AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with correctness fixes and a security-related dependency update. The dependency update is recorded in the manifest and has no standalone operator impact.
Action needed (1)
securitySecurity updates for golang. and golang.
The dependency manifest updates golang. and golang. to include security updates.
A maintenance release with dependency updates and correctness fixes across scheduling, kubelet behavior, server-side apply, and kubeadm. It also includes a Go 1.26.5 build update, with no disclosed security advisories.
Source ↗A maintenance release with fixes to kubeadm join and etcd learner promotion, reduced kubelet logging for missing optional annotations, and restored Cri-api JSON encoding compatibility. It also updates the build toolchain to Go 1.25.12.
Source ↗A maintenance release with kubeadm and kubelet behavior corrections, a changed kubeadm timeout default, and a deferred Kubelet deprecation removal. It also includes a toolchain dependency update and no identified security advisories.
Plan ahead (1)
deprecatedKubelet configurations flags deprecation removal timelineremoval planned in 1.38
Applies if you configure Kubelet's configurations flags.
This release defers removal of the Kubelet configurations flags deprecation and related fallback behavior from 1.37 to 1.38 to align with containerd v1. support.
A maintenance release with Go 1.26.4 build updates and correctness and performance fixes across scheduling, kubelet volume handling, suspended Jobs, Secret data, endpoint processing, and kubeadm dry-run certificate copying. No security advisories are disclosed.
Source ↗A maintenance release with correctness and performance fixes, along with an updated Go toolchain dependency. The recorded notes do not disclose security advisories or security-specific flaws.
Source ↗A maintenance release with a Go toolchain dependency update and fixes for operator-facing defects. The fixes cover endpoint handling, CSI volume republishing, Secret-sourced binary environment values, and kubeadm certificate dry runs.
Source ↗A maintenance release updates the Go build dependency to Go 1.25.11 and fixes a panic in the endpoint controller when processing services with an empty IPFamilies field. The remaining release-note entries are section headings without operator-facing changes.
A maintenance release focused on bug and regression corrections across Kubernetes components. The listed changes affect node startup, networking, kube-proxy, kubeadm initialization and joining, kubelet authorization, and etcd health checks.
Source ↗A maintenance release with operator-facing bug corrections in scheduling, networking, kubeadm, kube-proxy, and metric behavior. No security advisories or security-specific fixes are disclosed.
Source ↗A maintenance release with correctness fixes in networking, scheduling, kubeadm, and metrics behavior. No security advisories or operator actions are explicitly identified.
Source ↗A maintenance release focused on kubeadm bug fixes. The remaining release-note sections are headings or empty sections without an operator-facing change.
Source ↗A broad operator-significant release with API, configuration, CLI default, scheduling, runtime, feature-gate, metric, and dependency changes. Upgrade review and testing matter for users of removed or deprecated interfaces, changed defaults, custom scheduler integrations, CRDs, audit logging, and affected metrics.
Action needed (11)
breakingStrictIPCIDRValidation enabled by default
The StrictIPCIDRValidation feature gate in kube-apiserver is enabled by default.
breakingThe default debug profile, changed to general
The default debug profile changes from legacy to general.
breakingWatchCacheInitializationPostStartHook enabled by default
The WatchCacheInitializationPostStartHook feature gate is enabled by default.
breakingKubeletPSI graduation to GA
The KubeletPSI feature graduated to GA and is enabled by default.
breakingRelaxedServiceNameValidation at beta, enabled by default
The RelaxedServiceNameValidation feature gate graduated to beta and is enabled by default.
breakingRestartAllContainersOnContainerExits at beta, enabled by default
The RestartAllContainersOnContainerExits feature gate graduated to beta and is enabled by default.
breakingSuspended-job feature gates enabled by default
The MutablePodResourcesForSuspendedJobs and MutableSchedulingDirectivesForSuspendedJobs feature gates are enabled by default.
breakingAtomicFIFO informer store updates
Default informer behavior now updates store state with all objects in a list or relist before invoking individual-item handler methods. This behavior is associated with AtomicFIFO.
breakingUnlockWhileProcessing informer behavior
Informers can now enqueue new watch events while already-queued events are being processed. This behavior is associated with UnlockWhileProcessing.
breakingClientsAllowCARotation functionality enabled by default
This functionality is enabled by default and can be disabled through the ClientsAllowCARotation feature gate.
breakingClientsAllowTLSCacheGC functionality enabled by default
This functionality is enabled by default and can be controlled through the ClientsAllowTLSCacheGC feature gate.
Check if affected (25)
breakingThe volume_operation_total_errors metric, renamed
Applies if you use volume_operation_total_errors.
The metric volume_operation_total_errors is renamed to volume_operation_errors_total.
breakingThe git-repo volume plugin, disabled
Applies if you use the git-repo volume plugin.
The git-repo volume plugin is disabled by default, with no option to turn it back on.
breakingAllowlistEntry., renamed to AllowlistEntry.
Applies if you configure AllowlistEntry..
AllowlistEntry. is renamed to AllowlistEntry. in the credential plugin allowlist.
Plan ahead (6)
deprecatedService . deprecation
Applies if you configure Service ..
Warnings and deprecation were added for the Service . field.
deprecatedDirect access to metav1., deprecated
Applies if you use metav1..
Direct access to the Raw field of metav1. is deprecated.
deprecatedMinNodeScore and MaxNodeScore, deprecated
Applies if you use MinNodeScore or MaxNodeScore.
MinNodeScore and MaxNodeScore are deprecated in favor of MinScore and MaxScore.
A maintenance release updates the Go build toolchain and dependency versions, with fixes for upgrade and runtime defects. The changes include a Kubernetes build with Go 1.25.9 and fixes for apiserver startup during upgrades and kube-proxy nftables support.
Source ↗A maintenance release that updates the Go toolchain and dependency versions in the dependency manifest. It also fixes two correctness regressions, with no security advisories or operator actions identified.
Source ↗A maintenance release with the Go 1.25.9 toolchain and several correctness fixes. It changes the default for StatefulSet parallel pod management and includes fixes for kubelet restarts, apiserver audit-log latency annotations, and kube-proxy nftables support.
Check if affected (1)
breakingDefault for MaxUnavailableStatefulSet
Applies if you do not enable MaxUnavailableStatefulSet.
The MaxUnavailableStatefulSet feature gate is disabled by default to fix a 1.35 regression in StatefulSet parallel pod management.
A maintenance release with Kubeadm correctness fixes and an adjustment to DRA device taint eviction status behavior. It contains no identified security changes or operator actions.
Source ↗A kubeadm maintenance patch corrects defects in cluster lifecycle handling. The changes affect etcd client endpoints and reset-time unmounting of /var/lib/kubelet peer mounts.
A maintenance release focused on operator-facing bug fixes in admission validation and cluster lifecycle workflows. No security advisories, operator-actionable removals, default changes, or new constraints are described.
Source ↗A maintenance release updates the Kubernetes build to Go 1.25.7. No other release changes are recorded here.
Source ↗A maintenance release updates the Kubernetes build toolchain to Go 1.24.13. No other operator-facing changes are recorded.
Source ↗A maintenance release updates the Go toolchain used to build Kubernetes. No other substantive changes are recorded.
Source ↗A maintenance release with an updated Go toolchain used to build Kubernetes. The recorded release notes contain no specific operator-facing changes beyond that build update.
Source ↗A maintenance release with correctness fixes in device allocation and kubeadm behavior, plus a Go toolchain update. The changes address scheduling races, etcd learner promotion, argument ordering, and Node patch retries.
Source ↗A maintenance release corrects operator-relevant behavior across scheduling, kubeadm, logging, and Windows networking. Kubernetes is now built using Go 1.24.12, and no security advisories or security-specific fixes are disclosed.
Source ↗A maintenance release focused on correctness fixes and regression repairs across Kubernetes components. It also updates the Go toolchain and changes kubeadm retry behavior.
Source ↗A maintenance release with numerous correctness fixes and an enforced feature-gate default change. It also updates the Go toolchain and hnslib dependency, with no disclosed security advisories.
Check if affected (1)
breakingThe SchedulerAsyncAPICalls feature gate, disabled by default
Applies if you use the SchedulerAsyncAPICalls feature gate.
A 1.35.0 regression is fixed by disabling the SchedulerAsyncAPICalls feature gate. The change ships in Kubernetes v1.35.1.
