See the full kOps 1.37 release notes for details, including breaking changes and deprecations.

What's Changed

• docs: update 1.36 release notes by @hakman in #18592
• fix: retry listing cloud resources in kops delete cluster by @hakman in #18595
• hack: parallelize GitHub release promotion and add checksum validation by @hakman in #18594
• feat(linode): Refactor VPC model into broader Network model, and add subnet task by @moshevayner in #18590
• chore: Remove support for Kubernetes 1.31 by @hakman in #18598
• docs: update 1.36 release notes post-release by @hakman in #18599
• nodeup: don't mutate the cluster spec when clearing authenticator config by @hakman in #18600
• azure: allow kindnet pod CIDR to reach the kube-apiserver by @hakman in #18604
• Replace gsutil with gcloud storage by @hakman in #18609
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #18611
• Adding suitable control plane machine for gce by @YahiaBadr in #18612
• Allow specifying number of nodes that can be unready during validation by @Jefftree in #18614
• chore(networking): bump aws-cni to v1.22.3 by @moshevayner in #18615
• Tolerate unready nodes during scalability test validation by @Jefftree in #18616
• aws: remove support for Classic Load Balancer for the API by @hakman in #18617
• chore(channels): bump k8s and Ubuntu AMI versions in alpha channel by @moshevayner in #18621
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #18626
• gce: open control-plane node-exporter port (tcp/9100) by @Jefftree in #18620
• aws: add option for IP-based node names by @hakman in #18632
• aws: allow shared subnets to omit the zone by @hakman in #18630
• hetzner: Ignore WellKnownServices when comparing load balancers by @krillerdk in #18631
• Enable nri mounting on kindnet in kops by @michaelasp in #18635
• azure: support terraform provider azurerm v5 by @hakman in #18636
• Update hcloud-go/v2 to latest version (v2.47.0) by @krillerdk in #18638
• gce: download nodeup from private GCS buckets with curl by @hakman in #18623
• aws: do not set the primary network interface to "Unmanaged=yes" by @hakman in #18642
• rolling-update: restore 5s delay between pod eviction retries by @hakman in #18641
• Remove support for gossip DNS by @hakman in #18601
• etcd-manager: compute kops-utils-cp image at use time by @hakman in #18645
• chore(channels): Promote alpha to stable channel by @moshevayner in #18647
• aws: Default to AWS CCM v1.36.1 for all k8s versions by @rifelpet in #18649
• chore(networking): bump aws-cni to version 1.22.4 by @moshevayner in #18648
• Remove gossip leftovers by @hakman in #18650
• Remove the protokube binary by @hakman in #18653
• docs: gossip removal in kOps 1.37 and migration guide by @hakman in #18651
• Narrow instance cloud permissions to actual consumers by @hakman in #18654
• Narrow instance describe permissions by @hakman in #18656
• Clean up remaining gossip removal leftovers by @hakman in #18658
• Adding dynamic channel labels by @cheftako in #18640
• fix(channels): only treat known ready conditions as health signals by @argoyle in #18657
• aws: download nodeup from private S3 buckets with curl by @hakman in #18661
• scaletest: Align kops scalability configuration with kube-up for scheduler QPS/BURST by @ronaldngounou in #18080
• azure: download nodeup from Blob Storage with curl by @hakman in #18666
• Do not upload stale images. by @cheftako in #18665
• scaletest: Align kops scalability configuration with kube-up for CCM concurrentNodeSyncs by @ronaldngounou in #18082
• docs: remove seccomp feature gate by @eshaanm25 in #17954
• Install CNI plugins bundle for chained Cilium by @rdebnath-x-ion in #18589
• Validate Kubernetes feature gate input during cluster creation by @fallintoplace in #18408
• Register completion func for kubernetes-feature-gates flag by @hakman in #18667
• azure: detect VMs needing update from latestModelApplied by @hakman in #18669
• aws: Generate EC2NodeClass block device mapping for root volume by @danports in #18655
• iam: do not mutate Policy.Statement in AsJSON() by @hakman in #18672
• tests/e2e: use gs:// base URL only for kops versions supporting it by @hakman in #18670
• aws: Restrict KMS permissions to service-mediated calls by @hakman in #18671
• Cap the kops-controller bootstrap retry backoff, and verify the e2e upgrade actually rolls by @rifelpet in #18675
• kube-dns: use policy/v1 for PodDisruptionBudget by @hakman in #18678
• coredns: Tighten PDB to maxUnavailable 33% and always allow unhealthy pod eviction by @hakman in #18679
• tests/e2e: drop the deprecated KOPS_CONTROL_PLANE_SIZE fallback by @rifelpet in #18682
• tests/e2e: honor KOPS_EXTRA_FLAGS in the karpenter scenario by @rifelpet in #18681
• containerd: default to 2.3.4 / runc 1.4.3 by @hakman in #18683
• Fix node bootstrap in IPv6-only clusters with --dns=none by @rifelpet in #18684
• tests/e2e: resolve SSH keys the same way on every cloud by @rifelpet in #18686
• tests/integration: remove stale privateweave fixtures by @hakman in #18689
• feat(linode): Add Linode (Akamai) instance management capabilities by @moshevayner in #18622
• Makefile: build with grpcnotrace to reduce binary size by @hakman in #18687
• etcd-manager: remove kops-utils-cp and use image volumes on all supported Kubernetes versions by @hakman in #18688
• upup/pkg/fi: use literal method names for task dispatch by @hakman in #18690
• gce: open the etcd events metrics port in the node-to-master firewall by @Jefftree in #18685
• refactor: Rename Linode references to Akamai (Linode) across the codebase by @moshevayner in #18691
• chore(networking): bump aws-cni to version 1.23.0 by @moshevayner in #18692
• iam: grant ec2:DescribeSecurityGroups for AWS VPC CNI by @hakman in #18693
• refactor(linode): build SSH keys with instances by @moshevayner in #18694
• fix(akamai): Fix Akamai (Linode) Instance tag filter function by @moshevayner in #18696
• digitalocean: delete SSH keys when deleting a cluster by @rifelpet in #18697
• aws: report the SSH user for Rocky Linux instances by @rifelpet in #18698
• tests/e2e: determine the SSH user from the cluster when not configured by @rifelpet in #18699
• feat(akamai): Add volume task and extend cloud interface & mock for volume mgmt by @moshevayner in #18700
• Update Calico to v3.31.6 by @hakman in #18701
• Update Cilium to v1.18.12 by @hakman in #18702
• Upgrade kube-router to v2.11.0 by @hakman in #18703
• Update Flannel to v0.28.9 by @hakman in #18704
• Update default CNI plugins version to v1.7.1 / v1.8.0 / v1.9.1 by @hakman in #18705
• Upgrade kube-router to v2.11.1 and add UseNFTablesForN...

What's Changed

• Automated cherry pick of #18636: azure: support terraform provider azurerm v5 by @hakman in #18637
• Automated cherry pick of #18638: Update hcloud-go/v2 to latest version (v2.47.0) by @hakman in #18639
• Automated cherry pick of #18641: rolling-update: restore 5s delay between pod eviction retries by @hakman in #18643
• Automated cherry pick of #18642: aws: do not set the primary network interface to "Unmanaged=yes" by @hakman in #18644
• Automated cherry pick of #18645: etcd-manager: compute kops-utils-cp image at use time by @hakman in #18646
• Automated cherry pick of #18649: aws: Default to AWS CCM v1.36.1 for all k8s versions by @rifelpet in #18652
• Automated cherry pick of #18657: fix(channels): only treat known ready conditions as health signals by @hakman in #18659
• Automated cherry pick of #18655: Generate EC2NodeClass block device mapping for root volume by @hakman in #18673
• Release 1.36.2 by @hakman in #18674

Full Changelog: v1.36.1...v1.36.2

What's Changed

• Automated cherry pick of #18600: nodeup: don't mutate the cluster spec when clearing authenticator config by @rifelpet in #18602
• Automated cherry pick of #18631: hetzner: Ignore WellKnownServices when comparing load balancers by @hakman in #18633
• Release 1.36.1 by @hakman in #18634

Full Changelog: v1.36.0...v1.36.1

What's Changed

• Support etcd 3.7.0-rc.0 and allow overriding the etcd version in the scalability scenario by @Jefftree in #18458
• Enable misspell in golangci-lint by @ameukam in #17578
• e2e: Filter random AZ selection by instance type availability by @rifelpet in #18463
• azure: Use IMDS attested metadata document for node identity by @hakman in #18163
• gce: fix backend service ownership filtering during delete by @carterpewpew in #18460
• aws: Reconcile target group health check changes on existing target groups by @hakman in #18467
• gce: Reconcile HTTP health check changes on existing health checks by @hakman in #18468
• Improve Google Storage Bucket support. by @cheftako in #18466
• Enable gosec and gocritic by @ameukam in #18470
• Add serathius as scalability test owner by @Jefftree in #18475
• feat(linode): implement SSH key management and associated tasks by @moshevayner in #18383
• Added support for APIServer using LB by @cheftako in #18459
• chore(channels): bump k8s versions in alpha channel by @moshevayner in #18477
• Upgrade Karpenter to v1.13.0 by @hakman in #18479
• scaletest: Report experiment variant into scalability run metadata by @Jefftree in #18476
• channels: Add Kubernetes 1.36.0 support by @hakman in #18480
• gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18484
• e2e: Skip ImageVolume tests on COS 121 by @rifelpet in #18483
• Register Karpenter nodes with karpenter.sh/unregistered taint by @hakman in #18486
• Add missing EC2 read permissions to Karpenter IAM policy by @hakman in #18487
• scaletest: report experiment variant after kubetest2 runs by @Jefftree in #18485
• nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18478
• API only CLI by @cheftako in #18482
• Fixing LB behavior when you have both APIServer and Control Plane. by @cheftako in #18496
• Remove namespace from DO ClusterRole by @rifelpet in #18498
• chore(channels): promote to stable, bump node images, update recommended kOps versions by @hakman in #18501
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #18505
• scaletest: bind etcd metrics to all interfaces by @Jefftree in #18503
• e2e: test the PR's own channels, not master's by @hakman in #18504
• tests/e2e: refine externalTrafficPolicy=Local and hostNetwork skips by @rifelpet in #18509
• Allow setting missing slice elements from the command line by @hakman in #18511
• Add managed Karpenter EC2NodeClass and NodePool by @hakman in #18497
• tests/e2e: skip implement-NodePort ETP=Local test on more CNIs by @rifelpet in #18515
• chore(channels): pin Azure noble image to a deployable version by @hakman in #18516
• Switching from comparison on Role to helper. by @cheftako in #18514
• tests/e2e: also skip implement-NodePort ETP=Local test on calico+GCE by @rifelpet in #18517
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #18518
• Make cloud-controller-manager pods tolerate all taints by @rifelpet in #18510
• Add an experimental roles feature flag. by @cheftako in #18519
• azure: Scope nodes-to-API NSG rules to the NAT gateway public IP by @hakman in #18522
• fix: use JoinHostPost to tolerate IPv6 addresses by @justinsb in #18526
• azure: Bump azuredisk-csi-driver to v1.34.4 by @hakman in #18527
• chore: update syntax of CLAUDE.md by @justinsb in #18532
• azure: Bump azure-cloud-controller-manager to v1.36.2 by @hakman in #18529
• azure: Grant control-plane VMSS Contributor instead of Owner by @hakman in #18533
• coredns: Honor node taints in hostname topologySpreadConstraint by @hakman in #18535
• hetzner: fix Cluster Autoscaler node group membership by @hakman in #18538
• Expose GCP project as PROJECT env for ClusterLoader2 on GCE by @rifelpet in #18537
• tests/e2e: skip implement-NodePort ETP=Local test on calico+Azure by @hakman in #18540
• Update cluster-autoscaler to v1.36.0 by @hakman in #18541
• gce: register all zonal MIGs of a multi-zone instance group with cluster-autoscaler by @hakman in #18543
• Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18546
• pkg/assets: keep container registry clients out of runtime binaries by @hakman in #18554
• clusterapi: fix build by making gen.go a library package by @hakman in #18553
• Support running custom etcd versions by setting version and image by @hakman in #18525
• Default to etcd 3.7.0 for Kubernetes 1.37+ by @Jefftree in #18557
• feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @wkrysmann in #18556
• dump: grant SSH access to Karpenter nodes via EC2 Instance Connect by @hakman in #18563
• etcd-manager: upgrade to v3.0.20260707 by @hakman in #18560
• dns-controller: always apply the addon, empty when unused by @hakman in #18567
• Replace fi.PtrTo with new() builtin by @hakman in #18549
• Build with disable_grpc_modules tag to shrink binaries by @hakman in #18552
• nodeup: reduce binary size by decoupling from cloudup awsup by @hakman in #18571
• nodeup: remove the full Kubernetes API scheme and cloud providers from the binary by @hakman in #18572
• scalability: expose events-etcd metrics endpoint by @Jefftree in #18568
• vfs: use path/filepath in FSPath for Windows compatibility by @hakman in #18576
• Add support for kube-apiserver --strict-transport-security-directives flag by @hakman in #18577
• aws: Add metrics port 9999 to pod-identity-webhook Service by @hakman in #18579
• docs: expand Delve debugging instructions in contributing guide by @hakman in #18580
• kops create cluster: reject explicitly empty --project flag by @hakman in #18575
• aws: Require https scheme for pre-signed STS URLs in V2 tokens by @hakman in #18574
• aws: scope Karpenter controller IAM permissions by @hakman in #18582
• gce: register SSH keys under the "ubuntu" user for Ubuntu images by @hakman in #18581
• chore(deps): bump linodego to v2 by @moshevayner in #18584
• gce: allow TCP metrics ports in GCE firewall by @Qqkyu in #18545
• Release 1.37.0-alpha.1 by @hakman in #18596

New Contributors

• @carterpewpew made their first contribution in #18460
• @cheftako made their first contribution in #18466
• @wkrysmann made their first contribution in #18556
• @Qqkyu made their first contribution in #18545

Full Changelog: v1.36.0-beta.1...v1.37.0-alpha.1

See the full kOps 1.36 release notes for details, including breaking changes and deprecations.

Highlights

• Kubernetes 1.36 support and completion of the move away from the in-tree cloud providers
• Reworked addon management: kops-channels now runs as a static pod on control-plane nodes; the standalone channels binary is no longer distributed
• Hybrid bootstrap for gossip clusters: workers bootstrap directly against the API load balancer, easing migration off gossip DNS, which is deprecated
• Karpenter refresh: Karpenter v1.13.0 with kOps-managed EC2NodeClass and NodePool objects per instance group
• etcd-manager improvements: recovery of members with replaced data disks, membership changes resilient to unreachable members, a distroless image, and faster single-member cluster startup
• Expanded Azure support: cloud-controller-manager, Azure Disk CSI driver, and experimental Terraform target
• Hetzner Cluster Autoscaler support and groundwork for Linode (Akamai) as a new cloud provider
• Component updates: containerd v2.2.4, etcd-manager v3.0.20260707 with etcd 3.5.31/3.6.12, AWS Load Balancer Controller v3.3.0, Cilium tunables, CoreDNS v1.14.2, cluster-autoscaler v1.36.0
• Removed: support for Kubernetes 1.30, etcd 3.4, Amazon Linux 2, Ubuntu 20.04, and Debian 10

What's Changed

• Automated cherry pick of #18467: aws: Reconcile target group health check changes on existing target groups by @hakman in #18469
• Automated cherry pick of #18484: gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18488
• Automated cherry pick of #18478: nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18492
• Automated cherry pick of #18498: Remove namespace from DO ClusterRole by @rifelpet in #18499
• Automated cherry pick of #18511: Allow setting missing slice elements from the command line by @hakman in #18512
• Automated cherry pick of ##18479: Upgrade Karpenter to v1.13.0
  ##18486: Register Karpenter nodes with karpenter.sh/unregistered taint
  ##18487: Add missing EC2 read permissions to Karpenter IAM policy
  ##18497: Add managed Karpenter EC2NodeClass and NodePool by @hakman in #18513
• Automated cherry pick of #18522: azure: Scope nodes-to-API NSG rules to the NAT gateway public IP by @hakman in #18523
• Automated cherry pick of #18527: azure: Bump azuredisk-csi-driver to v1.34.4 by @hakman in #18528
• Automated cherry pick of #18529: azure: Bump azure-cloud-controller-manager to v1.36.2 by @hakman in #18531
• Automated cherry pick of #18533: azure: Grant control-plane VMSS Contributor instead of Owner by @hakman in #18534
• Automated cherry pick of #18535: coredns: Honor node taints in hostname topologySpreadConstraint by @hakman in #18536
• Automated cherry pick of #18538: hetzner: fix Cluster Autoscaler node group membership by @hakman in #18539
• Automated cherry pick of #18541: Update cluster-autoscaler to v1.36.0 by @hakman in #18542
• Automated cherry pick of #18543: gce: register all zonal MIGs of a multi-zone instance group with cluster-autoscaler by @hakman in #18544
• Automated cherry pick of #18546: Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18547
• Cherry pick of #18560: etcd-manager: upgrade to v3.0.20260707 by @hakman in #18561
• Automated cherry pick of #18556: feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @hakman in #18558
• Cherry pick of #18549: Replace fi.PtrTo with new() builtin by @hakman in #18551
• Automated cherry pick of #18567: dns-controller: always apply the addon, empty when unused by @hakman in #18573
• Release 1.36.0 by @hakman in #18591

Full Changelog: v1.36.0-beta.1...v1.36.0

What's Changed

• Automated cherry pick of #18428: cert-manager: upgrade to v1.19.5 and set AWS_REGION for Route53 dns-01 by @hakman in #18429
• Cherry pick of #18436: upgrade etcd-manager and etcd to latest patches by @hakman in #18437
• Automated cherry pick of #17968: Enable nf_conntrack kernel module on Rocky 9
  #18179: Load nf_tables module and install iptables-nft on RHEL10+ by @rifelpet in #18444
• backport: Update Cluster Autoscaler RBAC by @hakman in #18445
• Automated cherry pick of #18452: Calico: add NFTablesMode setting by @rifelpet in #18454
• cilium: mount the host's /etc/hosts on gossip clusters by @hakman in #18465
• Automated cherry pick of #18484: gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18489
• Automated cherry pick of #18478: nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18494
• Automated cherry pick of #18498: Remove namespace from DO ClusterRole by @rifelpet in #18500
• Automated cherry pick of #18546: Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18548
• Automated cherry pick of #18450: etcd-manager: switch to go-runner-based distroless image by @hakman in #18555
• Cherry pick of #18560: etcd-manager: upgrade to v3.0.20260707 by @hakman in #18562
• Automated cherry pick of #18556: feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @hakman in #18559
• Cherry pick of #18549: Replace fi.PtrTo with new() builtin by @hakman in #18550
• Release 1.35.2 by @hakman in #18593

Full Changelog: v1.35.1...v1.35.2

What's Changed

• scaletest: decouple client HTTP traffic for etcd events by @Jefftree in #18415
• Release notes for 1.36 (alpha) by @hakman in #18414
• chore: Add hashes for additional May releases by @hakman in #18418
• Add logs at v2 level to ensure we have slow pods data in logs by @hakuna-matatah in #18420
• chore: upgrade containerd to v2.3.1 by @hakman in #18422
• Upgrade kube-router to v2.10.0 by @rifelpet in #18421
• aws: pin LBC selectors to fix in-place upgrades by @hakman in #18426
• cert-manager: upgrade to v1.19.5 and set AWS_REGION for Route53 dns-01 by @hakman in #18428
• etcd: add ListenClientHTTPURLs field to EtcdManagerSpec by @Jefftree in #18416
• Default omitted authorization to RBAC instead of AlwaysAllow by @hakman in #18431
• cilium: allow disabling masquerade in ENI IPAM mode by @hakman in #18432
• channels: surface addon apply failures via a readiness probe by @hakman in #18433
• etcd-manager: upgrade etcd-manager and etcd to latest patches by @hakman in #18436
• chore: downgrade containerd to v2.2.4 by @hakman in #18447
• test: avoid kubeconfig access in golden tests by @hakman in #18448
• scaletest: Build only linux/amd64 in kubernetes scalability presubmits by @Jefftree in #18446
• scaletest: Allow feature gates to be set in scalability tests by @Jefftree in #18449
• feat: add gVisor RuntimeClass support for containerd by @ameukam in #18406
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #18451
• Calico: add NFTablesMode setting by @rifelpet in #18452
• etcd-manager: switch to go-runner-based distroless image by @hakman in #18450
• kube-proxy: assert buildPod command in unit test by @hakman in #18455
• gVisor: add HasGVisor() helper function by @hakman in #18456
• dump: add --node-dump-timeout flag for per-node dump timeout by @Jefftree in #18443
• scaltest: Default node dump timeout to 5m in scalability run-test.sh by @Jefftree in #18457
• Release 1.36.0-beta.1 by @hakman in #18464

Full Changelog: v1.36.0-alpha.1...v1.36.0-beta.1

What's Changed

• Automated cherry pick of #17740: Fix HasHighlyAvailableControlPlane to use AllInstanceGroups by @hakman in #18117
• Automated cherry pick of #18113: Add excludedInstanceTypes to instanceRequirements by @hakman in #18119
• Automated cherry pick of #18123: Fix instanceRequirements memory assignment bug by @hakman in #18124
• Automated cherry pick of #17999: aws: Bypass LBC webhook for cert-manager by @rifelpet in #18125
• Automated cherry pick of #18126: Add --use-kubeconfig to kops reconcile cluster by @hakman in #18127
• Automated cherry pick of #18128: vfs: Silence warnings when the S3 provider has no supported by @hakman in #18130
• Automated cherry pick of #18114: Pin upload-artifacts GHA to commit sha by @rifelpet in #18208
• Automated cherry pick of #18173: Update Golang to 1.25.9 by @hakman in #18205
• Automated cherry pick of #18110: Update Cluster Autoscaler to 1.35.0 by @hakman in #18217
• Automated cherry pick of #18237: cilium: require k8s-connectivity in liveness probe by @hakman in #18242
• aws: bypass LBC mservice webhook for kube-system by @hakman in #18248
• Automated cherry pick of #18251: aws: skip node S3 permissions when kops-controller serves node config by @hakman in #18253
• Cherrypick VPC CNI fixes to 1.35 by @rifelpet in #18268
• Cherrypick GCE resource dump fixes to 1.35 by @rifelpet in #18282
• Automated cherry pick of #18285: cilium: allow setting arbitrary cilium-config entries by @hakman in #18286
• Automated cherry pick of #18281: hetzner: Upgrade hcloud-cloud-controller-manager to v1.30.1 by @hakman in #18283
• Automated cherry pick of #18298: dns-controller: make priorityClassName configurable by @hakman in #18299
• Automated cherry pick of #18232: Initial support for Ubuntu 26.04 by @rifelpet in #18306
• Automated cherry pick of #18302: dns-controller: default Provider when ExternalDNS is partially set by @hakman in #18303
• Automated cherry pick of #18307: gce: expose kops-controller on internal LB for gossip clusters by @hakman in #18308
• Automated cherry pick of #18260: azure: encode storage account in azureblob:// URLs by @hakman in #18320
• Automated cherry pick of #18319: azure: list VMSS NICs in protokube gossip seed discovery by @hakman in #18321
• Automated cherry pick of #18323: etcd-manager: upgrade to v3.0.20260512 by @hakman in #18324
• Cherrypick GCE instance handling fixes to 1.35 by @rifelpet in #18327
• etcd-manager: bump etcd to latest patches (3.5.30, 3.6.11) by @yuzhouliu9 in #18333
• Automated cherry pick of #18375: cilium: add flags for bpf-lb-sock and bpf-lb-sock-hostns-only by @hakman in #18376
• Automated cherry pick of #18379: kops-controller and nodeup bug fixes by @rifelpet in #18380
• Automated cherry pick of #18384: Fix kops get assets when spec.dnsZone is a DNS name by @hakman in #18386
• Automated cherry pick of #18144: Move johngmyers to emeritus by @hakman in #18388
• Automated cherry pick of #18391: Validate instance group names in kops-controller by @rifelpet in #18392
• Upgrade Go to 1.26.3 for release-1.35 by @hakman in #18396
• Update dependencies for release-1.35 by @hakman in #18399
• Automated cherry pick of #18401: gomod: tidy and verify all modules by @hakman in #18404
• Automated cherry pick of #18403: build: use gcr.io/distroless/static as base image by @hakman in #18417
• Automated cherry pick of #18418: chore: Add hashes for additional May releases by @hakman in #18419
• Automated cherry pick of #18364: chore: upgrade containerd to v2.3.0
  #18422: chore: upgrade containerd to v2.3.1 by @hakman in #18423
• Release 1.35.1 by @hakman in #18425

Full Changelog: v1.35.0...v1.35.1

What's Changed

• Remove support for Amazon Linux 2 by @rifelpet in #17898
• Update distribution matrix for Amazon Linux 2 by @rifelpet in #17943
• metal: Unpin K8s version by @hakman in #17944
• Create iproute2 symlink for kuberouter on older distros by @rifelpet in #17945
• chore(channels): update alpha k8s versions with February releases by @moshevayner in #17948
• versionbump: go 1.25.7 by @justinsb in #17956
• Feature: pull user defined images for warm pool instances by @dezmodue in #17861
• Fix creation of discovery and state store buckets by @rifelpet in #17961
• Migrate more scenario scripts to --test=exec by @rifelpet in #17962
• Migrate e2e template AMIs to SSM params by @rifelpet in #17964
• LBC Scenario - Pass region to AWS CLI by @rifelpet in #17965
• Set kubeconfig for LBC test suite by @rifelpet in #17967
• Enable nf_conntrack kernel module on Rocky 9 by @rifelpet in #17968
• Remove DISCOVERY_STORE handling by @rifelpet in #17969
• kube-router: bump version v2.5.0 -> 2.7.1 by @aauren in #17966
• chore: Add asset hashes for February 2026 releases by @hakman in #17980
• Remove reference to unbound variable by @rifelpet in #17985
• Use golang-based tool for AWS instances availability by @ameukam in #17953
• drop cdn.dl.k8s.io as a mirror by @upodroid in #17976
• drop storage.googleapis.com/k8s-artifacts-cni as a mirror by @hakman in #17987
• tests/ai-conformance: don't panic if no zones for AWS by @justinsb in #17994
• Scenario Fixes by @rifelpet in #17997
• Use a deterministic bucket name in prow jobs by @rifelpet in #17998
• Make region selection determistic from BUILD_ID by @rifelpet in #18000
• Addon Scenario - Remove old feature flag by @rifelpet in #17963
• aws: Bypass LBC webhook for cert-manager by @hakman in #17999
• Bump actions/dependency-review-action from 4.8.2 to 4.8.3 by @dependabot[bot] in #18002
• tests/ai-conformance: fix syntax for enabling gatewayAPI with cilium by @justinsb in #17992
• tests/ai-conformance: fix syntax for enabling nvidia GPU in containerd by @justinsb in #18001
• Consolidate support for ENI-based CNIs by @rifelpet in #17940
• tests/ai-conformance: use nvidia GPU operator by @justinsb in #18005
• tests/ai-conformance: create cluster with some non-GPU nodes by @justinsb in #18006
• tests/ai-conformance: update test job for DRA v1 by @justinsb in #18008
• tests/ai-conformance: use server-side-apply for KubeRay Operator by @justinsb in #18007
• fix: avoid panic if subnet ID is nil by @justinsb in #18010
• tests/ai-conformance: create first tests for AI Conformance by @justinsb in #18009
• gce: don't request migration on instance types that don't support it by @justinsb in #18004
• gce: Wait to delete InstanceManagers and InstanceTemplates by @Camila-B in #18013
• Bump release tools for E2E tests by @ameukam in #18017
• Add warning for non-production use in README by @ritazh in #17952
• Keep skipping certain tests on older cilium versions by @rifelpet in #18019
• chore: Add hashes for additional February releases by @hakman in #18021
• chore: Bump alpha channels with additional February releases by @hakman in #18020
• chore: Bump etcd-manager to v3.0.20260227 by @hakman in #18026
• build(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #18029
• build(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by @dependabot[bot] in #18030
• chore(channels): promote alpha to stable by @moshevayner in #18033
• feat: Use wellknownports for etcd and add cilium etcd ports by @apeabody in #18035
• tests/ai-conformance: Install prometheus for metrics by @ameukam in #18018
• build(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @dependabot[bot] in #18042
• Fix node bootstrap challenge response hashing by @rifelpet in #18043
• Add addons node to scalability tests by @serathius in #18036
• test: Skip dumping not found nodes for GCE by @hakman in #18049
• allow pods to reach metric ports running on control plane nodes when using gce alias ip by @upodroid in #18052
• [aiconformance] Add test for gang scheduling with kueue by @justinsb in #18053
• chore: Bump Go to v1.25.8 by @hakman in #18058
• [aiconformance] Add tests for security / isolation by @justinsb in #18055
• scaletest: Move Prometheus to addon nodes by @serathius in #18048
• [aiconformance]: Add robust_controller test using KubeRay by @justinsb in #18056
• scaletest: Use sleep instead of wait for large clusters by @serathius in #18065
• [aiconformance]: Enable Cluster Autoscaler for GPU Nodes by @ameukam in #18066
• scaletest: Increase scalability tests log verbosity to 3 by @serathius in #18069
• [aiconformance]: Enable Metrics Server by @ameukam in #18067
• fix: don't panic when dumping nodes if we didn't capture cloud resources by @justinsb in #18072
• [aiconformance]: Validate networking/ai_inference requirements by @justinsb in #18063
• [aiconformance]: Add accelerator metrics validator test by @justinsb in #18064
• [aiconformance]: observability/ai_service_metrics by @justinsb in #18071
• [aiconformance]: Add K8s wrapper for DaemonSet object by @ameukam in #18073
• [aiconformance]: Add driver_runtime_management validator by @ameukam in #18074
• [aiconformance]: unify output under tests/ directory by @justinsb in #18076
• [aiconformance]: render markdown to HTML by @justinsb in #18077
• scaletest: Align kops scalability configuration with kube-up for kube-apiserver deleteCollectionsWorkers and MaxRequestInflight by @ronaldngounou in #18081
• [aiconformance]: Write conformance report to file by @justinsb in #18084
• [aiconformance]: Unify how we write test artifacts by @justinsb in #18087
• scaletest: Align kops scalability configuration with kube-up for kubeapisever CompactionInterval by @ronaldngounou in #18086
• Refactor interface type check to more idiomatic syntax by @rramkumar1 in #17951
• scaletest: Align kops scalability configuration with kube-up for kubelet kubeAPIQPS by @ronaldngounou in #18085
• Move VFS acls framework closer to VFS implementation code by @rramkumar1 in #17949
• Fix existing VPCs/Subnets with IPv6 by @rlees85 in #18089
• [aiconformance]: test for schedulingOrchestration pod autoscaling by @justinsb in #18075
• Enable E2E external CSI testing on GCP by @rifelpet in #18098
• [aiconformance] add test for schedulingOrchestration clusterAutoscaling by @justinsb in #18100
• Replace cwd with go:embed for storage.testdriver manifests by @rifelpet in #18102
• chore(channels): bump alpha channel k8s and ubuntu AMI versions by @moshevayner in #18103
• [aiconformance]: set namespace explicitly for testdata by @ameukam in https://github.com/kubernetes/kops/pu...

What's Changed

• Automated cherry pick of #17740: Fix HasHighlyAvailableControlPlane to use AllInstanceGroups by @hakman in #18118
• Automated cherry pick of #18114: Pin upload-artifacts GHA to commit sha by @rifelpet in #18209
• Automated cherry pick of #18173: Update Golang to 1.25.9 by @hakman in #18206
• Automated cherry pick of #17877: truncate very long sqs queue names
  #17885: fix truncate long sqs by @hakman in #18216
• Automated cherry pick of #18110: Update Cluster Autoscaler to 1.35.0 by @hakman in #18218
• Automated cherry pick of #18237: cilium: require k8s-connectivity in liveness probe by @hakman in #18243
• aws: bypass LBC mservice webhook for kube-system by @hakman in #18249
• Automated cherry pick of #18251: aws: skip node S3 permissions when kops-controller serves node config by @hakman in #18254
• Automated cherry pick of #18268: Cherrypick VPC CNI fixes by @rifelpet in #18269
• Automated cherry pick of #18285: cilium: allow setting arbitrary cilium-config entries by @hakman in #18287
• Automated cherry pick of #18281: hetzner: Upgrade hcloud-cloud-controller-manager to v1.30.1 by @hakman in #18284
• Automated cherry pick of #18298: dns-controller: make priorityClassName configurable by @hakman in #18300
• Automated cherry pick of #18302: dns-controller: default Provider when ExternalDNS is partially set by @hakman in #18304
• Automated cherry pick of #18307: gce: expose kops-controller on internal LB for gossip clusters by @hakman in #18309
• Automated cherry pick of #18319: azure: list VMSS NICs in protokube gossip seed discovery by @hakman in #18322
• Automated cherry pick of #18323: etcd-manager: upgrade to v3.0.20260512 by @hakman in #18325
• etcd-manager: bump etcd to latest patches (3.5.30, 3.6.11) by @yuzhouliu9 in #18332
• Automated cherry pick of #18375: cilium: add flags for bpf-lb-sock and bpf-lb-sock-hostns-only by @hakman in #18377
• Automated cherry pick of #18379: kops-controller and nodeup bug fixes by @rifelpet in #18381
• Automated cherry pick of #18384: Fix kops get assets when spec.dnsZone is a DNS name by @hakman in #18387
• Automated cherry pick of #18144: Move johngmyers to emeritus by @hakman in #18389
• Automated cherry pick of #18391: Validate instance group names in kops-controller by @rifelpet in #18393
• Upgrade Go to 1.26.3 for release-1.34 by @hakman in #18397
• Update dependencies for release-1.34 by @hakman in #18400
• Automated cherry pick of #18401: gomod: tidy and verify all modules by @hakman in #18405
• Release 1.34.3 by @hakman in #18412

Full Changelog: v1.34.2...v1.34.3