v0.32.0

Changes by Kind

Chore

• Added kcp-front-proxy, cache-server, virtual-workspaces, crd-puller and sharded-test-server to the release artifacts (#4080, @ntnn)
• BREAKING: Rename label on quota queue label to reduce cardinality:
  rename workqueue_adds_total{name="quota-} to workqueue_adds_total{name="quota"} (#4050, @mjudeikis)
• Bump github.com/moby/spdystream to 0.5.1 [CVE-2026-35469] (#4049, @xrstf)
• New utility crypto package in apimachinery for base36/63 related encoding
  Updated existing code paths to use new apimachinery crypto package for base36/63 encoding (#4159, @ntnn)
• Refactor controller registration pattern for non-leader-election controllers (#4193, @mjudeikis)
• Update to Go 1.25.10 (#4109, @xrstf)
• Update to Go 1.26.4. (#4187, @xrstf)

API Change

• Add a content proxy to the terminating VirtualWorkspace
  Add phase Terminating to Workspace and LogicalCluster to indicate terminating state (#4077, @mjudeikis)
• Add client evictor to release memory on LogicalCluster deletes (#4138, @mjudeikis)
• Add more in-depth defence on WorkspaceType default APIBindings (#4082, @mjudeikis)
• Add workspacetype InitializerPermissions and TerminatorPermissions (#4094, @mjudeikis)
• Added createdBy field to the logicalcluster spec for a more structured and secure owner identification. (#4060, @olamilekan000)
• Added migrating logical clusters between shards gated by the LogicalClusterMigration feature gate (#4191, @ntnn)
• CachedResourceEndpointSlice requires a cross-reference to APIExport it is being exported by
  • CachedResourceEndpointSlice are no longer created automatically
  • Objects replicated by CachedResources can be retrieved from the cache server API using their real GVR:identity (#3998, @gman0)
• Fix idempotency for clients for CachedResources (#4119, @mjudeikis)
• New logical cluster annotation LogicalClusterInactiveAnnotationKey (core.kcp.io/inactive) and a respecitve phase to mark logical clusters as inactive
  Deprecated the internal annotation internal.kcp.io/inactive, replaced with LogicalClusterInactiveAnnotationKey
  Active client watches will be cancelled on logical clusters that are marked as inactive
  Active wildcard watches will be cancelled when a logical cluster is marked as inactive (#4140, @ntnn)

Feature

• Add kcp_backend_rq_body_bytes, kcp_backend_rs_body_bytes, kcp_listener_tls_connection_error metrics to front-proxy. (#4192, @xrstf)
• Add kcp_workspace_count metric (#4095, @xrstf)
• Add kubectl kcp quickstart command to bootstrap a kcp environment with workspaces, APIResourceSchemas, APIExports, and APIBindings in a single command (#4024, @nuromirg)
• Add metrics for APIExport and APIBinding usage (#4147, @Elbehery)
• Cli: add the '--workspace'('-w') flag to the commands 'kubectl kcp bind apiexport', 'kubectl kcp workspace create', 'kubectl kcp workspace tree', 'kubectl kcp claims'. It can be used to override the current workspace defined in the kubeconfig. (#4104, @neolit123)
• Garbage collector is now cluster-aware, so one instance operates across all workspaces instead of each workspace having its own garbage collector (#4044, @ntnn)
• Implement rbac for /metrics (#4165, @mjudeikis)
• Improve workspace deletion after LogicalCluster is deleted (#4047, @mjudeikis)
• Kubequota controller is now cluster-aware, so one instance operates across all workspaces instead of each workspace having its own kubequota controller (#4183, @ntnn)
• LogicalClusters and Workspaces get the core.kcp.io/shard annotation with the value being the name of the shard they are scheduled on (#4171, @ntnn)
• When NO_GORUN is set sdk/testing allows setting the paths to prebuilt binaries by setting KCP_ASSET_$name in the environment to the path of the prebuilt binary; $name is the capitalized executable name with dashes replacing underscores (e.g. kcp-front-proxy is looked up with KCP_ASSET_KCP_FRONT_PROXY) (#4179, @ntnn)

Documentation

• Document WorkspaceType best practices (#4053, @mjudeikis)
• Improve cache server & replication documentation (#4056, @mjudeikis)
• Update etcd-druid version in ref architectures (#4039, @rose-krone)

Bug or Regression

• Add --external-logical-cluster-admin for the virtualworkspaces framework for SAR request support (#4091, @mjudeikis)
• Add a local-or-remote lookup cache for WorkspaceAuthenticationConfiguration so per-workspace auth with e.g. TokenReview works on shards (#4066, @ntnn)
• Fix CachedResource-backed (virtual-storage) resources being intermittently undiscoverable or unservable on kcp shards running with multiple replicas or embedded virtual workspaces. (#4190, @mjudeikis)
• Fix external virtual workspace proxying so concurrent /services/... requests keep impersonation headers request-scoped. (#4009, @officialasishkumar)
• Fix foreign apiexports, claimed in apibindings in sharded environments. (#4088, @mjudeikis)
• Fix index cleanup logic (#4139, @mjudeikis)
• Fix openAPIv3 partial serving in VirtualWorkspaces (#4134, @mjudeikis)
• Fix openapi controller evictions (#4142, @mjudeikis)
• Fix panic for mounts when GVR is not yet synced (#4074, @mjudeikis)
• Fix stale condition on LogicalCluster by reordering the delete (#4005, @mjudeikis)
• Fix watch request via VirtualWorkspace when selectors are used. (#4200, @mjudeikis)
• Fixed CRD creation in virtual workspaces failing with strict decoding errors for openAPIV3Schema fields (#3808, @olamilekan000)
• Opt into fixed klog stderrthreshold behavior so that -stderrthreshold is honored even when -logtostderr=true. (#3944, @pierluigilenoci)

Other (Cleanup or Flake)

• Make run-with-prometheus work for local dev (#4052, @mjudeikis)
• Reduce dynamicrestmapper logging to v(4) (#4172, @mjudeikis)

Dependencies

Added

• buf.build/go/protovalidate: v0.12.0
• github.com/cenkalti/backoff/v5: v5.0.3
• github.com/go-openapi/swag/cmdutils: v0.26.0
• github.com/go-openapi/swag/conv: v0.26.0
• github.com/go-openapi/swag/fileutils: v0.26.0
• github.com/go-openapi/swag/jsonname: v0.26.0
• github.com/go-openapi/swag/jsonutils/fixtures_test: v0.26.0
• github.com/go-openapi/swag/jsonutils: v0.26.0
• github.com/go-openapi/swag/loading: v0.26.0
• github.com/go-openapi/swag/mangling: v0.26.0
• github.com/go-openapi/swag/netutils: v0.26.0
• github.com/go-openapi/swag/stringutils: v0.26.0
• github.com/go-openapi/swag/typeutils: v0.26.0
• github.com/go-openapi/swag/yamlutils: v0.26.0
• github.com/go-openapi/testify/enable/yaml/v2: v2.4.2
• github.com/go-openapi/testify/v2: v2.4.2
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cri-streaming: e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/streaming: e006560

Changed

• buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go: 63bb56e → 8976f5b
• cyphar.com/go-pathrs: v0.2.1 → v0.2.2
• github.com/alecthomas/units: b94a6e3 → 0f3dac3
• github.com/containerd/containerd/api: v1.9.0 → v1.10.0
• github.com/coredns/corefile-migration: v1.0.29 → v1.0.31
• github.com/coreos/go-oidc: v2.3.0+incompatible → v2.5.0+incompatible
• github.com/coreos/go-systemd/v22: v22.5.0 → v22.7.0
• github.com/cyphar/filepath-securejoin: v0.6.0 → v0.6.1
• github.com/emicklei/go-restful/v3: v3.12.2 → v3.13.0
• github.com/fxamacker/cbor/v2: v2.9.0 → v2.9.1
• github.com/go-openapi/jsonpointer: v0.21.0 → v0.23.1
• github.com/go-openapi/jsonreference: v0.21.0 → v0.21.5
• github.com/go-openapi/swag: v0.23.0 → v0.26.0
• github.com/godbus/dbus/v5: v5.1.0 → v5.2.2
• github.com/golang-jwt/jwt/v5: v5.2.2 → v5.3.0
• github.com/google/cadvisor: v0.53.0 → v0.56.2
• github.com/google/cel-go: v0.26.0 → v0.28.0
• github.com/google/gnostic-models: v0.7.0 → v0.7.1
• github.com/google/pprof: 27863c8 → 294ebfa
• github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus: v1.0.1 → v1.1.0
• github.com/grpc-ecosystem/go-grpc-middleware/v2: v2.3.0 → v2.3.3
• github.com/grpc-ecosystem/grpc-gateway/v2: v2.26.3 → v2.27.7
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/api: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/apiextensions-apiserver: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/apimachinery: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/apiserver: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cli-runtime: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/client-go: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cloud-provider: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cluster-bootstrap: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/code-generator: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-base: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-helpers: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/controller-manager: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cri-api: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cri-client: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/csi-translation-lib: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/dynamic-resource-allocation: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/endpointslice: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/externaljwt: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kms: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-aggregator: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-controller-manager: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-proxy: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-scheduler: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kubectl: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kubelet: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/metrics: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/mount-utils: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/pod-security-admission: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/sample-apiserver: ba4f7d4 → e006560
• github.com/kcp-dev/kubernetes: ba4f7d4 → e006560
• github.com/moby/spdystream: v0.5.0 → v0.5.1
• github.com/onsi/ginkgo/v2: v2.27.2 → v2.28.1
• github.com/onsi/gomega: v1.38.2 → v1.39.1
• github.com/opencontainers/cgroups: v0.0.3 → v0.0.6
• github.com/opencontainers/runtime-spec: v1.2.1 → v1.3.0
• github.com/prometheus/common: v0.66.1 → v0.67.5
• github.com/prometheus/procfs: v0.16.1 → v0.20.1
• github.com/spf13/cobra: v1.10.0 → v1.10.2
• github.com/spf13/pflag: v1.0.9 → v1.0.10
• go.etcd.io/etcd/api/v3: v3.6.5 → v3.6.8
• go.etcd.io/etcd/client/pkg/v3: v3.6.5 → v3.6.8
• go.etcd.io/etcd/client/v3: v3.6.5 → v3.6.8
• go.etcd.io/etcd/pkg/v3: v3.6.5 → v3.6.8
• go.etcd.io/etcd/server/v3: v3.6.5 → v3.6.8
• go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful: v0.44.0 → v0.65.0
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: v0.60.0 → v0.65.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.61.0 → v0.65.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.34.0 → v1.40.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.34.0 → v1.40.0
• go.opentelemetry.io/proto/otlp: v1.5.0 → v1.9.0
• go.uber.org/zap: v1.27.0 → v1.27.1
• go.yaml.in/yaml/v2: v2.4.3 → v2.4.4
• golang.org/x/crypto: v0.47.0 → v0.52.0
• golang.org/x/exp: 87e1e73 → 74f9aab
• golang.org/x/mod: v0.31.0 → v0.36.0
• golang.org/x/net: v0.49.0 → v0.55.0
• golang.org/x/oauth2: v0.34.0 → v0.36.0
• golang.org/x/sync: v0.19.0 → v0.20.0
• golang.org/x/sys: v0.42.0 → v0.45.0
• golang.org/x/telemetry: 8fff8a5 → 42602be
• golang.org/x/term: v0.39.0 → v0.43.0
• golang.org/x/text: v0.33.0 → v0.37.0
• golang.org/x/time: v0.14.0 → v0.15.0
• golang.org/x/tools: v0.40.0 → v0.45.0
• google.golang.org/genproto/googleapis/api: b8f7ae3 → afd174a
• google.golang.org/genproto/googleapis/rpc: b8f7ae3 → afd174a
• google.golang.org/protobuf: v1.36.11 → f2248ac
• k8s.io/klog/v2: v2.130.1 → v2.140.0
• k8s.io/kube-openapi: 589584f → ec9c827
• k8s.io/utils: bc988d5 → 28399d8
• sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.31.2 → v0.34.0
• sigs.k8s.io/knftables: v0.0.17 → v0.0.21
• sigs.k8s.io/kustomize/api: v0.20.1 → v0.21.1
• sigs.k8s.io/kustomize/kustomize/v5: v5.7.1 → v5.8.1
• sigs.k8s.io/kustomize/kyaml: v0.20.1 → v0.21.1
• sigs.k8s.io/structured-merge-diff/v6: v6.3.0 → v6.4.0

Removed

• github.com/armon/circbuf: 5111143
• github.com/bufbuild/protovalidate-go: v0.9.1
• github.com/gregjones/httpcache: 901d907
• github.com/karrick/godirwalk: v1.17.0
• github.com/libopenstorage/openstorage: v1.0.0
• github.com/martinlindhe/base36: v1.1.1
• github.com/mohae/deepcopy: c48cc78
• github.com/mrunalp/fileutils: v0.5.1
• go.uber.org/automaxprocs: v1.6.0