AI-analyzed release notes for CNCF graduated and incubating projects.
This release adds API and storage capabilities, updates API query naming and defaults, and includes correctness fixes. No security advisories or security-specific fixes are disclosed.
Action needed (1)
breakingThe searchdepth default in the trace-summaries endpoint
The default for searchdepth changed in the trace-summaries endpoint.
A breaking release for CSI configuration also changes unused CRUSH rule handling and supported Kubernetes versions. It adds storage and object-store capabilities, including SSE-S3 with Vault Agent authentication, object-store account management, and encrypted OSD disk expansion.
Check if affected (2)
breakingCeph CSI operator for driver settings
Applies if you configure CSI driver settings.
breakingROOK_DELETE_UNUSED_CRUSH_RULES default
Applies if the Ceph mgr is running.
A broad maintenance and feature release combines bug fixes with new capabilities, configuration options, and platform support. It also changes defaults, tightens operational constraints, and removes V2 Backing Images.
Check if affected (5)
breakingV2 Backing Images removal
Applies if you use V2 Backing Images.
breakingThe data-engine-cpu-mask default, changed
Applies if you do not configure data-engine-cpu-mask.
breakingLive migration constraint for older CLI API versions
Applies if you use an engine image with a CLI API version older than 12.
This release adds scalers, configuration options, metrics, authentication modes, and compatibility improvements. Operators with custom RBAC need to account for the Kubernetes events API migration, and users of removed scaler settings need to update their configurations.
Check if affected (7)
securityCredential headers on cross-host redirects and HTTPS downgrades
Applicability is not stated in the release notes.
breakingScaledObject name length validation
Applies when a ScaledObject name exceeds 63 characters.
breakingPositive unprocessedEventThreshold values
Applies if you configure a non-positive unprocessedEventThreshold.
Plan ahead (1)
deprecatedThe buildId, selectAllActive, and selectUnversioned settings, deprecated
Applies if you configure buildId, selectAllActive, or selectUnversioned.
A feature and maintenance release with CLI and template changes, QEMU behavior updates, and fixes across drivers, hostagent, shell, and guest support. It also includes a deprecation, while no security advisories or explicitly described vulnerabilities are present.
Check if affected (1)
breakingQEMU 2MB OVMF images dropped by openSUSE
Applicability is not stated in the release notes.
Plan ahead (1)
deprecatedThe _LIMA_QEMU_UEFI_IN_BIOS flag, deprecated
Applies if you configure _LIMA_QEMU_UEFI_IN_BIOS.
A feature and operational-hardening release that adds alpha scheduling capabilities, new scheduler and Helm configuration, and fixes scheduler and integration stability issues. Operators should review Kubernetes and DRA compatibility requirements, the changed DRA default, and the disclosed denial-of-service and Prometheus security fixes.
Action needed (4)
securitymediumPrometheus dependency update for GHSA-vffh-x6r8-xx99
Updates github. to address stored XSS advisory GHSA-vffh-x6r8-xx99.
securitymediumAdmission webhook request body limits
The admission webhook now limits request bodies, fixing the denial-of-service risk identified by CVE-2026-44247 and GHSA-8wxp-xxp2-rcgx.
breakingDRA scheduling integration default
DRA scheduling integration is enabled by default.
breakingDRA scheduling integration default behavior
DRA scheduling integration is enabled by default to align with Kubernetes 1.34 and later behavior. Set predicate. to false to disable it.
Check if affected (2)
breakingOpt-in SchedulingGatesQueueAdmission
Applies if you enable SchedulingGatesQueueAdmission.
breakingOpt-in gang-aware preemption and reclamation
Applies if you configure gangPreempt and gangReclaim and do not configure preempt or reclaim.
