AI-analyzed release notes for CNCF graduated and incubating projects.
Jaeger v2.15.0 introduces a breaking constraint for trace and metric storage configuration. It also adds experimental MCP and ClickHouse capabilities, corrects API behavior, and includes an internal implementation change without direct operator impact.
Check if affected (1)
breakingTrace and metric storage configuration backend constraint
Applies if you configure trace or metric storage with more than one backend type.
A maintenance release with operator-facing removals, default and behavior changes, new CRD fields, expanded configuration support, and dependency updates. No security advisory is disclosed.
Action needed (1)
breakingNodes/proxy RBAC enablement removal
The unnecessary nodes/proxy RBAC enablement is removed.
Check if affected (2)
breakingDefault Ceph image pull policy
Applies if you do not configure ceph image pull policy.
breakingAutomated node fencing code removal
Applies if automated node fencing runs.
A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.
Action needed (15)
securityThe github. dependency, updated
The github. module is updated to v1.7.29.
securityThe github. dependency, updated
The github. module is updated to v2.4.0.
securityThe github. dependency, updated
The github. module is updated to v28.3.3+incompatible.
securityThe golang. dependency, updated
The golang. module is updated to v0.45.0.
securityThe helm. dependency, updated to v3.18.4
The helm. module is updated to v3.18.4.
securityThe helm. dependency, updated to v3.18.5
The helm. module is updated to v3.18.5.
breakingThe plpmtud default, set to blackhole
The default plpmtud mode is now blackhole (blackhole-detected).
breakingThe AddressScopeMax default, set to 254
The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.
breakingThe tls authMode default, set to migration
tls authMode is set to migration by default.
breakingThe CNI deletion timeout, reduced to 1.5 seconds
The CNI deletion timeout is reduced to 1.5 seconds.
breakingThe policy-default-local-cluster default
policy-default-local-cluster is now set by default.
breakingHost firewall bypass, disabled by default
Host firewall bypass is disabled by default.
breakingFQDN match pattern sanitization
FQDN match pattern sanitization is refactored and tightened.
breakingEncrypted traffic forwarding via cilium_host, removed
Forwarding encrypted traffic via cilium_host has been removed.
breakingCNI configuration in the container image, removed
The CNI configuration is no longer installed in the container image.
Check if affected (30)
breakingLocal-cluster default for network policy selectors
Applies if you do not set cluster in network policy selectors.
breakingThe CiliumBGPPeeringPolicy v1 API, removed
Applies if you use CiliumBGPPeeringPolicy.
breakingMutual Authentication, disabled by default
Applies if you enable Mutual Authentication.
Plan ahead (7)
deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced
Applies if you use --enable-ipsec-encrypted-overlay.
deprecatedKafka match fields and ToRequires and FromRequires, deprecated
Applies if you use ToRequires or FromRequires.
deprecatedTLS certificate and key Helm values, deprecated
Applies if you pass TLS certificates or keys in Helm values.
A substantial feature and maintenance release adds CEL and policy capabilities while correcting controller and API defects. It also includes security fixes, including a kubectl image update for CVEs, along with dependency and integration changes.
Action needed (2)
securitySecurity vulnerabilities addressed
Security vulnerabilities are addressed in this release.
securityUpdated kubectl image for CVE fixes
The kubectl image is updated to address CVEs in this release.
Check if affected (2)
breakingRestricted resource access in namespaced CEL policy types
Applies if you use namespaced CEL policy types.
breakingOpt-in VAP/MAP reporting
Applies if you use VAP/MAP reporting.
A feature and maintenance release that adds scaler and authentication capabilities, updates scaler behavior and status reporting, and corrects several defects. It also replaces a deprecated dependency and removes the NATS Streaming scaler.
Check if affected (1)
breakingThe NATS Streaming scaler, removed
Applies if you use the NATS Streaming scaler.
Argo v3.3.0 is a substantial feature and maintenance release with changes across synchronization, health, hydration, diff and apply behavior, the UI, and resource operations. It also updates core dependencies and removes an app controller flag.
Action needed (3)
securityThe k8s. module, updated to v1.34.2
The k8s. module is updated to v1.34.2 in Argo v3.3.0.
securityHelm 3.19.4
Helm is updated to 3.19.4 in Argo v3.3.0.
securityRedis, updated to the latest stable release
Redis is updated to the latest stable release in Argo v3.3.0.
Check if affected (1)
breakingThe --self-heal-backoff-cooldown-seconds flag, removed
Applies if your app controller configuration uses --self-heal-backoff-cooldown-seconds.
A substantial feature and maintenance release with V2 Data Engine changes, new capabilities, dependency updates, numerous fixes, and hotfix image replacements. It also deprecates V2 Backing Image functionality and includes a fix for an SPDK v25.05 CVE issue without a disclosed advisory identifier.
Action needed (1)
securityThe SPDK v25. CVE issue fix
The CVE issue in SPDK v25. is fixed in this release.
Check if affected (7)
breakingThe longhornio/longhorn-instance-manager:v1. image replacement
Applies if you use longhornio/longhorn-instance-manager:v1..
breakingThe longhornio/longhorn-manager:v1. image replacement
Applies if you use longhornio/longhorn-manager:v1..
breakingBackupstore-related settings removal
Applies if you configure backupstore related settings.
Plan ahead (2)
deprecatedBacking Image for the V2 Data Engine deprecationremoval planned in v1.12.0
Applies if you use Backing Image and the V2 Data Engine.
deprecatedV2 Backing Image Feature deprecation
Applies if you use the V2 Backing Image Feature.
A release with a breaking observability change that replaces OpenCensus support with OpenTelemetry. It also fixes sub-second precision in metric reporting.
Check if affected (1)
breakingOpenCensus support removed in favor of OpenTelemetry
Applies if you use OpenCensus.
A maintenance release that removes source-config-path output from release builds, deprecates several userspace interfaces, and rotates the package-signing key. It also includes correctness fixes, dependency updates, and an image-size reduction.
Check if affected (2)
breakingSource config path output in release builds
Applies if you use debug builds.
breakingGPG signing key for DEB/RPM packages, rotated
Applies if you use DEB/RPM packages.
Plan ahead (4)
deprecatedThe --gvisor-generate-config CLI option, deprecated
Applies if you use --gvisor-generate-config.
deprecatedThe legacy eBPF probe, deprecated
Applies if you use the legacy eBPF probe.
deprecatedThe gVisor engine, deprecated
Applies if you use the gVisor engine.
A maintenance release includes a hotfixed operator image, a security-relevant DNS query correction, and fixes across volume, replica, CSI, and management paths. It also adds namespace inheritance for longhorn-share-manager in FastFailover mode.
Check if affected (2)
securityThe instance-manager DNS query behavior
Applies if you do not use a hard or solid state disk.
breakingThe backing-image-manager:v1. image, replaced with backing-image-manager:v1.
Applies if you use backing-image-manager:v1..
A focused operator-facing release combining feature, compatibility, metrics, and defect fixes. The broader changelog is largely dependency housekeeping rather than additional operational changes.
Check if affected (3)
breakingThe kn. metric, renamed
Applies if you use kn..
breakingThe kn. metric, renamed
Applies if you use kn..
breakingService traffic ownership validation
Applicability is not stated in the release notes.
A release that removes or deprecates several operator-facing components while adding capabilities and changing supported formats and behavior. It also updates shipped platform components, including Trustee, image-rs, guest kernels, and OVMF.
Check if affected (2)
breakingProcess-based confidential computing via enclave-cc, removed
Applies if you use enclave-cc.
breakingExperimental Secure Comms mode, removed from the Cloud API Adaptor
Applies if you configure Secure Comms mode.
Plan ahead (2)
breakingThe CoCo operator, deprecated, with Helm chart installation
Applies if you use the CoCo operator.
deprecatedpacker guest images, deprecated in favor of mkosiremoval date not announced
Applies if you use packer images.
A maintenance release that removes deprecated preheat API endpoints and fixes unauthenticated access to the Dragonfly manager job API. Both changes affect users of the corresponding APIs.
Check if affected (2)
securityDragonfly manager job API unauthenticated access fix
Applies if you use Dragonfly manager job API.
breakingDeprecated preheat API endpoints removed
Applies if you use deprecated preheat API endpoints.
A breaking release changes supported Kubernetes versions and configuration behavior and removes automatic CSI client creation in external mode. It also adds storage features, reconciliation improvements, and operational changes including experimental NVMe-oF support, block volume statistics, encryption settings, and improved fencing and logging.
Check if affected (4)
breakingSupported Kubernetes versions
Applies if you run Kubernetes v1. through v1..
breakingactiveStandby behavior in the CephFilesystem CRD
Applies if activeStandby is set to false.
breakingCeph image settings in the rook-ceph-cluster chart
Applies if you use the rook-ceph-cluster chart.
Strimzi 0.50.0 includes Java 21 adoption for the operators, with compatibility exceptions for several modules. It also changes connector plugin version configuration, so existing settings that use the rejected option are affected.
Check if affected (1)
breakingThe connector. option, forbidden in connector configurations
Applies if you use connector. in KafkaConnect or KafkaMirrorMaker2 connector configuration.
This release adds dynamic-module, filter, routing, observability, and certificate capabilities, along with fixes and performance improvements across HTTP, networking, and protocol handling. It also changes HTTP reset behavior, removes runtime guards and legacy code paths, and deprecates the OpenTelemetry access log common_config field.
Action needed (1)
breakingRuntime guards and legacy code paths removed
Multiple runtime guards and legacy code paths are removed in this release.
Check if affected (2)
breakingDefault HTTP reset code changed
Applicability is not stated in the release notes.
breakingDefault upstream protocol error reset handling changed
Applicability is not stated in the release notes.
Plan ahead (1)
deprecatedOpenTelemetry access log common_config field deprecated
Applies if you configure common_config.
This release updates histogram collection and TSDB behavior while adding capabilities across the API, PromQL, storage, and UI. It also includes fixes for query handling, storage validation, receivers, and interface behavior.
Action needed (1)
breakingA 10,000-set limit for the TSDB status endpoint
The TSDB status endpoint now limits responses to a maximum of 10,000 sets of statistics.
Check if affected (1)
breakingThe native-histogram feature flag has no effect
Applies if you set scrape_native_histograms to collect Native Histogram samples from exporters.
A substantial feature and maintenance release adds operator capabilities including workflows, JWT authorization grants, organization invitations, OpenTelemetry export, and Windows services. It also updates Quarkus and fixes correctness issues, while changing supported database versions and addressing a vulnerability in brute force detection settings.
Check if affected (2)
securityBrute force detection settings vulnerability, corrected
Applies if you configure brute force detection settings.
breakingPostgreSQL 13. support removal
Applies if you depend on PostgreSQL 13..
Plan ahead (1)
deprecatedFine-Grained Admin Permissions v1, deprecated
Applies if you enable admin/fine-grained-permissions.
A release focused on removing legacy v1 components and storage interfaces, while changing configuration and UI defaults. It also adds or expands experimental storage capabilities and includes fixes for storage behavior and dependency API changes.
Check if affected (9)
breakingRemaining v1 utilities published as v2. versions
Applies if you use v1 utilities.
breakingThe UI theme selector, enabled by default
Applies if you use the UI.
breakingThe storage/v1/grpc interface, removed
Applies if you use storage/v1/grpc.
This release combines operator-facing additions with enforced defaults and restrictions, defect fixes, and dependency and image updates. New support includes native sidecar injection, ThinRuntime metadata configuration, and additional storage client types.
Action needed (1)
breakingRestricted service account permissions
Service account permissions are restricted. The sample file samples/juicefs/read_job. is included.
Check if affected (1)
breakingRemoval of the redundant SYS_ADMIN capability from runtime engines
Applies if you use runtime engines.
This CloudEvents release updates protocol and binding behavior, including clarifications to headers, formats, and extensions. The header rename concerns integrations that use the Webhook header.
Check if affected (1)
breakingThe Webhook-Request-Origin header, renamed to Webhook-Allowed-Origin
Applies if you use Webhook headers in CloudEvents HTTP bindings.
