Avisi cloud logo

Release notes

Avisi Managed Environment Kubernetes release notes

Introduction

This page documents updates to the Avisi Managed Environment Kubernetes clusters. This contains: new or updated functionality, bug fixes, known issues and deprecation announcements.

  • Please see our Kubernetes lifecycle policy for more information about how we handle our version management.
  • Check out our how to upgrade for information on how to upgrade your cluster.
  • Subscribe to the release notes RSS feed to get notified of new AME versions. In Slack, run /feed subscribe https://docs.avisi.cloud/release-notes/rss.xml in the channel that should receive the updates.

Release notes

We recommend the regular channel for production workloads.

Preview

Kubernetes v1.37 · v1.37.1-u-ame.1

Regular

Kubernetes v1.36 · v1.36.5-u-ame.1

Stable

Kubernetes v1.35 · v1.35.9-u-ame.1

Kubernetes v1.37 - Preview

v1.37.1-u-ame.1

Released 2026-10-23 · Kubernetes v1.37.1-ubuntu · Cluster controller v2.42.1-v1.37 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Core

  • containerd Upgraded containerd to 2.4.1
  • runc Upgraded runc to v1.5.2
  • cni_plugins Upgraded CNI plugins to v1.9.1
  • cluster-autoscaler Upgraded cluster-autoscaler to v1.36.1
  • konnectivity Upgraded Konnectivity to v0.37.0

CNI

  • calico Upgraded Calico (calico-v3.33) to v3.33.0
  • cilium Upgraded Cilium (cilium-v1.20) to v1.20.2
  • cilium-envoy Upgraded cilium-envoy to v1.37.6-1789133542

CSI

  • aws-ebs-csi Upgraded AWS EBS CSI driver to v1.66.1
  • hetzner-csi Upgraded Hetzner CSI driver to v2.24.0
  • openstack-cinder-csi Upgraded OpenStack Cinder CSI driver to v1.36.0
  • vsphere-csi Upgraded vSphere CSI driver to v3.7.3
  • csi Upgraded the CSI sidecars: csi-provisioner v6.4.0, csi-attacher v4.13.0, csi-resizer v2.3.0, csi-node-driver-registrar v2.18.0 and livenessprobe v2.20.0

Addons

  • metrics-server Upgraded metrics-server to v0.9.0

Cloud specifics

  • hetzner Upgraded hetzner-cloud-controller-manager to v1.39.0
  • openstack Upgraded openstack-cloud-controller-manager to v1.36.0
  • aws Upgraded aws-cloud-controller-manager to v1.37.0
  • vsphere Upgraded vsphere-cloud-controller-manager to v1.37.0

Images

  • aws Updated Ubuntu 24.04 AMIs (amd64: ami-030732eb9042f469b, arm64: ami-0468ccea1407a0357, released 2026-08-28)
  • vsphere Updated the vSphere VM template name to ubuntu-noble-24.04-cloudimg-tmpl-2026-q4

NodePorts are no longer reachable from the internet by default

On AWS and Hetzner, AME now only allows NodePort traffic from your cluster's internal network. Your cluster switches to this default on its first reconcile after the upgrade. If you expose services through NodePorts on public node IPs, set NodePort access to allowlist or public before you upgrade. Private clusters on AWS are not affected.

Improvements

  • kubernetes Introduced Kubernetes v1.37 support
  • network NodePorts on AWS and Hetzner are now reachable only from the cluster's internal network by default. The new NodePort access setting takes internal (the default), allowlist (the internal network plus the cluster's IP whitelist) or public (the previous behaviour).
  • openstack Node pools on OpenStack can boot from the disk that comes with the node type instead of a separate volume, with the new boot-disk-source setting (volume or node-type-disk). You can now also set the size of the boot volume. Both settings depend on what the cloud provider allows, and apply only to nodes created after the change.

Kubernetes v1.36 - Regular

v1.36.5-u-ame.1

Released 2026-10-23 · Kubernetes v1.36.5-ubuntu · Cluster controller v2.42.1-v1.36 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Core

  • containerd Upgraded containerd to 2.3.6
  • runc Upgraded runc to v1.5.2

CNI

  • cilium Upgraded Cilium (cilium-v1.19) to v1.19.8
  • cilium-envoy Upgraded cilium-envoy to v1.37.6-1789133542

CSI

  • aws-ebs-csi Upgraded AWS EBS CSI driver to v1.66.1
  • hetzner-csi Upgraded Hetzner CSI driver to v2.24.0
  • csi Upgraded the CSI sidecars: csi-provisioner v6.4.0, csi-attacher v4.13.0, csi-resizer v2.3.0, csi-node-driver-registrar v2.18.0 and livenessprobe v2.20.0

Addons

  • metrics-server Upgraded metrics-server to v0.9.0

Cloud specifics

  • hetzner Upgraded hetzner-cloud-controller-manager to v1.39.0

Images

  • vsphere Updated the vSphere VM template name to ubuntu-noble-24.04-cloudimg-tmpl-2026-q4

NodePorts are no longer reachable from the internet by default

On AWS and Hetzner, AME now only allows NodePort traffic from your cluster's internal network. Your cluster switches to this default on its first reconcile after the upgrade. If you expose services through NodePorts on public node IPs, set NodePort access to allowlist or public before you upgrade. Private clusters on AWS are not affected.

Improvements

  • network NodePorts on AWS and Hetzner are now reachable only from the cluster's internal network by default. The new NodePort access setting takes internal (the default), allowlist (the internal network plus the cluster's IP whitelist) or public (the previous behaviour).
  • openstack Node pools on OpenStack can boot from the disk that comes with the node type instead of a separate volume, with the new boot-disk-source setting (volume or node-type-disk). You can now also set the size of the boot volume. Both settings depend on what the cloud provider allows, and apply only to nodes created after the change.

v1.36.4-u-ame.4

Released 2026-09-30 · Kubernetes v1.36.4-ubuntu · Cluster controller v2.40.2-v1.36 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Improvements

  • cluster-autoscaler Autoscale from zero is available as a beta feature: an autoscaling node pool can drop to zero nodes and grow again when a pod needs it. The pool needs to have run at least one node before it can scale up from zero. Pods that select on zone, architecture, OS or instance type still trigger a scale-up from zero. See Autoscale from zero.
  • nodes New nodes join with their pool's taints already in place, so pods can no longer land on a node before its taints apply.
  • nodes Setting a node pool to zero nodes, or its maximum size to zero, now drains its nodes even when a PodDisruptionBudget blocks eviction. A pool that the autoscaler empties on its own still respects PodDisruptionBudgets. See Scale node pools to zero.

Fixes

  • cluster-autoscaler On Cilium clusters, the autoscaler no longer scales up twice for the same pending pods while a new node waits for the Cilium agent.
  • cluster-autoscaler Node pools that don't pin an availability zone now scale up for pods and volumes bound to a specific zone. Those pods previously stayed pending.
  • openstack Node pool operations on OpenStack no longer fail once the Keystone token expires.
  • nodes A node pool no longer ends up with more machines than requested after a failed scale-up, or after an AWS instance fails to start.
  • nodes Scaling down now removes the node that was drained or marked for deletion. It could previously remove a machine that never joined instead, and leave the drained node running.
  • nodes Scaling down no longer drains a healthy node based on outdated information from the cloud provider.
  • nodes Machines that never joined the cluster are now removed even when creating a replacement fails. They previously kept using cloud quota and could block the node pool from scaling.
  • nodes Node replacement now reports an error when it fails to cordon the old node. It previously reported success.

v1.36.4-u-ame.1

Released 2026-09-09 · Kubernetes v1.36.4-ubuntu · Cluster controller v2.39.1-v1.36 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Core

  • containerd Upgraded containerd to 2.3.4
  • runc Upgraded runc to v1.5.1
  • cluster-autoscaler Upgraded cluster-autoscaler to v1.36.1

CNI

  • calico Upgraded Calico (calico-v3.32) to v3.32.2
  • cilium Upgraded Cilium (cilium-v1.19) to v1.19.7
  • cilium-envoy Upgraded cilium-envoy to v1.36.9-1786864149

CSI

  • aws-ebs-csi Upgraded AWS EBS CSI driver to v1.65.0
  • hetzner-csi Upgraded Hetzner CSI driver to v2.23.0
  • vsphere-csi Upgraded vSphere CSI driver to v3.7.3
  • thalassa-csi Upgraded Thalassa CSI driver to v0.9.0
  • snapshot-controller Upgraded Snapshot Controller to v8.6.0
  • ceph-csi Removed Ceph CSI support. A ceph-csi block is now ignored instead of rejected, so existing cluster configurations still apply.

Cloud specifics

  • hetzner Upgraded hetzner-cloud-controller-manager to v1.36.0
  • aws Upgraded aws-cloud-controller-manager to v1.36.1
  • digitalocean Upgraded digitalocean-cloud-controller-manager to v0.1.69

Images

  • aws Updated Ubuntu 24.04 AMIs (amd64: ami-030732eb9042f469b, arm64: ami-0468ccea1407a0357, released 2026-08-28)

Improvements

  • cluster-autoscaler cluster-autoscaler now tracks your cluster's Kubernetes minor version. All minors previously shared one pinned version.
  • vsphere The vSphere CSI driver and syncer images now come from registry.k8s.io instead of a private mirror.

Fixes

  • calico Calico images come from the registry cache again. Since Calico v3.31 they came straight from the upstream registry, so Calico pods could fail to start when it rate limited or went down. Clusters with a restricted egress allowlist were affected too.
  • csi For the actively supported drivers, the CSI controllers now match the node plugin versions on your nodes. The two could previously drift apart across upgrades.

v1.36.2-u-ame.6

Released 2026-09-02 · Kubernetes v1.36.2-ubuntu · Cluster controller v2.38.3-v1.36 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Improvements

  • nodes Security updates on join is available as a beta feature: a node pool can install pending OS security updates on new nodes before they join the cluster. See Security updates on join and the announcement.

Fixes

  • autoscaler Recycling a node no longer triggers a duplicate scale-up. A node pool could previously grow to its maximum size after a single recycle.
  • nodes Node recycling now waits for the replacement node to stay healthy for 30 seconds before cordoning and draining the old node. Draining at first Ready raced CSI driver registration, which left evicted volume pods pending and triggered an autoscaler scale-up.
  • nodes The node install script is now gzipped in the cloud-init user data, so it stays within the 16 KB user data limit on AWS as the script grows. Node pools could otherwise fail to provision.
  • control-plane Addons are no longer installed before the cluster is ready to accept them, which could fail the first addon installation right after cluster creation.
  • hetzner Nodes no longer join the cluster without a provider ID. Such a node reported Ready but was never initialized by the cloud controller manager, received no addresses, and left Cilium in CrashLoopBackOff. Metadata service routing and NIC naming were also corrected for the CX*2, CX*3 and CCX*3 server types.

v1.36.2-u-ame.4

Released 2026-07-21 · Kubernetes v1.36.2-ubuntu · Cluster controller v2.38.0-v1.36 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Images

  • vsphere Updated the vSphere VM template name to ubuntu-noble-24.04-cloudimg-tmpl-2026-q3

Improvements

  • addons Pass additional cluster settings through to addon configurations, enabling addon default values

Fixes

  • control-plane Force cluster deletion now always succeeds, even when the customer's cloud credentials are invalid
  • nodes Fixed node-pool scale-down failing when a machine never joined the cluster

v1.36.2-u-ame.2

Released 2026-07-07 · Kubernetes v1.36.2-ubuntu · Cluster controller v2.37.2-v1.36 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Security fixes

The components shipped with Kubernetes v1.36 include fixes for these notable CVEs (CVSS ≥ 6):

  • containerd: CVE-2026-50195 (9.9, critical) and CVE-2026-53492 (9.6, critical) checkpoint/CRI escapes; CVE-2026-53488 (8.8), CVE-2026-53489 (6.5)
  • AWS EBS CSI: CVE-2026-33186 (9.1, critical) gRPC authorization bypass; CVE-2026-33814 (7.5)
  • cilium-envoy: CVE-2026-47774 (7.5), CVE-2026-27135 (7.5) HTTP/2 DoS
  • cilium: CVE-2026-53935 (6.9) cross-namespace redirect
  • kubernetes: CVE-2026-42504 (7.5), CVE-2026-27145 (6.5) Go stdlib DoS (Go 1.26.4 rebuild)
  • aws: Ubuntu 24.04 AMI CVE-2026-31431 (7.8, kernel LPE) and CVE-2026-43284 (7.8, kernel LPE, Dirty Frag); CVE-2026-28387 (8.1, OpenSSL), CVE-2026-35385 (7.5, OpenSSH)

Core

  • containerd Upgraded containerd to 2.3.2
  • runc Upgraded runc to v1.5.0
  • cni_plugins Upgraded CNI plugins to v1.9.1
  • cluster-autoscaler Upgraded cluster-autoscaler to v1.34.3
  • konnectivity Upgraded Konnectivity to v0.36.0

CNI

  • calico Upgraded Calico (calico-v3.32) to v3.32.0
  • cilium Upgraded Cilium (cilium-v1.19) to v1.19.5
  • cilium-envoy Upgraded cilium-envoy to v1.36.8

CSI

  • aws-ebs-csi Upgraded AWS EBS CSI driver to v1.62.0
  • hetzner-csi Upgraded Hetzner CSI driver to v2.21.2
  • openstack-cinder-csi Upgraded OpenStack Cinder CSI driver to v1.36.0
  • vsphere-csi Upgraded vSphere CSI driver to v3.7.2

Cloud specifics

  • hetzner Upgraded hetzner-cloud-controller-manager to v1.33.0
  • openstack Upgraded openstack-cloud-controller-manager to v1.36.0
  • aws Upgraded aws-cloud-controller-manager to v1.35.0
  • vsphere Upgraded vsphere-cloud-controller-manager to v1.36.0

Images

  • aws Updated Ubuntu 24.04 AMIs (amd64: ami-042dc8681de073ac4, arm64: ami-0a80e331254190309, released 2026-06-10)

Improvements

  • kubernetes Introduced Kubernetes v1.36 support

Fixes

  • kubeadm Fixed kubelet role setup on newly added Kubernetes versions by binding the apiserver-kubelet-client certificate to the kubelet API

Kubernetes v1.35 - Stable

v1.35.9-u-ame.1

Released 2026-10-23 · Kubernetes v1.35.9-ubuntu · Cluster controller v2.42.1-v1.35 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Core

  • containerd Upgraded containerd to 2.2.9

CNI

  • cilium Upgraded Cilium (cilium-v1.19) to v1.19.8
  • cilium-envoy Upgraded cilium-envoy to v1.37.6-1789133542

CSI

  • aws-ebs-csi Upgraded AWS EBS CSI driver to v1.66.1
  • hetzner-csi Upgraded Hetzner CSI driver to v2.24.0
  • csi Upgraded the CSI sidecars: csi-provisioner v6.4.0, csi-attacher v4.13.0, csi-resizer v2.3.0, csi-node-driver-registrar v2.18.0 and livenessprobe v2.20.0

Addons

  • metrics-server Upgraded metrics-server to v0.9.0

Cloud specifics

  • hetzner Upgraded hetzner-cloud-controller-manager to v1.39.0

Images

  • vsphere Updated the vSphere VM template name to ubuntu-noble-24.04-cloudimg-tmpl-2026-q4

NodePorts are no longer reachable from the internet by default

On AWS and Hetzner, AME now only allows NodePort traffic from your cluster's internal network. Your cluster switches to this default on its first reconcile after the upgrade. If you expose services through NodePorts on public node IPs, set NodePort access to allowlist or public before you upgrade. Private clusters on AWS are not affected.

Improvements

  • network NodePorts on AWS and Hetzner are now reachable only from the cluster's internal network by default. The new NodePort access setting takes internal (the default), allowlist (the internal network plus the cluster's IP whitelist) or public (the previous behaviour).
  • openstack Node pools on OpenStack can boot from the disk that comes with the node type instead of a separate volume, with the new boot-disk-source setting (volume or node-type-disk). You can now also set the size of the boot volume. Both settings depend on what the cloud provider allows, and apply only to nodes created after the change.

v1.35.8-u-ame.4

Released 2026-09-30 · Kubernetes v1.35.8-ubuntu · Cluster controller v2.40.2-v1.35 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Improvements

  • cluster-autoscaler Autoscale from zero is available as a beta feature: an autoscaling node pool can drop to zero nodes and grow again when a pod needs it. The pool needs to have run at least one node before it can scale up from zero. Pods that select on zone, architecture, OS or instance type still trigger a scale-up from zero. See Autoscale from zero.
  • nodes New nodes join with their pool's taints already in place, so pods can no longer land on a node before its taints apply.
  • nodes Setting a node pool to zero nodes, or its maximum size to zero, now drains its nodes even when a PodDisruptionBudget blocks eviction. A pool that the autoscaler empties on its own still respects PodDisruptionBudgets. See Scale node pools to zero.

Fixes

  • cluster-autoscaler On Cilium clusters, the autoscaler no longer scales up twice for the same pending pods while a new node waits for the Cilium agent.
  • cluster-autoscaler Node pools that don't pin an availability zone now scale up for pods and volumes bound to a specific zone. Those pods previously stayed pending.
  • openstack Node pool operations on OpenStack no longer fail once the Keystone token expires.
  • nodes A node pool no longer ends up with more machines than requested after a failed scale-up, or after an AWS instance fails to start.
  • nodes Scaling down now removes the node that was drained or marked for deletion. It could previously remove a machine that never joined instead, and leave the drained node running.
  • nodes Scaling down no longer drains a healthy node based on outdated information from the cloud provider.
  • nodes Machines that never joined the cluster are now removed even when creating a replacement fails. They previously kept using cloud quota and could block the node pool from scaling.
  • nodes Node replacement now reports an error when it fails to cordon the old node. It previously reported success.

v1.35.8-u-ame.1

Released 2026-09-09 · Kubernetes v1.35.8-ubuntu · Cluster controller v2.39.1-v1.35 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Core

  • containerd Upgraded containerd to 2.2.7
  • cluster-autoscaler Upgraded cluster-autoscaler to v1.35.2

CNI

  • calico Upgraded Calico (calico-v3.31) to v3.31.7
  • cilium Upgraded Cilium (cilium-v1.19) to v1.19.7
  • cilium-envoy Upgraded cilium-envoy to v1.36.9-1786864149

CSI

  • aws-ebs-csi Upgraded AWS EBS CSI driver to v1.65.0
  • hetzner-csi Upgraded Hetzner CSI driver to v2.23.0
  • vsphere-csi Upgraded vSphere CSI driver to v3.7.3
  • thalassa-csi Upgraded Thalassa CSI driver to v0.9.0
  • snapshot-controller Upgraded Snapshot Controller to v8.6.0
  • ceph-csi Removed Ceph CSI support. A ceph-csi block is now ignored instead of rejected, so existing cluster configurations still apply.

Cloud specifics

  • hetzner Upgraded hetzner-cloud-controller-manager to v1.36.0
  • aws Upgraded aws-cloud-controller-manager to v1.35.2
  • digitalocean Upgraded digitalocean-cloud-controller-manager to v0.1.69

Images

  • aws Updated Ubuntu 24.04 AMIs (amd64: ami-030732eb9042f469b, arm64: ami-0468ccea1407a0357, released 2026-08-28)

Improvements

  • cluster-autoscaler cluster-autoscaler now tracks your cluster's Kubernetes minor version. All minors previously shared one pinned version.
  • vsphere The vSphere CSI driver and syncer images now come from registry.k8s.io instead of a private mirror.

Fixes

  • calico Calico images come from the registry cache again. Since Calico v3.31 they came straight from the upstream registry, so Calico pods could fail to start when it rate limited or went down. Clusters with a restricted egress allowlist were affected too.
  • csi For the actively supported drivers, the CSI controllers now match the node plugin versions on your nodes. The two could previously drift apart across upgrades.

v1.35.6-u-ame.6

Released 2026-09-02 · Kubernetes v1.35.6-ubuntu · Cluster controller v2.38.3-v1.35 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Improvements

  • nodes Security updates on join is available as a beta feature: a node pool can install pending OS security updates on new nodes before they join the cluster. See Security updates on join and the announcement.

Fixes

  • autoscaler Recycling a node no longer triggers a duplicate scale-up. A node pool could previously grow to its maximum size after a single recycle.
  • nodes Node recycling now waits for the replacement node to stay healthy for 30 seconds before cordoning and draining the old node. Draining at first Ready raced CSI driver registration, which left evicted volume pods pending and triggered an autoscaler scale-up.
  • nodes The node install script is now gzipped in the cloud-init user data, so it stays within the 16 KB user data limit on AWS as the script grows. Node pools could otherwise fail to provision.
  • control-plane Addons are no longer installed before the cluster is ready to accept them, which could fail the first addon installation right after cluster creation.
  • hetzner Nodes no longer join the cluster without a provider ID. Such a node reported Ready but was never initialized by the cloud controller manager, received no addresses, and left Cilium in CrashLoopBackOff. Metadata service routing and NIC naming were also corrected for the CX*2, CX*3 and CCX*3 server types.

v1.35.6-u-ame.4

Released 2026-07-21 · Kubernetes v1.35.6-ubuntu · Cluster controller v2.38.0-v1.35 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Images

  • vsphere Updated the vSphere VM template name to ubuntu-noble-24.04-cloudimg-tmpl-2026-q3

Improvements

  • addons Pass additional cluster settings through to addon configurations, enabling addon default values

Fixes

  • control-plane Force cluster deletion now always succeeds, even when the customer's cloud credentials are invalid
  • nodes Fixed node-pool scale-down failing when a machine never joined the cluster

v1.35.6-u-ame.2

Released 2026-07-07 · Kubernetes v1.35.6-ubuntu · Cluster controller v2.37.2-v1.35 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Security fixes

Notable CVEs remediated in this release (CVSS ≥ 6):

  • containerd: CVE-2026-50195 (9.9, critical) and CVE-2026-53492 (9.6, critical) checkpoint/CRI escapes; CVE-2026-53488 (8.8), CVE-2026-46680 (7.8), CVE-2026-53489 (6.5)
  • AWS EBS CSI: CVE-2026-33186 (9.1, critical) gRPC authorization bypass; CVE-2026-33814 (7.5)
  • cilium-envoy: CVE-2026-47774 (7.5), CVE-2026-27135 (7.5) HTTP/2 DoS
  • cilium: CVE-2026-53935 (6.9) cross-namespace redirect
  • kubernetes: CVE-2026-42504 (7.5), CVE-2026-27145 (6.5) Go stdlib DoS (Go 1.25.11 rebuild)
  • aws: Ubuntu 24.04 AMI CVE-2026-31431 (7.8, kernel LPE) and CVE-2026-43284 (7.8, kernel LPE, Dirty Frag); CVE-2026-28387 (8.1, OpenSSL), CVE-2026-35385 (7.5, OpenSSH)

Core

  • containerd Upgraded containerd to 2.2.5
  • runc Upgraded runc to v1.4.3
  • konnectivity Upgraded Konnectivity to v0.35.0

CNI

  • calico Upgraded Calico (calico-v3.31) to v3.31.6
  • cilium Upgraded Cilium (cilium-v1.19) to v1.19.5
  • cilium-envoy Upgraded cilium-envoy to v1.36.8

CSI

  • aws-ebs-csi Upgraded AWS EBS CSI driver to v1.62.0
  • hetzner-csi Upgraded Hetzner CSI driver to v2.21.2
  • openstack-cinder-csi Upgraded OpenStack Cinder CSI driver to v1.36.0
  • vsphere-csi Upgraded vSphere CSI driver to v3.7.2

Cloud specifics

  • hetzner Upgraded hetzner-cloud-controller-manager to v1.33.0
  • vsphere Upgraded vsphere-cloud-controller-manager to v1.35.1

Images

  • aws Updated Ubuntu 24.04 AMIs (amd64: ami-042dc8681de073ac4, arm64: ami-0a80e331254190309, released 2026-06-10)

Fixes

  • kubeadm Fixed kubelet role setup on newly added Kubernetes versions by binding the apiserver-kubelet-client certificate to the kubelet API

v1.35.4-u-ame.4

Released 2026-06-11 · Kubernetes v1.35.4-ubuntu · Cluster controller v2.36.0-v1.35 · Addon controller v0.29.6 · Ubuntu 24.04 LTS

Addons

  • gpu Upgraded gpu-operator to v26.3.2

v1.35.4-u-ame.3

Released 2026-05-29 · Kubernetes v1.35.4-ubuntu · Cluster controller v2.36.0-v1.35 · Addon controller v0.29.5 · Ubuntu 24.04 LTS

Improvements

  • etcd Improved etcd high-availability handling with safe HA / non-HA switching.

v1.35.4-u-ame.2

Released 2026-05-08 · Kubernetes v1.35.4-ubuntu · Cluster controller v2.35.2-v1.35 · Addon controller v0.29.5 · Ubuntu 24.04 LTS

Images

  • vsphere Updated the vSphere VM template name to ubuntu-noble-24.04-cloudimg-tmpl-2026-q2

v1.35.4-u-ame.1

Released 2026-05-01 · Kubernetes v1.35.4-ubuntu · Cluster controller v2.35.1-v1.35 · Addon controller v0.29.5 · Ubuntu 24.04 LTS

Addons

  • ingress-nginx Upgraded ingress-nginx to 4.15.1 (app v1.15.1)
  • certmanager Upgraded cert-manager to v1.20.2

v1.35.4-u-ame.0

Released 2026-04-28 · Kubernetes v1.35.4-ubuntu · Cluster controller v2.35.1-v1.35 · Addon controller v0.29.3 · Ubuntu 24.04 LTS

Core

  • containerd Upgraded containerd to 2.2.3
  • runc Upgraded runc to v1.4.2

CNI

  • calico Upgraded Calico (calico-v3.31) to v3.31.5
  • cilium Upgraded Cilium (cilium-v1.19) to v1.19.3
  • cilium-envoy Upgraded cilium-envoy to v1.36.6-1776000132

Images

  • aws Updated Ubuntu 24.04 AMIs (amd64: ami-018f28221ffaa9b3b, arm64: ami-0e90ac8060d3ae6af, released 2026-04-09)

Improvements

  • nodes Security updates can now be configured per node pool, controlling whether they are installed on new nodes before join. Options: off (default), install, or install and reboot.

Fixes

  • nodes Reduced node join token TTL and node join timeout from 1 hour to 15 minutes
  • autoscaler Improved cluster-autoscaler handling

v1.35.3-u-ame.4

Released 2026-04-07 · Kubernetes v1.35.3-ubuntu · Cluster controller v2.34.2-v1.35 · Addon controller v0.29.3 · Ubuntu 24.04 LTS

Addons

  • kured Upgraded kured to 5.11.0 (app v1.21.0)

Fixes

  • kube-apiserver Fixed an issue which caused unnecessary restarts of kube-apiserver on Kubernetes v1.35.0+

v1.35.3-u-ame.2

Released 2026-04-01 · Kubernetes v1.35.3-ubuntu · Cluster controller v2.34.1-v1.35 · Addon controller v0.29.2 · Ubuntu 24.04 LTS

Fixes

  • openstack Skip deleted/deleting servers during node pool reconciliation

v1.35.3-u-ame.1

Released 2026-03-26 · Kubernetes v1.35.3-ubuntu · Cluster controller v2.34.0-v1.35 · Addon controller v0.29.2 · Ubuntu 24.04 LTS

Addons

  • kured Reverted to 5.6.2 (app v1.17.1) to fix an issue where nodes rebooted outside of scheduled windows or while disabled

v1.35.3-u-ame.0

Released 2026-03-23 · Kubernetes v1.35.3-ubuntu · Cluster controller v2.34.0-v1.35 · Addon controller v0.29.1 · Ubuntu 24.04 LTS

Components

  • containerd Upgraded containerd to 2.2.2
  • runc Upgraded runc to v1.4.1
  • cni_plugins Upgraded CNI plugins to v1.9.1
  • cluster-autoscaler Upgraded cluster-autoscaler to v1.34.3
  • konnectivity Upgraded Konnectivity to v0.34.0

CNI

  • calico Upgraded Calico (calico-v3.31) to v3.31.4
  • cilium Upgraded Cilium (cilium-v1.19) to v1.19.1
  • cilium-envoy Upgraded cilium-envoy to v1.35.9

CSI

  • aws-ebs-csi Upgraded AWS EBS CSI driver to v1.56.0
  • azure-disk-csi Upgraded Azure Disk CSI driver to v1.33.4
  • hetzner-csi Upgraded Hetzner CSI driver to v2.20.0
  • digitalocean-csi Upgraded DigitalOcean CSI driver to v2.1.2
  • openstack-cinder-csi Upgraded OpenStack Cinder CSI driver to v1.34.1
  • vsphere-csi Upgraded vSphere CSI driver to v3.6.1
  • thalassa-csi Upgraded Thalassa CSI driver to v0.5.3
  • ceph-csi Upgraded Ceph CSI driver to v3.5.1
  • snapshot-controller Upgraded Snapshot Controller to v8.3.0

Addons

  • monitoring Upgraded kube-prometheus-stack to 82.4.0
  • logging Upgraded Promtail to 6.17.1 (app v3.5.1)
  • ingress-nginx Upgraded ingress-nginx to 4.14.3 (app v1.14.3)
  • traefik Upgraded Traefik to 26.1.0 (app v2.11.0)
  • certmanager Upgraded cert-manager to v1.19.4
  • kured Upgraded kured to 5.11.0 (app v1.21.0)
  • gpu Upgraded gpu-operator to v25.10.1
  • flux-operator Upgraded flux-operator to 0.42.1
  • cloudnative-pg Upgraded CloudNativePG to 0.27.1 (app v1.28.1)

Cloud specifics

  • hetzner Upgraded hetzner-cloud-controller-manager to v1.30.1
  • openstack Upgraded openstack-cloud-controller-manager to v1.35.0
  • aws Upgraded aws-cloud-controller-manager to v1.35.0
  • azure Upgraded azure-cloud-controller-manager to v1.34.3
  • vsphere Upgraded vsphere-cloud-controller-manager to v1.35.0
  • digitalocean Upgraded digitalocean-cloud-controller-manager to v0.1.66

Images

  • aws Updated Ubuntu 24.04 AMIs (amd64: ami-005f97cc4a61dd3b4, arm64: ami-052b310a8f0d76968)
  • vsphere Updated the vSphere VM template name to ubuntu-noble-24.04-cloudimg-tmpl-2026-01-19
  • thalassa Updated Thalassa image ID to d5em2emeeagc739oao00

Improvements

  • autoscaler Track temporary nodes during autoscaler scaling to prevent unintended node recreation
  • nodeprovisioner Add priority-based scale-down ordering
  • nodeprovisioner Stop eagerly deleting autoscaler-tainted nodes

Fixes

  • thalassa Implement GetProviderID for ThalassaMachine

Archived versions (EOL)

These Kubernetes minor versions are no longer supported. See the lifecycle policy for current support windows.

Organisations

Platform administration documentation

Identity & User Management

Identity & User Management

On this page

IntroductionRelease notesKubernetes v1.37 - Previewv1.37.1-u-ame.1Kubernetes v1.36 - Regularv1.36.5-u-ame.1v1.36.4-u-ame.4v1.36.4-u-ame.1v1.36.2-u-ame.6v1.36.2-u-ame.4v1.36.2-u-ame.2Kubernetes v1.35 - Stablev1.35.9-u-ame.1v1.35.8-u-ame.4v1.35.8-u-ame.1v1.35.6-u-ame.6v1.35.6-u-ame.4v1.35.6-u-ame.2v1.35.4-u-ame.4v1.35.4-u-ame.3v1.35.4-u-ame.2v1.35.4-u-ame.1v1.35.4-u-ame.0v1.35.3-u-ame.4v1.35.3-u-ame.2v1.35.3-u-ame.1v1.35.3-u-ame.0Archived versions (EOL)