2.151.0

2.151.0

Release Date: September 24, 2026

Changes

• Merge pull request #1211 from cloudfoundry/fix-compilation-on-windows - Author: Geoff Franks - SHA: 8ae85b7
• Skip this test on windows - Author: Amin Jamali - SHA: 8a4a4d3
• Merge pull request #1210 from cloudfoundry/fix-go-fmt-1 - Author: Amelia Downs - SHA: f033b04
• Fix go fmt for executor - Author: Amin Jamali - SHA: b5bc8c6
• Merge pull request #1209 from cloudfoundry/pin-kube-openapi - Author: Amelia Downs - SHA: c87e8db
• Pin k8s.io/kube-openapi - Author: Amin Jamali - SHA: ad9ffa0
• Merge pull request #1208 from klapkov/untar_fix - Author: Amin Jamali - SHA: 030c8cc
• Mark untar for linux only - Author: Konstantin Lapkov - SHA: a915dae
• Bump to go1.27 since that's a new requirement for the newly added dependency - Author: Amin Jamali - SHA: c648b45
• Upgrade golang-1.27-windows (1.27.1) - Author: App Platform Runtime Working Group CI Bot - SHA: 19ec0d0
• Upgrade golang-1.27-linux (1.27.1) - Author: App Platform Runtime Working Group CI Bot - SHA: a5e20ad
• Merge pull request #1206 from klapkov/bump-deps - Author: Amin Jamali - SHA: e9b0bf2
• Fix k8sclient on windows and sync packages - Author: Konstantin Lapkov - SHA: 679a579
• Sync rep/rep_windows package specs (CI linux/amd64) - Author: Konstantin Lapkov - SHA: 04819b9
• Merge pull request #1205 from klapkov/bump-deps - Author: Amin Jamali - SHA: e664ee5
• Vendor deps and sync packages - Author: Konstantin Lapkov - SHA: e5f5287
• Merge pull request #1204 from klapkov/CFAR-1430-workload-identity-opt-in - Author: Amelia Downs - SHA: b5e57f6
• Add tests for the feature flag and update the spec description - Author: Konstantin Lapkov - SHA: 1be5d1e
• make TLS verification configurable for kubelet client - Author: Pavel Busko - SHA: c77da46
• Support for k8s-garden-client for running on k8s natively - Author: Pavel Busko - SHA: c642af3
• Add diego.executor.inject_workload_identity BOSH property - Author: Konstantin Lapkov - SHA: 4474400

Go Packages Updates

• Bumped go.mod package 'code.cloudfoundry.org/archiver' from 'v0.87.0' to 'v0.89.0'
• Bumped go.mod package 'code.cloudfoundry.org/bbs' from 'v1.16.0' to 'v1.18.0'
• Bumped go.mod package 'code.cloudfoundry.org/bbs/encryption' from 'v1.12.0' to 'v1.16.0'
• Bumped go.mod package 'code.cloudfoundry.org/bbs/format' from 'v1.11.0' to 'v1.13.0'
• Bumped go.mod package 'code.cloudfoundry.org/bbs/models' from 'v1.13.0' to 'v1.14.0'
• Bumped go.mod package 'code.cloudfoundry.org/bytefmt' from 'v0.89.0' to 'v0.91.0'
• Bumped go.mod package 'code.cloudfoundry.org/certsplitter' from 'v0.87.0' to 'v0.89.0'
• Bumped go.mod package 'code.cloudfoundry.org/cfhttp/v2' from 'v2.94.0' to 'v2.95.0'
• Bumped go.mod package 'code.cloudfoundry.org/clock' from 'v1.87.0' to 'v1.89.0'
• Bumped go.mod package 'code.cloudfoundry.org/cnbapplifecycle' from 'v0.0.8' to 'v0.0.9'
• Bumped go.mod package 'code.cloudfoundry.org/commandrunner' from 'v0.76.0' to 'v0.78.0'
• Bumped go.mod package 'code.cloudfoundry.org/credhub-cli' from 'v0.0.0-20260907130120-567c46b571cd' to 'v0.0.0-20260921130234-f80c1c8a1b4a'
• Bumped go.mod package 'code.cloudfoundry.org/debugserver' from 'v0.114.0' to 'v0.116.0'
• Bumped go.mod package 'code.cloudfoundry.org/diego-db-helpers' from 'v0.17.0' to 'v0.19.0'
• Bumped go.mod package 'code.cloudfoundry.org/diego-logging-client' from 'v0.124.0' to 'v0.126.0'
• Bumped go.mod package 'code.cloudfoundry.org/dockerdriver' from 'v0.106.0' to 'v0.108.0'
• Bumped go.mod package 'code.cloudfoundry.org/durationjson' from 'v0.89.0' to 'v0.91.0'
• Bumped go.mod package 'code.cloudfoundry.org/eventhub' from 'v0.89.0' to 'v0.91.0'
• Bumped go.mod package 'code.cloudfoundry.org/garden' from 'v0.2.0' to 'v0.4.0'
• Bumped go.mod package 'code.cloudfoundry.org/go-diodes' from 'v0.0.0-20260831145205-e8366a756183' to 'v0.0.0-20260921100641-e75e32521ad8'
• Bumped go.mod package 'code.cloudfoundry.org/goshims' from 'v0.112.0' to 'v0.114.0'
• Added go.mod package 'code.cloudfoundry.org/k8s-garden-client' version 'v0.8.0'
• Bumped go.mod package 'code.cloudfoundry.org/lager/v3' from 'v3.86.0' to 'v3.88.0'
• Bumped go.mod package 'code.cloudfoundry.org/localip' from 'v0.88.0' to 'v0.90.0'
• Bumped go.mod package 'code.cloudfoundry.org/locket' from 'v1.12.0' to 'v1.13.0'
• Bumped go.mod package 'code.cloudfoundry.org/routing-api' from 'v0.14.0' to 'v0.16.0'
• Bumped go.mod package 'code.cloudfoundry.org/routing-info' from 'v1.13.0' to 'v1.15.0'
• Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.66.0' to 'v0.68.0'
• Bumped go.mod package 'github.com/Azure/go-ansiterm' from 'v0.0.0-20250102033503-faa5f7b0171c' to 'v0.0.0-20260917205352-e937bb47801a'
• Added go.mod package 'github.com/Microsoft/hcsshim' version 'v0.15.0-rc.4'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2' from 'v1.46.0' to 'v1.47.0'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/config' from 'v1.33.3' to 'v1.33.5'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/credentials' from 'v1.20.3' to 'v1.20.5'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/feature/ec2/imds' from 'v1.19.2' to 'v1.20.0'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/internal/configsources' from 'v1.5.2' to 'v1.5.3'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/internal/endpoints/v2' from 'v2.8.2' to 'v2.8.3'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/internal/v4a' from 'v1.5.2' to 'v1.5.3'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/service/ecr' from 'v1.64.0' to 'v1.66.0'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/service/ecrpublic' from 'v1.46.0' to 'v1.47.0'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/service/internal/presigned-url' from 'v1.14.2' to 'v1.14.3'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/service/signin' from 'v1.9.0' to 'v1.10.0'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/service/sso' from 'v1.37.0' to 'v1.38.0'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/service/ssooidc' from 'v1.42.0' to 'v1.43.0'
• Bumped go.mod package 'github.com/aws/aws-sdk-go-v2/service/sts' from 'v1.49.0' to 'v1.51.0'
• Bumped go.mod package 'github.com/aws/smithy-go' from 'v1.28.1' to 'v1.28.2'
• Added go.mod package 'github.com/beorn7/perks' version 'v1.0.1'
• Bumped go.mod package 'github.com/buildpacks/lifecycle' from 'v0.21.18' to 'v0.21.20'
• Bumped go.mod package 'github.com/cloudfoundry/socks5-proxy' from 'v0.2.187' to 'v0.2.189'
• Added go.mod package 'github.com/containerd/cgroups/v3' version 'v3.1.3'
• Added go.mod package 'github.com/containerd/containerd/api' version 'v1.12.0'
• Added go.mod package 'github.com/containerd/containerd/v2' version 'v2.4.0'
• Added go.mod package 'github.com/containerd/continuity' version 'v0.5.0'
• Added go.mod package 'github.com/containerd/fifo' version 'v1.1.0'
• Added go.mod package 'github.com/containerd/log' version 'v0.2.0'
• Added go.mod package 'github.com/containerd/log/otel' version 'v0.1.0'
• Added go.mod package 'github.com/containerd/platforms' version 'v1.0.0-rc.5'
• Added go.mod package 'github.com/containerd/plugin' version 'v1.1.0'
• Added go.mod package 'github.com/containerd/ttrpc' version 'v1.2.9'
• Added go.mod package 'github.com/davecgh/go-spew' version 'v1.1.2-0.20180830191138-d8f796af33cc'
• Bumped go.mod package 'github.com/docker/cli' from 'v29.8.0+incompatible' to 'v29.8.1+incompatible'
• Added go.mod package 'github.com/emicklei/go-restful/v3' version 'v3.13.0'
• Added go.mod package 'github.com/evanphx/json-patch/v5' version 'v5.9.11'
• Added go.mod package 'github.com/fxamacker/cbor/v2' version 'v2.9.4'
• Added go.mod package 'github.com/go-openapi/jsonpointer' version 'v1.0.1'
• Added go.mod package 'github.com/go-openapi/jsonreference' version 'v1.0.2'
• Added go.mod package 'github.com/go-openapi/swag' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/cmdutils' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/conv' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/fileutils' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/jsonutils' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/loading' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/mangling' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/netutils' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/pools' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/stringutils' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/typeutils' version 'v0.29.2'
• Added go.mod package 'github.com/go-openapi/swag/yamlutils' version 'v0.29.2'
• Added go.mod package 'github.com/google/gnostic-models' version 'v0.7.1'
• Bumped go.mod package 'github.com/gopacket/gopacket' from 'v1.7.1' to 'v1.7.2'
• Added go.mod package 'github.com/json-iterator/go' version 'v1.1.12'
• Added go.mod package 'github.com/moby/locker' version 'v1.0.1'
• Added go.mod package 'github.com/moby/sys/signal' version 'v0.7.1'
• Bumped go.mod package 'github.com/moby/sys/userns' from 'v0.2.0' to 'v0.2.1'
• Added go.mod package 'github.com/modern-go/concurrent' version 'v0.0.0-20180306012644-bacd9c7ef1dd'
• Added go.mod package 'github.com/munnerz/goautoneg' version 'v0.0.0-20191010083416-a7dc8b61c822'
• Bumped go.mod package 'github.com/nats-io/nats-server/v2' from 'v2.14.6' to 'v2.15.0'
• Bumped go.mod package 'github.com/nats-io/nats.go' from 'v1.53.1' to 'v1.54.0'
• Bumped go.mod package 'github.com/onsi/ginkgo/v2' from 'v2.32.1' to 'v2.33.0'
• Bumped go.mod package 'github.com/onsi/gomega' from 'v1.43.0' to 'v1.43.1'
• Added go.mod package 'github.com/pmezard/go-difflib' version 'v1.0.1-0.20181226105442-5d4384ee4fb2'
• Added go.mod package 'github.com/prometheus/client_golang' version 'v1.24.1'
• Added go.mod package 'github.com/prometheus/client_model' version 'v0.6.3'
• Added go.mod package 'github.com/prometheus/common' version 'v0.71.0'
• Added go.mod package 'github.com/prometheus/procfs' version 'v0.22.0'
• Bumped go.mod package 'github.com/tedsuo/ifrit' from 'v0.0.0-20260813155221-94822c932811' to 'v0.0.0-20260908181113-dd353a7daa27'
• Added go.mod package 'github.com/x448/float16' version 'v0.8.4'
• Added go.mod package 'go.opentelemetry.io/otel/sdk' version 'v1.46.0'
• Bumped go.mod package 'go.step.sm/crypto' from 'v0.90.0' to 'v0.91.0'
• Added go.mod package 'go.yaml.in/yaml/v2' version 'v2.4.4'
• Bumped go.mod package 'golang.org/x/crypto' from 'v0.56.0' to 'v0.57.0'
• Bumped go.mod package 'golang.org/x/net' from 'v0.58.0' to 'v0.59.0'
• Bumped go.mod package 'golang.org/x/text' from 'v0.41.0' to 'v0.42.0'
• Bumped go.mod package 'golang.org/x/tools' from 'v0.49.0' to 'v0.50.0'
• Added go.mod package 'gomodules.xyz/jsonpatch/v2' version 'v2.5.0'
• Bumped go.mod package 'google.golang.org/genproto/googleapis/api' from 'v0.0.0-20260908043556-f8649ddbbfe6' to 'v0.0.0-20260921155816-b14227669459'
• Bumped go.mod package 'google.golang.org/genproto/googleapis/rpc' from 'v0.0.0-20260908043556-f8649ddbbfe6' to 'v0.0.0-20260921155816-b14227669459'
• Bumped go.mod package 'google.golang.org/grpc' from 'v1.83.2' to 'v1.84.0'
• Added go.mod package 'gopkg.in/evanphx/json-patch.v4' version 'v4.13.0'
• Added go.mod package 'gopkg.in/inf.v0' version 'v0.9.1'
• Bumped go.mod package 'gorm.io/driver/postgres' from 'v1.6.2' to 'v1.6.3'
• Added go.mod package 'k8s.io/api' version 'v0.37.0'
• Added go.mod package 'k8s.io/apiextensions-apiserver' version 'v0.37.0'
• Added go.mod package 'k8s.io/apimachinery' version 'v0.37.0'
• Added go.mod package 'k8s.io/client-go' version 'v0.37.0'
• Added go.mod package 'k8s.io/klog/v2' version 'v2.140.0'
• Added go.mod package 'k8s.io/kube-openapi' version 'v0.0.0-20260911184034-7970a1e230da'
• Added go.mod package 'k8s.io/kubelet' version 'v0.37.0'
• Added go.mod package 'k8s.io/utils' version 'v0.0.0-20260707023825-cf1189d6abe3'
• Added go.mod package 'sigs.k8s.io/controller-runtime' version 'v0.25.1'
• Added go.mod package 'sigs.k8s.io/json' version 'v0.0.0-20260909141634-11ed52e25bc5'
• Added go.mod package 'sigs.k8s.io/randfill' version 'v1.0.0'
• Added go.mod package 'sigs.k8s.io/structured-merge-diff/v6' version 'v6.4.2'
• Added go.mod package 'sigs.k8s.io/yaml' version 'v1.6.0'

Bosh Job Spec changes:

diff --git a/jobs/rep/spec b/jobs/rep/spec
index 9a23f71d6..bb4313a89 100644
--- a/jobs/rep/spec
+++ b/jobs/rep/spec
@@ -217,6 +217,9 @@ properties:
   diego.executor.volman.driver_paths:
     description: "OS style path string containing the directories volman will look in for voldriver specs (delimited by : or ; depending on the OS)"
     default: "/var/vcap/data/voldrivers"
+  diego.executor.inject_workload_identity:
+    description: "When true, Rep injects _workload_guid and _workload_type into every volume mount config before calling the volume driver. This lets volume drivers that validate a mount against the workload's service bindings read the workload identity directly, instead of reconstructing it out-of-band."
+    default: false
   diego.executor.instance_identity_ca_cert:
     description: "PEM-encoded CA used to sign instance identity credentials. Enables instance identity if set along with instance_identity_key"
   diego.executor.instance_identity_key:
diff --git a/jobs/rep_windows/spec b/jobs/rep_windows/spec
index 5a07c5374..95ba5489c 100644
--- a/jobs/rep_windows/spec
+++ b/jobs/rep_windows/spec
@@ -196,6 +196,9 @@ properties:
     description: "Experimental: arbitrary command to run after setup action"
   diego.executor.post_setup_user:
     description: "Experimental: user to run post setup hook command"
+  diego.executor.inject_workload_identity:
+    description: "When true, Rep injects _workload_guid and _workload_type into every volume mount config before calling the volume driver. This lets volume drivers that validate a mount against the workload's service bindings read the workload identity directly, instead of reconstructing it out-of-band."
+    default: false
   diego.executor.instance_identity_ca_cert:
     description: "PEM-encoded CA used to sign instance identity credentials. Enables instance identity if set along with instance_identity_key"
   diego.executor.instance_identity_key:
diff --git a/jobs/vizzini/spec b/jobs/vizzini/spec
index 51c7d0f1d..83d83efc7 100644
--- a/jobs/vizzini/spec
+++ b/jobs/vizzini/spec
@@ -1,7 +1,7 @@
 ---
 name: vizzini
 packages:
-  - golang-1.26-linux
+  - golang-1.27-linux
   - vizzini
 
 templates:

✨ Built with go 1.27.1

Full Changelog: v2.150.0...v2.151.0

Resources

• Download release 2.151.0 from bosh.io.