Kubernetes Release Notes

Major Themes

Graduating to Standard

• HTTPRoute Retries (GEP-1731): the retry configuration of an HTTPRoute rule (codes, attempts and backoff) is promoted to the Standard channel, together with the HTTPRouteRetryCodes and HTTPRouteRetryConnectionError conformance features. The backoff field is implementation-specific because backoff behavior, especially jitter, varies between implementations. (#5357, @snorwin, #5359, @mikemorris)

New in Experimental

• Gateway Address Routability (GEP-5093): routability is expressed per Gateway address, so a single Gateway can serve addresses of different scopes. Valid values are empty (implementation default), Cluster, or a domain-prefixed implementation-specific value. (#5304, @rikatz)
• Standardized Attribute Dictionary (GEP-5253): a shared, vendor-neutral set of traffic attributes, based on OpenTelemetry semantic conventions, for use by features such as XTelemetryPolicy. (#5256, @gkhom)
• Session Persistence on Backend (GEP-1619 and GEP-4894): session persistence is configured on the XBackend resource, and the route-inline and BackendTrafficPolicy attachment points are deprecated. (#4876, #5298, @gcs278)
• Pre-routing Filters (GEP-5224): listener filters that run before routing decisions, for use cases such as external authentication and payload processing, with the new GatewayListenerFilters feature. Filters can be set on both Gateway and ListenerSet listeners. (#5315, @jaellio, #5370, @snorwin)
• ClusterTrustBundle in caCertificateRefs (GEP-5075): BackendTLSPolicy and Gateway frontend TLS validation can reference a ClusterTrustBundle through the existing caCertificateRefs field, instead of copying CA bundles into every namespace. (#5272, #5356, @davidesalerno)
• TelemetryPolicy for Distributed Tracing (GEP-4768): the XTelemetryPolicy API standardizes tracing configuration for Gateways without vendor-specific CRDs. Metrics and access logs are not covered yet. (#5323, @gkhom)

Major Changes Since v1.6.3

Breaking Changes

Experimental API changes (no effect on the Standard channel):

• SessionPersistence API: sessionName moved to cookie.name (Extended, optional) and header.name (Core, required), cookieConfig renamed to cookie, and HeaderConfig added. (#4873, @gcs278)
• SessionPersistence API: the cookie Path now defaults to / instead of being computed from route matches, and the new cookie.path field (Extended) allows explicit path configuration. (#5046, @gcs278)
• SessionPersistence: route-inline and BackendTrafficPolicy session persistence are deprecated in favor of the Backend resource. (#4876, @gcs278)
• XBackend: spec.port.port was renamed to spec.port.number, spec.port.name was removed, and backendRef.port is now prohibited when referencing an XBackend. (#5287, @gcs278)

Go types:

• BackendAncestorStatus.AncestorRef was renamed in the generated Go types for consistency with docs and JSON/YAML serialization. (#5187, @Stevenjin8)
• ForwardBodyConfig.MaxSize changed type from uint16 to int32. (#5099, @arjunxplorer)

Conformance features:

• The HTTPRouteRetry and HTTPRouteRetryBackendTimeout features were removed. HTTPRouteRetryCodes was added and HTTPRouteRetryConnectionError is retained. (#5167, @snorwin)
• The HTTPRouteBackendRequestRedirect feature and its test were removed. (#5279, @snorwin)
• Go was upgraded to 1.27 (go 1.27.0 directive in go.mod and conformance/go.mod) and Kubernetes dependencies to v0.37. (#5297, @snorwin, #5232, @snorwin, #5388, @howardjohn)

GEP & API Graduation

GEP Status Updates:

• GEP-4768 (TelemetryPolicy): add the proposal, then the experimental XTelemetryPolicy API (#4872, @gkhom, #5323, #5345, @robscott)
• GEP-5093 (Gateway Address Routability): add as Provisional, move to Implementable, then to Experimental. (#5094, @usize, #5263, @rikatz, #5304, @rikatz)
• GEP-5224 (Pre-routing filters): add as Provisional, move to Implementable, then to Experimental. (#5235, @jaellio, #5271, @jaellio, #5315, @jaellio)
• GEP-5075 (ClusterTrustBundle caCertificateRef): add as Provisional, move to Experimental, then use caCertificateRefs instead of a dedicated reference type. (#5259, @davidesalerno, #5272, @davidesalerno, #5356, @davidesalerno)
• GEP-5253: Standardized Attribute Dictionary. (#5256, @gkhom)
• GEP-4359: Gateway API Regex. (#4764, @Stevenjin8)
• GEP-4360: Regex-based Path Rewrites. (#4695, @Stevenjin8)
• GEP-1619 (Session Persistence): synced with API updates and made the Backend the attachment point. (#4870, #4876, @gcs278)
• GEP-1731 (HTTPRoute Retries): aligned retry semantics with implementations, then loosened the backoff definition so it no longer requires an exponential strategy, and promoted the retry configuration, including backoff, to the Standard channel. (#5167, @snorwin, #5359, @mikemorris)
• GEP-4894 (Backend): deferred SelectorRef in favor of the Selector field. (#5158, @gcs278)

Graduations to Standard:

• HTTPRoute retry configuration (retry.codes and retry.attempts) is promoted to the Standard channel, and the HTTPRouteRetryCodes and HTTPRouteRetryConnectionError features are now Standard. retry.backoff (implementation-specific) is promoted with them. (#5357, @snorwin)
• HTTPRoute and GRPCRoute rule name uniqueness validation is now enforced in the Standard channel. (#5009, @snorwin)
• BackendTLSPolicy SANs and TLS options are now marked as Standard channel. (#4999, @Suvink)
• The TLSRouteMixedMode feature is now Standard channel. (#5412, @rikatz)

Feature

New Experimental APIs and Fields

• Experimental XTelemetryPolicy API (GEP-4768). (#5323, @gkhom, #5345, @robscott)
• XBackend supports a new EndpointSelector type that routes to in-cluster pods selected by label. (#5255, @gcs278)
• XBackend supports session persistence for the EndpointSelector type. (#5298, @gcs278)
• XBackend TLS mode was refactored and its CEL validation fixed. (#5316, @snorwin)
• Gateway address routability (GEP-5093), including the GatewayAddressRoutability and GatewayAddressRoutabilityCluster features. (#5304, @rikatz)
• Pre-routing listener filters (GEP-5224), with the new GatewayListenerFilters feature. (#5315, @jaellio)
• Pre-routing listener filters (filters) were added to ListenerSet. (#5370, @snorwin)
• ClusterTrustBundle can be referenced through caCertificateRefs in BackendTLSPolicy and Gateway frontend TLS validation, with the new ClusterTrustBundle feature. (#5272, @davidesalerno, #5356, @davidesalerno)

API & Validation Enhancements

• HTTPRouteRetry.Attempts now defaults to 1, and its minimum was lowered from 1 to 0 so retries can be disabled per rule. (#5269, @snorwin, #5387, @mikemorris)
• Added CEL validation enforcing that TLS is disabled for H2C and enabled for HTTP2. Added a new WSS protocol value for WebSockets over TLS. (#5312, @snorwin)
• Added the GatewayRouteHostnameIntersectionPrecedence feature so implementations can opt in to resolving *Route precedence using the original Route hostnames instead of the calculated Listener/Route intersection. (#5212, @rostislavbobo)
• Replaced immutable CEL validation rules with the +k8s:immutable marker. (#4902, @chinmaychahar)

Release Artifacts

• Releases now contain OpenAPIv2 schema definitions. (#4686, @Rycieos)

Documentation

New and Updated Documentation

• Added documentation for XBackend. (#4931, @keithmattix)
• Added TCP and UDP examples and documentation. (#4932, @zac-nixon)
• Added ListenerSet to the SectionName interpretation table. (#4880, @apkatsikas)
• Stopped referring to ListenerSet as experimental. (#5228, @linuzctl)
• Aligned the GRPCRoute hostname cross-serving godoc with the relaxed site docs. (#5176, @lexfrei)
• Clarified that implementations should only retry HTTPRoute requests on connection errors when it is safe to do so, and that backoff specifies the base interval of a backoff strategy rather than the minimum interval. The precise backoff curve and jitter are implementation-specific, and implementations that retry immediately with no backoff must not advertise support for backoff. (#5269, @snorwin, #5359, @mikemorris)
• Marked Upstream TLS (BackendTLSPolicy) as Standard channel since v1.4.0. (#4965, @anneheartrecord)
• Corrected API groups in the GEP-709 ReferenceGrant example. (#5310, @deepujain)
• Corrected conformance feature selection guidance. (#5175, @immanuwell)
• Updated the API reference format for readability. (#5156, @youngnick)

Site & Project

• Removed the old MkDocs and Python environments. (#5165, @rikatz)
• Added dark mode image support. (#5203, @robscott)
• Added a GitHub repository link to the site navbar. (#5305, @yashrajshuklaaa)
• Added an AI Policy document and AI disclosure to the pull request template. (#5151, @youngnick, #5208, @youngnick)

Implementations & Conformance Reports

• Added or updated conformance reports for Agentgateway, Airlock Microgateway, AWS Load Balancer Controller, Calico, Cilium, Cloudflare Tunnel Gateway Controller, GKE Gateway, Gravitee, Higress, Istio, Kgateway, Kong Operator, Linkerd, NGINX Gateway Fabric, Traefik Proxy and WSO2 Gateway.
• Envoy Gateway moved to Conformant. (#5186, @zirain)
• HAProxy Ingress was renamed to N42 Gateway. (#5268, @jcmoraisjr)

Bug or Regression

• Fixed the generator so that inline references are supported on experimental validation, and fixed generator tag recognition for experimental markers. (#5288, #5303, @rikatz)
• Fixed the backend port name CEL expression and added a unit test. (#5193, @snorwin)
• Fixed an always-true scheme check in conformance redirect port validation. (#5201, @immanuwell)
• Added CEL validation for LabelKey in XBackend's endpointSelector.matchLabels. (#5397, @snorwin)

Test & Conformance

New Conformance Tests

• Added a conformance test for GRPCRouteFilterRequestHeaderModifier (new GRPCRouteRequestHeaderModifier feature). (#4060, @salonichf5)
• Added a BackendTLSPolicy conformance test for GRPCRoute. (#4882, @Thealisyed)
• Added a BackendTLSPolicy with TLSRoute Terminate conformance test. (#4875, @davidesalerno)
• Added a Gateway maximum name length conformance test. (#5035, @arjunexplorer)
• Added an HTTPRoute rule precedence conformance test. (#5128, @thorn3r)
• Added a conformance test covering shared and dedicated routes across multiple Gateways for GRPCRoute. (#5281, @snorwin)
• Added conformance tests validating that Gateway resolves HTTPRoute precedence using original route hostname specificity rather than the calculated listener/route hostname intersection. (#5124, @rostislavbobo)
• Added conformance tests validating that Gateway resolves GRPCRoute precedence using original route hostname specificity rather than the calculated listener/route hostname intersection. (#5346, @rostislavbobo)
• Added conformance tests validating that Gateway resolves TLSRoute precedence using original route hostname specificity rather than the calculated listener/route hostname intersection. (#5361, @rostislavbobo)
• Extended the HTTPRoute same-hostname intersection conformance test to cover path prefix and header matching across multiple attached Routes. (#5410, @rostislavbobo)
• Added conformance tests for URLRewrite filters at HTTPBackendRef level (HTTPRouteBackendURLRewrite). (#4823, @Srujan-rai)
• Added unit tests for the echo response parser. (#4635, @archy-rock3t-cloud)

Test Machinery & Framework Updates

• The conformance suite now supports an injectable WebSocket dialer (ConformanceOptions.WebSocketDialer). It defaults to the previous websocket.Dial behavior when unset. (#4936, @lexfrei)
• The conformance gRPC DefaultClient is now safe for concurrent SendRPC and reusable after Close. (#4946, @lexfrei)
• Base-resource cleanup now waits for deletion to complete, so the suite can be re-run in a single process (go test -count>1). (#4948, @lexfrei)
• RouteMustHaveParents now runs the observedGeneration check against the status it just read. Implementations whose status lags the Route generation may now fail where they previously passed. (#5206, @lexfrei)
• Report an error when a conformance manifest is missing from every configured filesystem. (#5216, @immanuwell)
• Conformance report Implementation.URL is now validated as a well-formed http(s) URL. (#5209, @yashrajshuklaaa)
• The conformance echo server images moved to a dedicated repository (kubernetes-sigs/gateway-api-conformance-images). (#5090, @snorwin)
• Use the timeout config more consistently. (#5150, @howardjohn)
• Preserve = in conformance key-value flags. (#5034, @immanuwell)

Updates & Fixes to Existing Tests

• Expect RefNotPermitted for a cross-namespace certificateRef to a nonexistent secret. (#5306, @PetrMc)
• Wait for mesh weighted routes to be programmed. (#5214, @Automaat)
• Retry the failure-path assertion in the client certificate validation test. (#5097, @yashrajshuklaaa)
• Added containerPorts to the echo pod in the mesh conformance manifest. (#5055, @AnirbanNandi)
• Foreign status entries on HTTPRoutes, BackendTLSPolicy and Gateway are now preserved by conformance tests. (#5206, @lexfrei)
• Removed the HTTPRoute retry tests that required unsafe retries and added a retry-with-backend-timeout case. (#5339, @snorwin)
• Fixed a nil Group pointer dereference panic in gatewayListenersMatch and listenerSetListenersMatch when the actual SupportedKinds list is empty. (#5411, @Ujjwaljain16)
• Fixed parentRefToString in the conformance helpers printing a pointer address instead of the namespace name. (#5399, @Ujjwaljain16)
• Replaced coredns with echo-basic in the UDPRoute conformance tests and base manifests. (#5408, @linolayani)
• Updated TCPRoute conformance test manifests and helpers from v1alpha2 to v1. (#5365, @davidjumani)
• Removed remaining references to removed alpha APIs from conformance and CEL/CRD/VAP tests. (#5368, @rikatz)

Other (Cleanup or Flake)

• Mark HTTPRouteBackendURLRewrite tests as provisional. (#5270, @snorwin)
• Removed the provisional flag from conformance tests that are now stable. (#5254, @rikatz)
• Added a make lint target. (#5198, @youngnick)
• Added a new implist tool. (#5191, @youngnick)
• Fixed the package declared as main so that it can be imported as utils. (#5275, @yashrajshuklaaa)
• Bumped the Go toolchain to 1.26.8 to fix stdlib CVEs. (#5280, @yashrajshuklaaa)
• Marked generated OpenAPI files as generated in PRs. (#5261, @youngnick)

Full Changelog

Full Changelog: v1.6.3...v1.7.0

Dependencies

Only changes to modules directly required by the root, conformance, tests and tools modules are listed below.

Added

• github.com/spf13/cobra: v1.10.2
• sigs.k8s.io/gateway-api-conformance-images: v0.2.0

Changed

• github.com/stretchr/testify: v1.11.1 → v1.12.1
• golang.org/x/mod: v0.36.0 → v0.42.0
• golang.org/x/net: v0.55.0 → v0.61.0
• golang.org/x/sync: v0.20.0 → v0.24.0
• golang.org/x/tools: v0.45.0 → v0.52.0
• google.golang.org/grpc: v1.81.1 → v1.84.0
• k8s.io/api: v0.36.1 → v0.37.1
• k8s.io/apiextensions-apiserver: v0.36.1 → v0.37.1
• k8s.io/apimachinery: v0.36.1 → v0.37.1
• k8s.io/client-go: v0.36.1 → v0.37.1
• k8s.io/code-generator: v0.36.1 → v0.37.1
• k8s.io/kube-openapi: 927ab1f → d427ff9
• k8s.io/utils: 28399d8 → be93311
• sigs.k8s.io/controller-runtime: v0.24.1 → v0.25.2
• sigs.k8s.io/controller-tools: v0.21.0 → v0.22.0
• sigs.k8s.io/structured-merge-diff/v6: v6.4.0 → v6.4.2

Removed

• github.com/miekg/dns: v1.1.72

Original source

Kubernetes Community,

Kubernetes v1.38.0-alpha.3 has been built and pushed using Golang version 1.27.3.

The release notes have been updated in CHANGELOG-1.38.md, with a pointer to them on GitHub:

v1.38.0-alpha.3

Downloads for v1.38.0-alpha.3

Source Code

kubernetes.tar.gz
sha512: edb2c658ee0d9b8bc31e1610fce7c458370ce7586625545c3384ffdf0c150de2efbb420e49012919bc742afcdc9de73fbb1fa20c720f5b6d88cc980745018734
kubernetes-src.tar.gz
sha512: 9d6dcc2dd9badeea4693861cf27bc1d2c39c9922cc794a8bb869ffeebac88288c065ba0ca43271d7447f02d7cf98c8df81ce39a810b38ce72599dc37eccc6a93

Client Binaries

kubernetes-client-darwin-amd64.tar.gz
sha512: cf2e09db90d56ea9f31783ef7c412276b0647bba4431437629f123896b52a2989aa9d1852509a5853928d82ce054d20fa0b54905481c382ae50a533b58452f18
kubernetes-client-darwin-arm64.tar.gz
sha512: 617c4528a27f3a0f3adb625bcdb4ac71242e1d5d06fc2eb394e2fb8fd1fc308a869a803859c7c3c7b30d07848868f9e3424f287c44ad875caf69c121ad242f5e
kubernetes-client-linux-386.tar.gz
sha512: c58ecbed34ab7db7fb1a58173f9284ea952c0c22e77b0e76a8c34615a4104b193b3bbf2f3a3cff2d9fd41296d2e8ef51aab78afcafafd67471f48acaa0d38eb6
kubernetes-client-linux-amd64.tar.gz
sha512: 2dff6b6bfce8b67db405189e7df4220d6c77216e2cf27b2e07868a00afb7f86abc008833666253e2704f6ffd92d2240342149bc67946862457ea8df3ca1fc8d4
kubernetes-client-linux-arm.tar.gz
sha512: 59a0cd7376d9d075dc33335cf9cac275b8da43aaaaedc42d092d97e6262c1bbc5961cc363ad45f2f048be211d2aea32666410df2ed76295eb7f0e9234834e62c
kubernetes-client-linux-arm64.tar.gz
sha512: a7ecedc019fbbcd5c496b3ed78b54773958133f4d29cfd8c2a801cb52ac56d77b134a57e5c04eb020a1f2f0a9f90847b2c1457d3273267d922925c304f4dda28
kubernetes-client-linux-ppc64le.tar.gz
sha512: 791da175df65b2859984d08fa0255dcb148a1d380fa9ba3a529f415d305fd3c7b464fefb25cc1f2878b3eac165fe9c43658567e44c00ba7cab7596a3d9e61d0c
kubernetes-client-linux-s390x.tar.gz
sha512: a8e39dd9f31926c9e1e231f0796fa897becf5cfb29f58351e9358c52819155471e6b4527451c7fb496f6e4249c162721d430c5613302b50d87d2823c8f07bc36
kubernetes-client-windows-386.tar.gz
sha512: fd3634c705cd21f8c024165a235ac8adfba111b5a55b9ced07b54ceeeca0f0ed111dd4e4a41c0bb0d48b30478488d1235fafd6f30754f10b029f6e181a724ad2
kubernetes-client-windows-amd64.tar.gz
sha512: 3a80f4d7f04819f4ee9fef25ce42dfe727ede22d86f5fb916258e7913647952a5bf5a13738d37fea95e79f75b90ebf7e0a0175c244e0e7da43412015cefb8748
kubernetes-client-windows-arm64.tar.gz
sha512: 8c5afc52446d14ba2f3a7ccc4fab66b3e8631e37162d2ca2d81c0f71f9746f89d1a64929f1c14b92ad08f5540e405a115658174ff5e3a79e4990fd3de72cdfd3

Server Binaries

kubernetes-server-linux-amd64.tar.gz
sha512: 841b11843836910b5c21d6491d35186e98ff48fb4f96f2e2bc74101eae65c794d8deee994968ac8bee1e197a0d7fa1505871fff71b65bdb5b9b48368011b8d55
kubernetes-server-linux-arm64.tar.gz
sha512: 96654b658725378fa9101c224661b9c38002341d60b6bedc13f0bad474d6850837daf1559fc0479d1c3a6bd395f7256e5986d61bff8b585ee99a20254806c6e5
kubernetes-server-linux-ppc64le.tar.gz
sha512: d0bea40802e197f0a8038c8ebf2eced4dabf87f31ee96c245515f3de4c46543fd229b3a9188c8d21f71c6a16048d806fc2bedb790645884ede29bf26c1ba8edf
kubernetes-server-linux-s390x.tar.gz
sha512: 505f5f045c3c5d45716599e6270a10e14e42bc2e1262dcd98fa268cf84d85fe6fe8c1e66911089e7d507e159580a7ff4dc7e19333a63a88f504d17f5664484bc

Node Binaries

kubernetes-node-linux-amd64.tar.gz
sha512: b9ce9203ed73992e2a2f83556d6413050405a85fd54141152ea8effefeef5bd1f5c0f80022581a6d2bc676d3e6d2476623c414874d19a96ef03ef402f6de799e
kubernetes-node-linux-arm64.tar.gz
sha512: 004b20ba1080867663cb3367218c1b7b4745179a5e2d80845d8ef37f37244e1944110d24cebbfb2a6077116c4b3b3c5e701c56debb0c257e42189c14c0b5574a
kubernetes-node-linux-ppc64le.tar.gz
sha512: f56c46df12475c61e6f5878339766bf1171dbf116d5930ec623f559dd439300441172334f70f0b500d102b89e3c7e0e521860dc28b572e1018331a81e28d095e
kubernetes-node-linux-s390x.tar.gz
sha512: 9e125dde061e825995311e5abbfb2583536e710155902fe99a49b87f1d23ff8a732c9c732305387b196af83d458cc5cf6ffc97a4516311a7fb893f5b51103367
kubernetes-node-windows-amd64.tar.gz
sha512: 9f68c04e76327a08b866ce3249e95f286436ab228524a2f31bdacaced6e5f2022a8163d0f6a1f02936f08ac4e94ad42d0f996d0ea6838d76d06ecd3b3bbe6e1c

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

registry.k8s.io/conformance:v1.38.0-alpha.3 — amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-apiserver:v1.38.0-alpha.3 — amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-controller-manager:v1.38.0-alpha.3 — amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-proxy:v1.38.0-alpha.3 — amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-scheduler:v1.38.0-alpha.3 — amd64, arm64, ppc64le, s390x
registry.k8s.io/kubectl:v1.38.0-alpha.3 — amd64, arm64, ppc64le, s390x

Changelog since v1.38.0-alpha.2

Urgent Upgrade Notes
(No, really, you MUST read this before you upgrade)

• ACTION REQUIRED the type label on the alpha metrics scheduler_queued_entities and scheduler_queue_incoming_entities_total was renamed to entity. Please update dashboards and alerts that filter on type. (#143180, @dom4ha) [SIG Instrumentation and Scheduling]
• Kubelet now rejects env-file entries with a hash immediately after a closing single quote, such as KEY='value'#suffix, instead of silently ignoring the suffix. add a space or tab before an intended comment, or move an intended literal suffix inside the single quotes. Affected containers may fail to start until these entries are corrected. (#143221, @rishabhraj1572) [SIG Node]

Changes by Kind

Dependency

• Kubernetes is now built with Go 1.27.2 (#142873, @dims) [SIG Release]
• Kubernetes is now built with Go 1.27.3 (#143201, @dims) [SIG Release]

API Change

• Add cgroup_mount_mode to the CRI API to support writable cgroups (#139824, @chrishenzie) [SIG Node]
• Add conditional authorization support to kube-apiserver (#137633, @luxas) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Instrumentation, Network, Node, Scheduling and Testing]
• Add conditional authorization support to kube-apiserver (#141959, @luxas) [SIG API Machinery, Auth, Instrumentation and Testing]
• Add the staticOrder field to WebhookAdmissionConfiguration for the MutatingAdmissionWebhook plugin (KEP-5793). It controls whether manifest-based mutating webhooks run before (StaticFirst, the default), after (StaticLast), or interleaved by configuration name with (ByName) webhooks registered through the API. It requires staticManifestsDir and the ManifestBasedAdmissionControlConfig feature gate. Remove staticOrder before downgrading to v1.37 or earlier, which reject it at startup. (#143160, @aramase) [SIG API Machinery, Auth and Testing]
• Added percentageOfPlacementsToScore to the scheduler config. With TopologyAwareWorkloadScheduling enabled, the scheduler now evaluates an adaptive subset of placements by default. Set it to 100 to evaluate all placements as before. (#139859, @willie-yao) [SIG Scheduling and Testing]
• Adds sharding.NewShardRangeSelector and cache.NewShardedListWatch helpers for sharded informers and reflectors. (#142760, @Jefftree) [SIG API Machinery and Testing]
• CRI API: added the PullSecurityProfile, ListSecurityProfiles, and RemoveSecurityProfile RPCs, the OCI seccomp profile type with oci_ref and SecurityProfileBase, the seccomp_profile_oci runtime feature, and the SecurityProfileInvalid well-known error, for seccomp profiles pulled from OCI registries (Alpha). (#142509, @saschagrunert) [SIG Node, Testing and Windows]
• Corrected the StatefulSet maxUnavailable API documentation: percentage values are rounded down to a minimum of 1, not rounded up. Behavior is unchanged. (#142541, @Czoyx) [SIG API Machinery, Apps and CLI]
• Decoding JSON lists into unstructured.UnstructuredList, as the dynamic client and kubectl get -o json do, now uses about half the memory, and decode time drops by about a third. (#142575, @QHarshil) [SIG API Machinery]
• Extend Workload API validation to require child templates of a CompositePodGroupTemplate with a gang scheduling policy or all disruption mode to also use a gang scheduling policy or all disruption mode, respectively. (#142830, @iomarsayed) [SIG Scheduling and Testing]
• Fixes a bug where the kubelet set pod sandbox CPU and memory limits to the partial sum of container limits when only some containers declared them. The sandbox limits are now unlimited when unset, to match pod cgroup behavior. A container explicitly setting a limit of 0 is now treated as unset in pod-level limit defaulting. (#141014, @pravk03) [SIG API Machinery, Apps, CLI, Node and Scheduling]
• Go API objects no longer provides direct access to the Raw byte slice in ObjectMeta.ManagedFields[*].FieldsV1. Use the accessor methods (GetRawBytes, GetRawString, SetRawBytes, SetRawString, GetRawReader, NewFieldsV1). Building with -tags=fieldsv1byte restores temporary access to the previous Raw []byte implementation. (#143011, @yongruilin) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling and Storage]
• Graduates the ShardedListAndWatch feature gate to Beta. (#142702, @Jefftree) [SIG API Machinery and Testing]
• Implemented recursive status propagation and hierarchical diagnostic reporting for CompositePodGroup objects. (#141860, @jdzikowski) [SIG API Machinery, Node, Scheduling and Testing]
• Increase PodGroup priority validation to highest possible value that can set (#142846, @kannon92) [SIG Apps, Scheduling and Testing]
• Introduce a new evictionrequest-controller to observe and manage the new Eviction and EvictionRequest APIs from the lifecycle API group. It automatically creates Evictions according to EvictionRequests and coordinates external responders via eviction status, ensuring that the eviction contract is upheld. (#137133, @johankj) [SIG API Machinery, Apps, Architecture, Auth, CLI, Etcd, Instrumentation, Node and Testing]
• Introduce a new imperative-eviction.k8s.io/evictor responder controller for pods. This responder is executed last, after all other responders have run, and attempts to evict a pod using the imperative eviction API (pods//eviction subresource). It fulfills the declarative Eviction API contract. (#137396, @atiratree) [SIG API Machinery, Apps, Architecture, Auth, CLI, Etcd, Instrumentation, Node and Testing]
• K8s.io/apiserver: webhook.New takes a compiled webhook.Matcher instead of match conditions and a CEL compiler, webhook.NewFromInterface drops its compiler argument, and authorizerfactory.DelegatingAuthorizerConfig.Compiler is removed. validation.ValidateAndCompileMatchConditions is replaced by validation.NewWebhookMatcher. (#142655, @dims) [SIG API Machinery and Auth]
• Kube-apiserver: support the ShardedListAndWatch feature for custom resources and dynamic clients that use Unstructured objects. (#142975, @neolit123) [SIG API Machinery and Testing]
• Kube-scheduler: in the alpha TopologyAwareWorkloadScheduling placement generator, nodes whose topology label value is an empty string are no longer treated as a topology domain. They are skipped when generating placements, and a pod group with an already-scheduled pod on such a node now fails placement generation with an explicit error instead of resolving its domain to "". (#140308, @yuzhiquan) [SIG API Machinery and Scheduling]
• Kube-scheduler: the alpha metric scheduler_preemption_workload_disruptions gained a victim label (pod, podgroup, compositepodgroup). Standalone pods evicted by a workload preemption are now counted (victim=pod), and pods of groups with DisruptionMode=Single are counted as victim=pod instead of as group disruptions. kube-scheduler: during workload preemption, pods of PodGroups or CompositePodGroups with DisruptionMode=Single now rank as individual pods when choosing victims, instead of above standalone pods of the same priority. the kube-scheduler framework interface PreemptionVictim has a new Type() method, and PreemptionCandidate.NumPodGroupDisruptions() was replaced by NumDisruptionsByVictimType(). Out-of-tree implementations of these interfaces must be updated. (#142955, @dom4ha) [SIG Instrumentation and Scheduling]
• Kubectl: graduated kuberc support to stable. A kuberc configuration file containing a kubectl.config.k8s.io/v1 Preference object provides a mechanism for customizing kubectl behavior (separate from kubeconfig, which configured cluster access across different clients). (#142619, @soltysh) [SIG CLI and Testing]
• Kubelet-config: (v1beta1) improve documentation readability (#140520, @ingyeoking13) [SIG Node]
• Promote the Topology-aware Scheduling (TAS) feature gate TopologyAwareWorkloadScheduling to beta (#140295, @helayoty) [SIG API Machinery, Apps, Etcd, Node, Scheduling and Testing]
• Selector strings using "!=" (for example app!=web) are now accepted by commands that convert a selector into a LabelSelector, such as kubectl create pdb --selector and kubectl set selector; they are translated to a NotIn match expression. (#142216, @reckless-sherixx) [SIG API Machinery]
• The CustomResourceDefinition API types and generated clients are now published in the new module k8s.io/apiextensions-api, which does not depend on k8s.io/apiserver. The corresponding packages in k8s.io/apiextensions-apiserver remain as deprecated aliases; go fix -inline ./... migrates callers. The protobuf package of the CRD .proto files changes to k8s.io.apiextensions_api.pkg.apis.apiextensions.v1 (and v1beta1); the wire format is unchanged. (#142746, @yongruilin) [SIG API Machinery, Apps, Autoscaling, CLI, Etcd, Release, Scheduling, Storage and Testing]

Feature

• Add 2 new metrics to track errors syncing pods:

1. kubelet_sync_result_errors_total: a counter that is incremented for every failed sync action.
2. kubelet_pod_worker_errors_total: a counter for any error raised during the pod worker loop. (#143284, @tallclair) [SIG Instrumentation and Node]
   • Add write-gating and leader recovery for leader election in client-go (#143289, @michaelasp) [SIG API Machinery]
   • Added support to CompositePodGroup to preemption metrics. Changed alpha metric by adding preemptor label (podgroup or compositepodgroup) to scheduler_workload_preemption_attempts_total and scheduler_workload_preemption_victims, and updated scheduler_preemption_evaluation_duration_seconds to distinguish compositepodgroup preemptors. (#141969, @dom4ha) [SIG Instrumentation and Scheduling]
   • Added the AllocatorPoolBufferCap feature gate (beta, enabled by default) to bound protobuf encode buffers retained in runtime.AllocatorPool at 256 KiB. (#141299, @seans3) [SIG API Machinery and Testing]
   • Added the OpenAPIV2LazyBuild feature gate (beta, enabled by default): kube-apiserver builds the /openapi/v2 spec on first request instead of at startup, reducing memory on clusters that rarely or never request it. Served content, ETags and update behavior are unchanged. With the gate enabled, a spec that fails to build no longer fails startup; it is logged and omitted from the aggregated /openapi/v2. Set --feature-gates=OpenAPIV2LazyBuild=false to restore eager building. Library consumers: GenericAPIServer.StaticOpenAPISpec is now a cached.Value[*spec.Swagger], and apiextensions-apiserver's OpenAPI Controller.Run takes one. (#140939, @seans3) [SIG API Machinery and Testing]
   • Client-go: Added rest.Config.DropManagedFields, which asks the API server to omit metadata.managedFields from responses and strips it from decoded objects when the server doesn't. It takes effect with the new alpha ManagedFieldsOptOutClient feature gate, which also opts kube-controller-manager's shared informers in. (#142695, @yongruilin) [SIG API Machinery and Testing]
   • Extended workloadbuilder validation to enforce hierarchy depth/size limits, parent-child scheduling policy and disruption mode compatibility and uniform priorityClassName across the workload tree. (#143278, @tosi3k) [SIG Scheduling]
   • Extends pod group scheduling attempts and latency metrics with type to support CompositePodGroup (#141823, @dom4ha) [SIG Instrumentation and Scheduling]
   • Extends topology-aware placement metrics with type to support CompositePodGroup (#141929, @dom4ha) [SIG Instrumentation and Scheduling]
   • Improve reliability of serving of Exact LIST on resources with infrequent updates from watch cache by keep the last snapshots behind compaction window (#143325, @serathius) [SIG API Machinery]
   • Introduce a new protobuf-based checkpoint format for kubelet resource allocation and actuation checkpoint files (allocated_pods_state and actuated_pods_state), adding a top-level version field set to "v2". The checkpoint's data field now contains a protobuf-encoded podList. It also maintains the legacy entries field for backward compatibility during kubelet downgrades, and automatically migrates unversioned v1 checkpoints on upgrade. (#141039, @natasha41575) [SIG Node]
   • Kube-scheduler: TAS now runs multiple PlacementGenerate plugins per PodGroup and intersects their node lists. (#139565, @mboersma) [SIG API Machinery, Scheduling and Testing]
   • Kubelet now honors serverCertificateKeyAlgorithm when generating its self-signed serving certificate. Previously that certificate was always RSA-2048; it now uses the configured algorithm, defaulting to ECDSA-P256 as documented. (#142434, @antcybersec) [SIG Auth and Node]
   • Kubelet: added the ALPHA metric kubelet_device_plugin_devices, a gauge of the number of devices the device manager currently knows about, broken down by resource_name and health_state (healthy or unhealthy). This makes devices reported unhealthy by a device plugin distinguishable from devices that are gone because the plugin deregistered, which previously both appeared only as a drop in allocatable. (#143223, @jianzhangbjz) [SIG Instrumentation and Node]
   • Kuberc set: add validation for credential plugin allowlist paths (#142639, @weizhoublue) [SIG CLI]
   • Kubernetes is now built using Go 1.27.2 (#143116, @xmudrii) [SIG Release and Testing]
   • Kubernetes is now built using Go 1.27.3 (#143339, @palnabarun) [SIG Release and Testing]
   • Strengthened runtime PodGroup and CompositePodGroup hierarchy validation in kube-scheduler to verify maximum tree depth, Workload reference consistency, scheduling policies (no Gang parent with Basic child), and disruption modes (no All parent with Single child). (#142719, @GFilipek) [SIG Scheduling and Testing]
   • The KEP-4006 WebSocket streaming feature gates TranslateStreamCloseWebsocketRequests, PortForwardWebsockets, AuthorizePodWebsocketUpgradeCreatePermission and ExtendWebSocketsToKubelet are promoted to GA and locked on. They can no longer be disabled. (#142860, @seans3) [SIG API Machinery, Node and Testing]
   • The WebSocket streaming metrics apiserver_stream_translator_requests_total, apiserver_stream_tunnel_requests_total, apiserver_websocket_streaming_requests_total and kubelet_websocket_streaming_requests_total are now BETA. (#142897, @seans3) [SIG API Machinery, Instrumentation and Node]
   • The KUBECTL_REMOTE_COMMAND_WEBSOCKETS and KUBECTL_PORT_FORWARD_WEBSOCKETS environment variables are removed; the features are GA. kubectl always uses WebSockets (with SPDY fallback) for exec, attach, cp and port-forward. (#142861, @seans3) [SIG API Machinery, CLI and Testing]
   • The e2e test "Services should support named targetPorts that resolve to different ports on different endpoints" is now labeled [FutureConformance] and [Conformance: [>=1.41]], indicating that it will become a Conformance requirement in Kubernetes 1.41. Third party service proxy implementations should ensure that they implement this functionality correctly before then.
   (This is the first e2e test to make use of [FutureConformance] labeling, introduced in 1.38.) (#142561, @danwinship) [SIG Architecture, Network and Testing]
   • The metrics apiserver_resource_size_estimate_bytes and apiserver_resource_objects now include explicit observation timestamps. They preserve last known metric value on error instead of reporting -1. (#142007, @LiomSV) [SIG API Machinery, Etcd and Instrumentation]

Bug or Regression

• Add missing newlines when parsing kuberc returns errors. (#143413, @soltysh) [SIG CLI]
• Adds node run api path to default kubectl proxy filter (#143187, @mpuckett159) [SIG CLI]
• CRD validation failures for minLength now report Too short: must be at least N characters (cause type FieldValueTooShort) instead of Invalid value. (#142983, @krishhna24) [SIG API Machinery]
• Cacher will no longer return "/" in continue token (#142919, @serathius) [SIG API Machinery]
• Fix a bug where cached watch events and status subresource requests did not apply storage read-time defaults to legacy Services and PersistentVolumeClaims, which could cause the ServiceCIDR repair controller to delete active Service IPAddress objects after a status update. (#143291, @Jefftree) [SIG API Machinery, Network, Storage and Testing]
• Fix: deployment rollouts fail to report timeouts after old ReplicaSet scale-down errors (#142902, @weizhoublue) [SIG Apps]
• Fixed a bug where in-place Pod resizing reset existing hugepage limits to zero. (#141991, @chrishenzie) [SIG Node]
• Fixed a kube-scheduler panic when a ResourceSlice changes its device count while a matching DeviceTaintRule event is processed. (#143378, @ahmadmaha02) [SIG Node]
• Fixed device taint eviction ignoring a DeviceToleration with an empty effect; per the API documentation it now tolerates NoExecute taints like any other matching toleration. (#143376, @yogeshbendre) [SIG Apps and Scheduling]
• Fixed static Memory Manager pod-scope accounting for memory resource types requested only by init containers. (#140816, @AutuSnow) [SIG Node]
• Fixed the DRA converting watch client not terminating when stopped, which left its result channel open and kept draining the upstream watch. (#143365, @alkaid040492) [SIG Node]
• Fixed the informer_store_resource_version metric reporting 0 before an informer store records a resource version. (#143314, @Jefftree) [SIG API Machinery, Architecture, Instrumentation, Scheduling and Testing]
• Fixed the kubelet losing a pod's failure phase and reason when its containers exited successfully during eviction, kubelet preemption, or graceful node shutdown. (#142761, @amrmahdi) [SIG Node and Testing]
• Fixed the storage version migrator removing old versions from a CustomResourceDefinition's status.storedVersions after a failed migration, which allowed those versions to be removed from the CRD while objects were still stored in them. (#143103, @SEPURI-SAI-KRISHNA) [SIG API Machinery, Apps and Testing]
• Fixed volume binding (scheduler CSI storage capacity) comparing storage sizes via overflowing int64 values; now uses exact quantity comparison, preventing wrong scheduling decisions for storage sizes larger than 2^63 bytes. (#142088, @Octopusjust) [SIG Scheduling and Storage]
• Fixes a bug for the alpha feature userspace nftable localhost proxy (gate KubeProxyNFTablesLocalhostNodePorts) where the proxy will not be accessible if kube-proxy is already running the service without localhost in --nodeport-addresses then restarted with localhost in --nodeport-addresses. (#142184, @AustinAbro321) [SIG Network]
• Job controller: job_pods_creation_total no longer counts a failed pod creation as both succeeded and failed. (#142923, @yankovitchg) [SIG Apps]
• Job status.ready no longer decreases when deleting a Ready pod fails. (#142922, @yankovitchg) [SIG Apps]
• Keep a multi-line event message inside its table row (#142149, @0xff-dev) [SIG CLI and Testing]
• Kube-proxy configuration validation errors now identify public configuration field paths rather than internal Go type and field names (#142583, @akasakariko) [SIG Network]
• Kube-scheduler: PodGroup and CompositePodGroup objects that are deleted and recreated under the same name while the scheduler's watch is interrupted are now processed as a deletion followed by an addition rather than an in-place update, keeping the scheduler's cache and queue hierarchy consistent. (#142950, @divyanshuprakas-h) [SIG Scheduling]
• Kubeadm: fixed swapped Job names and namespaces in upgrade health-check when dry-running. (#143207, @rishabhraj1572) [SIG Cluster Lifecycle]
• Kubeadm: fixed the automatic rollback of the etcd data directory after a failed etcd upgrade, which previously copied the backup into a subdirectory of the member directory instead of restoring where it should be. The etcd backup directory now holds the member directory's contents. The etcd data backup before an upgrade is now retried for up to 30 seconds if copying fails. (#143087, @SEPURI-SAI-KRISHNA) [SIG Cluster Lifecycle]
• Kubeadm: retry listing etcd members on transient errors during control plane join and reset, instead of failing on the first error. (#143356, @SEPURI-SAI-KRISHNA) [SIG Cluster Lifecycle]
• Kubectl create ingress now rejects a --default-backend with an empty service name or port, and an --annotation with an empty key. (#142338, @DevaanshPathak) [SIG CLI]
• Kubectl describe pod now lists environment variables that are sourced from a file (valueFrom.fileKeyRef). Previously they were omitted from the Environment section. (#142213, @reckless-sherixx) [SIG CLI]
• Kubectl: --kuberc now takes precedence over KUBERC even when it points to the default kuberc path. (#143277, @thnky) [SIG CLI]
• Kubelet: FileKeyRef now honors optional: true when the env file does not exist, and publishes a key with an empty value (KEY='') instead of reporting it as missing. A value after whitespace following = in an env file, as in KEY= 'value', is now a parse error instead of being read as an empty value. (#142665, @imusmanmalik) [SIG Node and Testing]
• Kubelet: fixed rotated container logs being deleted when writing their compressed copy failed, for example on a full disk. (#143147, @SEPURI-SAI-KRISHNA) [SIG Node]
• Make pods/binding label and annotation validation consistent with pod creation and update (#143285, @liggitt) [SIG Apps and Node]
• Pod group preemption clears the nominated node name of lower priority pods running on nodes nominated for pod group. (#142684, @Argh4k) [SIG Scheduling and Testing]
• PodGroup and CompositePodGroup creation will no longer be rejected when preemptionPolicy is unset and the referenced PriorityClass specifies preemptionPolicy: Never. (#143253, @alimaazamat) [SIG Scheduling and Testing]
• The Deployment controller now retries when scaling down an old ReplicaSet fails during a rolling update, instead of treating that failure as success. (#142650, @yankovitchg) [SIG Apps]
• The PodDisruptionBudget controller now updates PDB status when a pod's labels change away from a previously matching PDB, and when multiple PDBs match the same pod. (#143111, @yankovitchg) [SIG Apps]
• Tighten StatefulSet pod names to match the form - without leading 0. (for example web-01 for StatefulSet web). Previously the controller would adopt such a Pod as ordinal 1 and could treat it as the replica in place of the real web-1. (#141094, @marshtompsxd) [SIG Apps]
• Use fixed name for pod group templates for job integration (#142856, @kannon92) [SIG Apps]

Other (Cleanup or Flake)

• Allow immediate volume detach when node is deleted (#136029, @huww98) [SIG Apps and Storage]
• Bump etcd SDK to v3.7.3 (#143358, @ivanvc) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling, Storage and Testing]
• Client-go: NewUnstructuredExtractor builds its type information from /openapi/v3, per group-version, instead of the deprecated /openapi/v2 document. Adds managedfields.NewGVKParserFromOpenAPIV3. (#142048, @seans3) [SIG API Machinery]
• DRA ResourceSlice validation: new version numbers in device attributes must fit into int64. (#142964, @pohly)
• Fixed a bug where kubectl OpenAPI v3 query parameter verification failed on typed *List resources (such as ReplicationControllerList and ServiceList) and fell back to downloading /openapi/v2. (#143288, @seans3) [SIG CLI]
• Kubeadm: use a custom fake client for dry-running and reduce the kubeadm binary size by 20%. (#142742, @neolit123) [SIG Cluster Lifecycle]
• Kubectl apply and kubectl diff no longer fall back to fetching the deprecated /openapi/v2 schema when calculating client-side patches. (#143286, @seans3) [SIG CLI]
• Kubectl kustomize no longer loads kustomize Go (.so) plugins; exec and KRM function plugins are unaffected. Static release binaries never loaded .so plugins. (#142791, @dims) [SIG CLI]
• Promote apiserver_resource_size_estimate_bytes to BETA (#141164, @LiomSV) [SIG API Machinery, Etcd and Instrumentation]
• The ExecProbeTimeout feature gate, which was graduated to GA and locked to default in 1.35, has been removed. (#143335, @antcybersec) [SIG Node]
• The SystemdWatchdog feature gate, which was graduated to GA and locked to default in 1.35, has been removed. (#143337, @antcybersec) [SIG Node]
• The deprecated AllowOverwriteTerminationGracePeriodSeconds feature gate, locked to default in 1.35, has been removed. (#143336, @antcybersec) [SIG Node]
• kubectl apply, create and replace no longer download the deprecated /openapi/v2 schema to validate list documents client-side; the items are validated server-side like single objects. (#143327, @seans3) [SIG CLI]
• kubectl explain no longer falls back to /openapi/v2 when /openapi/v3 is unavailable. The --output=plaintext-openapiv2 option is deprecated and will be removed in a future release. (#143396, @seans3) [SIG CLI]

Dependencies

Added

• go.opentelemetry.io/otel/log: v1.47.0

Changed

• cel.dev/expr: v0.25.2 → v0.25.3
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.34.0 → v1.35.0
• github.com/emicklei/go-restful/v3: v3.13.0 → v3.14.0
• github.com/envoyproxy/go-control-plane/envoy: v1.37.0 → e6e3fd9
• github.com/go-errors/errors: v1.4.2 → v1.5.1
• github.com/godbus/dbus/v5: v5.2.2 → v5.2.4
• github.com/google/gnostic-models: v0.7.0 → v0.7.1
• github.com/klauspost/compress: v1.19.0 → v1.20.1
• github.com/prometheus/client_golang: v1.24.0 → v1.25.0
• github.com/prometheus/client_model: v0.6.2 → v0.6.3
• github.com/prometheus/common: v0.70.0 → v0.72.0
• github.com/prometheus/procfs: v0.21.1 → v0.22.0
• go.etcd.io/etcd/api/v3: v3.7.2 → v3.7.3
• go.etcd.io/etcd/client/pkg/v3: v3.7.2 → v3.7.3
• go.etcd.io/etcd/client/v3: v3.7.2 → v3.7.3
• go.etcd.io/etcd/pkg/v3: v3.7.2 → v3.7.3
• go.etcd.io/etcd/server/v3: v3.7.2 → v3.7.3
• go.opentelemetry.io/contrib/detectors/gcp: v1.44.0 → v1.45.0
• go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful: v0.71.0 → v0.72.0
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: v0.71.0 → v0.72.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.71.0 → v0.72.0
• go.opentelemetry.io/contrib/propagators/b3: v1.46.0 → v1.47.0
• go.opentelemetry.io/otel: v1.46.0 → v1.47.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.46.0 → v1.47.0
• go.opentelemetry.io/otel/exporters/stdout/stdouttrace: v1.46.0 → v1.47.0
• go.opentelemetry.io/otel/metric: v1.46.0 → v1.47.0
• go.opentelemetry.io/otel/sdk: v1.46.0 → v1.47.0
• go.opentelemetry.io/otel/sdk/metric: v1.46.0 → v1.47.0
• go.opentelemetry.io/otel/trace: v1.46.0 → v1.47.0
• golang.org/x/crypto: v0.57.0 → v0.58.0
• golang.org/x/net: v0.59.0 → v0.61.0
• golang.org/x/sync: v0.23.0 → v0.24.0
• golang.org/x/sys: v0.48.0 → v0.49.0
• golang.org/x/telemetry: 4bcc4b2 → ed294f9
• golang.org/x/term: v0.46.0 → v0.47.0
• golang.org/x/text: v0.42.0 → v0.43.0
• golang.org/x/tools: v0.50.0 → v0.51.0
• google.golang.org/genproto/googleapis/api: 6ac0973 → ac3dfec
• google.golang.org/genproto/googleapis/rpc: da73d73 → 8a89bd6
• google.golang.org/grpc: v1.84.0 → v1.85.0
• k8s.io/kube-openapi: 2cfbdf1 → ca3452a
• sigs.k8s.io/kustomize/api: v0.21.1 → v0.21.3
• sigs.k8s.io/kustomize/cmd/config: v0.21.1 → v0.21.3
• sigs.k8s.io/kustomize/kustomize/v5: v5.8.1 → v5.8.3
• sigs.k8s.io/kustomize/kyaml: v0.21.1 → v0.21.3
• sigs.k8s.io/structured-merge-diff/v7: v7.0.0 → v7.0.1

Removed

• cloud.google.com/go/auth: v0.20.0
• github.com/NYTimes/gziphandler: v1.1.1
• github.com/go-openapi/swag: v0.23.0
• github.com/google/s2a-go: v0.1.9
• github.com/googleapis/enterprise-certificate-proxy: v0.3.15
• github.com/googleapis/gax-go/v2: v2.22.0
• github.com/josharian/intern: v1.0.0
• github.com/mailru/easyjson: v0.7.7
• google.golang.org/api: v0.278.0

Contributors, the CHANGELOG-1.38.md has been bootstrapped with v1.38.0-alpha.3 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.34.13 has been built and pushed using Golang version 1.26.10.

The release notes have been updated in CHANGELOG-1.34.md, with a pointer to them on GitHub:

v1.34.13

Downloads for v1.34.13

Source Code

filename sha512 hash kubernetes.tar.gz 1698627b7fdf328743a9d93eb535c36ab87833a64847f2d95d77eac43ce15dc698e0c76b06549662c4161b2de7a108340db7944ab9af4b31cb8832d00d7ea594 kubernetes-src.tar.gz dde9dbce00864bfe74022285936a7862910bf8e1f6d26e699c5388bb49ec0d31a9d83d5235b3357037d426e062eb9d9d5c61fa0db5a9bff3f2775b4ae2bc1187

Client Binaries

filename sha512 hash kubernetes-client-darwin-amd64.tar.gz 4967595bbad84b850278af96ace4b62af6affdbb8ead0e887e27d23d256fb3bc65d536ab6543a40d871e13f18057a63ac793e61e3343efc6d1ce92b38772ecc9 kubernetes-client-darwin-arm64.tar.gz d4ebe7cfb013e6c9d0534e186d6b0450d2705544b163054f666899b2ad841ea284c146eec199948f7b7d91ea34f0b4a23599a1feff1c792c0047d1937399dade kubernetes-client-linux-386.tar.gz ac9551f3710ace8846c2c72dfb09034558b7865cd088ad63b630f3bfa1b5989d62783943c2cfc336a59d857f4710a0bd6abd6d70d2b30fed5f231bff53492510 kubernetes-client-linux-amd64.tar.gz 80c50a0af1bc7c59b4e56760d2e78b0902017351675ae107dbb873e23a3daa21638361a6dd96cc7673546185b3718d83a244caa9bbe0f5b241ec659d38245a50 kubernetes-client-linux-arm.tar.gz a75fe849b5538c18e2e9585c92b016ddc5b35aff564c85d9cc26887c92d5dfc26b9cc9257c491514835bd8b54f9d63899d60bc8ebcc7c9c16bf8d26372983fb6 kubernetes-client-linux-arm64.tar.gz 7911003b9ac766a44910ce9d77f67889b788d9cda4cd6b6e7fabd977fb554e2b6a18d9ead6a672d38f3523ce3a23bedbfe3cfef3a9a670b589f626dbaa0f177e kubernetes-client-linux-ppc64le.tar.gz 3295d6dcc435d1b088ae5c136fd0586fa3b7572e50adfe0c982fe6b2bebf3026c797bb4be859e3c0eafc1c100baec20abb8aa0e78d0363d71bd46b29d7b8f892 kubernetes-client-linux-s390x.tar.gz 33e51aec7319813399c5b7ab6fc29850cbaba30cd73d7fde5b15cefaf82ae07a22c61a45d050376c8078836bb759a18161d0995294e4a22bb2a631933178c26b kubernetes-client-windows-386.tar.gz ddb3b11ac7ffc165b7ca295cb3f0468315738b0a44a218ea5669e3dc12eb7574c85144abae038ad9048e63796363f83b6251a442b2a108c21d38c560feb53245 kubernetes-client-windows-amd64.tar.gz e7712b0d018cbe3e584002704ee81726b5ef89df11f08b040414946ff656b5805387eef5f32105dd48acb50c14a1eb55606440501eccfddf307fa77ff2363186 kubernetes-client-windows-arm64.tar.gz 0fc29bfe561cdbccf8fe184c2ea43e853d13de3dd4d1c09327f53998b185e558266bdbbf5d21f39ba3ce9d9e698497dbe9a8a62dea3185b71587550e3bfc486c

Server Binaries

filename sha512 hash kubernetes-server-linux-amd64.tar.gz c25978f4d36c23ce0aa4ddad6a9a2c34812ffb24cca2686c41d9a0762bc0a981447f686448b5ea8ea1f083f7775b5cb3406619772806f93d6c3d2d31defa41a6 kubernetes-server-linux-arm64.tar.gz 70cb60db7d3b5b7111687141e94d33ebe84aa883548587c6775db4923a117419a4fcea181c853cb5da26ea1c0bd92e1f99c1fbcef5158ff32ee0179747ad600b kubernetes-server-linux-ppc64le.tar.gz dd7c2a2fb0c572e255ae29def729f606837915e9a4575cc9519f66a756c0f27f3416b26217a63ee60e77d2bc6adaaa41496909d6a0cd4661d0ae75289466ec18 kubernetes-server-linux-s390x.tar.gz 491f513984882189d231fbda1c4a222e116f7a05136d3e5d1d187119aa8f7d3b2c1b0be73a18f19bc263bb61bcfed5e5a91ec04dbae92e84289baaf76db93a0c

Node Binaries

filename sha512 hash kubernetes-node-linux-amd64.tar.gz e3560a06fc0dd9753dc4c10e659531a36b3486e62d31328c3a4ba5f501aeea32d5d57d740a9276a3ed1205eb2a4dfec5d2ed55f281a9e74860dee60d2560eb44 kubernetes-node-linux-arm64.tar.gz c6259647c18a5e6fe3b909bbd2d78768e480f3beef3e997049e8b66bcee3150ce0bcf5124c3ae2652fa0ca19614e2ba980e2e7b138c427821b96f9985bb36ac7 kubernetes-node-linux-ppc64le.tar.gz 649580b31640c254e129e1ad10ece3c330ac8d62cfa7ce34f1b9f3581040abc4ef0fa2ce8815306568c83a9627cf507d68fe92b6de0839f6d4995bad4096ac9a kubernetes-node-linux-s390x.tar.gz 0ac2b0285c45ff364fa816a5cfb94c930c12db20df22f3e6a693f2127518456c0f67a866b1dfbfa9f5f222a75d0d9d08e2302df63f37cfe0578e6ecfc2520b97 kubernetes-node-windows-amd64.tar.gz 7a0ff4adf607187c617ca13380ac4e39154ae10f0c76567834e9b844cbe2db0936f945fa4543f60ea8d8c1284020257dd2bb9f97cd60128ff04625dd6d809161

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

name architectures registry.k8s.io/conformance:v1.34.13 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-apiserver:v1.34.13 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-controller-manager:v1.34.13 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-proxy:v1.34.13 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-scheduler:v1.34.13 amd64, arm64, ppc64le, s390x registry.k8s.io/kubectl:v1.34.13 amd64, arm64, ppc64le, s390x

Changelog since v1.34.12

Changes by Kind

Dependency

• Kubernetes is now built with Go 1.26.10 (#143255, @palnabarun) [SIG Release]

Feature

• Kubernetes is now built using Go 1.26.10 (#143344, @palnabarun) [SIG Release and Testing]
• Kubernetes is now built using Go 1.26.9 (#143120, @xmudrii) [SIG Release and Testing]

Bug or Regression

• Fixed a bug where Pod .status.resourceClaimStatuses could flap between partial lists of claims, when multiple claims were used in the pod. (#142025, @troychiu) [SIG Apps and Node]
• Fixed kube-scheduler evaluation of pod affinity and anti-affinity namespace selectors using negative operators, so pods in excluded namespaces no longer affect node filtering or scoring. (#142049, @rahulbabu95) [SIG Scheduling and Testing]
• Fixes an issue where the kubelet /configz endpoint reported incorrect value for kubeletconfig.cgroupDriver when the cgroup driver setting is received from the container runtime. (#142982, @kannon92) [SIG Node]
• Kube-apiserver and other servers built on k8s.io/apiserver now accept up to 16384 request header values. Without this, Go 1.27's default of 500 rejects impersonated or proxied users with about 500 or more groups with HTTP 431. Releases built with Go 1.26 had no separate header-count limit. (#142773, @cwedgwood) [SIG API Machinery and Auth]

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.34.md has been bootstrapped with v1.34.13 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.35.10 has been built and pushed using Golang version 1.26.10.

The release notes have been updated in CHANGELOG-1.35.md, with a pointer to them on GitHub:

v1.35.10

Downloads for v1.35.10

Source Code

filename sha512 hash kubernetes.tar.gz 58f6a64ca1ba07e9f73dc2d8155ede9212f12a48cfeed3a40420ccd4cd7929de127a22a6fc34ad6506ca5631fb8743c857b0c41a81dc9c4d4c079f7c797199f5 kubernetes-src.tar.gz 21206f71aa990caced61df7b5851a04c302e72ec61768ac95dd694e37ec8517f59abefe0fa782bf5bf4398014a777c1524524c291e5a97f55b834cc5af034bf9

Client Binaries

filename sha512 hash kubernetes-client-darwin-amd64.tar.gz ea5d1c4a771c98260f5a2da0c429eb1465f97f766cdb4e7d0129cf0d798a2e7e46dd9cfacf1de2a6638f2d1347e38d0d48056b08d6a78f3fe2ef73affd00c971 kubernetes-client-darwin-arm64.tar.gz 718e509b78cafd6993f234484dd6fe4681802a32649746025781065df2eb3f182228fb5844ce22ad4934a73f929c41b5072ef8a45093bdabe49e5b9ef0c010d6 kubernetes-client-linux-386.tar.gz 1fcd398cc5f2e90cd02c603da0d95467ef6475c515d8fb4553c2cb8028a69843240fe817f0fb24851a9c41b3c564be056f5e2822bf3cfc702d9cd173433083bb kubernetes-client-linux-amd64.tar.gz 877430a343c2fa68a495282ebf587c263a0044f7773d450f96d847383802e4f6d389b21fd010cb35df1b873b6e4418105358292483c79ea1e91e7fe090abf68f kubernetes-client-linux-arm.tar.gz 9e8da689e38765960bd97261cab2f847b6853e6b12f4825019ac9f2cea0a212124906dfcc55b673bffcb2183e2972bcd94f38f1107ccbfa5f3cfe3d478b959f2 kubernetes-client-linux-arm64.tar.gz e691f694c5bdcc5f42c1ff74b1b860b56d32704972c1f532fb76e5d4ebc79898c9118d313b4a589cab2dbe5e2f873d0968373d0d9387ebd17f6899b6b2f0d516 kubernetes-client-linux-ppc64le.tar.gz c1d8fdddffe52bc8dc57316559a1a5ac717dc83bf9695573709c5c828960451078baad0fa1ba479b090ab7543b2b0343a242baabe0c9f32a8d96b08d8292aacf kubernetes-client-linux-s390x.tar.gz 7ad1eb0badd9437c743314adbc60f26581087f6707400c20c189d239ae610175b6852213cc05ae8e4363fdfd1bb5d1becb12a7089abc6c6305daba17e7e94324 kubernetes-client-windows-386.tar.gz 5b5d9fbbb065e8c6a47e00a1ce5818ac82971c32f0ff9ae8394ad831db551fb9723cbd9a5adfbe06e5697f0b93b1ab93980b4253ea6c26bcb1abedc4760d468b kubernetes-client-windows-amd64.tar.gz 3c6f0ee4989bc62aaaa55038c7d8b51d8b6a472d6d8c0dc1fe9c98610ff3e51a34eb5fadcab05cac876dc0dda5afca20c2e7cdcc0d7f1da2ac4816688f860001 kubernetes-client-windows-arm64.tar.gz 8f68db56674a677877c0b9ba0eb2e564a8b03a4c499506189f6176e77837ad97ffdf05ce91b382c3b707ad54f69ba3678b2bc6b09beb90fea8c940191d673287

Server Binaries

filename sha512 hash kubernetes-server-linux-amd64.tar.gz 9dcc8cd56fd0626e69a16667cfa351c9fa4c2bcf3cf2e2717300403a7326d18ae3f239d9c90e8a2b70d79ecf190b6647cfbd1634420be2f50d37737f246b2e33 kubernetes-server-linux-arm64.tar.gz 7b75354c521042f13937a1b9974b1b720457b5374dbc1514a4ce87d75992aef581c17c8645b9ef0f44fa51aa57418cd7524587cda94ee0f405086ae31b27d6eb kubernetes-server-linux-ppc64le.tar.gz c9df5d4201c71500c9527683f75415cc79ee23c6767a7f37fcf51b213a70be1267c9f935566fb6a0776084aab60aa792dea18eb945df8b6d3f00e25894aad82e kubernetes-server-linux-s390x.tar.gz b00676371dc0dd197ef8f055f87ba8204295b0fb69a94209a725f66dcf2b4e42c206fd08dc029f4281d04acdf4cf9a7f6ab6b23fbbb5df61b97bf129fe0fb593

Node Binaries

filename sha512 hash kubernetes-node-linux-amd64.tar.gz 6282a3e9a684e91b87506d29ac8c6bca52e04ad6b4573d56738eacee5c2a14c771f168e85028acfa78544010767e1e20705a567211f41ef5bdfd985691641d58 kubernetes-node-linux-arm64.tar.gz 828442a5fb57ee4969f2ae91192aa4a255b37b73407abd47f00a810b5453f7c94967362808206cb014fe015df7d6c991e6f5c92dbdbe352d42800c4c53338d08 kubernetes-node-linux-ppc64le.tar.gz 09ba9b4449116f63cb5fe7c2b4cbf92f6e993e1f40b645f7627a0282fd11da51b6c9e9b9cc374ff8fd5f36ba5f37d92a9af4abebd755f49c02d701c8ad8a646f kubernetes-node-linux-s390x.tar.gz 809b3421279c5f5115da3cbe3bd3665ebe5171291acef60d8fb4f8aa6f2eaa1a8d709d01a76653d966dd67fc830264f6a2b19a3f2c672860f3b4fdab74be2207 kubernetes-node-windows-amd64.tar.gz 7906c3cc5d2c40ad1d0aa2cddfd98f0a4d24dd757da5e9916c372cb767ec8e1c11385e627c6af193c1688a26172ba98f4defbc5e40aa2a8f1e021bfc62df5af8

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

• registry.k8s.io/conformance:v1.35.10 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kube-apiserver:v1.35.10 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kube-controller-manager:v1.35.10 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kube-proxy:v1.35.10 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kube-scheduler:v1.35.10 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kubectl:v1.35.10 — amd64, arm64, ppc64le, s390x

Changelog since v1.35.9

Changes by Kind

Dependency

• Kubernetes is now built with Go 1.26.10 (#143256, @palnabarun) [SIG Release]

Feature

• Kubernetes is now built using Go 1.26.10 (#143343, @palnabarun) [SIG Release and Testing]
• Kubernetes is now built using Go 1.26.9 (#143119, @xmudrii) [SIG Release and Testing]

Bug or Regression

• Fixed a bug where Pod .status.resourceClaimStatuses could flap between partial lists of claims, when multiple claims were used in the pod. (#142023, @troychiu) [SIG Apps and Node]
• Fixed an issue where a Job recreated with the same name as a recently deleted Job could remain unreconciled because it inherited pending Pod expectations from the previous Job. (#142392, @6democratickim9) [SIG Apps and Testing]
• Fixed kube-scheduler evaluation of pod affinity and anti-affinity namespace selectors using negative operators, so pods in excluded namespaces no longer affect node filtering or scoring. (#142050, @rahulbabu95) [SIG Scheduling and Testing]
• Kube-apiserver and other servers built on k8s.io/apiserver now accept up to 16384 request header values. Without this, Go 1.27's default of 500 rejects impersonated or proxied users with about 500 or more groups with HTTP 431. Releases built with Go 1.26 had no separate header-count limit. (#142772, @cwedgwood) [SIG API Machinery and Auth]
• Kubelet/DRA: fixed a bug where retrying a partially-failed PrepareResources caused duplicate CDI device IDs to be passed to the CRI runtime, which could cause container start to fail. (#140954, @bart0sh) [SIG Node]

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.35.md has been bootstrapped with v1.35.10 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.36.6 has been built and pushed using Golang version 1.26.10.

The release notes have been updated in CHANGELOG-1.36.md, with a pointer to them on GitHub:

v1.36.6

Downloads for v1.36.6

Source Code

filename sha512 hash kubernetes.tar.gz aa10719e9cef00650de223e95cbd15a0220e7999da2faf43e1b35320df943e0ff2aa3dd5c13ebcf7564e0276c0678e0e929190b1ae2211d835411a2a0c350bb1 kubernetes-src.tar.gz cd1bcf40557410c57a117d11ae2f735fe24f5e14eb80ebfecf78cb2463b84d701e2f5463dc83b53e55783819b43a10d1055a470fe0ab67546d1c88e90d9d6cbd

Client Binaries

filename sha512 hash kubernetes-client-darwin-amd64.tar.gz b146d8c86cac9ad6431e09689a4d4245265a8f76866b99680a1389295a1806fe155de6edd239c166e86e6b18dde5c06bae456741932d629dd52e8f22d46d3c48 kubernetes-client-darwin-arm64.tar.gz aa767575579d85c44f287c0e652c2db988436aa630cabb19c4811e8e6a6a27d9a399c660cb6688b5aabfc47830dba768d0e65ce21542b4a75d09bedbf76968a7 kubernetes-client-linux-386.tar.gz 052d3d99c8a92a5695603ad47723db2b6e99e20e22289eeff64840c45dd15d9b2204524d0c16c755d43bf92882a3f5066959373b54d0e7e70f3ccdd3f56af407 kubernetes-client-linux-amd64.tar.gz 90ba8f6676988f7913cae016e5df1a3c05ec09944a6529800c5c87e5d26df093769a5401e6413096266e16a3fd72a626cdf816e0855f558d1c81c0f6f127493f kubernetes-client-linux-arm.tar.gz 3359423f7823943024aff924d0a85a7ac6078081b0126bc6478a6b0e66dfbe1a17f5afdb9edea7af6108f4ab79bce60b4bf74c32c4179635c1cc479c1804f32e kubernetes-client-linux-arm64.tar.gz 8cd7eaca6af5882977d11ce1d8f2a96e71a0428451ed1c320999bcf9112e7c836c8ce6606ad27003078c91409a7ac632f23322bcb52e8c19eac6b01708f0b51b kubernetes-client-linux-ppc64le.tar.gz eb36863e43b4ed1ff2483fb2b4995a69d101d1b12494d1477bb3bfafaac9e241a8f5f6e9569bb4b5344ecf66f3c284911f6af7059297bcde40b222126deb30a1 kubernetes-client-linux-s390x.tar.gz ab69e3bf7b865868b24b6f37d1389afe0052b025ffb3e22eae4741e979bc82752074da6fbbd5d8980d61e1e496e1c07a857747d6902f8b826701bf9067d8820e kubernetes-client-windows-386.tar.gz 85302bf3d75aba1e252d5e3cf28a54100528c9504845bfc034ad3e76798615534d03802c43b65e42064502581b1a2a5042046be79a780053d39ac37e05b153b7 kubernetes-client-windows-amd64.tar.gz 457794f8a0513b22e0aad328745c093bd303c5bb3a7b7d0ebcac9010b50edf643f75fdacfb79a26ddae843e81fd2d3035958f9a13df4e6c2fa4e7e33aa0fa6d2 kubernetes-client-windows-arm64.tar.gz 6cd2941162389142f492e879b273874344a762fe5a6ae82fb6677e75efd607d32c4078fc0ff7158646ea55ce6aae741a2e97f047a4c4f51c5b72e6e8e4e528b0

Server Binaries

filename sha512 hash kubernetes-server-linux-amd64.tar.gz ff6597d0557c2cd125a2b949defa839aa9d2dce16166454b6d85745016e43708543087a0e76b256996370d71b6a0199e2a8e08cbdd8ccd70a14a94c9349d48cb kubernetes-server-linux-arm64.tar.gz 8c737c60b8146f222f976c589870194a0387e8960a03ff729b38e29d5bab504652183fd685e41787f63c047454d7cd946c67b649733ab79d6cc8b3f605c869e3 kubernetes-server-linux-ppc64le.tar.gz ff3c8e86f0bd0fa178e106810b14e7fb5115e8699291771eccc02d95faea88c8b9ed660103c74326d0159f65d9ebb14ff139dd49812c17225910a6915c536623 kubernetes-server-linux-s390x.tar.gz ba9b297f0f0870035d3e6429f34175d03df640fe52f1de93eb9d8f70b314dca97302a48ccb8cdcfbba154587bf3872c7a4e785dc2410bd8713cf99316b51d035

Node Binaries

filename sha512 hash kubernetes-node-linux-amd64.tar.gz 8ad4e53e1dd688802e6be08985cf52548239f5f5567dc26019416703bf6a07b99529a8169e790a1d38c383cdeca70e808d1f1a69a0489c6d19b448c8295aaed2 kubernetes-node-linux-arm64.tar.gz ab5218892f7dd9069151111ed88eb663126377f0f44fd9b66264cb0975524acb93fd54ca49bfec0c05a7a1b55b7bdbaaf027347fb7731e9dc3ce884aae5b5f0d kubernetes-node-linux-ppc64le.tar.gz 51fbb7c88ddb81ee4cc69555eeedb6dd942d530c7213f2d40948495b4c10bdfa77c9b1617e36185bff9608e3b99b5f1a674457b3c5d61acf13821a26e34af767 kubernetes-node-linux-s390x.tar.gz 4d96ab69b793f420327256372dd1124ae8d5ab8283e7433838e1492dec980c2eaaf43c97fd3bead978d382a9aaedde2e725851024a1cfd4b3dda73ea24ab1541 kubernetes-node-windows-amd64.tar.gz b085c80ae440390c05d8af3a5af179d5fc085c8a9dc812bb2c8760848bebb666945aa071dbfbfb728fd88ab3ae3dfea429f42bd6980289df65ca3bea63db23ee

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

name architectures registry.k8s.io/conformance:v1.36.6 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-apiserver:v1.36.6 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-controller-manager:v1.36.6 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-proxy:v1.36.6 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-scheduler:v1.36.6 amd64, arm64, ppc64le, s390x registry.k8s.io/kubectl:v1.36.6 amd64, arm64, ppc64le, s390x

Changelog since v1.36.5

Changes by Kind

Dependency

• Kubernetes is now built with Go 1.26.10 (#143203, @dims) [SIG Release]

Feature

• Kubernetes is now built using Go 1.26.10 (#143342, @palnabarun) [SIG Release and Testing]
• Kubernetes is now built using Go 1.26.9 (#143118, @xmudrii) [SIG Release and Testing]

Bug or Regression

• Fixed a bug where Pod .status.resourceClaimStatuses could flap between partial lists of claims, when multiple claims were used in the pod. (#142021, @troychiu) [SIG Apps and Node]
• Fixed an issue where a Job recreated with the same name as a recently deleted Job could remain unreconciled because it inherited pending Pod expectations from the previous Job. (#142391, @6democratickim9) [SIG Apps and Testing]
• Fixed kube-scheduler evaluation of pod affinity and anti-affinity namespace selectors using negative operators, so pods in excluded namespaces no longer affect node filtering or scoring. (#141563, @rahulbabu95) [SIG Scheduling and Testing]
• Kube-apiserver and other servers built on k8s.io/apiserver now accept up to 16384 request header values. Without this, Go 1.27's default of 500 rejects impersonated or proxied users with about 500 or more groups with HTTP 431. Releases built with Go 1.26 had no separate header-count limit. (#142771, @cwedgwood) [SIG API Machinery and Auth]
• Kube-proxy no longer tries to set the nf_conntrack_max sysctl if its value is already higher than the value kube-proxy wants it to be. This fixes a regression in 1.36 on systems where kube-proxy does not have permission to modify the sysctls, since the new maximum value for nf_conntrack_max could cause kube-proxy to now want a different (lower) value than it had before. (#142199, @danwinship) [SIG Network]

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.36.md has been bootstrapped with v1.36.6 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.37.2 has been built and pushed using Golang version 1.26.10.

The release notes have been updated in CHANGELOG-1.37.md, with a pointer to them on GitHub:

v1.37.2

Downloads for v1.37.2

Source Code

filename sha512 hash kubernetes.tar.gz 9e19e0189c0d4688fb8b27a7516b3d71ed9a92795c6531b6e1975d7f6d3d40a957e2befd47af88ef531e5f306266286661c64cb4bd6b72b0541d3700de72d3dd kubernetes-src.tar.gz 2c5e991be1dcf78db1db099b8b52e6750d251045d4662f2cacf28d415f17a41a536ad3a88e35cde6a109f09c120c6a0b05f6b61b88202656a6671ed4c442db44

Client Binaries

filename sha512 hash kubernetes-client-darwin-amd64.tar.gz 1bf8eca8dc3cf81281513cb1d9f3474264a5dbef49e69edeca965170446f22b09374de4e0b61ac9c49dc8a53a36c3a61578bcd7e54e330ef41676554620927cf kubernetes-client-darwin-arm64.tar.gz 99e2e941d3248788d4c1562387a072e0bffc4a2ce011d3a0047a2d6a0df64b63283e77b66654c070dc84d5d236279fc76713acbc873e0a74758f7355390febfd kubernetes-client-linux-386.tar.gz e8176ba3e45c72b5752b203b373a7ee06d2d53d9cb24d15547a3a23ba00890a269182c9866c48996d3561232000672727690c525ced781c99319cb2a623ee0af kubernetes-client-linux-amd64.tar.gz b09ee8f473b44ecd1689e80392dae203e4a0cce49fcd622e47e3b48c98afc78ce0600b6694d13903af4cffb059f90e0309772c4919de166bca30eacf40ee4273 kubernetes-client-linux-arm.tar.gz fc7ac4be3ed77813abfd713e6aaeac2ae75f26ce11805d30decfd74db15f39dd4b8c56e3510e15a91865b3ff0393f0c71eed87aecbeb12370cf51300a13fb1ed kubernetes-client-linux-arm64.tar.gz 6a224e4787d1877577a58cad1524b132229e1ccc9bd0eb588d0c1764ceba652280223fd1f693196a8d04f2792bbe50cb22b468b7b65b1bf97cf9a7d22263a3f4 kubernetes-client-linux-ppc64le.tar.gz 6ed62c70087a550a77251259fa1e5f64e33ca14bb2f15ce4954275c5f911efafd1d04d49c27a1eb7592c25a01103a788652626a8deedae01d5136ce31901a35e kubernetes-client-linux-s390x.tar.gz 6533484127af8094e7713b24bc6483774be6010d3538de66568d378b4485873b1871d523e0b3fb9b96a5a8c8455ffed892060563a215276abc28b5b44f70a68f kubernetes-client-windows-386.tar.gz 6bee7891708be062302883a44327bf58a60644d055995569a9a889f53d1a73c971f14bc1ac9a2a1e00eabc76f07503724f9dd441b16f309e6ca652b92023fdd8 kubernetes-client-windows-amd64.tar.gz cf186d4fad00bd77a5670d107d3d70235ccee1ebe8b654783a67d491d060221aeb00d459792613d4c5ea2e40d42f9951fc8c83ec25a2d57c235d560511d2433f kubernetes-client-windows-arm64.tar.gz 749f13506dfd73670a588def02e9aae4ce890d4283f01ea48def4738c2be8763915ff708d302134ec8a79daf559f4d12028db113ad56ae8f3e756015cb97b482

Server Binaries

filename sha512 hash kubernetes-server-linux-amd64.tar.gz 0956faf23fbe144f7b7d787bd3c9fa601a2916c30152d7788f4d5155168d1db353e252ee865f196c55c24b5c1e8ef9aa351ce5aa34afe2506ed5f88864f6ce0c kubernetes-server-linux-arm64.tar.gz cd1b134bbc30a3ba07579556ee03b630412adbc443b262d5fe42527c6c316393b1cc4a58ba2fb83b030c571494dcae6a8d49818245c192efc97ffcedd90b0b41 kubernetes-server-linux-ppc64le.tar.gz 4cd59c117124d0ae1d61b810af9fa477f3bb873f2d3401d28156ede19b0f3033351d208ce98403e3bdcde421061f8d34ec92d8011a58d4cd10cbafce01f7ab34 kubernetes-server-linux-s390x.tar.gz 240eca87a0d9f0e85cca33efe1b268c906d24615d6fe8ff1b3439925290ae0971258e1933ac606de739742222fc9b80688fbb0ccda97819e9624132021f319a8

Node Binaries

filename sha512 hash kubernetes-node-linux-amd64.tar.gz 6e9f34d35a40f5b4e0026b98cfaa30b52530d2b3e0dc78a8600ce66ae0552e8966e5db78a360d62908d0fe35ef0f816d6da0e21d0f6bc7f26beba3a3a0b3ecdb kubernetes-node-linux-arm64.tar.gz 841361fa8a16fa523d7cb4f936f09a9abe1eb240bcc25e07bc31b42964e7ba11c4c762b4f6f53c0efcaf1af466cabbc7b847e7b0e036582ab5ab25706559eb95 kubernetes-node-linux-ppc64le.tar.gz ef6b00e8268c922a39173a494ac46ad51ba68285ff7796dc0344d620a791d0d8e0223b623d1515cd1c7e3b2defbaee48e344925d2ddef34df607879f70c08ffe kubernetes-node-linux-s390x.tar.gz 0d4072a65161c04fab94ff40ac24a4e01e987c184e887f18d4efaf268a2aa713fdc4eac96a5432b3b97d4339d587f916ac84b19d62047cd0aaee03954501a729 kubernetes-node-windows-amd64.tar.gz d28802c32d09f1cbac711ad7e9f804901f797a61807814da9c673122a20ed3c2a479d2520a3b77fb5cdd653d4fc4a4f6eeeba511d3295124a2bd8c4cd23e5c53

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

• registry.k8s.io/conformance:v1.37.2 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kube-apiserver:v1.37.2 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kube-controller-manager:v1.37.2 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kube-proxy:v1.37.2 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kube-scheduler:v1.37.2 — amd64, arm64, ppc64le, s390x
• registry.k8s.io/kubectl:v1.37.2 — amd64, arm64, ppc64le, s390x

Changelog since v1.37.1

Changes by Kind

Dependency

• Kubernetes is now built with Go 1.26.10 (#143204, @dims) [SIG Release]

Feature

• Kubernetes is now built using Go 1.26.10 (#143341, @palnabarun) [SIG Release and Testing]
• Kubernetes is now built using Go 1.26.9 (#143117, @xmudrii) [SIG Release and Testing]

Bug or Regression

• Fixed a bug where NoExecute device taints (DeviceTaintRule) did not evict pods using DRA-backed extended resources (pod.Status.ExtendedResourceClaimStatus). (#142492, @troychiu) [SIG Apps, Auth, Node and Scheduling]
• Fixed an issue where a Job recreated with the same name as a recently deleted Job could remain unreconciled because it inherited pending Pod expectations from the previous Job. (#142390, @6democratickim9) [SIG Apps and Testing]
• Kube-apiserver and other servers built on k8s.io/apiserver now accept up to 16384 request header values. Without this, Go 1.27's default of 500 rejects impersonated or proxied users with about 500 or more groups with HTTP 431. Releases built with Go 1.26 had no separate header-count limit. (#142770, @cwedgwood) [SIG API Machinery and Auth]
• Kube-proxy no longer tries to set the nf_conntrack_max sysctl if its value is already higher than the value kube-proxy wants it to be. This fixes a regression in 1.36 on systems where kube-proxy does not have permission to modify the sysctls, since the new maximum value for nf_conntrack_max could cause kube-proxy to now want a different (lower) value than it had before. (#142198, @danwinship) [SIG Network]

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.37.md has been bootstrapped with v1.37.2 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source