v1.37.0-alpha.1

What's Changed

• Support etcd 3.7.0-rc.0 and allow overriding the etcd version in the scalability scenario by @Jefftree in #18458
• Enable misspell in golangci-lint by @ameukam in #17578
• e2e: Filter random AZ selection by instance type availability by @rifelpet in #18463
• azure: Use IMDS attested metadata document for node identity by @hakman in #18163
• gce: fix backend service ownership filtering during delete by @carterpewpew in #18460
• aws: Reconcile target group health check changes on existing target groups by @hakman in #18467
• gce: Reconcile HTTP health check changes on existing health checks by @hakman in #18468
• Improve Google Storage Bucket support. by @cheftako in #18466
• Enable gosec and gocritic by @ameukam in #18470
• Add serathius as scalability test owner by @Jefftree in #18475
• feat(linode): implement SSH key management and associated tasks by @moshevayner in #18383
• Added support for APIServer using LB by @cheftako in #18459
• chore(channels): bump k8s versions in alpha channel by @moshevayner in #18477
• Upgrade Karpenter to v1.13.0 by @hakman in #18479
• scaletest: Report experiment variant into scalability run metadata by @Jefftree in #18476
• channels: Add Kubernetes 1.36.0 support by @hakman in #18480
• gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18484
• e2e: Skip ImageVolume tests on COS 121 by @rifelpet in #18483
• Register Karpenter nodes with karpenter.sh/unregistered taint by @hakman in #18486
• Add missing EC2 read permissions to Karpenter IAM policy by @hakman in #18487
• scaletest: report experiment variant after kubetest2 runs by @Jefftree in #18485
• nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18478
• API only CLI by @cheftako in #18482
• Fixing LB behavior when you have both APIServer and Control Plane. by @cheftako in #18496
• Remove namespace from DO ClusterRole by @rifelpet in #18498
• chore(channels): promote to stable, bump node images, update recommended kOps versions by @hakman in #18501
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #18505
• scaletest: bind etcd metrics to all interfaces by @Jefftree in #18503
• e2e: test the PR's own channels, not master's by @hakman in #18504
• tests/e2e: refine externalTrafficPolicy=Local and hostNetwork skips by @rifelpet in #18509
• Allow setting missing slice elements from the command line by @hakman in #18511
• Add managed Karpenter EC2NodeClass and NodePool by @hakman in #18497
• tests/e2e: skip implement-NodePort ETP=Local test on more CNIs by @rifelpet in #18515
• chore(channels): pin Azure noble image to a deployable version by @hakman in #18516
• Switching from comparison on Role to helper. by @cheftako in #18514
• tests/e2e: also skip implement-NodePort ETP=Local test on calico+GCE by @rifelpet in #18517
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #18518
• Make cloud-controller-manager pods tolerate all taints by @rifelpet in #18510
• Add an experimental roles feature flag. by @cheftako in #18519
• azure: Scope nodes-to-API NSG rules to the NAT gateway public IP by @hakman in #18522
• fix: use JoinHostPost to tolerate IPv6 addresses by @justinsb in #18526
• azure: Bump azuredisk-csi-driver to v1.34.4 by @hakman in #18527
• chore: update syntax of CLAUDE.md by @justinsb in #18532
• azure: Bump azure-cloud-controller-manager to v1.36.2 by @hakman in #18529
• azure: Grant control-plane VMSS Contributor instead of Owner by @hakman in #18533
• coredns: Honor node taints in hostname topologySpreadConstraint by @hakman in #18535
• hetzner: fix Cluster Autoscaler node group membership by @hakman in #18538
• Expose GCP project as PROJECT env for ClusterLoader2 on GCE by @rifelpet in #18537
• tests/e2e: skip implement-NodePort ETP=Local test on calico+Azure by @hakman in #18540
• Update cluster-autoscaler to v1.36.0 by @hakman in #18541
• gce: register all zonal MIGs of a multi-zone instance group with cluster-autoscaler by @hakman in #18543
• Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18546
• pkg/assets: keep container registry clients out of runtime binaries by @hakman in #18554
• clusterapi: fix build by making gen.go a library package by @hakman in #18553
• Support running custom etcd versions by setting version and image by @hakman in #18525
• Default to etcd 3.7.0 for Kubernetes 1.37+ by @Jefftree in #18557
• feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @wkrysmann in #18556
• dump: grant SSH access to Karpenter nodes via EC2 Instance Connect by @hakman in #18563
• etcd-manager: upgrade to v3.0.20260707 by @hakman in #18560
• dns-controller: always apply the addon, empty when unused by @hakman in #18567
• Replace fi.PtrTo with new() builtin by @hakman in #18549
• Build with disable_grpc_modules tag to shrink binaries by @hakman in #18552
• nodeup: reduce binary size by decoupling from cloudup awsup by @hakman in #18571
• nodeup: remove the full Kubernetes API scheme and cloud providers from the binary by @hakman in #18572
• scalability: expose events-etcd metrics endpoint by @Jefftree in #18568
• vfs: use path/filepath in FSPath for Windows compatibility by @hakman in #18576
• Add support for kube-apiserver --strict-transport-security-directives flag by @hakman in #18577
• aws: Add metrics port 9999 to pod-identity-webhook Service by @hakman in #18579
• docs: expand Delve debugging instructions in contributing guide by @hakman in #18580
• kops create cluster: reject explicitly empty --project flag by @hakman in #18575
• aws: Require https scheme for pre-signed STS URLs in V2 tokens by @hakman in #18574
• aws: scope Karpenter controller IAM permissions by @hakman in #18582
• gce: register SSH keys under the "ubuntu" user for Ubuntu images by @hakman in #18581
• chore(deps): bump linodego to v2 by @moshevayner in #18584
• gce: allow TCP metrics ports in GCE firewall by @Qqkyu in #18545
• Release 1.37.0-alpha.1 by @hakman in #18596

New Contributors

• @carterpewpew made their first contribution in #18460
• @cheftako made their first contribution in #18466
• @wkrysmann made their first contribution in #18556
• @Qqkyu made their first contribution in #18545

Full Changelog: v1.36.0-beta.1...v1.37.0-alpha.1

v1.36.0

See the full kOps 1.36 release notes for details, including breaking changes and deprecations.

Highlights

• Kubernetes 1.36 support and completion of the move away from the in-tree cloud providers
• Reworked addon management: kops-channels now runs as a static pod on control-plane nodes; the standalone channels binary is no longer distributed
• Hybrid bootstrap for gossip clusters: workers bootstrap directly against the API load balancer, easing migration off gossip DNS, which is deprecated
• Karpenter refresh: Karpenter v1.13.0 with kOps-managed EC2NodeClass and NodePool objects per instance group
• etcd-manager improvements: recovery of members with replaced data disks, membership changes resilient to unreachable members, a distroless image, and faster single-member cluster startup
• Expanded Azure support: cloud-controller-manager, Azure Disk CSI driver, and experimental Terraform target
• Hetzner Cluster Autoscaler support and groundwork for Linode (Akamai) as a new cloud provider
• Component updates: containerd v2.2.4, etcd-manager v3.0.20260707 with etcd 3.5.31/3.6.12, AWS Load Balancer Controller v3.3.0, Cilium tunables, CoreDNS v1.14.2, cluster-autoscaler v1.36.0
• Removed: support for Kubernetes 1.30, etcd 3.4, Amazon Linux 2, Ubuntu 20.04, and Debian 10

What's Changed

• Automated cherry pick of #18467: aws: Reconcile target group health check changes on existing target groups by @hakman in #18469
• Automated cherry pick of #18484: gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18488
• Automated cherry pick of #18478: nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18492
• Automated cherry pick of #18498: Remove namespace from DO ClusterRole by @rifelpet in #18499
• Automated cherry pick of #18511: Allow setting missing slice elements from the command line by @hakman in #18512
• Automated cherry pick of ##18479: Upgrade Karpenter to v1.13.0
  ##18486: Register Karpenter nodes with karpenter.sh/unregistered taint
  ##18487: Add missing EC2 read permissions to Karpenter IAM policy
  ##18497: Add managed Karpenter EC2NodeClass and NodePool by @hakman in #18513
• Automated cherry pick of #18522: azure: Scope nodes-to-API NSG rules to the NAT gateway public IP by @hakman in #18523
• Automated cherry pick of #18527: azure: Bump azuredisk-csi-driver to v1.34.4 by @hakman in #18528
• Automated cherry pick of #18529: azure: Bump azure-cloud-controller-manager to v1.36.2 by @hakman in #18531
• Automated cherry pick of #18533: azure: Grant control-plane VMSS Contributor instead of Owner by @hakman in #18534
• Automated cherry pick of #18535: coredns: Honor node taints in hostname topologySpreadConstraint by @hakman in #18536
• Automated cherry pick of #18538: hetzner: fix Cluster Autoscaler node group membership by @hakman in #18539
• Automated cherry pick of #18541: Update cluster-autoscaler to v1.36.0 by @hakman in #18542
• Automated cherry pick of #18543: gce: register all zonal MIGs of a multi-zone instance group with cluster-autoscaler by @hakman in #18544
• Automated cherry pick of #18546: Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18547
• Cherry pick of #18560: etcd-manager: upgrade to v3.0.20260707 by @hakman in #18561
• Automated cherry pick of #18556: feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @hakman in #18558
• Cherry pick of #18549: Replace fi.PtrTo with new() builtin by @hakman in #18551
• Automated cherry pick of #18567: dns-controller: always apply the addon, empty when unused by @hakman in #18573
• Release 1.36.0 by @hakman in #18591

Full Changelog: v1.36.0-beta.1...v1.36.0

v1.35.2

What's Changed

• Automated cherry pick of #18428: cert-manager: upgrade to v1.19.5 and set AWS_REGION for Route53 dns-01 by @hakman in #18429
• Cherry pick of #18436: upgrade etcd-manager and etcd to latest patches by @hakman in #18437
• Automated cherry pick of #17968: Enable nf_conntrack kernel module on Rocky 9
  #18179: Load nf_tables module and install iptables-nft on RHEL10+ by @rifelpet in #18444
• backport: Update Cluster Autoscaler RBAC by @hakman in #18445
• Automated cherry pick of #18452: Calico: add NFTablesMode setting by @rifelpet in #18454
• cilium: mount the host's /etc/hosts on gossip clusters by @hakman in #18465
• Automated cherry pick of #18484: gce: emit kops.k8s.io/instancegroup node label by @rifelpet in #18489
• Automated cherry pick of #18478: nodeup: load ip_set module and disable firewalld on RHEL10 by @rifelpet in #18494
• Automated cherry pick of #18498: Remove namespace from DO ClusterRole by @rifelpet in #18500
• Automated cherry pick of #18546: Update Go to 1.26.5 and bump golang.org/x modules by @hakman in #18548
• Automated cherry pick of #18450: etcd-manager: switch to go-runner-based distroless image by @hakman in #18555
• Cherry pick of #18560: etcd-manager: upgrade to v3.0.20260707 by @hakman in #18562
• Automated cherry pick of #18556: feat(api): add storageInitializationTimeout to KubeAPIServerConfig by @hakman in #18559
• Cherry pick of #18549: Replace fi.PtrTo with new() builtin by @hakman in #18550
• Release 1.35.2 by @hakman in #18593

Full Changelog: v1.35.1...v1.35.2

v1.36.0-beta.1

What's Changed

• scaletest: decouple client HTTP traffic for etcd events by @Jefftree in #18415
• Release notes for 1.36 (alpha) by @hakman in #18414
• chore: Add hashes for additional May releases by @hakman in #18418
• Add logs at v2 level to ensure we have slow pods data in logs by @hakuna-matatah in #18420
• chore: upgrade containerd to v2.3.1 by @hakman in #18422
• Upgrade kube-router to v2.10.0 by @rifelpet in #18421
• aws: pin LBC selectors to fix in-place upgrades by @hakman in #18426
• cert-manager: upgrade to v1.19.5 and set AWS_REGION for Route53 dns-01 by @hakman in #18428
• etcd: add ListenClientHTTPURLs field to EtcdManagerSpec by @Jefftree in #18416
• Default omitted authorization to RBAC instead of AlwaysAllow by @hakman in #18431
• cilium: allow disabling masquerade in ENI IPAM mode by @hakman in #18432
• channels: surface addon apply failures via a readiness probe by @hakman in #18433
• etcd-manager: upgrade etcd-manager and etcd to latest patches by @hakman in #18436
• chore: downgrade containerd to v2.2.4 by @hakman in #18447
• test: avoid kubeconfig access in golden tests by @hakman in #18448
• scaletest: Build only linux/amd64 in kubernetes scalability presubmits by @Jefftree in #18446
• scaletest: Allow feature gates to be set in scalability tests by @Jefftree in #18449
• feat: add gVisor RuntimeClass support for containerd by @ameukam in #18406
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #18451
• Calico: add NFTablesMode setting by @rifelpet in #18452
• etcd-manager: switch to go-runner-based distroless image by @hakman in #18450
• kube-proxy: assert buildPod command in unit test by @hakman in #18455
• gVisor: add HasGVisor() helper function by @hakman in #18456
• dump: add --node-dump-timeout flag for per-node dump timeout by @Jefftree in #18443
• scaltest: Default node dump timeout to 5m in scalability run-test.sh by @Jefftree in #18457
• Release 1.36.0-beta.1 by @hakman in #18464

Full Changelog: v1.36.0-alpha.1...v1.36.0-beta.1

v1.35.1

What's Changed

• Automated cherry pick of #17740: Fix HasHighlyAvailableControlPlane to use AllInstanceGroups by @hakman in #18117
• Automated cherry pick of #18113: Add excludedInstanceTypes to instanceRequirements by @hakman in #18119
• Automated cherry pick of #18123: Fix instanceRequirements memory assignment bug by @hakman in #18124
• Automated cherry pick of #17999: aws: Bypass LBC webhook for cert-manager by @rifelpet in #18125
• Automated cherry pick of #18126: Add --use-kubeconfig to kops reconcile cluster by @hakman in #18127
• Automated cherry pick of #18128: vfs: Silence warnings when the S3 provider has no supported by @hakman in #18130
• Automated cherry pick of #18114: Pin upload-artifacts GHA to commit sha by @rifelpet in #18208
• Automated cherry pick of #18173: Update Golang to 1.25.9 by @hakman in #18205
• Automated cherry pick of #18110: Update Cluster Autoscaler to 1.35.0 by @hakman in #18217
• Automated cherry pick of #18237: cilium: require k8s-connectivity in liveness probe by @hakman in #18242
• aws: bypass LBC mservice webhook for kube-system by @hakman in #18248
• Automated cherry pick of #18251: aws: skip node S3 permissions when kops-controller serves node config by @hakman in #18253
• Cherrypick VPC CNI fixes to 1.35 by @rifelpet in #18268
• Cherrypick GCE resource dump fixes to 1.35 by @rifelpet in #18282
• Automated cherry pick of #18285: cilium: allow setting arbitrary cilium-config entries by @hakman in #18286
• Automated cherry pick of #18281: hetzner: Upgrade hcloud-cloud-controller-manager to v1.30.1 by @hakman in #18283
• Automated cherry pick of #18298: dns-controller: make priorityClassName configurable by @hakman in #18299
• Automated cherry pick of #18232: Initial support for Ubuntu 26.04 by @rifelpet in #18306
• Automated cherry pick of #18302: dns-controller: default Provider when ExternalDNS is partially set by @hakman in #18303
• Automated cherry pick of #18307: gce: expose kops-controller on internal LB for gossip clusters by @hakman in #18308
• Automated cherry pick of #18260: azure: encode storage account in azureblob:// URLs by @hakman in #18320
• Automated cherry pick of #18319: azure: list VMSS NICs in protokube gossip seed discovery by @hakman in #18321
• Automated cherry pick of #18323: etcd-manager: upgrade to v3.0.20260512 by @hakman in #18324
• Cherrypick GCE instance handling fixes to 1.35 by @rifelpet in #18327
• etcd-manager: bump etcd to latest patches (3.5.30, 3.6.11) by @yuzhouliu9 in #18333
• Automated cherry pick of #18375: cilium: add flags for bpf-lb-sock and bpf-lb-sock-hostns-only by @hakman in #18376
• Automated cherry pick of #18379: kops-controller and nodeup bug fixes by @rifelpet in #18380
• Automated cherry pick of #18384: Fix kops get assets when spec.dnsZone is a DNS name by @hakman in #18386
• Automated cherry pick of #18144: Move johngmyers to emeritus by @hakman in #18388
• Automated cherry pick of #18391: Validate instance group names in kops-controller by @rifelpet in #18392
• Upgrade Go to 1.26.3 for release-1.35 by @hakman in #18396
• Update dependencies for release-1.35 by @hakman in #18399
• Automated cherry pick of #18401: gomod: tidy and verify all modules by @hakman in #18404
• Automated cherry pick of #18403: build: use gcr.io/distroless/static as base image by @hakman in #18417
• Automated cherry pick of #18418: chore: Add hashes for additional May releases by @hakman in #18419
• Automated cherry pick of #18364: chore: upgrade containerd to v2.3.0
  #18422: chore: upgrade containerd to v2.3.1 by @hakman in #18423
• Release 1.35.1 by @hakman in #18425

Full Changelog: v1.35.0...v1.35.1

v1.36.0-alpha.1

What's Changed

• Remove support for Amazon Linux 2 by @rifelpet in #17898
• Update distribution matrix for Amazon Linux 2 by @rifelpet in #17943
• metal: Unpin K8s version by @hakman in #17944
• Create iproute2 symlink for kuberouter on older distros by @rifelpet in #17945
• chore(channels): update alpha k8s versions with February releases by @moshevayner in #17948
• versionbump: go 1.25.7 by @justinsb in #17956
• Feature: pull user defined images for warm pool instances by @dezmodue in #17861
• Fix creation of discovery and state store buckets by @rifelpet in #17961
• Migrate more scenario scripts to --test=exec by @rifelpet in #17962
• Migrate e2e template AMIs to SSM params by @rifelpet in #17964
• LBC Scenario - Pass region to AWS CLI by @rifelpet in #17965
• Set kubeconfig for LBC test suite by @rifelpet in #17967
• Enable nf_conntrack kernel module on Rocky 9 by @rifelpet in #17968
• Remove DISCOVERY_STORE handling by @rifelpet in #17969
• kube-router: bump version v2.5.0 -> 2.7.1 by @aauren in #17966
• chore: Add asset hashes for February 2026 releases by @hakman in #17980
• Remove reference to unbound variable by @rifelpet in #17985
• Use golang-based tool for AWS instances availability by @ameukam in #17953
• drop cdn.dl.k8s.io as a mirror by @upodroid in #17976
• drop storage.googleapis.com/k8s-artifacts-cni as a mirror by @hakman in #17987
• tests/ai-conformance: don't panic if no zones for AWS by @justinsb in #17994
• Scenario Fixes by @rifelpet in #17997
• Use a deterministic bucket name in prow jobs by @rifelpet in #17998
• Make region selection determistic from BUILD_ID by @rifelpet in #18000
• Addon Scenario - Remove old feature flag by @rifelpet in #17963
• aws: Bypass LBC webhook for cert-manager by @hakman in #17999
• Bump actions/dependency-review-action from 4.8.2 to 4.8.3 by @dependabot[bot] in #18002
• tests/ai-conformance: fix syntax for enabling gatewayAPI with cilium by @justinsb in #17992
• tests/ai-conformance: fix syntax for enabling nvidia GPU in containerd by @justinsb in #18001
• Consolidate support for ENI-based CNIs by @rifelpet in #17940
• tests/ai-conformance: use nvidia GPU operator by @justinsb in #18005
• tests/ai-conformance: create cluster with some non-GPU nodes by @justinsb in #18006
• tests/ai-conformance: update test job for DRA v1 by @justinsb in #18008
• tests/ai-conformance: use server-side-apply for KubeRay Operator by @justinsb in #18007
• fix: avoid panic if subnet ID is nil by @justinsb in #18010
• tests/ai-conformance: create first tests for AI Conformance by @justinsb in #18009
• gce: don't request migration on instance types that don't support it by @justinsb in #18004
• gce: Wait to delete InstanceManagers and InstanceTemplates by @Camila-B in #18013
• Bump release tools for E2E tests by @ameukam in #18017
• Add warning for non-production use in README by @ritazh in #17952
• Keep skipping certain tests on older cilium versions by @rifelpet in #18019
• chore: Add hashes for additional February releases by @hakman in #18021
• chore: Bump alpha channels with additional February releases by @hakman in #18020
• chore: Bump etcd-manager to v3.0.20260227 by @hakman in #18026
• build(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #18029
• build(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by @dependabot[bot] in #18030
• chore(channels): promote alpha to stable by @moshevayner in #18033
• feat: Use wellknownports for etcd and add cilium etcd ports by @apeabody in #18035
• tests/ai-conformance: Install prometheus for metrics by @ameukam in #18018
• build(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @dependabot[bot] in #18042
• Fix node bootstrap challenge response hashing by @rifelpet in #18043
• Add addons node to scalability tests by @serathius in #18036
• test: Skip dumping not found nodes for GCE by @hakman in #18049
• allow pods to reach metric ports running on control plane nodes when using gce alias ip by @upodroid in #18052
• [aiconformance] Add test for gang scheduling with kueue by @justinsb in #18053
• chore: Bump Go to v1.25.8 by @hakman in #18058
• [aiconformance] Add tests for security / isolation by @justinsb in #18055
• scaletest: Move Prometheus to addon nodes by @serathius in #18048
• [aiconformance]: Add robust_controller test using KubeRay by @justinsb in #18056
• scaletest: Use sleep instead of wait for large clusters by @serathius in #18065
• [aiconformance]: Enable Cluster Autoscaler for GPU Nodes by @ameukam in #18066
• scaletest: Increase scalability tests log verbosity to 3 by @serathius in #18069
• [aiconformance]: Enable Metrics Server by @ameukam in #18067
• fix: don't panic when dumping nodes if we didn't capture cloud resources by @justinsb in #18072
• [aiconformance]: Validate networking/ai_inference requirements by @justinsb in #18063
• [aiconformance]: Add accelerator metrics validator test by @justinsb in #18064
• [aiconformance]: observability/ai_service_metrics by @justinsb in #18071
• [aiconformance]: Add K8s wrapper for DaemonSet object by @ameukam in #18073
• [aiconformance]: Add driver_runtime_management validator by @ameukam in #18074
• [aiconformance]: unify output under tests/ directory by @justinsb in #18076
• [aiconformance]: render markdown to HTML by @justinsb in #18077
• scaletest: Align kops scalability configuration with kube-up for kube-apiserver deleteCollectionsWorkers and MaxRequestInflight by @ronaldngounou in #18081
• [aiconformance]: Write conformance report to file by @justinsb in #18084
• [aiconformance]: Unify how we write test artifacts by @justinsb in #18087
• scaletest: Align kops scalability configuration with kube-up for kubeapisever CompactionInterval by @ronaldngounou in #18086
• Refactor interface type check to more idiomatic syntax by @rramkumar1 in #17951
• scaletest: Align kops scalability configuration with kube-up for kubelet kubeAPIQPS by @ronaldngounou in #18085
• Move VFS acls framework closer to VFS implementation code by @rramkumar1 in #17949
• Fix existing VPCs/Subnets with IPv6 by @rlees85 in #18089
• [aiconformance]: test for schedulingOrchestration pod autoscaling by @justinsb in #18075
• Enable E2E external CSI testing on GCP by @rifelpet in #18098
• [aiconformance] add test for schedulingOrchestration clusterAutoscaling by @justinsb in #18100
• Replace cwd with go:embed for storage.testdriver manifests by @rifelpet in #18102
• chore(channels): bump alpha channel k8s and ubuntu AMI versions by @moshevayner in #18103
• [aiconformance]: set namespace explicitly for testdata by @ameukam in https://github.com/kubernetes/kops/pu...

v1.34.3

What's Changed

• Automated cherry pick of #17740: Fix HasHighlyAvailableControlPlane to use AllInstanceGroups by @hakman in #18118
• Automated cherry pick of #18114: Pin upload-artifacts GHA to commit sha by @rifelpet in #18209
• Automated cherry pick of #18173: Update Golang to 1.25.9 by @hakman in #18206
• Automated cherry pick of #17877: truncate very long sqs queue names
  #17885: fix truncate long sqs by @hakman in #18216
• Automated cherry pick of #18110: Update Cluster Autoscaler to 1.35.0 by @hakman in #18218
• Automated cherry pick of #18237: cilium: require k8s-connectivity in liveness probe by @hakman in #18243
• aws: bypass LBC mservice webhook for kube-system by @hakman in #18249
• Automated cherry pick of #18251: aws: skip node S3 permissions when kops-controller serves node config by @hakman in #18254
• Automated cherry pick of #18268: Cherrypick VPC CNI fixes by @rifelpet in #18269
• Automated cherry pick of #18285: cilium: allow setting arbitrary cilium-config entries by @hakman in #18287
• Automated cherry pick of #18281: hetzner: Upgrade hcloud-cloud-controller-manager to v1.30.1 by @hakman in #18284
• Automated cherry pick of #18298: dns-controller: make priorityClassName configurable by @hakman in #18300
• Automated cherry pick of #18302: dns-controller: default Provider when ExternalDNS is partially set by @hakman in #18304
• Automated cherry pick of #18307: gce: expose kops-controller on internal LB for gossip clusters by @hakman in #18309
• Automated cherry pick of #18319: azure: list VMSS NICs in protokube gossip seed discovery by @hakman in #18322
• Automated cherry pick of #18323: etcd-manager: upgrade to v3.0.20260512 by @hakman in #18325
• etcd-manager: bump etcd to latest patches (3.5.30, 3.6.11) by @yuzhouliu9 in #18332
• Automated cherry pick of #18375: cilium: add flags for bpf-lb-sock and bpf-lb-sock-hostns-only by @hakman in #18377
• Automated cherry pick of #18379: kops-controller and nodeup bug fixes by @rifelpet in #18381
• Automated cherry pick of #18384: Fix kops get assets when spec.dnsZone is a DNS name by @hakman in #18387
• Automated cherry pick of #18144: Move johngmyers to emeritus by @hakman in #18389
• Automated cherry pick of #18391: Validate instance group names in kops-controller by @rifelpet in #18393
• Upgrade Go to 1.26.3 for release-1.34 by @hakman in #18397
• Update dependencies for release-1.34 by @hakman in #18400
• Automated cherry pick of #18401: gomod: tidy and verify all modules by @hakman in #18405
• Release 1.34.3 by @hakman in #18412

Full Changelog: v1.34.2...v1.34.3

v1.35.0

What's Changed

• Automated cherry pick of #17945: Create iproute2 symlink for kuberouter on older distros by @rifelpet in #17946
• Automated cherry pick of #17956: versionbump: go 1.25.7 by @hakman in #17957
• Automated cherry pick of #17861: Feature: pull user defined images for warm pool instances by @hakman in #17959
• Automated cherry pick of #17980: chore: Add asset hashes for February 2026 releases by @hakman in #17981
• Automated cherry pick of #17966: kube-router: bump version v2.5.0 -> 2.7.1 by @hakman in #17979
• Automated cherry pick of #17976: drop cdn.dl.k8s.io as a mirror
  #17987: drop storage.googleapis.com/k8s-artifacts-cni as a mirror by @hakman in #17988
• Automated cherry pick of #18021: chore: Add hashes for additional February releases by @hakman in #18022
• Automated cherry pick of #18026: chore: Bump etcd-manager to v3.0.20260227 by @hakman in #18027
• Automated cherry pick of #18043: Fix node bootstrap challenge response hashing by @rifelpet in #18044
• Automated cherry pick of #18058: chore: Bump Go to v1.25.8 by @hakman in #18059
• Release 1.35.0 by @hakman in #18090

Full Changelog: v1.35.0-beta.1...v1.35.0

v1.34.2

What's Changed

• Automated cherry pick of #17755: Include maxParallelImagePulls field in Kubelet config by @hakman in #17772
• Automated cherry pick of #17773: aws: Tag Launch Template network interfaces by @hakman in #17774
• Automated cherry pick of #17776: aws: Enable CloudWatch metrics for the warm pool of an ASG by @recollir in #17778
• Automated cherry pick of #17783: chore(upup): bump aws-cni to 1.20.5 by @moshevayner in #17786
• Automated cherry pick of #17792: aws: Disable the kubelet systemd unit during warm pool warming by @dezmodue in #17801
• Automated cherry pick of #17800: aws: Allow warm pool with mixed instances policy by @kimxogus in #17803
• gcp: cherrypick ccm upgrade to release 1.34 by @upodroid in #17794
• Automated cherry pick of #17812: etcd-manager: Update etcd versions by @hakman in #17813
• Automated cherry pick of #17712: gce: bump GCE PD CSI Driver by @upodroid in #17835
• Automated cherry pick of #17899: Update Cilium to v1.18.6 by @hakman in #17900
• Automated cherry pick of #17689: Migrate Kindnet to Kubernetes prod registry by @rifelpet in #17903
• Automated cherry pick of #17854: Add iam:ListInstanceProfiles permission to Karpenter by @hakman in #17905
• Cherry-pick #17879: bump golang to 1.25.6 by @justinsb in #17906
• deps: bump containerd to v1.7.29 to address vulnerabilities by @justinsb in #17907
• Automated cherry pick of #17917: hetzner: Update default server type to cx23 by @hakman in #17918
• Automated cherry pick of #17867: Use a different systemd-networkd configuration for AL2023
  #17882: Disable cloud-init network hotplug on Ubuntu 24.04 for Cilium and Ama…
  #17933: Set MACAddressPolicy=none for AWS VPC CNI on AL2023 by @rifelpet in #17935
• Automated cherry pick of #17945: Create iproute2 symlink for kuberouter on older distros by @rifelpet in #17947
• Automated cherry pick of #17956: versionbump: go 1.25.7 by @hakman in #17958
• Automated cherry pick of #17861: Feature: pull user defined images for warm pool instances by @hakman in #17960
• chore: Back-port pulling CNI plugins from GitHub by @hakman in #17970
• Automated cherry pick of #17980: chore: Add asset hashes for February 2026 releases by @hakman in #17982
• Automated cherry pick of #17976: drop cdn.dl.k8s.io as a mirror
  #17987: drop storage.googleapis.com/k8s-artifacts-cni as a mirror by @hakman in #17989
• Automated cherry pick of #18021: chore: Add hashes for additional February releases by @hakman in #18023
• Automated cherry pick of #18026: chore: Bump etcd-manager to v3.0.20260227 by @hakman in #18028
• Automated cherry pick of #18043: Fix node bootstrap challenge response hashing by @rifelpet in #18045
• Automated cherry pick of #18058: chore: Bump Go to v1.25.8 by @hakman in #18060
• Release 1.34.2 by @hakman in #18091

Full Changelog: v1.34.1...v1.34.2

v1.33.2

What's Changed

• Automated cherry pick of #17722: scaleway: Fix failing terraform test by @hakman in #17724
• Automated cherry pick of #17559: Bump ko-build by @hakman in #17729
• Update Go to 1.24.7 and some deps by @hakman in #17730
• Automated cherry pick of #17640: Update cluster-autoscaler to v1.34.0 releases
  #17725: Update cluster-autoscaler to v1.34.1 by @hakman in #17727
• Automated cherry pick of #17776: aws: Enable CloudWatch metrics for the warm pool of an ASG by @recollir in #17779
• Automated cherry pick of #17792: aws: Disable the kubelet systemd unit during warm pool warming by @dezmodue in #17802
• Automated cherry pick of #17793: gcp: Update ccm to fix broken arm64 jobs by @upodroid in #17814
• Automated cherry pick of #17712: gce: bump GCE PD CSI Driver by @upodroid in #17836
• Automated cherry pick of #17144: Normalize the hardcoded images used for warmpool pre-pulling
  #17861: Feature: pull user defined images for warm pool instances by @hakman in #17977
• chore: Back-port pulling CNI plugins from GitHub by @hakman in #17971
• Automated cherry pick of #17980: chore: Add asset hashes for February 2026 releases by @hakman in #17983
• Automated cherry pick of #17976: drop cdn.dl.k8s.io as a mirror
  #17987: drop storage.googleapis.com/k8s-artifacts-cni as a mirror by @hakman in #17990
• Automated cherry pick of #17956: versionbump: go 1.25.7 by @hakman in #17995
• Automated cherry pick of #18021: chore: Add hashes for additional February releases by @hakman in #18024
• Automated cherry pick of #18043: Fix node bootstrap challenge response hashing by @rifelpet in #18046
• Automated cherry pick of #18058: chore: Bump Go to v1.25.8 by @hakman in #18061
• Release 1.33.2 by @hakman in #18092

Full Changelog: v1.33.1...v1.33.2