v1.14.0

👌 Kubernetes version support

• Management Cluster: v1.33.x -> v1.36.x
• Workload Cluster: v1.31.x -> v1.36.x

More information about version support can be found here

Highlights

• Cluster API is now using Golang 1.26, CR v0.24, CT v0.21

• Improve the project security posture and increase its capability to deal with CVEs from direct/indirect dependencies

  • Introduced dedicated Golang module for API types (#13762)
    • This new API module ensures consumers of the API types
      • Stronger compatibility guarantees.
      • Considerably smaller and tightly controlled dependency tree, thus reducing exposure to CVEs from dependencies.
  • Formalization of policies and rules for Golang version bump, allowing a better response to Golang CVEs.
  • See also the wider effort about code organization proposal + (#13910).

• Enable safe joining of nodes on older kubernetes versions with kubeadm (#13433)

  • This feature removes a constraint preventing scale up, remediation and autoscaling of worker nodes during cluster rollouts,
    thus allowing future improvements like support for independent worker versions in cluster topology.

• Improved observability on upgrades, Kubernetes version in-use and runtime extensions errors.

  • Surface upgrade plan in cluster status (#13923)
  • Surface aggregated machine versions in status (#13341)
  • Surface Runtime Extension errors in cluster conditions (#13813)

• More work to improve robustness and reliability of controllers

  • Improve forward etcd leadership in KCP, allowing the system to better handle partial failures during control plane machine deletion (#13848)
  • Tolerate missing InfraTemplates during control plane machine deletion, allowing the system to tolerate accidental resource deletion (#13558)
  • Allow KCP remediation of unhealthy machines during intermediate steps of chained upgrades (#13869)
  • KCP is now able to cleanup not started etcd members after a machine is remediated (#13685)
  • Implement stale controller mitigation in all the relevant controllers (#13720, #13737, #13730)
  • Allow remediation of unhealthy Machines managed by old MachineSets during in-place updates (#13886)
  • Perform draining and volume detachment once until completion (#11590)
  • Use regular patch instead of SSA to patch Cluster in topology controller (#13760)

• More work for reducing Cluster API memory footprint and for improving performance at scale

  • Introduce options for cache tuning in ClusterCache clients, use those options to better control memory footprint in core CAPI, CABPK and KCP (#13780, #13820)
  • Implement managedFields interning (#13807)

• Misc:

  • Allow patching of metadata.{labels,annotations} through ClusterClass patches (#13924)
  • Kubernetes version validation now enforces strict semver compatibility (#13874)
  • Several changes to reduce E2E test durations while we keep adding new tests and improving test coverage of the existing ones.
  • Add experimental clusterctl convert command (#12843)

Deprecation Warning

Important:

• The v1beta1 API version in core Cluster API, CABPK and KCP is on track to be unserved in CAPI v1.16. All the consumers of this API version should migrate to v1beta2 ASAP.
  • Utils for the Cluster API v1beta1 condition types (condition helpers, patch helper etc.) will be removed as a next step.
  • All the status.deprecated fields existing in v1beta2 types (used for v1beta1 down conversions) types will be removed as a next step.
• Support for the Cluster API v1beta1 contract versions is on track to be dropped in CAPI v1.16. Provider should start implementing the v1beta2 contract ASAP.

Removal of Docker* API resources will happen in CAPI v1.15. All the consumers of these API resources should migrate to Dev* API resources ASAP.

• NOTE: CAPD is considered a test provider, API deprecation period does not apply

For additional details for providers, please take a look at Cluster API v1.13 compared to v1.14.

Changes since v1.13.0

📈 Overview

• 258 new commits merged
• 4 breaking changes ⚠️
• 28 feature additions ✨
• 28 bugs fixed 🐛

⚠️ Breaking Changes

• CAPD: Mark docker resources as deprecated (#13557)
• Dependency: Bump to controller-runtime v0.24 & controller-tools v0.21 (#13651)
• Machine/MachinePool/MachineSet/MachineDeployment/Cluster: Fix version validation in webhooks (#13874)
• Misc: Fix minor goroutine leak in util/cache after controller shutdown (#13487)

✨ New Features

• API: Introduce separate API module (#13762)
• API: Move OpenAPI schema out of the api package to avoid direct dependency on kube-openapi in the api module (#13825)
• API: Surface aggregated machine versions in status (#13341)
• Bootstrap: Write kubeadm control plane version file for workers to use to fetch the matching kubeadm binary (#13433)
• CAPD: Introduce per-reconciler concurrency flags in CAPDev (#13740)
• CAPD: Migrate ClusterClass changes e2e test from the docker to the in-memory backend (#13764)
• CAPD: Migrate templates to use Dev* instead of Docker* (#13741)
• CI: Remove YEAR from copyright header boilerplate (#13889)
• Cluster: Use regular patch instead of SSA to patch Cluster in topology controller (#13760)
• ClusterCache: Expose and use DefaultTransform on CacheOptions (#13780)
• ClusterCache: Use DefaultTransform in core CAPI, CABPK and KCP (#13820)
• ClusterClass/KCP/MachineSet: Implement stale controller mitigation in KCP / MS / Cluster topology controller (#13737)
• ClusterClass: Allow patching of metadata.{labels,annotations} through ClusterClass patches (#13924)
• clusterctl: Add cluster-api-provider-kubeswift to the built-in infrastructure provider list (#13946)
• clusterctl: Add configuration ExternallyProvisioned for clusterctl (#13739)
• clusterctl: Add experimental clusterctl convert command (#12843)
• Dependency: Bump Go 1.26 (#13623)
• e2e: Migrate ClusterClass rollout e2e test from the docker to the in-memory backend (#13806)
• e2e: Migrate ClusterClass upgrade with different NS e2e test from the docker to the in-memory backend (#13885)
• e2e: Migrate e2e tests from using Docker* resources to Dev* resources (#13647)
• e2e: Migrate test extension to use Dev* instead of Docker* (#13716)
• e2e: Update in-place updating a workload cluster e2e test to use in-memory backend (#13895)
• e2e: Use in-memory template for clusterctl upgrade tests (#13866)
• KCP: Improve forward etcd leadership (#13848)
• MachineDeployment/util: Stale controller mitigation in reconcile wrapper & MD controller, enable store & fifo informer metrics (#13720)
• Misc: Implement managedFields interning (#13807)
• Misc: Implement new code structure (#13894)
• Release: Prepare main branch for v1.14 development (#13617)

🐛 Bug Fixes

• CAPD: Fix a panic in CAPDev cache.Get() (#13959)
• CAPD: Fix CAPD flakes (#13757)
• CAPD: Fix E2E host port binding lookup (#13627)
• CAPIM: Fix deadlock in in-memory server (#13971)
• CI: Fix verify docker images arch (#13922)
• ClusterClass: Fix Machine taint propagation in the Cluster topology controller for the v1beta1 contract (#13991)
• clusterctl: Detect cert-manager image changes during upgrade (#13850)
• clusterctl: Fix v1beta1 describe output stream (#13893)
• clusterctl: Raise management cluster client QPS and Burst (#13875)
• clusterctl: Reject incomplete GitHub release asset URLs (#13909)
• clusterctl: Skip update check for clusterctl completion (#13653)
• clusterctl: Trim whitespace in --show-conditions filters (#13897)
• Dependency: Fix CVE-2026-39883 (#13571)
• Devtools: Fix Grafana deployment (#13998)
• Devtools: Fix parallel build of binaries in Tiltfile (#13995)
• Devtools: Fix Tilt kube-state-metrics deployment (#13677)
• e2e: Fix ClusterClass rollout test with k8s latest (#13881)
• e2e: Fix PrettyPrint in WaitForControlPlaneToBeReady (#13843)
• e2e: Fix self-hosted test (#13778)
• KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembers (#13717)
• KCP: Fix KCP in-place update with InfraMachine webhooks with immutability validation (#13640)
• KCP: KCP deletion should tolerate missing InfraTemplates (#13558)
• Machine/Bootstrap: Perform draining and volume detachment once until completion (#11590)
• MachineDeployment: Fix nil pointer panic when paused with no matching MachineSet (#13827)
• MachineSet: Delete unhealthy Machines of old MS during in-place updates (#13886)
• MachineSet: Fix retry to remove finalizer in MS topology reconciler (#13993)
• Release: Revert unset GOCACHE env var (#13732)
• Testing: Fix TestHealthCheckTargets flake (#13860)

🌱 Others

• API/Runtime SDK/IPAM/MachinePool/MachineSet/MachineDeployment: Fix typos in generated CRD descriptions (#13641)
• API: Adjust IsMachineDeploymentUpgrading to detect in-place upgrades (#13876)
• API: Follow-ups for Surface aggregated machine versions in status (#13871)
• API: Surface upgrade plan in cluster status (#13923)
• Bootstrap: Limit size of files generated from templates (#13927)
• CABPK: Prevent CABPK to override controlling ownerRef for bootstrap secrets (#13937)
• CABPK: Use ClusterClass with RuntimeSDK in kubeadm join old Node e2e test & fix e2e test failures (#13759)
• CAPD: Add support for controller restart to in-memory backend (#13595)
• CAPD: Only add finalizer after InfraMachine has owner in CAPDev (#13714)
• CAPD: Partially revert fix self-hosted test (#13795)
• CAPD: Refactor CAPDev reconciler (#13702)
• CI: Add cron buckets to prow generator (#13656)
• CI: Add KCP infra adoption test (#13731)
• CI: Ad...

v1.13.5

👌 Kubernetes version support

• Management Cluster: v1.32.x -> v1.36.x
• Workload Cluster: v1.30.x -> v1.36.x

More information about version support can be found here

Changes since v1.13.4

📈 Overview

• 13 new commits merged
• 2 bugs fixed 🐛

🐛 Bug Fixes

• CAPD: Fix a panic in CAPDev cache.Get() (#13961)
• ClusterClass: Fix Machine taint propagation in the Cluster topology controller for the v1beta1 contract (#13985)

🌱 Others

• clusterctl: Add oxide as an infrastructure provider (#13934)
• clusterctl: Bump cert-manager to v1.21.0 (#13917)
• clusterctl: Bump cert-manager to v1.21.1 (#14011)
• clusterctl: Harden clusterctl move (#13940)
• Dependency: Bump golang.org/x/text to v0.39.0, cel-go to v0.29.0 and grpc to v1.82.1 to address security advisories (#13977)
• e2e: Bump autoscaler version used for testing (#13942)
• e2e: Bump Kubernetes version used for testing to v1.37.0-beta.0 (#13950)
• e2e: Increase clusterctl and e2e test dry-run cluster-template timeouts (#14015)
• KCP: Bump corefile-migration to v1.0.34 (#13958)
• KCP: KCP enforce context deadline on connection stream (#14001)

📖 Additionally, there has been 1 contribution to our documentation and book. (#13935)

Dependencies

Added

Nothing has changed.

Changed

• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.31.0 → v1.32.0
• github.com/antlr4-go/antlr/v4: v4.13.0 → v4.13.1
• github.com/cncf/xds/go: ee656c7 → dba9d58
• github.com/coredns/corefile-migration: v1.0.32 → v1.0.34
• github.com/envoyproxy/go-control-plane/envoy: v1.36.0 → v1.37.0
• github.com/envoyproxy/protoc-gen-validate: v1.3.0 → v1.3.3
• github.com/go-jose/go-jose/v4: v4.1.3 → v4.1.4
• github.com/google/cel-go: v0.26.0 → v0.29.0
• go.opentelemetry.io/contrib/detectors/gcp: v1.39.0 → v1.43.0
• golang.org/x/exp: 8a7402a → 9b4947d
• golang.org/x/mod: v0.36.0 → v0.37.0
• golang.org/x/net: v0.55.0 → v0.56.0
• golang.org/x/telemetry: 42602be → 59b4966
• golang.org/x/text: v0.38.0 → v0.39.0
• golang.org/x/tools: v0.45.0 → v0.47.0
• google.golang.org/genproto/googleapis/api: 9d38bb4 → afd174a
• google.golang.org/genproto/googleapis/rpc: 9d38bb4 → afd174a
• google.golang.org/grpc: v1.80.0 → v1.82.1

Removed

Nothing has changed.

Thanks to all our contributors! 😊

v1.12.11

👌 Kubernetes version support

• Management Cluster: v1.31.x -> v1.36.x
• Workload Cluster: v1.29.x -> v1.36.x

More information about version support can be found here

Changes since v1.12.10

📈 Overview

• 9 new commits merged
• 1 bug fixed 🐛

🐛 Bug Fixes

• CAPD: Fix a panic in CAPDev cache.Get() (#13962)

🌱 Others

• CI: Trivyignore CVE-2026-56852 (#14027)
• clusterctl: Bump cert-manager to v1.21.0 (#13916)
• clusterctl: Harden clusterctl move (#13941)
• Dependency: Bump x/text to v0.39.0, otel to v1.41.0, cel-go to v0.29.0 and grpc to v1.82.1 to address security advisories (#13978)
• e2e: Bump autoscaler version used for testing (#13943)
• e2e: Increase clusterctl and e2e test dry-run cluster-template timeouts (#14016)
• KCP: Bump corefile-migration to v1.0.34 (#13957)
• KCP: KCP enforce context deadline on connection stream (#14004)

Dependencies

Added

Nothing has changed.

Changed

• github.com/antlr4-go/antlr/v4: v4.13.0 → v4.13.1
• github.com/coredns/corefile-migration: v1.0.32 → v1.0.34
• github.com/google/cel-go: v0.26.0 → v0.29.0
• golang.org/x/exp: 8a7402a → 9b4947d

Removed

Nothing has changed.

Thanks to all our contributors! 😊

v1.14.0-rc.1

🚨 This is a RELEASE CANDIDATE. Use it only for testing purposes. If you find any bugs, file an issue.

More details about the release

⚠️ RELEASE CANDIDATE NOTES ⚠️

👌 Kubernetes version support

• Management Cluster: v1.33.x -> v1.36.x
• Workload Cluster: v1.31.x -> v1.36.x

More information about version support can be found here

Highlights

• Cluster API is now using Golang 1.26, CR v0.24, CT v0.21

• Improve the project security posture and increase its capability to deal with CVEs from direct/indirect dependencies

  • Introduced dedicated Golang module for API types (#13762)
    • This new API module ensures consumers of the API types
      • Stronger compatibility guarantees.
      • Considerably smaller and tightly controlled dependency tree, thus reducing exposure to CVEs from dependencies.
  • Formalization of policies and rules for Golang version bump, allowing a better response to Golang CVEs.
  • See also the wider effort about code organization proposal + (#13910).

• Enable safe joining of nodes on older kubernetes versions with kubeadm (#13433)

  • This feature removes a constraint preventing scale up, remediation and autoscaling of worker nodes during cluster rollouts,
    thus allowing future improvements like support for independent worker versions in cluster topology.

• Improved observability on upgrades, Kubernetes version in-use and runtime extensions errors.

  • Surface upgrade plan in cluster status (#13923)
  • Surface aggregated machine versions in status (#13341)
  • Surface Runtime Extension errors in cluster conditions (#13813)

• More work to improve robustness and reliability of controllers

  • Improve forward etcd leadership in KCP, allowing the system to better handle partial failures during control plane machine deletion (#13848)
  • Tolerate missing InfraTemplates during control plane machine deletion, allowing the system to tolerate accidental resource deletion (#13558)
  • Allow KCP remediation of unhealthy machines during intermediate steps of chained upgrades (#13869)
  • KCP is now able to cleanup not started etcd members after a machine is remediated (#13685)
  • Implement stale controller mitigation in all the relevant controllers (#13720, #13737, #13730)
  • Allow remediation of unhealthy Machines managed by old MachineSets during in-place updates (#13886)
  • Perform draining and volume detachment once until completion (#11590)
  • Use regular patch instead of SSA to patch Cluster in topology controller (#13760)

• More work for reducing Cluster API memory footprint and for improving performance at scale

  • Introduce options for cache tuning in ClusterCache clients, use those options to better control memory footprint in core CAPI, CABPK and KCP (#13780, #13820)
  • Implement managedFields interning (#13807)

• Misc:

  • Allow patching of metadata.{labels,annotations} through ClusterClass patches (#13924)
  • Kubernetes version validation now enforces strict semver compatibility (#13874)
  • Several changes to reduce E2E test durations while we keep adding new tests and improving test coverage of the existing ones.
  • Add experimental clusterctl convert command (#12843)

Deprecation Warning

Important:

• The v1beta1 API version in core Cluster API, CABPK and KCP is on track to be unserved in CAPI v1.16. All the consumers of this API version should migrate to v1beta2 ASAP.
  • Utils for the Cluster API v1beta1 condition types (condition helpers, patch helper etc.) will be removed as a next step.
  • All the status.deprecated fields existing in v1beta2 types (used for v1beta1 down conversions) types will be removed as a next step.
• Support for the Cluster API v1beta1 contract versions is on track to be dropped in CAPI v1.16. Provider should start implementing the v1beta2 contract ASAP.

Removal of Docker* API resources will happen in CAPI v1.15. All the consumers of these API resources should migrate to Dev* API resources ASAP.

• NOTE: CAPD is considered a test provider, API deprecation period does not apply

For additional details for providers, please take a look at Cluster API v1.13 compared to v1.14.

Changes since v1.14.0-rc.0

📈 Overview

• 9 new commits merged
• 4 bugs fixed 🐛

🐛 Bug Fixes

• ClusterClass: Fix Machine taint propagation in the Cluster topology controller for the v1beta1 contract (#13991)
• Devtools: Fix Grafana deployment (#13998)
• Devtools: Fix parallel build of binaries in Tiltfile (#13995)
• MachineSet: Fix retry to remove finalizer in MS topology reconciler (#13993)

🌱 Others

• ClusterClass: Increase MD/MS topology reconciler concurrency to 25 (#14008)
• clusterctl: Bump cert-manager to v1.21.1 (#14012)
• e2e: Drop syncer from in-memory server (#13992)
• e2e: Increase clusterctl and e2e test dry-run cluster-template timeouts (#14014)

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

Changes since v1.13.0

📈 Overview

• 258 new commits merged
• 4 breaking changes ⚠️
• 28 feature additions ✨
• 28 bugs fixed 🐛

⚠️ Breaking Changes

• CAPD: Mark docker resources as deprecated (#13557)
• Dependency: Bump to controller-runtime v0.24 & controller-tools v0.21 (#13651)
• Machine/MachinePool/MachineSet/MachineDeployment/Cluster: Fix version validation in webhooks (#13874)
• Misc: Fix minor goroutine leak in util/cache after controller shutdown (#13487)

✨ New Features

• API: Introduce separate API module (#13762)
• API: Move OpenAPI schema out of the api package to avoid direct dependency on kube-openapi in the api module (#13825)
• API: Surface aggregated machine versions in status (#13341)
• Bootstrap: Write kubeadm control plane version file for workers to use to fetch the matching kubeadm binary (#13433)
• CAPD: Introduce per-reconciler concurrency flags in CAPDev (#13740)
• CAPD: Migrate ClusterClass changes e2e test from the docker to the in-memory backend (#13764)
• CAPD: Migrate templates to use Dev* instead of Docker* (#13741)
• CI: Remove YEAR from copyright header boilerplate (#13889)
• Cluster: Use regular patch instead of SSA to patch Cluster in topology controller (#13760)
• ClusterCache: Expose and use DefaultTransform on CacheOptions (#13780)
• ClusterCache: Use DefaultTransform in core CAPI, CABPK and KCP (#13820)
• ClusterClass/KCP/MachineSet: Implement stale controller mitigation in KCP / MS / Cluster topology controller (#13737)
• ClusterClass: Allow patching of metadata.{labels,annotations} through ClusterClass patches (#13924)
• clusterctl: Add cluster-api-provider-kubeswift to the built-in infrastructure provider list (#13946)
• clusterctl: Add configuration ExternallyProvisioned for clusterctl (#13739)
• clusterctl: Add experimental clusterctl convert command (#12843)
• Dependency: Bump Go 1.26 (#13623)
• e2e: Migrate ClusterClass rollout e2e test from the docker to the in-memory backend (#13806)
• e2e: Migrate ClusterClass upgrade with different NS e2e test from the docker to the in-memory backend (#13885)
• e2e: Migrate e2e tests from using Docker* resources to Dev* resources (#13647)
• e2e: Migrate test extension to use Dev* instead of Docker* (#13716)
• e2e: Update in-place updating a workload cluster e2e test to use in-memory backend (#13895)
• e2e: Use in-memory template for clusterctl upgrade tests (#13866)
• KCP: Improve forward etcd leadership (#13848)
• MachineDeployment/util: Stale controller mitigation in reconcile wrapper & MD controller, enable store & fifo informer metrics (#13720)
• Misc: Implement managedFields interning (#13807)
• Misc: Implement new code structure (#13894)
• Release: Prepare main branch for v1.14 development (#13617)

🐛 Bug Fixes

• CAPD: Fix a panic in CAPDev cache.Get() (#13959)
• CAPD: Fix CAPD flakes (#13757)
• CAPD: Fix E2E host port binding lookup (#13627)
• CAPIM: Fix deadlock in in-memory server (#13971)
• CI: Fix verify docker images arch (#13922)
• ClusterClass: Fix Machine taint propagation in the Cluster topology controller for the v1beta1 contract (#13991)
• clusterctl: Detect cert-manager image changes during upgrade (#13850)
• clusterctl: Fix v1beta1 describe output stream (#13893)
• clusterctl: Raise management cluster client QPS and Burst (#13875)
• clusterctl: Reject incomplete GitHub release asset URLs (#13909)
• clusterctl: Skip update check for clusterctl completion (#13653)
• clusterctl: Trim whitespace in --show-conditions filters (#13897)
• Dependency: Fix CVE-2026-39883 (#13571)
• Devtools: Fix Grafana deployment (#13998)
• Devtools: Fix parallel build of binaries in Tiltfile (#13995)
• Devtools: Fix Tilt kube-state-metrics deployment (#13677)
• e2e: Fix ClusterClass rollout test with k8s latest (#13881)
• e2e: Fix PrettyPrint in WaitForControlPlaneToBeReady (#13843)
• e2e: Fix self-hosted test (#13778)
• KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembers (#13717)
• KCP: Fix KCP in-place update with InfraMachine webhooks with immutability validation (#13640)
• KCP: KCP deletion should tolerate missing InfraTemplates (#13558)
• Machine/Bootstrap: Perform draining and volume detachment once until completion (#11590)
• MachineDeployment: Fix nil pointer panic when paused with no matching MachineSet (#13827)
• MachineSet: Delete unhealthy Machines of old MS during in-place updates (#13886)
• MachineSet:...

v1.14.0-rc.0

🚨 This is a RELEASE CANDIDATE. Use it only for testing purposes. If you find any bugs, file an issue.

More details about the release

⚠️ RELEASE CANDIDATE NOTES ⚠️

👌 Kubernetes version support

• Management Cluster: v1.33.x -> v1.36.x
• Workload Cluster: v1.31.x -> v1.36.x

More information about version support can be found here

Highlights

• Cluster API is now using Golang 1.26, CR v0.24, CT v0.21

• Improve the project security posture and increase its capability to deal with CVEs from direct/indirect dependencies

  • Introduced dedicated Golang module for API types (#13762)
    • This new API module ensures consumers of the API types
      • Stronger compatibility guarantees.
      • Considerably smaller and tightly controlled dependency tree, thus reducing exposure to CVEs from dependencies.
  • Formalization of policies and rules for Golang version bump, allowing a better response to Golang CVEs.
  • See also the wider effort about code organization proposal + (#13910).

• Enable safe joining of nodes on older kubernetes versions with kubeadm (#13433)

  • This feature removes a constraint preventing scale up, remediation and autoscaling of worker nodes during cluster rollouts,
    thus allowing future improvements like support for independent worker versions in cluster topology.

• Improved observability on upgrades, Kubernetes version in-use and runtime extensions errors.

  • Surface upgrade plan in cluster status (#13923)
  • Surface aggregated machine versions in status (#13341)
  • Surface Runtime Extension errors in cluster conditions (#13813)

• More work to improve robustness and reliability of controllers

  • Improve forward etcd leadership in KCP, allowing the system to better handle partial failures during control plane machine deletion (#13848)
  • Tolerate missing InfraTemplates during control plane machine deletion, allowing the system to tolerate accidental resource deletion (#13558)
  • Allow KCP remediation of unhealthy machines during intermediate steps of chained upgrades (#13869)
  • KCP is now able to cleanup not started etcd members after a machine is remediated (#13685)
  • Implement stale controller mitigation in all the relevant controllers (#13720, #13737, #13730)
  • Allow remediation of unhealthy Machines managed by old MachineSets during in-place updates (#13886)
  • Perform draining and volume detachment once until completion (#11590)
  • Use regular patch instead of SSA to patch Cluster in topology controller (#13760)

• More work for reducing Cluster API memory footprint and for improving performance at scale

  • Introduce options for cache tuning in ClusterCache clients, use those options to better control memory footprint in core CAPI, CABPK and KCP (#13780, #13820)
  • Implement managedFields interning (#13807)

• Misc:

  • Allow patching of metadata.{labels,annotations} through ClusterClass patches (#13924)
  • Kubernetes version validation now enforces strict semver compatibility (#13874)
  • Several changes to reduce E2E test durations while we keep adding new tests and improving test coverage of the existing ones.
  • Add experimental clusterctl convert command (#12843)

Deprecation Warning

Important:

• The v1beta1 API version in core Cluster API, CABPK and KCP is on track to be unserved in CAPI v1.16. All the consumers of this API version should migrate to v1beta2 ASAP.
  • Utils for the Cluster API v1beta1 condition types (condition helpers, patch helper etc.) will be removed as a next step.
  • All the status.deprecated fields existing in v1beta2 types (used for v1beta1 down conversions) types will be removed as a next step.
• Support for the Cluster API v1beta1 contract versions is on track to be dropped in CAPI v1.16. Provider should start implementing the v1beta2 contract ASAP.

Removal of Docker* API resources will happen in CAPI v1.15. All the consumers of these API resources should migrate to Dev* API resources ASAP.

• NOTE: CAPD is considered a test provider, API deprecation period does not apply

For additional details for providers, please take a look at Cluster API v1.13 compared to v1.14.

Changes since v1.13.0

📈 Overview

• 248 new commits merged
• 4 breaking changes ⚠️
• 28 feature additions ✨
• 24 bugs fixed 🐛

⚠️ Breaking Changes

• CAPD: Mark docker resources as deprecated (#13557)
• Dependency: Bump to controller-runtime v0.24 & controller-tools v0.21 (#13651)
• Machine/MachinePool/MachineSet/MachineDeployment/Cluster: Fix version validation in webhooks (#13874)
• Misc: Fix minor goroutine leak in util/cache after controller shutdown (#13487)

✨ New Features

• API: Introduce separate API module (#13762)
• API: Move OpenAPI schema out of the api package to avoid direct dependency on kube-openapi in the api module (#13825)
• API: Surface aggregated machine versions in status (#13341)
• Bootstrap: Write kubeadm control plane version file for workers to use to fetch the matching kubeadm binary (#13433)
• CAPD: Introduce per-reconciler concurrency flags in CAPDev (#13740)
• CAPD: Migrate ClusterClass changes e2e test from the docker to the in-memory backend (#13764)
• CAPD: Migrate templates to use Dev* instead of Docker* (#13741)
• CI: Remove YEAR from copyright header boilerplate (#13889)
• Cluster: Use regular patch instead of SSA to patch Cluster in topology controller (#13760)
• ClusterCache: Expose and use DefaultTransform on CacheOptions (#13780)
• ClusterCache: Use DefaultTransform in core CAPI, CABPK and KCP (#13820)
• ClusterClass/KCP/MachineSet: Implement stale controller mitigation in KCP / MS / Cluster topology controller (#13737)
• ClusterClass: Allow patching of metadata.{labels,annotations} through ClusterClass patches (#13924)
• clusterctl: Add cluster-api-provider-kubeswift to the built-in infrastructure provider list (#13946)
• clusterctl: Add configuration ExternallyProvisioned for clusterctl (#13739)
• clusterctl: Add experimental clusterctl convert command (#12843)
• Dependency: Bump Go 1.26 (#13623)
• e2e: Migrate ClusterClass rollout e2e test from the docker to the in-memory backend (#13806)
• e2e: Migrate ClusterClass upgrade with different NS e2e test from the docker to the in-memory backend (#13885)
• e2e: Migrate e2e tests from using Docker* resources to Dev* resources (#13647)
• e2e: Migrate test extension to use Dev* instead of Docker* (#13716)
• e2e: Update in-place updating a workload cluster e2e test to use in-memory backend (#13895)
• e2e: Use in-memory template for clusterctl upgrade tests (#13866)
• KCP: Improve forward etcd leadership (#13848)
• MachineDeployment/util: Stale controller mitigation in reconcile wrapper & MD controller, enable store & fifo informer metrics (#13720)
• Misc: Implement managedFields interning (#13807)
• Misc: Implement new code structure (#13894)
• Release: Prepare main branch for v1.14 development (#13617)

🐛 Bug Fixes

• CAPD: Fix a panic in CAPDev cache.Get() (#13959)
• CAPD: Fix CAPD flakes (#13757)
• CAPD: Fix E2E host port binding lookup (#13627)
• CAPIM: Fix deadlock in in-memory server (#13971)
• CI: Fix verify docker images arch (#13922)
• clusterctl: Detect cert-manager image changes during upgrade (#13850)
• clusterctl: Fix v1beta1 describe output stream (#13893)
• clusterctl: Raise management cluster client QPS and Burst (#13875)
• clusterctl: Reject incomplete GitHub release asset URLs (#13909)
• clusterctl: Skip update check for clusterctl completion (#13653)
• clusterctl: Trim whitespace in --show-conditions filters (#13897)
• Dependency: Fix CVE-2026-39883 (#13571)
• Devtools: Fix Tilt kube-state-metrics deployment (#13677)
• e2e: Fix ClusterClass rollout test with k8s latest (#13881)
• e2e: Fix PrettyPrint in WaitForControlPlaneToBeReady (#13843)
• e2e: Fix self-hosted test (#13778)
• KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembers (#13717)
• KCP: Fix KCP in-place update with InfraMachine webhooks with immutability validation (#13640)
• KCP: KCP deletion should tolerate missing InfraTemplates (#13558)
• Machine/Bootstrap: Perform draining and volume detachment once until completion (#11590)
• MachineDeployment: Fix nil pointer panic when paused with no matching MachineSet (#13827)
• MachineSet: Delete unhealthy Machines of old MS during in-place updates (#13886)
• Release: Revert unset GOCACHE env var (#13732)
• Testing: Fix TestHealthCheckTargets flake (#13860)

🌱 Others

• API/Runtime SDK/IPAM/MachinePool/MachineSet/MachineDeployment: Fix typos in generated CRD descriptions (#13641)
• API: Adjust IsMachineDeploymentUpgrading to detect in-place upgrades (#13876)
• API: Follow-ups for Surface aggregated machine versions in status (#13871)
• API: Surface upgrade plan in cluster status (#13923)
• Bootstrap: Limit size of files generated from templates (#13927)
• CABPK: Prevent CABPK to override controlling ownerRef for bootstrap secrets (#13937)
• CABPK: Use ClusterClass with RuntimeSDK in kubeadm join old Node e2e test & fix e2e test failures (#13759)
• CAPD: Add support for controller restart to in-memory backend (#13595)
• CAPD: Only add finalizer after InfraMachine has owner in CAPDev (#13714)
• CAPD: Partially revert fix self-hosted test (#13795)
• CAPD: Refactor CAPDev reconciler (#13702)
• CI: Add cron buckets to prow generator (#13656)
• CI: Add KCP infra adoption test (#13731)
• CI: Add stable BuildKit cache mount...

v1.14.0-beta.1

🚨 This is a BETA RELEASE. Use it only for testing purposes. If you find any bugs, file an issue.

Changes since v1.14.0-beta.0

📈 Overview

• 29 new commits merged
• 3 feature additions ✨
• 2 bugs fixed 🐛

✨ New Features

• ClusterClass: Allow patching of metadata.{labels,annotations} through ClusterClass patches (#13924)
• clusterctl: Add cluster-api-provider-kubeswift to the built-in infrastructure provider list (#13946)
• Misc: Implement new code structure (#13894)

🐛 Bug Fixes

• CI: Fix verify docker images arch (#13922)
• clusterctl: Reject incomplete GitHub release asset URLs (#13909)

🌱 Others

• API: Surface upgrade plan in cluster status (#13923)
• Bootstrap: Limit size of files generated from templates (#13927)
• CABPK: Prevent CABPK to override controlling ownerRef for bootstrap secrets (#13937)
• CI: Add stable BuildKit cache mount IDs (#13930)
• ClusterCache/Misc: Block ExecProvider/AuthProvider in ClusterCache, deprecate remote funcs (#13949)
• clusterctl: Add oxide as an infrastructure provider (#13920)
• clusterctl: Harden clusterctl move (#13928)
• Control-plane: Align scale validator to upstream (#13925)
• Devtools: Bump setup-envtest to v0.24.1 (#13948)
• Devtools: Verify mdbook sha (#13926)
• e2e: Bump autoscaler version used for testing (#13919)
• e2e: Bump Kubernetes version used for testing to v1.37.0-beta.0 (#13912)
• e2e: Rename in-memory e2e test flavor to in-memory-scale (#13936)
• KCP: KCP enforce context deadline on connection stream (#13939)
• Release: Add Code Freeze date field to provider_issues.go to be used for beta communication (#13915)
• Runtime SDK: Add 20 MB read limits for Runtime SDK client & server (#13944)

Dependencies

Added

Nothing has changed.

Changed

• github.com/coredns/corefile-migration: v1.0.33 → v1.0.34
• github.com/go-logr/logr: v1.4.3 → v1.4.4

Removed

Nothing has changed.

More details about the release

⚠️ BETA RELEASE NOTES ⚠️

Changes since v1.13.0

📈 Overview

• 231 new commits merged
• 4 breaking changes ⚠️
• 27 feature additions ✨
• 22 bugs fixed 🐛

⚠️ Breaking Changes

• CAPD: Mark docker resources as deprecated (#13557)
• Dependency: Bump to controller-runtime v0.24 & controller-tools v0.21 (#13651)
• Machine/MachinePool/MachineSet/MachineDeployment/Cluster: Fix version validation in webhooks (#13874)
• Misc: Fix minor goroutine leak in util/cache after controller shutdown (#13487)

✨ New Features

• API: Introduce separate API module (#13762)
• API: Move OpenAPI schema out of the api package to avoid direct dependency on kube-openapi in the api module (#13825)
• API: Surface aggregated machine versions in status (#13341)
• Bootstrap: Write kubeadm control plane version file for workers to use to fetch the matching kubeadm binary (#13433)
• CAPD: Introduce per-reconciler concurrency flags in CAPDev (#13740)
• CAPD: Migrate ClusterClass changes e2e test from the docker to the in-memory backend (#13764)
• CAPD: Migrate templates to use Dev* instead of Docker* (#13741)
• CI: Remove YEAR from copyright header boilerplate (#13889)
• Cluster: Use regular patch instead of SSA to patch Cluster in topology controller (#13760)
• ClusterCache: Expose and use DefaultTransform on CacheOptions (#13780)
• ClusterCache: Use DefaultTransform in core CAPI, CABPK and KCP (#13820)
• ClusterClass/KCP/MachineSet: Implement stale controller mitigation in KCP / MS / Cluster topology controller (#13737)
• ClusterClass: Allow patching of metadata.{labels,annotations} through ClusterClass patches (#13924)
• clusterctl: Add cluster-api-provider-kubeswift to the built-in infrastructure provider list (#13946)
• clusterctl: Add experimental clusterctl convert command (#12843)
• Dependency: Bump Go 1.26 (#13623)
• e2e: Migrate ClusterClass rollout e2e test from the docker to the in-memory backend (#13806)
• e2e: Migrate ClusterClass upgrade with different NS e2e test from the docker to the in-memory backend (#13885)
• e2e: Migrate e2e tests from using Docker* resources to Dev* resources (#13647)
• e2e: Migrate test extension to use Dev* instead of Docker* (#13716)
• e2e: Update in-place updating a workload cluster e2e test to use in-memory backend (#13895)
• e2e: Use in-memory template for clusterctl upgrade tests (#13866)
• KCP: Improve forward etcd leadership (#13848)
• MachineDeployment/util: Stale controller mitigation in reconcile wrapper & MD controller, enable store & fifo informer metrics (#13720)
• Misc: Implement managedFields interning (#13807)
• Misc: Implement new code structure (#13894)
• Release: Prepare main branch for v1.14 development (#13617)

🐛 Bug Fixes

• CAPD: Fix CAPD flakes (#13757)
• CAPD: Fix E2E host port binding lookup (#13627)
• CI: Fix verify docker images arch (#13922)
• clusterctl: Detect cert-manager image changes during upgrade (#13850)
• clusterctl: Fix v1beta1 describe output stream (#13893)
• clusterctl: Raise management cluster client QPS and Burst (#13875)
• clusterctl: Reject incomplete GitHub release asset URLs (#13909)
• clusterctl: Skip update check for clusterctl completion (#13653)
• clusterctl: Trim whitespace in --show-conditions filters (#13897)
• Dependency: Fix CVE-2026-39883 (#13571)
• Devtools: Fix Tilt kube-state-metrics deployment (#13677)
• e2e: Fix ClusterClass rollout test with k8s latest (#13881)
• e2e: Fix PrettyPrint in WaitForControlPlaneToBeReady (#13843)
• e2e: Fix self-hosted test (#13778)
• KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembers (#13717)
• KCP: Fix KCP in-place update with InfraMachine webhooks with immutability validation (#13640)
• KCP: KCP deletion should tolerate missing InfraTemplates (#13558)
• Machine/Bootstrap: Perform draining and volume detachment once until completion (#11590)
• MachineDeployment: Fix nil pointer panic when paused with no matching MachineSet (#13827)
• MachineSet: Delete unhealthy Machines of old MS during in-place updates (#13886)
• Release: Revert unset GOCACHE env var (#13732)
• Testing: Fix TestHealthCheckTargets flake (#13860)

🌱 Others

• API/Runtime SDK/IPAM/MachinePool/MachineSet/MachineDeployment: Fix typos in generated CRD descriptions (#13641)
• API: Adjust IsMachineDeploymentUpgrading to detect in-place upgrades (#13876)
• API: Follow-ups for Surface aggregated machine versions in status (#13871)
• API: Surface upgrade plan in cluster status (#13923)
• Bootstrap: Limit size of files generated from templates (#13927)
• CABPK: Prevent CABPK to override controlling ownerRef for bootstrap secrets (#13937)
• CABPK: Use ClusterClass with RuntimeSDK in kubeadm join old Node e2e test & fix e2e test failures (#13759)
• CAPD: Add support for controller restart to in-memory backend (#13595)
• CAPD: Only add finalizer after InfraMachine has owner in CAPDev (#13714)
• CAPD: Partially revert fix self-hosted test (#13795)
• CAPD: Refactor CAPDev reconciler (#13702)
• CI: Add cron buckets to prow generator (#13656)
• CI: Add KCP infra adoption test (#13731)
• CI: Add stable BuildKit cache mount IDs (#13930)
• CI: Cleanup ./scripts folder (#13896)
• CI: Cleanup golangci-lint excludes (#13891)
• CI: Drop jobs on release-1.11 (#13593)
• CI: Fix link in cloudbuild.yaml's (#13793)
• CI: Fix linter findings in hack/tools (#13814)
• CI: Harden git workflows (#13442)
• CI: Make it possible to exclude CVEs with govulncheck (#13669)
• CI: Migrate from import boss to depguard (#13873)
• CI: Read permissions for pr-verify action (#13687)
• CI: Replace deprecated gaurav-nelson/github-action-markdown-link-check with tcort fork (#13572)
• CI: Revert "Migrate away from custom GitHub action approval workflow" (#13802)
• CI: Stop running make lint-api multiple times in the GitHub action (#13824)
• ClusterCache/Misc: Block ExecProvider/AuthProvider in ClusterCache, deprecate remote funcs (#13949)
• ClusterCache: Cleanup ClusterCache metrics for deleted Clusters (#13660)
• clusterctl/Misc: Avoid building if LDFLAGS returns error checking for SemVer (#13418)
• clusterctl: Add cloudscale-ch-cloudscale provider (#13544)
• clusterctl: Add oxide as an infrastructure provider (#13920)
• clusterctl: Bump cert-manager to v1.20.3 (#13847)
• clusterctl: Bump cert-manager to v1.21.0 (#13900)
• clusterctl: Bump Cert-manager v1.20.2 (#13583)
• clusterctl: Harden clusterctl move (#13928)
• clusterctl: Improve clusterctl describe (#13753)
• clusterctl: Print help on argument validation errors (#13808)
• Control-plane: Add additional test cases for EnsureKubeadmPermissions (#13758)
• Control-plane: Align scale validator to upstream (#13925)
• Control-plane: Remove unused functions in internal/contract (#13826)
• Dependency: 1.26.3 (#13661)
• Dependency: Bump envtest 1.36 (#13657)
• Dependency: Bump go to v1.26.4 (#13788)
• Dependency: Bump Go to v1.26.5 (#13902)
• Dependency: Bump golang/x/net to 0.55.0 (#13744)
• Devtools: Add Headlamp to Tilt dev environment (#13538)
• Devtools: Add log dashboard (#13594)
• Devtools: Bump headlamp CAPI plugin to 0.2.0-beta.0 (#13783)
• Devtools: Bump setup-envtest to v0.24.1 (#13948)
• Devtools: Enable prealloc linter & fix findings (#13711)
• Devtools: Fix gosec lint findings (#13709)
• Devtools: Move scripts under hack/scripts (#13877)
• Devtools: Upgrade tempo & fix configuration (#13727)
• Devtools: Verify mdbook sha (#13926)
• e2e: Add options to runtimesdk e2e test (#13750)
• e2e: Bump autoscaler version used for testing (#13919)
• e2e: Bump Kubernetes version used for testing to v1.37.0...

v1.14.0-beta.0

🚨 This is a BETA RELEASE. Use it only for testing purposes. If you find any bugs, file an issue.

More details about the release

⚠️ BETA RELEASE NOTES ⚠️

Changes since v1.13.0

📈 Overview

• 201 new commits merged
• 4 breaking changes ⚠️
• 24 feature additions ✨
• 20 bugs fixed 🐛

⚠️ Breaking Changes

• CAPD: Mark docker resources as deprecated (#13557)
• Dependency: Bump to controller-runtime v0.24 & controller-tools v0.21 (#13651)
• Machine/MachinePool/MachineSet/MachineDeployment/Cluster: Fix version validation in webhooks (#13874)
• Misc: Fix minor goroutine leak in util/cache after controller shutdown (#13487)

✨ New Features

• API: Introduce separate API module (#13762)
• API: Move OpenAPI schema out of the api package to avoid direct dependency on kube-openapi in the api module (#13825)
• API: Surface aggregated machine versions in status (#13341)
• Bootstrap: Write kubeadm control plane version file for workers to use to fetch the matching kubeadm binary (#13433)
• CAPD: Introduce per-reconciler concurrency flags in CAPDev (#13740)
• CAPD: Migrate ClusterClass changes e2e test from the docker to the in-memory backend (#13764)
• CAPD: Migrate templates to use Dev* instead of Docker* (#13741)
• CI: Remove YEAR from copyright header boilerplate (#13889)
• Cluster: Use regular patch instead of SSA to patch Cluster in topology controller (#13760)
• ClusterCache: Expose and use DefaultTransform on CacheOptions (#13780)
• ClusterCache: Use DefaultTransform in core CAPI, CABPK and KCP (#13820)
• ClusterClass/KCP/MachineSet: Implement stale controller mitigation in KCP / MS / Cluster topology controller (#13737)
• clusterctl: Add experimental clusterctl convert command (#12843)
• Dependency: Bump Go 1.26 (#13623)
• e2e: Migrate ClusterClass rollout e2e test from the docker to the in-memory backend (#13806)
• e2e: Migrate ClusterClass upgrade with different NS e2e test from the docker to the in-memory backend (#13885)
• e2e: Migrate e2e tests from using Docker* resources to Dev* resources (#13647)
• e2e: Migrate test extension to use Dev* instead of Docker* (#13716)
• e2e: Update in-place updating a workload cluster e2e test to use in-memory backend (#13895)
• e2e: Use in-memory template for clusterctl upgrade tests (#13866)
• KCP: Improve forward etcd leadership (#13848)
• MachineDeployment/util: Stale controller mitigation in reconcile wrapper & MD controller, enable store & fifo informer metrics (#13720)
• Misc: Implement managedFields interning (#13807)
• Release: Prepare main branch for v1.14 development (#13617)

🐛 Bug Fixes

• CAPD: Fix CAPD flakes (#13757)
• CAPD: Fix E2E host port binding lookup (#13627)
• clusterctl: Detect cert-manager image changes during upgrade (#13850)
• clusterctl: Fix v1beta1 describe output stream (#13893)
• clusterctl: Raise management cluster client QPS and Burst (#13875)
• clusterctl: Skip update check for clusterctl completion (#13653)
• clusterctl: Trim whitespace in --show-conditions filters (#13897)
• Dependency: Fix CVE-2026-39883 (#13571)
• Devtools: Fix Tilt kube-state-metrics deployment (#13677)
• e2e: Fix ClusterClass rollout test with k8s latest (#13881)
• e2e: Fix PrettyPrint in WaitForControlPlaneToBeReady (#13843)
• e2e: Fix self-hosted test (#13778)
• KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembers (#13717)
• KCP: Fix KCP in-place update with InfraMachine webhooks with immutability validation (#13640)
• KCP: KCP deletion should tolerate missing InfraTemplates (#13558)
• Machine/Bootstrap: Perform draining and volume detachment once until completion (#11590)
• MachineDeployment: Fix nil pointer panic when paused with no matching MachineSet (#13827)
• MachineSet: Delete unhealthy Machines of old MS during in-place updates (#13886)
• Release: Revert unset GOCACHE env var (#13732)
• Testing: Fix TestHealthCheckTargets flake (#13860)

🌱 Others

• API/Runtime SDK/IPAM/MachinePool/MachineSet/MachineDeployment: Fix typos in generated CRD descriptions (#13641)
• API: Adjust IsMachineDeploymentUpgrading to detect in-place upgrades (#13876)
• API: Follow-ups for Surface aggregated machine versions in status (#13871)
• CABPK: Use ClusterClass with RuntimeSDK in kubeadm join old Node e2e test & fix e2e test failures (#13759)
• CAPD: Add support for controller restart to in-memory backend (#13595)
• CAPD: Only add finalizer after InfraMachine has owner in CAPDev (#13714)
• CAPD: Partially revert fix self-hosted test (#13795)
• CAPD: Refactor CAPDev reconciler (#13702)
• CI: Add cron buckets to prow generator (#13656)
• CI: Add KCP infra adoption test (#13731)
• CI: Cleanup ./scripts folder (#13896)
• CI: Cleanup golangci-lint excludes (#13891)
• CI: Drop jobs on release-1.11 (#13593)
• CI: Fix link in cloudbuild.yaml's (#13793)
• CI: Fix linter findings in hack/tools (#13814)
• CI: Harden git workflows (#13442)
• CI: Make it possible to exclude CVEs with govulncheck (#13669)
• CI: Migrate from import boss to depguard (#13873)
• CI: Read permissions for pr-verify action (#13687)
• CI: Replace deprecated gaurav-nelson/github-action-markdown-link-check with tcort fork (#13572)
• CI: Revert "Migrate away from custom GitHub action approval workflow" (#13802)
• CI: Stop running make lint-api multiple times in the GitHub action (#13824)
• ClusterCache: Cleanup ClusterCache metrics for deleted Clusters (#13660)
• clusterctl/Misc: Avoid building if LDFLAGS returns error checking for SemVer (#13418)
• clusterctl: Add cloudscale-ch-cloudscale provider (#13544)
• clusterctl: Bump cert-manager to v1.20.3 (#13847)
• clusterctl: Bump cert-manager to v1.21.0 (#13900)
• clusterctl: Bump Cert-manager v1.20.2 (#13583)
• clusterctl: Improve clusterctl describe (#13753)
• clusterctl: Print help on argument validation errors (#13808)
• Control-plane: Add additional test cases for EnsureKubeadmPermissions (#13758)
• Control-plane: Remove unused functions in internal/contract (#13826)
• Dependency: 1.26.3 (#13661)
• Dependency: Bump envtest 1.36 (#13657)
• Dependency: Bump go to v1.26.4 (#13788)
• Dependency: Bump Go to v1.26.5 (#13902)
• Dependency: Bump golang/x/net to 0.55.0 (#13744)
• Devtools: Add Headlamp to Tilt dev environment (#13538)
• Devtools: Add log dashboard (#13594)
• Devtools: Bump headlamp CAPI plugin to 0.2.0-beta.0 (#13783)
• Devtools: Enable prealloc linter & fix findings (#13711)
• Devtools: Fix gosec lint findings (#13709)
• Devtools: Move scripts under hack/scripts (#13877)
• Devtools: Upgrade tempo & fix configuration (#13727)
• e2e: Add options to runtimesdk e2e test (#13750)
• e2e: Bump to kind main to fix e2e tests (#13767)
• e2e: Bump to kind v0.32.0 (#13781)
• e2e: Cleanup of ControlPlaneKubeletLocalMode handling in KCP adoption test (#13695)
• e2e: Cleanup unused e2e test templates (#13713)
• e2e: Enable opt-out of OwnerReferencesPermissionEnforcement admission controller & opt-out in clusterctl upgrade tests (#13819)
• e2e: Fix E2E chained upgrade (#13618)
• e2e: Give resource versions more time to become stable in e2e tests (#13882)
• e2e: Improve handling of missing kind versions (#13642)
• e2e: Start testing against Kubernetes v1.37 (#13614)
• e2e: Start testing with K8s 1.36.0 (#13611)
• e2e: Start testing with Kubernetes v1.36.0-rc.0 (#13564)
• e2e: Start testing with Kubernetes v1.36.0-rc.1 (#13585)
• e2e: Use only 1 worker machine per MD/MP in RuntimeSDK e2e test (#13872)
• e2e: Use Runtime SDK for kcp-infra-adoption e2e test (#13809)
• KCP: Add kubeadm cluster role (#13664)
• KCP: Allow KCP remediation on chained upgrade intermediate steps (#13869)
• KCP: KCP cleanup etcd members not started after a machine is remediated (#13685)
• KCP: Remove the check on the errors returned by etcd's status response (#13846)
• KCP: Update RemoveEtcdMember to accept a *etcd.Member instead of a member name (#13784)
• Machine: Drop KCP specific logic in Machine reconcileDelete (#13829)
• Machine: Improve machine controller in-place update unit tests (#13682)
• MachineDeployment: Extend stale controller mitigation in MD controller to MS deletion (#13730)
• MachineSet: Cleanup orphaned BoostrapConfigs / InfraMachines in MS controller (#13812)
• Misc: Add finalizer only after we got owner/cluster (#13747)
• Misc: Correct typos in comments and error messages (#13756)
• Misc: Delete unused nolint directives (#13710)
• Misc: Fix static check lint errors (#13708)
• Misc: Improve conversion webhook aliasing (#13828)
• Misc: Replace reflect.Ptr with reflect.Pointer (#13707)
• Misc: Stop setting TypeMeta in typed objects (part II) (#13890)
• Misc: Update Kubernetes bump issue template (#13693)
• Release: Add workaround for generate release notes (#13655)
• Release: Optimize go build in make release-binary (#13499)
• Release: Report consistency errors in release note draft (#13861)
• Runtime SDK: Do not follow redirects when calling runtime extensions (#13763)
• Runtime SDK: Surface Runtime Extension errors in conditions (#13813)
• Security: Updated gitignore (#13799)
• Testing/Documentation/e2e: Improve support for OwnerReferencesPermissionEnforcement admission controller (#13805)
• Testing: Add a test case to confirm that kcp can safely remove a member when it doesn't have a corresponding machine but it has no alarm (#13772)
• Testing: Improve KCP remediation ack signal diagnostics and reset handling (#13736)
• Testing: Make the clusterctl upgrade management cluster control plane count configurable (#13766)
• Testing: Update version matrix for GitHub workflows for release 1.13 (#13578)
• util: Refactor consistency store to allow defer without previous store registration (#13751)
• util: Remove deprecated code (#13749)
• ...

v1.13.4

👌 Kubernetes version support

• Management Cluster: v1.32.x -> v1.36.x
• Workload Cluster: v1.30.x -> v1.36.x

More information about version support can be found here

Changes since v1.13.3

📈 Overview

• 7 new commits merged
• 4 bugs fixed 🐛

🐛 Bug Fixes

• clusterctl: Raise management cluster client QPS and Burst (#13901)
• e2e: Bump kind image in clusterctl v1.10 upgrade test to avoid containerd segv (#13854)
• e2e: Fix PrettyPrint in WaitForControlPlaneToBeReady (#13844)
• MachineSet: Delete unhealthy Machines on old MS during in-place updates (#13888)

🌱 Others

• clusterctl: Bump cert-manager to v1.20.3 (#13851)
• Dependency: Bump Go version to v1.25.12 (#13906)
• Dependency: Bump golang.org/x/crypto version to v0.53.0 (#13864)

Dependencies

Added

Nothing has changed.

Changed

• golang.org/x/crypto: v0.51.0 → v0.53.0
• golang.org/x/mod: v0.35.0 → v0.36.0
• golang.org/x/sync: v0.20.0 → v0.21.0
• golang.org/x/sys: v0.45.0 → v0.46.0
• golang.org/x/telemetry: be6f6cb → 42602be
• golang.org/x/term: v0.43.0 → v0.44.0
• golang.org/x/text: v0.37.0 → v0.38.0
• golang.org/x/tools: v0.44.0 → v0.45.0

Removed

Nothing has changed.

Thanks to all our contributors! 😊

v1.12.10

👌 Kubernetes version support

• Management Cluster: v1.31.x -> v1.36.x
• Workload Cluster: v1.29.x -> v1.36.x

More information about version support can be found here

Changes since v1.12.9

📈 Overview

• 5 new commits merged
• 2 bugs fixed 🐛

🐛 Bug Fixes

• e2e: Bump kind image in clusterctl v1.10 upgrade test to avoid containerd segv (#13855)
• e2e: Fix PrettyPrint in WaitForControlPlaneToBeReady (#13845)

🌱 Others

• clusterctl: Bump cert-manager to v1.20.3 (#13852)
• Dependency: Add CVEs to .trivyignore (#13865)
• Dependency: Bump Go version to v1.25.12 (#13907)

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

Thanks to all our contributors! 😊

v1.14.0-alpha.0

🚨 This is a ALPHA RELEASE. Use it only for testing purposes. If you find any bugs, file an issue.

More details about the release

⚠️ ALPHA RELEASE NOTES ⚠️

More information about version support can be found here

Changes since v1.13.0

📈 Overview

• 153 new commits merged
• 7 breaking changes ⚠️
• 13 feature additions ✨
• 12 bugs fixed 🐛

⚠️ Breaking Changes

• CAPD: Mark docker resources as deprecated (#13557)
• CAPD: Migrate ClusterClass changes e2e test from the docker to the in-memory backend (#13764)
• CAPD: Migrate templates to use Dev* instead of Docker* (#13741)
• Dependency: Bump to controller-runtime v0.24 & controller-tools v0.21 (#13651)
• e2e: Migrate e2e tests from using Docker* resources to Dev* resources (#13647)
• e2e: Migrate test extension to use Dev* instead of Docker* (#13716)
• Misc: Fix minor goroutine leak in util/cache after controller shutdown (#13487)

✨ New Features

• API: Introduce separate API module (#13762)
• API: Move OpenAPI schema out of the api package to avoid direct dependency on kube-openapi in the api module (#13825)
• Bootstrap: Write kubeadm control plane version file for workers to use to fetch the matching kubeadm binary (#13433)
• CAPD: Introduce per-reconciler concurrency flags in CAPDev (#13740)
• Cluster: Use regular patch instead of SSA to patch Cluster in topology controller (#13760)
• ClusterCache: Expose and use DefaultTransform on CacheOptions (#13780)
• ClusterCache: Use DefaultTransform in core CAPI, CABPK and KCP (#13820)
• ClusterClass/KCP/MachineSet: Implement stale controller mitigation in KCP / MS / Cluster topology controller (#13737)
• clusterctl: Add experimental clusterctl convert command (#12843)
• Dependency: Bump Go 1.26 (#13623)
• MachineDeployment/util: Stale controller mitigation in reconcile wrapper & MD controller, enable store & fifo informer metrics (#13720)
• Misc: Implement managedFields interning (#13807)
• Release: Prepare main branch for v1.14 development (#13617)

🐛 Bug Fixes

• CAPD: Fix CAPD flakes (#13757)
• CAPD: Fix E2E host port binding lookup (#13627)
• clusterctl: Skip update check for clusterctl completion (#13653)
• Dependency: Fix CVE-2026-39883 (#13571)
• Devtools: Fix Tilt kube-state-metrics deployment (#13677)
• e2e: Fix self-hosted test (#13778)
• KCP: Fix failing TestKubeadmControlPlaneReconciler_reconcileEtcdMembers (#13717)
• KCP: Fix KCP in-place update with InfraMachine webhooks with immutability validation (#13640)
• KCP: KCP deletion should tolerate missing InfraTemplates (#13558)
• Machine/Bootstrap: Perform draining and volume detachment once until completion (#11590)
• MachineDeployment: Fix nil pointer panic when paused with no matching MachineSet (#13827)
• Release: Revert unset GOCACHE env var (#13732)

🌱 Others

• API/Runtime SDK/IPAM/MachinePool/MachineSet/MachineDeployment: Fix typos in generated CRD descriptions (#13641)
• CABPK: Use ClusterClass with RuntimeSDK in kubeadm join old Node e2e test & fix e2e test failures (#13759)
• CAPD: Add support for controller restart to in-memory backend (#13595)
• CAPD: Only add finalizer after InfraMachine has owner in CAPDev (#13714)
• CAPD: Partially revert fix self-hosted test (#13795)
• CAPD: Refactor CAPDev reconciler (#13702)
• CI: Add cron buckets to prow generator (#13656)
• CI: Add KCP infra adoption test (#13731)
• CI: Drop jobs on release-1.11 (#13593)
• CI: Fix link in cloudbuild.yaml's (#13793)
• CI: Fix linter findings in hack/tools (#13814)
• CI: Harden git workflows (#13442)
• CI: Make it possible to exclude CVEs with govulncheck (#13669)
• CI: Read permissions for pr-verify action (#13687)
• CI: Replace deprecated gaurav-nelson/github-action-markdown-link-check with tcort fork (#13572)
• CI: Revert "Migrate away from custom GitHub action approval workflow" (#13802)
• CI: Stop running make lint-api multiple times in the GitHub action (#13824)
• ClusterCache: Cleanup ClusterCache metrics for deleted Clusters (#13660)
• clusterctl/Misc: Avoid building if LDFLAGS returns error checking for SemVer (#13418)
• clusterctl: Add cloudscale-ch-cloudscale provider (#13544)
• clusterctl: Bump Cert-manager v1.20.2 (#13583)
• clusterctl: Improve clusterctl describe (#13753)
• Control-plane: Add additional test cases for EnsureKubeadmPermissions (#13758)
• Control-plane: Remove unused functions in internal/contract (#13826)
• Dependency: 1.26.3 (#13661)
• Dependency: Bump envtest 1.36 (#13657)
• Dependency: Bump go to v1.26.4 (#13788)
• Dependency: Bump golang/x/net to 0.55.0 (#13744)
• Devtools: Add Headlamp to Tilt dev environment (#13538)
• Devtools: Add log dashboard (#13594)
• Devtools: Bump headlamp CAPI plugin to 0.2.0-beta.0 (#13783)
• Devtools: Fix gosec lint findings (#13709)
• Devtools: Upgrade tempo & fix configuration (#13727)
• e2e: Add options to runtimesdk e2e test (#13750)
• e2e: Bump to kind main to fix e2e tests (#13767)
• e2e: Bump to kind v0.32.0 (#13781)
• e2e: Cleanup of ControlPlaneKubeletLocalMode handling in KCP adoption test (#13695)
• e2e: Cleanup unused e2e test templates (#13713)
• e2e: Enable opt-out of OwnerReferencesPermissionEnforcement admission controller & opt-out in clusterctl upgrade tests (#13819)
• e2e: Fix E2E chained upgrade (#13618)
• e2e: Improve handling of missing kind versions (#13642)
• e2e: Start testing against Kubernetes v1.37 (#13614)
• e2e: Start testing with K8s 1.36.0 (#13611)
• e2e: Start testing with Kubernetes v1.36.0-rc.0 (#13564)
• e2e: Start testing with Kubernetes v1.36.0-rc.1 (#13585)
• e2e: Use Runtime SDK for kcp-infra-adoption e2e test (#13809)
• KCP: Add kubeadm cluster role (#13664)
• KCP: KCP cleanup etcd members not started after a machine is remediated (#13685)
• KCP: Update RemoveEtcdMember to accept a *etcd.Member instead of a member name (#13784)
• Machine: Improve machine controller in-place update unit tests (#13682)
• MachineDeployment: Extend stale controller mitigation in MD controller to MS deletion (#13730)
• MachineSet: Cleanup orphaned BoostrapConfigs / InfraMachines in MS controller (#13812)
• Misc: Add finalizer only after we got owner/cluster (#13747)
• Misc: Correct typos in comments and error messages (#13756)
• Misc: Delete unused nolint directives (#13710)
• Misc: Fix static check lint errors (#13708)
• Misc: Improve conversion webhook aliasing (#13828)
• Misc: Replace reflect.Ptr with reflect.Pointer (#13707)
• Misc: Update Kubernetes bump issue template (#13693)
• Release: Add workaround for generate release notes (#13655)
• Release: Optimize go build in make release-binary (#13499)
• Runtime SDK: Do not follow redirects when calling runtime extensions (#13763)
• Runtime SDK: Surface Runtime Extension errors in conditions (#13813)
• Security: Updated gitignore (#13799)
• Testing/Documentation/e2e: Improve support for OwnerReferencesPermissionEnforcement admission controller (#13805)
• Testing: Add a test case to confirm that kcp can safely remove a member when it doesn't have a corresponding machine but it has no alarm (#13772)
• Testing: Improve KCP remediation ack signal diagnostics and reset handling (#13736)
• Testing: Make the clusterctl upgrade management cluster control plane count configurable (#13766)
• Testing: Update version matrix for GitHub workflows for release 1.13 (#13578)
• util: Refactor consistency store to allow defer without previous store registration (#13751)
• util: Remove deprecated code (#13749)
• util: Switch CRD migrator to use merge patch (#13792)

📖 Additionally, there have been 20 contributions to our documentation and book. (#13419, #13559, #13566, #13568, #13574, #13589, #13592, #13603, #13615, #13620, #13624, #13637, #13645, #13683, #13684, #13696, #13699, #13704, #13718, #13777)

Dependencies

Added

• github.com/clipperhouse/displaywidth: v0.10.0
• github.com/clipperhouse/stringish: v0.1.1
• github.com/clipperhouse/uax29/v2: v2.6.0
• k8s.io/streaming: v0.36.2

Changed

• github.com/alecthomas/units: b94a6e3 → 0f3dac3
• github.com/coredns/corefile-migration: v1.0.31 → v1.0.33
• github.com/coreos/go-oidc: v2.3.0+incompatible → v2.5.0+incompatible
• github.com/coreos/go-systemd/v22: v22.5.0 → v22.7.0
• github.com/godbus/dbus/v5: v5.0.4 → v5.1.0
• github.com/golang-jwt/jwt/v5: v5.2.2 → v5.3.0
• github.com/google/pprof: 294ebfa → 545e8a4
• github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus: v1.0.1 → v1.1.0
• github.com/grpc-ecosystem/go-grpc-middleware/v2: v2.3.0 → v2.3.3
• github.com/mattn/go-runewidth: v0.0.16 → v0.0.19
• github.com/moby/spdystream: v0.5.0 → v0.5.1
• github.com/olekukonko/errors: v1.1.0 → v1.2.0
• github....