v1.36.3-dd.1

Changelog

• d61ec6a Update to new version of the base image
• 06546ae feat(apiserver): add OTel tracing spans for VAP/MAP CEL evaluation
• e560625 perf(apiserver): cache CEL conversions on VersionedAttributes
• 1c1a983 noderesources: exempt annotated pods from max-pod-count cap
• 8b7e6ce fix(kube-apiserver): always refetch JWKS on unknown key ID
• fde023a Add PodStatusBatchUpdates feature gate to debounce pod status writes
• fc909ff Conflicts errors don't count against retries datadog:patch (#98)
• ceaa8c0 fix ds controller deletes pod when not match RequiredDuringSchedulingIgnoredDuringExecution
• a38f332 - Enable boringcrypto when building.
• db3180e flowcontrol: currentCL can reach maxCL (#87)
• 0f29094 Release commit for Kubernetes v1.36.3
• 5874ee7 DRA: roll back reserved state in allocateDevice
• 2c14a99 Bump images and versions to golang 1.26.5 and update distroless-iptables
• fb2467e stop logging missing optional container annotations
• 4434901 Add e2e test for setting maps and slices to null via SSA
• f015292 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
• ccca5a9 kubelet startPodSync: reuse the previous context to fix memory leak regression
• ab57dc0 Make utf8 replacement char test pass on Go 1.27
• b86d94a Restore string JSON encoding of cri-api KeyValue
• 5acf40f kubeadm: treat already promoted learner as successful
• 24b3a25 kubeadm: use KubernetesAPICallTimeout for mandatory kubeadm-config fetch
• d20c60a Align DeviceTaintRule informer API version with handlers
• 903e7fc Update CHANGELOG/CHANGELOG-1.36.md for v1.36.2
• 24e2b02 Release commit for Kubernetes v1.36.2
• ff173bd Fix job controller reporting active=0 during pod creation backoff
• 02c02b9 Bump images and versions to go 1.26.4 and distroless iptables
• afb3ede Fix wrong marking of errors
• 088d4d9 upgrade go to 1.26.4
• 6489fe4 DRA E2E: simplify kind.yaml
• 0a283bc kubeadm: fix dry-run CA copy paths in init certs
• bed40bd flowcontrol: cover Required rule for spec.type and limitResponse.type
• 746956b flowcontrol: emit Required when spec.type or limitResponse.type is empty
• 6bd05d6 Fix DRA scoring bug with mixed allocated and unallocated claims
• 0f0c734 batch/job: Fix scheduling directives mutation for not-yet-started suspended Jobs
• c106d15 fix(endpoint): avoid panic on services with empty IPFamilies
• 6c684db fix(csi): preserve mount dir on NodePublish error during remount
• 238883b feat(volume): add IsRemount to MounterArgs
• 37349f7 DRA: account for shared devices when rebuilding counters
• 65cef41 Restore ability to plumb binary data through envvar values
• 314bf62 Only emit non-dupicated values as metrics
• 46a0b04 Optimize how deletions are handled
• aee40ed Improve performance characteristic of selinux metric emission
• d2b5ca0 DRA: fix AllocationModeAll with consumed counters
• 102c4a4 Update CHANGELOG/CHANGELOG-1.36.md for v1.36.1
• 7569396 Release commit for Kubernetes v1.36.1
• 720f13b test/compatibility_lifecycle: resolve feature names from variables
• b0b25e8 kubeadm: use dedicated ClusterRole for apiserver kubelet client
• 2bd8606 KEP-5304: DecodeMetadataFromStream only skips metadata entries with unknown API versions
• b643483 DRA: merge same request metadata across drivers
• f0d0ff9 kubeadm: skip LocalAPIEndpoint defaulting on worker join
• 100bf5d kubeadm: use the localAPIEndpoint for all API calls in 'init'
• 0008353 kube-proxy: don't do full periodic syncs on large cluster mode
• a45cef8 Delete remote endpoint if it has same ip as local endpoint in the system.
• cbb38cd Delete remote endpoint if it has same ip as local endpoint in the system.
• 28dd6f2 hack/update-vendor.sh
• 529473c register zfs cadvisor plugin
• 07144e3 Add a (*Client) addEndpoint method
• 98ecfc6 Evaluate etcd cluster health using quorum
• 891a905 test/localupcluster: stop all components before starting replacements
• 1d850e8 localupcluster: set readiness polling interval to 1 second
• 62d05ad localupcluster: properly query /readyz and /healthz
• 745e271 Update CHANGELOG/CHANGELOG-1.36.md for v1.36.0
• ecf6dec Release commit for Kubernetes v1.36.0
• b2ba48e Escape path inside the container
• 3ddb659 kubeadm: skip promote call when etcd member is already a voting member
• 2aaa5b6 skip MemoryQoS rollback test until implementation is resolved
• bb2bb3c Gate setting memory QoS behind feature gate
• b2f73c0 CHANGELOG: Update directory for v1.33.11 release
• 1845002 CHANGELOG: Update directory for v1.34.7 release
• f8627a6 CHANGELOG: Update directory for v1.35.4 release
• cec8f06 CHANGELOG: Update directory for v1.36.0-rc.1 release
• 9c18c38 Update CHANGELOG/CHANGELOG-1.36.md for v1.36.0-rc.1
• 95ccf45 Release commit for Kubernetes v1.36.0-rc.1
• 064f095 scheduler: address recreated pod review feedback
• f620910 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• 48c8f0d scheduler: skip requeueing recreated pods on scheduling failure
• feda787 update go.opentelemetry.io/otel to v1.41.0
• dc47d88 scheduler: fix inFlightPods leak when pod is recreated during scheduling failure
• a2b55fc DRA: use full image name in test manifests
• 45ab866 Downgrade log level from Error to Info for unserved GVRs in peer proxy
• 28b6b1e Reduce number of chaos workers to prevent timeouts
• bf7ccb8 Bump images and versions to go 1.26.2 and distroless iptables
• 3b5f150 devicemanager: constrain topology hints to device NUMA nodes
• 8254743 Pin MutatingAdmissionPolicy storage version to v1beta1
• 7ef0d61 Add release-1.36 publishing bot rules
• bc15d50 CHANGELOG: Update directory for v1.36.0-rc.0 release
• 9531564 Release commit for Kubernetes v1.36.0-rc.0
• cd3d2cf Bump golang version from 1.26.1 to 1.26.2
• cfe5b54 Adds polling for HPA reconciliation_duration unit test (kubernetes#138059)
• 1c87f39 build/dependencies.yaml: enforce PATCH level validation for pause
• bfe8f6b lint small fix
• b9b0ff4 remove accidently commited file
• bc2179d pause: fix version drift in various files
• 1140c34 Make cleanup aware of uid differences
• afdb5e5 Update CNI plugins to v1.9.1
• 3906ec7 kep-5304: bump cdi spec version to 0.5.0
• 84be835 Deflake TestPodSubresourceAuth by waiting for effective permissions before testing
• 10efa46 e2e_node: wait for pod drain before asserting zero pods in Memory Manager Metrics
• 3e7c6e3 Simplify isPodLevelResourcesResizeInProgress to check for absence of actuated resources
• e622b86 remove unnecessary fixes
• ba1ac16 fix erroneously reporting a PLR resize in progress on pod creation
• 65cc1c2 Fix race condition in updating the PodStatus cache
• adbf3b5 Add granular authorization for DRA ResourceClaim status upda...

v1.35.7-dd.1

Changelog

• 173ad68 Update to new version of the base image
• befdcbb feat(apiserver): add OTel tracing spans for VAP/MAP CEL evaluation
• 76b5c64 perf(apiserver): cache CEL conversions on VersionedAttributes
• d1ad738 noderesources: exempt annotated pods from max-pod-count cap
• a7a83f1 fix(kube-apiserver): always refetch JWKS on unknown key ID
• 1ec00d2 patch from PR# 133654
• 40714d2 Conflicts errors don't count against retries datadog:patch (#98)
• d0190c1 fix ds controller deletes pod when not match RequiredDuringSchedulingIgnoredDuringExecution
• 93e70d4 - Enable boringcrypto when building.
• 9a9bbb3 flowcontrol: currentCL can reach maxCL (#87)
• 0866950 Sidecar: Enable Lyft type sidecars
• 96cb9ab Release commit for Kubernetes v1.35.7
• 68bd319 Bump images and versions to golang 1.25.12 and update distroless-iptables
• ff899e0 stop logging missing optional container annotations
• 2165452 Fix vet error
• 8b1184f Make utf8 replacement char test pass on Go 1.27
• 64f72b7 Restore string JSON encoding of cri-api KeyValue
• cfad4b5 kubeadm: treat already promoted learner as successful
• 463e908 kubeadm: use KubernetesAPICallTimeout for mandatory kubeadm-config fetch
• 4c89481 Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af
• 923d2d9 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.6
• fc0e7a6 Release commit for Kubernetes v1.35.6
• dd84374 Fix job controller reporting active=0 during pod creation backoff
• 5ccf8f4 Bump images and versions to go 1.25.11 and distroless iptables
• d44082b Fix wrong marking of errors
• d2212b8 kubeadm: fix dry-run CA copy paths in init certs
• a74c5bf Fix DRA scoring bug with mixed allocated and unallocated claims
• 77292b8 fix(endpoint): avoid panic on services with empty IPFamilies
• df562ae fix(csi): preserve mount dir on NodePublish error during remount
• f1ce76d feat(volume): add IsRemount to MounterArgs
• b596e7b Restore ability to plumb binary data through envvar values
• 4a0532b Cache selinux conflicts
• fd08821 controller/selinuxwarning/cache: Add reverse index
• 9f52f4d controller/selinuxwarning: Pre-parse SELinux label
• 350f793 DRA: fix AllocationModeAll with consumed counters
• 90640ec Update CHANGELOG/CHANGELOG-1.35.md for v1.35.5
• 6636cbc Release commit for Kubernetes v1.35.5
• bf604dc test/compatibility_lifecycle: resolve feature names from variables
• b9ffe7c kubeadm: use dedicated ClusterRole for apiserver kubelet client
• 7909267 kubeadm: skip LocalAPIEndpoint defaulting on worker join
• f792796 kubeadm: use the localAPIEndpoint for all API calls in 'init'
• faa8112 kube-proxy: don't do full periodic syncs on large cluster mode
• 943d941 Delete remote endpoint if it has same ip as local endpoint in the system.
• d550d45 Delete remote endpoint if it has same ip as local endpoint in the system.
• 6d314b2 Add a (*Client) addEndpoint method
• feb7fa1 Evaluate etcd cluster health using quorum
• 1a7f0b3 Escape path inside the container
• 799beb9 kubeadm: skip promote call when etcd member is already a voting member
• 6953afb scheduler: address recreated pod review feedback
• bf14155 scheduler: skip requeueing recreated pods on scheduling failure
• 55f12e8 scheduler: fix inFlightPods leak when pod is recreated during scheduling failure
• 31d47ca Update CHANGELOG/CHANGELOG-1.35.md for v1.35.4
• 7b8c6cf Release commit for Kubernetes v1.35.4
• 1687aa8 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• e87f6b9 update go.opentelemetry.io/otel to v1.41.0
• 97ccbdf Bump images and versions to go 1.25.9 and distroless iptables
• 69dd59d podStartSLOduration excludes init container runtime and image pulling time, includes only stateless and immediately schedulable pods
• 46ba1c3 Deflake TestPodSubresourceAuth by waiting for effective permissions before testing
• 1d5e94e podresources: filter out inactive pods in Get()
• 91a1e8b e2e: node: podresources: fix expectations for Get() and terminated pods
• 9d8bbea Fix device plugin admission failure after container restart
• d8a562b Fix backport differences for 1.35 (remove WithOrigin and MarkAlpha)
• b6ee759 Add slice and map union member support with tests
• 3d39627 Use IsZero instead of IsNil for union ratcheting check
• 7b708cc Add DRA test for device attribute with no value set
• 863ed56 Add nil OldValue test coverage for union doc_tests
• 9a39e5c Fix union validation ratcheting when oldObj is nil
• b0ec348 KEP-961: demote maxUnavailable feature in statefulset to off by default
• 570f471 kubelet: fix sidecar restart after kubelet restart
• 4c04292 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.3
• 6c1cd99 Release commit for Kubernetes v1.35.3
• 93de120 pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions
• 6b56734 Update knftables to v0.0.21
• b57e146 cmd/kubeadm: ignore EINVAL error during unmount
• af6488c Use localhost image reference in PodObservedGenerationTracking test
• 61003ad drop publishing rules from dependencies.yaml on release branch
• b9be60a start scheduler after creating binding/non-binding slices
• 659d489 dra: stabilize DeviceBindingConditions BasicFlow by creating without-binding slice first
• 02115b6 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.2
• fdc9d74 Release commit for Kubernetes v1.35.2
• 1c0c911 kubeadm: do not add learner member to etcd client endpoints
• d05c506 Fix flake TestDeviceTaintRule test by adjusting event hanlder status update logic Co-authored-by: Pohly patrick.ohly@intel.com
• 69d9b9b Bump images and versions to go 1.25.7 and distroless iptables
• 2371267 add dockerized go cache to make clean
• de51841 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.1
• bd39991 fake client-go: un-deprecate NewSimpleClientset
• 0a9d14b Fix flaky TestApplyCRDuringCRDFinalization test
• 38378d5 Bugfix: calculate request latency properly in audit log filter

v1.35.6-dd.10

Changelog

• a1980d1 Update to new version of the base image
• f25ad12 feat(apiserver): add OTel tracing spans for VAP/MAP CEL evaluation
• c8149cd perf(apiserver): cache CEL conversions on VersionedAttributes
• b2d83c5 noderesources: exempt annotated pods from max-pod-count cap
• 3e17a5d fix(kube-apiserver): always refetch JWKS on unknown key ID
• 161a419 patch from PR# 133654
• c558a36 Conflicts errors don't count against retries datadog:patch (#98)
• 98a4c92 fix ds controller deletes pod when not match RequiredDuringSchedulingIgnoredDuringExecution
• 39fc0a3 - Enable boringcrypto when building.
• 2a49a5b flowcontrol: currentCL can reach maxCL (#87)
• 96b6c43 Sidecar: Enable Lyft type sidecars
• fc0e7a6 Release commit for Kubernetes v1.35.6
• 5ccf8f4 Bump images and versions to go 1.25.11 and distroless iptables
• d44082b Fix wrong marking of errors
• d2212b8 kubeadm: fix dry-run CA copy paths in init certs
• a74c5bf Fix DRA scoring bug with mixed allocated and unallocated claims
• 77292b8 fix(endpoint): avoid panic on services with empty IPFamilies
• df562ae fix(csi): preserve mount dir on NodePublish error during remount
• f1ce76d feat(volume): add IsRemount to MounterArgs
• b596e7b Restore ability to plumb binary data through envvar values
• 4a0532b Cache selinux conflicts
• fd08821 controller/selinuxwarning/cache: Add reverse index
• 9f52f4d controller/selinuxwarning: Pre-parse SELinux label
• 350f793 DRA: fix AllocationModeAll with consumed counters
• 90640ec Update CHANGELOG/CHANGELOG-1.35.md for v1.35.5
• 6636cbc Release commit for Kubernetes v1.35.5
• b9ffe7c kubeadm: use dedicated ClusterRole for apiserver kubelet client
• 7909267 kubeadm: skip LocalAPIEndpoint defaulting on worker join
• f792796 kubeadm: use the localAPIEndpoint for all API calls in 'init'
• faa8112 kube-proxy: don't do full periodic syncs on large cluster mode
• 943d941 Delete remote endpoint if it has same ip as local endpoint in the system.
• d550d45 Delete remote endpoint if it has same ip as local endpoint in the system.
• 6d314b2 Add a (*Client) addEndpoint method
• feb7fa1 Evaluate etcd cluster health using quorum
• 1a7f0b3 Escape path inside the container
• 6953afb scheduler: address recreated pod review feedback
• bf14155 scheduler: skip requeueing recreated pods on scheduling failure
• 55f12e8 scheduler: fix inFlightPods leak when pod is recreated during scheduling failure
• 31d47ca Update CHANGELOG/CHANGELOG-1.35.md for v1.35.4
• 7b8c6cf Release commit for Kubernetes v1.35.4
• 1687aa8 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• e87f6b9 update go.opentelemetry.io/otel to v1.41.0
• 97ccbdf Bump images and versions to go 1.25.9 and distroless iptables
• 69dd59d podStartSLOduration excludes init container runtime and image pulling time, includes only stateless and immediately schedulable pods
• 46ba1c3 Deflake TestPodSubresourceAuth by waiting for effective permissions before testing
• 1d5e94e podresources: filter out inactive pods in Get()
• 91a1e8b e2e: node: podresources: fix expectations for Get() and terminated pods
• 9d8bbea Fix device plugin admission failure after container restart
• d8a562b Fix backport differences for 1.35 (remove WithOrigin and MarkAlpha)
• b6ee759 Add slice and map union member support with tests
• 3d39627 Use IsZero instead of IsNil for union ratcheting check
• 7b708cc Add DRA test for device attribute with no value set
• 863ed56 Add nil OldValue test coverage for union doc_tests
• 9a39e5c Fix union validation ratcheting when oldObj is nil
• b0ec348 KEP-961: demote maxUnavailable feature in statefulset to off by default
• 570f471 kubelet: fix sidecar restart after kubelet restart
• 4c04292 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.3
• 6c1cd99 Release commit for Kubernetes v1.35.3
• 93de120 pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions
• 6b56734 Update knftables to v0.0.21
• b57e146 cmd/kubeadm: ignore EINVAL error during unmount
• af6488c Use localhost image reference in PodObservedGenerationTracking test
• 61003ad drop publishing rules from dependencies.yaml on release branch
• b9be60a start scheduler after creating binding/non-binding slices
• 659d489 dra: stabilize DeviceBindingConditions BasicFlow by creating without-binding slice first
• 02115b6 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.2
• fdc9d74 Release commit for Kubernetes v1.35.2
• 1c0c911 kubeadm: do not add learner member to etcd client endpoints
• d05c506 Fix flake TestDeviceTaintRule test by adjusting event hanlder status update logic Co-authored-by: Pohly patrick.ohly@intel.com
• 69d9b9b Bump images and versions to go 1.25.7 and distroless iptables
• 2371267 add dockerized go cache to make clean
• de51841 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.1
• bd39991 fake client-go: un-deprecate NewSimpleClientset
• 0a9d14b Fix flaky TestApplyCRDuringCRDFinalization test
• 38378d5 Bugfix: calculate request latency properly in audit log filter

v1.35.5-dd.10

Changelog

• c94e01e Update to new version of the base image
• 4c72cb4 feat(apiserver): add OTel tracing spans for VAP/MAP CEL evaluation
• b98d031 perf(apiserver): cache CEL conversions on VersionedAttributes
• 2f12b06 noderesources: exempt annotated pods from max-pod-count cap
• 9640080 fix(kube-apiserver): always refetch JWKS on unknown key ID
• 8b7d96a patch from PR# 133654
• 460839b Conflicts errors don't count against retries datadog:patch (#98)
• 690b705 fix ds controller deletes pod when not match RequiredDuringSchedulingIgnoredDuringExecution
• 65e55bb - Enable boringcrypto when building.
• fbfb2b7 flowcontrol: currentCL can reach maxCL (#87)
• 8544b8c Sidecar: Enable Lyft type sidecars
• 6636cbc Release commit for Kubernetes v1.35.5
• b9ffe7c kubeadm: use dedicated ClusterRole for apiserver kubelet client
• 7909267 kubeadm: skip LocalAPIEndpoint defaulting on worker join
• f792796 kubeadm: use the localAPIEndpoint for all API calls in 'init'
• faa8112 kube-proxy: don't do full periodic syncs on large cluster mode
• 943d941 Delete remote endpoint if it has same ip as local endpoint in the system.
• d550d45 Delete remote endpoint if it has same ip as local endpoint in the system.
• 6d314b2 Add a (*Client) addEndpoint method
• feb7fa1 Evaluate etcd cluster health using quorum
• 1a7f0b3 Escape path inside the container
• 6953afb scheduler: address recreated pod review feedback
• bf14155 scheduler: skip requeueing recreated pods on scheduling failure
• 55f12e8 scheduler: fix inFlightPods leak when pod is recreated during scheduling failure
• 31d47ca Update CHANGELOG/CHANGELOG-1.35.md for v1.35.4
• 7b8c6cf Release commit for Kubernetes v1.35.4
• 1687aa8 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• e87f6b9 update go.opentelemetry.io/otel to v1.41.0
• 97ccbdf Bump images and versions to go 1.25.9 and distroless iptables
• 69dd59d podStartSLOduration excludes init container runtime and image pulling time, includes only stateless and immediately schedulable pods
• 46ba1c3 Deflake TestPodSubresourceAuth by waiting for effective permissions before testing
• 1d5e94e podresources: filter out inactive pods in Get()
• 91a1e8b e2e: node: podresources: fix expectations for Get() and terminated pods
• 9d8bbea Fix device plugin admission failure after container restart
• d8a562b Fix backport differences for 1.35 (remove WithOrigin and MarkAlpha)
• b6ee759 Add slice and map union member support with tests
• 3d39627 Use IsZero instead of IsNil for union ratcheting check
• 7b708cc Add DRA test for device attribute with no value set
• 863ed56 Add nil OldValue test coverage for union doc_tests
• 9a39e5c Fix union validation ratcheting when oldObj is nil
• b0ec348 KEP-961: demote maxUnavailable feature in statefulset to off by default
• 570f471 kubelet: fix sidecar restart after kubelet restart
• 4c04292 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.3
• 6c1cd99 Release commit for Kubernetes v1.35.3
• 93de120 pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions
• 6b56734 Update knftables to v0.0.21
• b57e146 cmd/kubeadm: ignore EINVAL error during unmount
• af6488c Use localhost image reference in PodObservedGenerationTracking test
• 61003ad drop publishing rules from dependencies.yaml on release branch
• b9be60a start scheduler after creating binding/non-binding slices
• 659d489 dra: stabilize DeviceBindingConditions BasicFlow by creating without-binding slice first
• 02115b6 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.2
• fdc9d74 Release commit for Kubernetes v1.35.2
• 1c0c911 kubeadm: do not add learner member to etcd client endpoints
• d05c506 Fix flake TestDeviceTaintRule test by adjusting event hanlder status update logic Co-authored-by: Pohly patrick.ohly@intel.com
• 69d9b9b Bump images and versions to go 1.25.7 and distroless iptables
• 2371267 add dockerized go cache to make clean
• de51841 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.1
• bd39991 fake client-go: un-deprecate NewSimpleClientset
• 0a9d14b Fix flaky TestApplyCRDuringCRDFinalization test
• 38378d5 Bugfix: calculate request latency properly in audit log filter

v1.35.6-dd.9

Changelog

• 09fec18 Update to new version of the base image
• 6ca0bc1 feat(apiserver): add OTel tracing spans for VAP/MAP CEL evaluation
• eb058ae perf(apiserver): cache CEL conversions on VersionedAttributes
• 7908514 noderesources: exempt annotated pods from max-pod-count cap
• 14346f4 fix(kube-apiserver): always refetch JWKS on unknown key ID
• 5c38d7e patch from PR# 133654
• ba719b9 Conflicts errors don't count against retries datadog:patch (#98)
• 20758c9 fix ds controller deletes pod when not match RequiredDuringSchedulingIgnoredDuringExecution
• cb6787d - Enable boringcrypto when building.
• 112b918 flowcontrol: currentCL can reach maxCL (#87)
• 4a5cee4 Sidecar: Enable Lyft type sidecars
• fc0e7a6 Release commit for Kubernetes v1.35.6
• 5ccf8f4 Bump images and versions to go 1.25.11 and distroless iptables
• d44082b Fix wrong marking of errors
• d2212b8 kubeadm: fix dry-run CA copy paths in init certs
• a74c5bf Fix DRA scoring bug with mixed allocated and unallocated claims
• 77292b8 fix(endpoint): avoid panic on services with empty IPFamilies
• df562ae fix(csi): preserve mount dir on NodePublish error during remount
• f1ce76d feat(volume): add IsRemount to MounterArgs
• b596e7b Restore ability to plumb binary data through envvar values
• 4a0532b Cache selinux conflicts
• fd08821 controller/selinuxwarning/cache: Add reverse index
• 9f52f4d controller/selinuxwarning: Pre-parse SELinux label
• 350f793 DRA: fix AllocationModeAll with consumed counters
• 90640ec Update CHANGELOG/CHANGELOG-1.35.md for v1.35.5
• 6636cbc Release commit for Kubernetes v1.35.5
• b9ffe7c kubeadm: use dedicated ClusterRole for apiserver kubelet client
• 7909267 kubeadm: skip LocalAPIEndpoint defaulting on worker join
• f792796 kubeadm: use the localAPIEndpoint for all API calls in 'init'
• faa8112 kube-proxy: don't do full periodic syncs on large cluster mode
• 943d941 Delete remote endpoint if it has same ip as local endpoint in the system.
• d550d45 Delete remote endpoint if it has same ip as local endpoint in the system.
• 6d314b2 Add a (*Client) addEndpoint method
• feb7fa1 Evaluate etcd cluster health using quorum
• 1a7f0b3 Escape path inside the container
• 6953afb scheduler: address recreated pod review feedback
• bf14155 scheduler: skip requeueing recreated pods on scheduling failure
• 55f12e8 scheduler: fix inFlightPods leak when pod is recreated during scheduling failure
• 31d47ca Update CHANGELOG/CHANGELOG-1.35.md for v1.35.4
• 7b8c6cf Release commit for Kubernetes v1.35.4
• 1687aa8 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• e87f6b9 update go.opentelemetry.io/otel to v1.41.0
• 97ccbdf Bump images and versions to go 1.25.9 and distroless iptables
• 69dd59d podStartSLOduration excludes init container runtime and image pulling time, includes only stateless and immediately schedulable pods
• 46ba1c3 Deflake TestPodSubresourceAuth by waiting for effective permissions before testing
• 1d5e94e podresources: filter out inactive pods in Get()
• 91a1e8b e2e: node: podresources: fix expectations for Get() and terminated pods
• 9d8bbea Fix device plugin admission failure after container restart
• d8a562b Fix backport differences for 1.35 (remove WithOrigin and MarkAlpha)
• b6ee759 Add slice and map union member support with tests
• 3d39627 Use IsZero instead of IsNil for union ratcheting check
• 7b708cc Add DRA test for device attribute with no value set
• 863ed56 Add nil OldValue test coverage for union doc_tests
• 9a39e5c Fix union validation ratcheting when oldObj is nil
• b0ec348 KEP-961: demote maxUnavailable feature in statefulset to off by default
• 570f471 kubelet: fix sidecar restart after kubelet restart
• 4c04292 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.3
• 6c1cd99 Release commit for Kubernetes v1.35.3
• 93de120 pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions
• 6b56734 Update knftables to v0.0.21
• b57e146 cmd/kubeadm: ignore EINVAL error during unmount
• af6488c Use localhost image reference in PodObservedGenerationTracking test
• 61003ad drop publishing rules from dependencies.yaml on release branch
• b9be60a start scheduler after creating binding/non-binding slices
• 659d489 dra: stabilize DeviceBindingConditions BasicFlow by creating without-binding slice first
• 02115b6 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.2
• fdc9d74 Release commit for Kubernetes v1.35.2
• 1c0c911 kubeadm: do not add learner member to etcd client endpoints
• d05c506 Fix flake TestDeviceTaintRule test by adjusting event hanlder status update logic Co-authored-by: Pohly patrick.ohly@intel.com
• 69d9b9b Bump images and versions to go 1.25.7 and distroless iptables
• 2371267 add dockerized go cache to make clean
• de51841 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.1
• bd39991 fake client-go: un-deprecate NewSimpleClientset
• 0a9d14b Fix flaky TestApplyCRDuringCRDFinalization test
• 38378d5 Bugfix: calculate request latency properly in audit log filter

v1.35.5-dd.9

Changelog

• 45ec83d Update to new version of the base image
• bb32fb7 feat(apiserver): add OTel tracing spans for VAP/MAP CEL evaluation
• 46019b3 perf(apiserver): cache CEL conversions on VersionedAttributes
• 98a6bd2 noderesources: exempt annotated pods from max-pod-count cap
• f9f3a93 fix(kube-apiserver): always refetch JWKS on unknown key ID
• 3056adb patch from PR# 133654
• d70a1e0 Conflicts errors don't count against retries datadog:patch (#98)
• eeb3ad1 fix ds controller deletes pod when not match RequiredDuringSchedulingIgnoredDuringExecution
• ef843b8 - Enable boringcrypto when building.
• 12e54bc flowcontrol: currentCL can reach maxCL (#87)
• 824d704 Sidecar: Enable Lyft type sidecars
• 6636cbc Release commit for Kubernetes v1.35.5
• b9ffe7c kubeadm: use dedicated ClusterRole for apiserver kubelet client
• 7909267 kubeadm: skip LocalAPIEndpoint defaulting on worker join
• f792796 kubeadm: use the localAPIEndpoint for all API calls in 'init'
• faa8112 kube-proxy: don't do full periodic syncs on large cluster mode
• 943d941 Delete remote endpoint if it has same ip as local endpoint in the system.
• d550d45 Delete remote endpoint if it has same ip as local endpoint in the system.
• 6d314b2 Add a (*Client) addEndpoint method
• feb7fa1 Evaluate etcd cluster health using quorum
• 1a7f0b3 Escape path inside the container
• 6953afb scheduler: address recreated pod review feedback
• bf14155 scheduler: skip requeueing recreated pods on scheduling failure
• 55f12e8 scheduler: fix inFlightPods leak when pod is recreated during scheduling failure
• 31d47ca Update CHANGELOG/CHANGELOG-1.35.md for v1.35.4
• 7b8c6cf Release commit for Kubernetes v1.35.4
• 1687aa8 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• e87f6b9 update go.opentelemetry.io/otel to v1.41.0
• 97ccbdf Bump images and versions to go 1.25.9 and distroless iptables
• 69dd59d podStartSLOduration excludes init container runtime and image pulling time, includes only stateless and immediately schedulable pods
• 46ba1c3 Deflake TestPodSubresourceAuth by waiting for effective permissions before testing
• 1d5e94e podresources: filter out inactive pods in Get()
• 91a1e8b e2e: node: podresources: fix expectations for Get() and terminated pods
• 9d8bbea Fix device plugin admission failure after container restart
• d8a562b Fix backport differences for 1.35 (remove WithOrigin and MarkAlpha)
• b6ee759 Add slice and map union member support with tests
• 3d39627 Use IsZero instead of IsNil for union ratcheting check
• 7b708cc Add DRA test for device attribute with no value set
• 863ed56 Add nil OldValue test coverage for union doc_tests
• 9a39e5c Fix union validation ratcheting when oldObj is nil
• b0ec348 KEP-961: demote maxUnavailable feature in statefulset to off by default
• 570f471 kubelet: fix sidecar restart after kubelet restart
• 4c04292 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.3
• 6c1cd99 Release commit for Kubernetes v1.35.3
• 93de120 pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions
• 6b56734 Update knftables to v0.0.21
• b57e146 cmd/kubeadm: ignore EINVAL error during unmount
• af6488c Use localhost image reference in PodObservedGenerationTracking test
• 61003ad drop publishing rules from dependencies.yaml on release branch
• b9be60a start scheduler after creating binding/non-binding slices
• 659d489 dra: stabilize DeviceBindingConditions BasicFlow by creating without-binding slice first
• 02115b6 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.2
• fdc9d74 Release commit for Kubernetes v1.35.2
• 1c0c911 kubeadm: do not add learner member to etcd client endpoints
• d05c506 Fix flake TestDeviceTaintRule test by adjusting event hanlder status update logic Co-authored-by: Pohly patrick.ohly@intel.com
• 69d9b9b Bump images and versions to go 1.25.7 and distroless iptables
• 2371267 add dockerized go cache to make clean
• de51841 Update CHANGELOG/CHANGELOG-1.35.md for v1.35.1
• bd39991 fake client-go: un-deprecate NewSimpleClientset
• 0a9d14b Fix flaky TestApplyCRDuringCRDFinalization test
• 38378d5 Bugfix: calculate request latency properly in audit log filter

v1.34.9-dd.11

Changelog

• f3953dd Update to new version of the base image
• 1aa3e83 noderesources: exempt annotated pods from max-pod-count cap
• 0a1946b fix(kube-apiserver): always refetch JWKS on unknown key ID
• beccf60 patch from PR# 133654
• 2c84b4f Conflicts errors don't count against retries datadog:patch (#98)
• 9895b18 fix ds controller deletes pod when not match RequiredDuringSchedulingIgnoredDuringExecution
• 4286233 - Enable boringcrypto in the build image
• 7ac357b flowcontrol: currentCL can reach maxCL (#87)
• 2a535c1 Sidecar: Enable Lyft type sidecars
• ad7c737 Release commit for Kubernetes v1.34.9
• 2a666d3 Bump images and versions to go 1.25.11 and distroless iptables
• 718d9e6 kubeadm: fix dry-run CA copy paths in init certs
• b135fba fix(endpoint): avoid panic on services with empty IPFamilies
• 1b82d45 fix(csi): preserve mount dir on NodePublish error during remount
• 58b0072 feat(volume): add IsRemount to MounterArgs
• 1e8b97d Restore ability to plumb binary data through envvar values
• 811df22 Update CHANGELOG/CHANGELOG-1.34.md for v1.34.8
• 1f328c5 Release commit for Kubernetes v1.34.8
• 3eb96fe kubeadm: use dedicated ClusterRole for apiserver kubelet client
• 8e92749 kubeadm: skip LocalAPIEndpoint defaulting on worker join
• d0c333c kubeadm: use the localAPIEndpoint for all API calls in 'init'
• 2df7128 kube-proxy: don't do full periodic syncs on large cluster mode
• ce035f3 Delete remote endpoint if it has same ip as local endpoint in the system.
• b13bd47 Delete remote endpoint if it has same ip as local endpoint in the system.
• a15a8c9 Add a (*Client) addEndpoint method
• ca1b774 Evaluate etcd cluster health using quorum
• 8aebf02 Escape path inside the container
• df429e2 scheduler: address recreated pod review feedback
• d7fec89 scheduler: skip requeueing recreated pods on scheduling failure
• 0fbabba scheduler: fix inFlightPods leak when pod is recreated during scheduling failure
• 9611999 Update CHANGELOG/CHANGELOG-1.34.md for v1.34.7
• 66d3c15 Release commit for Kubernetes v1.34.7
• da7c39f Fix IPv6 allocator for /64 CIDRs
• 4b3d41f Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• 27f03cc update go.opentelemetry.io/otel to v1.41.0
• e9820ab Bump images and versions to go 1.25.9 and distroless iptables
• 8d6ca23 Bump to go 1.25
• 00bd02c podStartSLOduration excludes init container runtime and image pulling time, includes only stateless and immediately schedulable pods
• 9c0f626 podresources: filter out inactive pods in Get()
• aa1f18e e2e: node: podresources: fix expectations for Get() and terminated pods
• 5dea39f Fix device plugin admission failure after container restart
• 0b87e64 Fix flaking RunTestDelayedWatchDelivery
• f95ab20 Update CHANGELOG/CHANGELOG-1.34.md for v1.34.6
• 8b2bf66 Release commit for Kubernetes v1.34.6
• 77ba3a8 pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions
• 82db891 Update knftables to v0.0.21
• 87990de drop publishing rules from dependencies.yaml on release branch
• da50ffd cmd/kubeadm: ignore EINVAL error during unmount
• 7c49a01 Update CHANGELOG/CHANGELOG-1.34.md for v1.34.5
• 1e54c34 kubeadm: do not add learner member to etcd client endpoints
• 9dfc82f fix: parsing the patch directly
• 8505698 Use fast policy refresh interval for TestParamRef
• dd36f43 Fix flaky TestApplyCRDuringCRDFinalization test
• 80c3d91 Bugfix: calculate request latency properly in audit log filter

v1.34.8-dd.10

Changelog

• 5f60a15 Update to new version of the base image
• c171ebf noderesources: exempt annotated pods from max-pod-count cap
• 17d13ce fix(kube-apiserver): always refetch JWKS on unknown key ID
• fde3daf patch from PR# 133654
• 0443d38 Conflicts errors don't count against retries datadog:patch (#98)
• e60ae71 fix ds controller deletes pod when not match RequiredDuringSchedulingIgnoredDuringExecution
• cfa806a - Enable boringcrypto in the build image
• bc8f3cd flowcontrol: currentCL can reach maxCL (#87)
• eea2d61 Sidecar: Enable Lyft type sidecars
• 1f328c5 Release commit for Kubernetes v1.34.8
• 3eb96fe kubeadm: use dedicated ClusterRole for apiserver kubelet client
• 8e92749 kubeadm: skip LocalAPIEndpoint defaulting on worker join
• d0c333c kubeadm: use the localAPIEndpoint for all API calls in 'init'
• 2df7128 kube-proxy: don't do full periodic syncs on large cluster mode
• ce035f3 Delete remote endpoint if it has same ip as local endpoint in the system.
• b13bd47 Delete remote endpoint if it has same ip as local endpoint in the system.
• a15a8c9 Add a (*Client) addEndpoint method
• ca1b774 Evaluate etcd cluster health using quorum
• 8aebf02 Escape path inside the container
• df429e2 scheduler: address recreated pod review feedback
• d7fec89 scheduler: skip requeueing recreated pods on scheduling failure
• 0fbabba scheduler: fix inFlightPods leak when pod is recreated during scheduling failure
• 9611999 Update CHANGELOG/CHANGELOG-1.34.md for v1.34.7
• 66d3c15 Release commit for Kubernetes v1.34.7
• da7c39f Fix IPv6 allocator for /64 CIDRs
• 4b3d41f Update github.com/moby/spdystream from v0.5.0 to v0.5.1
• 27f03cc update go.opentelemetry.io/otel to v1.41.0
• e9820ab Bump images and versions to go 1.25.9 and distroless iptables
• 8d6ca23 Bump to go 1.25
• 00bd02c podStartSLOduration excludes init container runtime and image pulling time, includes only stateless and immediately schedulable pods
• 9c0f626 podresources: filter out inactive pods in Get()
• aa1f18e e2e: node: podresources: fix expectations for Get() and terminated pods
• 5dea39f Fix device plugin admission failure after container restart
• 0b87e64 Fix flaking RunTestDelayedWatchDelivery
• f95ab20 Update CHANGELOG/CHANGELOG-1.34.md for v1.34.6
• 8b2bf66 Release commit for Kubernetes v1.34.6
• 77ba3a8 pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions
• 82db891 Update knftables to v0.0.21
• 87990de drop publishing rules from dependencies.yaml on release branch
• da50ffd cmd/kubeadm: ignore EINVAL error during unmount
• 7c49a01 Update CHANGELOG/CHANGELOG-1.34.md for v1.34.5
• 1e54c34 kubeadm: do not add learner member to etcd client endpoints
• 9dfc82f fix: parsing the patch directly
• 8505698 Use fast policy refresh interval for TestParamRef
• dd36f43 Fix flaky TestApplyCRDuringCRDFinalization test
• 80c3d91 Bugfix: calculate request latency properly in audit log filter

v1.35.6-dd.8

Changelog

• 06654cd feat(apiserver): add OTel tracing spans for VAP/MAP CEL evaluation

v1.35.5-dd.8

Changelog

• 1cd7262 feat(apiserver): add OTel tracing spans for VAP/MAP CEL evaluation