Remove support for gossip DNS by hakman · Pull Request #18601 · kubernetes/kops

hakman · 2026-07-16T10:51:25Z

Support for gossip DNS, deprecated since kOps 1.29, is removed in kOps 1.37, see #18240.

New gossip clusters are rejected, and existing clusters need to migrate before they can be upgraded. This affects clusters whose name ends in .k8s.local and that were not created with --dns=none; clusters using --dns=none, even with a .k8s.local name, are not affected. Migrate to --dns=none or a hosted DNS zone using kOps 1.36, which introduced hybrid bootstrap to make that migration easier.

What changed

Cluster validation rejects legacy gossip clusters with an actionable error. Since validation runs on all write paths, this blocks kops create and kops update cluster, while kops get, kops delete cluster, kops validate cluster, and an edit/replace that switches the cluster to dns: none keep working for unmigrated clusters.
Nodes no longer download, install or run protokube, whose only remaining responsibility was gossip DNS. The protokube binary itself is still built and shipped; removing it is left for a follow-up.
dns-controller loses its gossip provider mode and flags. The AWS China special case that passed --dns=gossip (effectively running dns-controller with no provider) is removed; AWS now always uses aws-route53.
kops-controller loses the hosts controller and its discovery options, along with the corresponding RBAC and headless services in the addon manifest.
The spec.gossipConfig and spec.dnsControllerGossipConfig cluster spec fields are removed from all API versions. Old stored specs still load, as unknown fields are dropped on decode.
Gossip firewall rules and the dns-controller gossip ports are removed. The worker node IAM role no longer receives the S3 and ec2:DescribeInstances permissions that legacy gossip bootstrap required.
Gossip integration tests and fixtures are removed. The minimal_openstack, openstack_floatingip and minimal_scaleway fixtures migrate to dns=none, as they are the only integration test coverage for their clouds.
Documentation is updated and the gossip page is rewritten as a migration guide; 1.37 release notes are added.

Notes for reviewers

The Azure DenyNodesToEtcd NSG rule narrows from port range 4000-4001 to just 4001, as 4000 was the protokube memberlist port.
The upgrade-ab-gossip e2e scenario is deleted; the corresponding prow job needs to be removed in test-infra.
The expected output regeneration is in its own commit, generated with ./hack/update-expected.sh.

/cc @rifelpet @justinsb

hakman · 2026-07-16T13:02:26Z

/test all

hakman · 2026-07-16T15:00:00Z

/retest

hakman · 2026-07-16T16:08:48Z

CSI flakes...
/override pull-kops-e2e-azure-cni-calico

kubernetes-prow · 2026-07-16T16:08:53Z

@hakman: Overrode contexts on behalf of hakman: pull-kops-e2e-azure-cni-calico

Details

In response to this:

CSI flakes...
/override pull-kops-e2e-azure-cni-calico

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

rifelpet · 2026-07-22T12:37:22Z

/approve

i'll let someone else take a pass too since it is so large.

hakman · 2026-07-23T06:06:53Z

Thanks @rifelpet!
/assign @justinsb

hakman · 2026-07-23T13:24:44Z

i'll let someone else take a pass too since it is so large.

@rifelpet quite right on this one, so decided to revert some of the mechanical changes to make it more reviewable.

hakman · 2026-07-23T13:28:19Z

/test pull-kops-e2e-cni-cilium-etcd

hakman · 2026-07-23T14:09:10Z

/test pull-kops-e2e-cni-cilium-etcd

Gossip DNS support is removed in kOps 1.37. Clusters whose name ends in .k8s.local without dns=none now fail validation with a message pointing at the migration path, and the deprecated gossipConfig and dnsControllerGossipConfig fields are rejected with an error asking for their removal. kops create cluster keeps defaulting .k8s.local names to dns=none.

Nodes no longer install or run protokube, whose only remaining responsibility was gossip DNS. Remove the gossip mode from dns-controller, the hosts controller and discovery options from kops-controller, the gossip branches from nodeup and the cluster model, and the gossip firewall rules. The gossipConfig and dnsControllerGossipConfig cluster spec fields are deprecated, no longer have any effect, and are rejected by validation when set. The protokube binary itself is still built and shipped; removing it is left for a separate change.

The minimal_openstack, openstack_floatingip and minimal_scaleway fixtures migrate to dns=none, as they are the only integration test coverage for their clouds.

Generated with ./hack/update-expected.sh

Keep the deprecated nodeup wire field temporarily to avoid rewriting generated nodeup configs while gossip runtime support remains removed.

Keep control-plane nodeup asset lists and hashes stable temporarily while leaving the protokube model and service removed.

Leave the unregistered gossip fixtures in place temporarily so their bulk deletion can be reviewed and merged separately.

hakman · 2026-07-29T11:36:57Z

/test all

hakman · 2026-07-29T13:56:38Z

/test pull-kops-e2e-cni-cilium

justinsb · 2026-07-30T11:20:27Z

-				for _, a := range n.protokubeAsset[arch] {
-					config.Assets[arch] = append(config.Assets[arch], a.CompactString())
-				}
+	// Keep protokube in control-plane nodeup configs temporarily to avoid changing


I'm guessing we're going to tackle this in a follow-on PR, but it would make this one huge?

yup, too many files in this PR and make GitHub hard to use.

justinsb · 2026-07-30T11:23:17Z

Thanks @hakman

Looking at this, there are quite a few pitfalls and complexity! So if anyone is still on gossip, I think they will be much happier on dns=none at this point. Removal seems like the right call.

/approve
/lgtm

kubernetes-prow · 2026-07-30T11:23:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb, rifelpet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [justinsb,rifelpet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

hakman · 2026-07-30T11:24:55Z

Thanks @justinsb, hope everyone will migrate safely using kOps 1.36.

hakman · 2026-07-30T12:02:38Z

/override pull-kops-e2e-cni-amazonvpc

kubernetes-prow · 2026-07-30T12:02:43Z

@hakman: Overrode contexts on behalf of hakman: pull-kops-e2e-cni-amazonvpc

Details

In response to this:

/override pull-kops-e2e-cni-amazonvpc

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kubernetes-prow Bot requested a review from justinsb July 16, 2026 10:51

kubernetes-prow Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 16, 2026

kubernetes-prow Bot requested a review from rifelpet July 16, 2026 10:51

hakman force-pushed the remove-gossip-dns branch 2 times, most recently from 40d517c to cc60d82 Compare July 16, 2026 11:07

hakman changed the title ~~WIP Remove support for gossip DNS~~ Remove support for gossip DNS Jul 16, 2026

kubernetes-prow Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 16, 2026

hakman mentioned this pull request Jul 22, 2026

kops: replace gossip tests with dns-none kubernetes/test-infra#37511

Merged

hakman force-pushed the remove-gossip-dns branch from cc60d82 to 7ce9fac Compare July 22, 2026 09:43

kubernetes-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 22, 2026

kubernetes-prow Bot assigned justinsb Jul 23, 2026

kubernetes-prow Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 28, 2026

hakman force-pushed the remove-gossip-dns branch from 20cb470 to c2c893f Compare July 29, 2026 06:16

kubernetes-prow Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 29, 2026

hakman added 8 commits July 29, 2026 09:17

Remove gossip integration tests and fixtures

88831eb

The minimal_openstack, openstack_floatingip and minimal_scaleway fixtures migrate to dns=none, as they are the only integration test coverage for their clouds.

Update expected output for gossip DNS removal

689b644

Generated with ./hack/update-expected.sh

docs: update for gossip DNS removal and add 1.37 release notes

2445d04

revert: retain legacy gossip nodeup field

36a27dc

Keep the deprecated nodeup wire field temporarily to avoid rewriting generated nodeup configs while gossip runtime support remains removed.

revert: retain protokube nodeup assets

8babfe0

Keep control-plane nodeup asset lists and hashes stable temporarily while leaving the protokube model and service removed.

revert: retain orphaned gossip fixtures

b645998

Leave the unregistered gossip fixtures in place temporarily so their bulk deletion can be reviewed and merged separately.

hakman force-pushed the remove-gossip-dns branch from c2c893f to b645998 Compare July 29, 2026 06:21

justinsb reviewed Jul 30, 2026

View reviewed changes

justinsb approved these changes Jul 30, 2026

View reviewed changes

kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 30, 2026

kubernetes-prow Bot merged commit 4616ced into kubernetes:master Jul 30, 2026
42 checks passed

hakman deleted the remove-gossip-dns branch July 30, 2026 15:44

This was referenced Jul 30, 2026

Remove gossip leftovers #18650

Merged

Remove the protokube binary #18653

Merged

Conversation

hakman commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Notes for reviewers

Uh oh!

hakman commented Jul 16, 2026

Uh oh!

hakman commented Jul 16, 2026

Uh oh!

hakman commented Jul 16, 2026

Uh oh!

kubernetes-prow Bot commented Jul 16, 2026

Uh oh!

rifelpet commented Jul 22, 2026

Uh oh!

hakman commented Jul 23, 2026

Uh oh!

hakman commented Jul 23, 2026

Uh oh!

hakman commented Jul 23, 2026

Uh oh!

hakman commented Jul 23, 2026

Uh oh!

hakman commented Jul 29, 2026

Uh oh!

hakman commented Jul 29, 2026

Uh oh!

justinsb Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

hakman Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

justinsb commented Jul 30, 2026

Uh oh!

kubernetes-prow Bot commented Jul 30, 2026

Uh oh!

hakman commented Jul 30, 2026

Uh oh!

hakman commented Jul 30, 2026

Uh oh!

kubernetes-prow Bot commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hakman commented Jul 16, 2026 •

edited

Loading