cheftako in #18482
• Fixing LB behavior when you have both APIServer and Control Plane. by @cheftako in #18496
• Remove namespace from DO ClusterRole by @rifelpet in #18498
• chore(channels): promote to stable, bump node images, update recommended kOps versions by @hakman in #18501
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #18505
• scaletest: bind etcd metrics to all interfaces by @Jefftree in #18503
• e2e: test the PR's own channels, not master's by @hakman in #18504
• tests/e2e: refine externalTrafficPolicy=Local and hostNetwork skips by @rifelpet in #18509
• Allow setting missing slice elements from the command line by @hakman in #18511
• Add managed Karpenter EC2NodeClass and NodePool by @hakman in #18497
• tests/e2e: skip implement-NodePort ETP=Local test on more CNIs by @rifelpet in #18515
• chore(channels): pin Azure noble image to a deployable version by @hakman in #18516
• Switching from comparison on Role to helper. by @cheftako in #18514
• tests/e2e: also skip implement-NodePort ETP=Local test on calico+GCE by @rifelpet in #18517
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #18518
• Make cloud-controller-manager pods tolerate all taints by @rifelpet in #18510
• Add an experimental roles feature flag. by @cheftako in #18519
• azure: Scope nodes-to-API NSG rules to the NAT gateway public IP by @hakman in #18522
• fix: use JoinHostPost to tolerate IPv6 addresses by @justinsb in #18526
• azure: Bump azuredisk-csi-driver to v1.34.4 by @hakman in #18527
• chore: update syntax of CLAUDE.md by @justinsb in #18532
• azure: Bump azure-cloud-controller-manager to v1.36.2 by @hakman in #18529
• azure: Grant control-plane VMSS Contributor instead of Owner by @hakman in #18533
• coredns: Honor node taints in hostname topologySpreadConstraint by @hakman in #18535
• hetzner: fix Cluster Autoscaler node group membership by @hakman in #18538
• Expose GCP project as PROJECT env for ClusterLoader2 on GCE by @rifelpet in #18537
• tests/e2e: skip implement-NodePort ETP=Local test on calico+Azure by @hakman in #18540
• Update cluster-autoscaler to v1.36.0 by @hakman in #18541
• gce: register all zonal MIGs of a multi-zone instance group with cluster-autoscaler by @hakman in #18543
• Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18546
• pkg/assets: keep container registry clients out of runtime binaries by @hakman in #18554
• clusterapi: fix build by making gen.go a library package by @hakman in #18553
• Support running custom etcd versions by setting version and image by @hakman in #18525
• Default to etcd 3.7.0 for Kubernetes 1.37+ by @Jefftree in #18557
• feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @wkrysmann in #18556
• dump: grant SSH access to Karpenter nodes via EC2 Instance Connect by @hakman in #18563
• etcd-manager: upgrade to v3.0.20260707 by @hakman in #18560
• dns-controller: always apply the addon, empty when unused by @hakman in #18567
• Replace fi.PtrTo with new() builtin by @hakman in #18549
• Build with disable_grpc_modules tag to shrink binaries by @hakman in #18552
• nodeup: reduce binary size by decoupling from cloudup awsup by @hakman in #18571
• nodeup: remove the full Kubernetes API scheme and cloud providers from the binary by @hakman in #18572
• scalability: expose events-etcd metrics endpoint by @Jefftree in #18568
• vfs: use path/filepath in FSPath for Windows compatibility by @hakman in #18576
• Add support for kube-apiserver --strict-transport-security-directives flag by @hakman in #18577
• aws: Add metrics port 9999 to pod-identity-webhook Service by @hakman in #18579
• docs: expand Delve debugging instructions in contributing guide by @hakman in #18580
• kops create cluster: reject explicitly empty --project flag by @hakman in #18575
• aws: Require https scheme for pre-signed STS URLs in V2 tokens by @hakman in #18574
• aws: scope Karpenter controller IAM permissions by @hakman in #18582
• gce: register SSH keys under the "ubuntu" user for Ubuntu images by @hakman in #18581
• chore(deps): bump linodego to v2 by @moshevayner in #18584
• gce: allow TCP metrics ports in GCE firewall by @Qqkyu in #18545
• Release 1.37.0-alpha.1 by @hakman in #18596

New Contributors

• @carterpewpew made their first contribution in #18460
• @cheftako made their first contribution in #18466
• @wkrysmann made their first contribution in #18556
• @Qqkyu made their first contribution in #18545

Full Changelog: v1.36.0-beta.1...v1.37.0-alpha.1

See the full kOps 1.36 release notes for details, including breaking changes and deprecations.

Highlights

• Kubernetes 1.36 support and completion of the move away from the in-tree cloud providers
• Reworked addon management: kops-channels now runs as a static pod on control-plane nodes; the standalone channels binary is no longer distributed
• Hybrid bootstrap for gossip clusters: workers bootstrap directly against the API load balancer, easing migration off gossip DNS, which is deprecated
• Karpenter refresh: Karpenter v1.13.0 with kOps-managed EC2NodeClass and NodePool objects per instance group
• etcd-manager improvements: recovery of members with replaced data disks, membership changes resilient to unreachable members, a distroless image, and faster single-member cluster startup
• Expanded Azure support: cloud-controller-manager, Azure Disk CSI driver, and experimental Terraform target
• Hetzner Cluster Autoscaler support and groundwork for Linode (Akamai) as a new cloud provider
• Component updates: containerd v2.2.4, etcd-manager v3.0.20260707 with etcd 3.5.31/3.6.12, AWS Load Balancer Controller v3.3.0, Cilium tunables, CoreDNS v1.14.2, cluster-autoscaler v1.36.0
• Removed: support for Kubernetes 1.30, etcd 3.4, Amazon Linux 2, Ubuntu 20.04, and Debian 10

What's Changed

• Automated cherry pick of #18467: aws: Reconcile target group health check changes on existing target groups by @hakman in #18469
• Automated cherry pick of #18484: gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18488
• Automated cherry pick of #18478: nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18492
• Automated cherry pick of #18498: Remove namespace from DO ClusterRole by @rifelpet in #18499
• Automated cherry pick of #18511: Allow setting missing slice elements from the command line by @hakman in #18512
• Automated cherry pick of ##18479: Upgrade Karpenter to v1.13.0
  ##18486: Register Karpenter nodes with karpenter.sh/unregistered taint
  ##18487: Add missing EC2 read permissions to Karpenter IAM policy
  ##18497: Add managed Karpenter EC2NodeClass and NodePool by @hakman in #18513
• Automated cherry pick of #18522: azure: Scope nodes-to-API NSG rules to the NAT gateway public IP by @hakman in #18523
• Automated cherry pick of #18527: azure: Bump azuredisk-csi-driver to v1.34.4 by @hakman in #18528
• Automated cherry pick of #18529: azure: Bump azure-cloud-controller-manager to v1.36.2 by @hakman in #18531
• Automated cherry pick of #18533: azure: Grant control-plane VMSS Contributor instead of Owner by @hakman in #18534
• Automated cherry pick of #18535: coredns: Honor node taints in hostname topologySpreadConstraint by @hakman in #18536
• Automated cherry pick of #18538: hetzner: fix Cluster Autoscaler node group membership by @hakman in #18539
• Automated cherry pick of #18541: Update cluster-autoscaler to v1.36.0 by @hakman in #18542
• Automated cherry pick of #18543: gce: register all zonal MIGs of a multi-zone instance group with cluster-autoscaler by @hakman in #18544
• Automated cherry pick of #18546: Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18547
• Cherry pick of #18560: etcd-manager: upgrade to v3.0.20260707 by @hakman in #18561
• Automated cherry pick of #18556: feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @hakman in #18558
• Cherry pick of #18549: Replace fi.PtrTo with new() builtin by @hakman in #18551
• Automated cherry pick of #18567: dns-controller: always apply the addon, empty when unused by @hakman in #18573
• Release 1.36.0 by @hakman in #18591

Full Changelog: v1.36.0-beta.1...v1.36.0

What's Changed

• Automated cherry pick of #18428: cert-manager: upgrade to v1.19.5 and set AWS_REGION for Route53 dns-01 by @hakman in #18429
• Cherry pick of #18436: upgrade etcd-manager and etcd to latest patches by @hakman in #18437
• Automated cherry pick of #17968: Enable nf_conntrack kernel module on Rocky 9
  #18179: Load nf_tables module and install iptables-nft on RHEL10+ by @rifelpet in #18444
• backport: Update Cluster Autoscaler RBAC by @hakman in #18445
• Automated cherry pick of #18452: Calico: add NFTablesMode setting by @rifelpet in #18454
• cilium: mount the host's /etc/hosts on gossip clusters by @hakman in #18465
• Automated cherry pick of #18484: gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18489
• Automated cherry pick of #18478: nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18494
• Automated cherry pick of #18498: Remove namespace from DO ClusterRole by @rifelpet in #18500
• Automated cherry pick of #18546: Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18548
• Automated cherry pick of #18450: etcd-manager: switch to go-runner-based distroless image by @hakman in #18555
• Cherry pick of #18560: etcd-manager: upgrade to v3.0.20260707 by @hakman in #18562
• Automated cherry pick of #18556: feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @hakman in #18559
• Cherry pick of #18549: Replace fi.PtrTo with new() builtin by @hakman in #18550
• Release 1.35.2 by @hakman in #18593

Full Changelog: v1.35.1...v1.35.2

What's Changed

• scaletest: decouple client HTTP traffic for etcd events by @Jefftree in #18415
• Release notes for 1.36 (alpha) by @hakman in #18414
• chore: Add hashes for additional May releases by @hakman in #18418
• Add logs at v2 level to ensure we have slow pods data in logs by @hakuna-matatah in #18420
• chore: upgrade containerd to v2.3.1 by @hakman in #18422
• Upgrade kube-router to v2.10.0 by @rifelpet in #18421
• aws: pin LBC selectors to fix in-place upgrades by @hakman in #18426
• cert-manager: upgrade to v1.19.5 and set AWS_REGION for Route53 dns-01 by @hakman in #18428
• etcd: add ListenClientHTTPURLs field to EtcdManagerSpec by @Jefftree in #18416
• Default omitted authorization to RBAC instead of AlwaysAllow by @hakman in #18431
• cilium: allow disabling masquerade in ENI IPAM mode by @hakman in #18432
• channels: surface addon apply failures via a readiness probe by @hakman in #18433
• etcd-manager: upgrade etcd-manager and etcd to latest patches by @hakman in #18436
• chore: downgrade containerd to v2.2.4 by @hakman in #18447
• test: avoid kubeconfig access in golden tests by @hakman in #18448
• scaletest: Build only linux/amd64 in kubernetes scalability presubmits by @Jefftree in #18446
• scaletest: Allow feature gates to be set in scalability tests by @Jefftree in #18449
• feat: add gVisor RuntimeClass support for containerd by @ameukam in #18406
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #18451
• Calico: add NFTablesMode setting by @rifelpet in #18452
• etcd-manager: switch to go-runner-based distroless image by @hakman in #18450
• kube-proxy: assert buildPod command in unit test by @hakman in #18455
• gVisor: add HasGVisor() helper function by @hakman in #18456
• dump: add --node-dump-timeout flag for per-node dump timeout by @Jefftree in #18443
• scaltest: Default node dump timeout to 5m in scalability run-test.sh by @Jefftree in #18457
• Release 1.36.0-beta.1 by @hakman in #18464

Full Changelog: v1.36.0-alpha.1...v1.36.0-beta.1

What's Changed

• Automated cherry pick of #17740: Fix HasHighlyAvailableControlPlane to use AllInstanceGroups by @hakman in #18117
• Automated cherry pick of #18113: Add excludedInstanceTypes to instanceRequirements by @hakman in #18119
• Automated cherry pick of #18123: Fix instanceRequirements memory assignment bug by @hakman in #18124
• Automated cherry pick of #17999: aws: Bypass LBC webhook for cert-manager by @rifelpet in #18125
• Automated cherry pick of #18126: Add --use-kubeconfig to kops reconcile cluster by @hakman in #18127
• Automated cherry pick of #18128: vfs: Silence warnings when the S3 provider has no supported by @hakman in #18130
• Automated cherry pick of #18114: Pin upload-artifacts GHA to commit sha by @rifelpet in #18208
• Automated cherry pick of #18173: Update Golang to 1.25.9 by @hakman in #18205
• Automated cherry pick of #18110: Update Cluster Autoscaler to 1.35.0 by @hakman in #18217
• Automated cherry pick of #18237: cilium: require k8s-connectivity in liveness probe by @hakman in #18242
• aws: bypass LBC mservice webhook for kube-system by @hakman in #18248
• Automated cherry pick of #18251: aws: skip node S3 permissions when kops-controller serves node config by @hakman in #18253
• Cherrypick VPC CNI fixes to 1.35 by @rifelpet in #18268
• Cherrypick GCE resource dump fixes to 1.35 by @rifelpet in #18282
• Automated cherry pick of #18285: cilium: allow setting arbitrary cilium-config entries by @hakman in #18286
• Automated cherry pick of #18281: hetzner: Upgrade hcloud-cloud-controller-manager to v1.30.1 by @hakman in #18283
• Automated cherry pick of #18298: dns-controller: make priorityClassName configurable by @hakman in #18299
• Automated cherry pick of #18232: Initial support for Ubuntu 26.04 by @rifelpet in #18306
• Automated cherry pick of #18302: dns-controller: default Provider when ExternalDNS is partially set by @hakman in #18303
• Automated cherry pick of #18307: gce: expose kops-controller on internal LB for gossip clusters by @hakman in #18308
• Automated cherry pick of #18260: azure: encode storage account in azureblob:// URLs by @hakman in #18320
• Automated cherry pick of #18319: azure: list VMSS NICs in protokube gossip seed discovery by @hakman in #18321
• Automated cherry pick of #18323: etcd-manager: upgrade to v3.0.20260512 by @hakman in #18324
• Cherrypick GCE instance handling fixes to 1.35 by @rifelpet in #18327
• etcd-manager: bump etcd to latest patches (3.5.30, 3.6.11) by @yuzhouliu9 in #18333
• Automated cherry pick of #18375: cilium: add flags for bpf-lb-sock and bpf-lb-sock-hostns-only by @hakman in #18376
• Automated cherry pick of #18379: kops-controller and nodeup bug fixes by @rifelpet in #18380
• Automated cherry pick of #18384: Fix kops get assets when spec.dnsZone is a DNS name by @hakman in #18386
• Automated cherry pick of #18144: Move johngmyers to emeritus by @hakman in #18388
• Automated cherry pick of #18391: Validate instance group names in kops-controller by @rifelpet in #18392
• Upgrade Go to 1.26.3 for release-1.35 by @hakman in #18396
• Update dependencies for release-1.35 by @hakman in #18399
• Automated cherry pick of #18401: gomod: tidy and verify all modules by @hakman in #18404
• Automated cherry pick of #18403: build: use gcr.io/distroless/static as base image by @hakman in #18417
• Automated cherry pick of #18418: chore: Add hashes for additional May releases by @hakman in #18419
• Automated cherry pick of #18364: chore: upgrade containerd to v2.3.0
  #18422: chore: upgrade containerd to v2.3.1 by @hakman in #18423
• Release 1.35.1 by @hakman in #18425

Full Changelog: v1.35.0...v1.35.1