Skip to content

Release notes for kOps 1.37 series

⚠ kOps 1.37 has not been released yet! ⚠

This is a document to gather the release notes prior to the release.

Significant changes

  • Support for AWS Classic Load Balancer (CLB) for the API, deprecated since kOps 1.26, has been removed. See the breaking changes section below for the required actions.

  • On AWS, the new spec.cloudProvider.aws.useIPBasedNodeNames field (spec.cloudConfig.useIPBasedNodeNames in the v1alpha2 API) names Kubernetes nodes after the EC2 private DNS name (e.g. ip-10-0-0-1.eu-west-1.compute.internal) instead of the EC2 instance ID, restoring the naming used before kOps 1.24. Only newly launched nodes are affected; roll the cluster to rename existing nodes.

Removal of gossip DNS

Support for gossip DNS, deprecated since kOps 1.29, has been removed. New gossip clusters will be rejected, and existing clusters will need to migrate before they can be upgraded. This affects clusters whose name ends in .k8s.local and that were not created with --dns=none; clusters using --dns=none, even with a .k8s.local name, are not affected.

Migrate to --dns=none or a hosted DNS zone using kOps 1.36 before upgrading; kOps 1.36 introduced hybrid bootstrap to make that migration easier. See the gossip documentation for the migration steps.

As part of this removal, the protokube component, whose only remaining responsibility was gossip DNS, is no longer built, shipped, or run on nodes. The gossipConfig and dnsControllerGossipConfig cluster spec fields are deprecated, no longer have any effect, and must be removed from cluster specs.

Other changes of note

  • On DigitalOcean, Hetzner, and Scaleway, control-plane user data no longer includes cloud API credentials. Components that still require them receive them through manifests generated by kops update cluster. If an additionalUserData script or spec.hooks unit relied on these variables, set them in the script or unit itself.

  • On AWS, when spec.iam.useServiceAccountExternalPermissions is enabled, the control-plane instance role no longer includes Route 53 permissions. Grant affected workloads access through spec.additionalPolicies or a service account IAM role.

  • On AWS, the ec2:ModifyInstanceAttribute permission granted to nodes for kube-router and kindnet is now limited to instances tagged as belonging to the cluster.

  • On AWS, ec2:DescribeInstanceTypes is no longer granted unconditionally to every instance role. Instance roles receive the permission when Nvidia GPU support or Cilium ENI IPAM is enabled, and clusters using the AWS VPC CNI keep it as part of the CNI permissions. The cluster autoscaler permissions also omit it when spec.clusterAutoscaler.awsUseStaticInstanceList is enabled.

  • On AWS, ec2:DescribeRegions is no longer granted for etcd-manager, which reads the region from the instance metadata service instead of calling the EC2 API.

  • On AWS, instance roles that require no permissions, such as the bastion role and the default worker node role, no longer have an inline IAM policy. kops update cluster deletes the previously created inline policy from such roles. With the Terraform target, the corresponding aws_iam_role_policy resources are removed from the configuration and destroyed on the next apply.

  • Private cluster asset repositories now support AWS s3:// URLs in addition to existing GCE gs:// URLs, both for KOPS_BASE_URL (nodeup download) and spec.assets.fileRepository. Nodes authenticate with their instance credentials; see the asset repository documentation for the required permissions. The AWS nodeup download requires node images with curl 8.0 or newer.

  • Private cluster asset repositories now also support Azure azureblob://<account>/<container>/<prefix> URLs, both for KOPS_BASE_URL (nodeup download) and spec.assets.fileRepository. Nodes authenticate with their system-assigned managed identity, which has to be granted the Storage Blob Data Reader role on the assets container; see the asset repository documentation for the details and warnings.

Breaking changes

  • Support for AWS Classic Load Balancer (CLB) for the API has been removed. Clusters with spec.api.loadBalancer.class: Classic (or with no explicit class, which previously defaulted to Classic) fail validation, and the long-deprecated kops create cluster --api-loadbalancer-class flag has been removed. Existing clusters using a CLB must migrate to a Network Load Balancer (NLB) using kOps 1.36 or earlier before upgrading to kOps 1.37, following the CLB to NLB migration guide. Attaching instance groups to externally-managed Classic Load Balancers via spec.externalLoadBalancers[].loadBalancerName remains supported.
  • Support for gossip DNS was removed. Existing gossip clusters must migrate to --dns=none or a hosted DNS zone using kOps 1.36 before upgrading.
  • The protokube binary is no longer part of kOps releases, and nodes no longer install or run it.
  • The spec.gossipConfig and spec.dnsControllerGossipConfig cluster spec fields are deprecated, no longer have any effect, and must be removed from cluster specs.

Other breaking changes

  • None at this time

Known Issues

  • None at this time

Deprecations

  • Support for Kubernetes version 1.31 is removed in kOps 1.37.

  • Support for Kubernetes version 1.32 is deprecated and will be removed in kOps 1.38.

  • Support for AWS Classic Load Balancer (CLB) for the API is removed in kOps 1.37.

  • Support for containerd versions older than 2.2 (all end of life upstream) is deprecated and will be removed in kOps 1.38.

  • Support for gossip DNS, deprecated since kOps 1.29, is removed in kOps 1.37.