Changes by Kind
Security
- Update
github.com/golang-jwt/jwt/v4
to v4.5.2 (addressing CVE-2025-30204) (#3352, @embik) (#3454, @xrstf)
Deprecation
- Deprecate
APIExport
Virtual Workspace URL population. Add feature flagEnableDeprecatedAPIExportVirtualWorkspacesUrls
to re-enable deprecatedAPIExport
Virtual Workspace URLs (#3411, @mjudeikis)
API Change
- Add caching API under
cache.kcp.io
to be able to interact with cache server programmatically (#3382, @mjudeikis) - Add optional
spec.mount
toWorkspace
objects to stabilize mount API (#3380, @mjudeikis) - Add
CachedResourcesEndpointSlice
resource (#3442, @gman0) - Add new version of
APIBinding
toapis.kcp.io/v1alpha2
(#3384, @xmudrii) - Add new version of
APIExport
toapis.kcp.io/v1alpha2
(#3318, @xrstf) - Implement support for verbs in PermissionClaims (#3402, @xmudrii)
- Make
CachedResource
GVR immutable and unique in the logical cluster (#3476, @gman0) - Rebase to Kubernetes v1.32.3 (#3383, @gman0)
ValidatingAdmissionPolicy
has been removed fromadmissionregistration.k8s.io/v1alpha1
as per Kubernetes v1.32 API lifecycle managementadmissionregistration.k8s.io/v1alpha1
is no longer being served by default- Stop printing Ready column for
APIExports
as virtual workspace URLs are no longer populated by default (#3493, @embik) - Add
sdk/testing/server.ContextRunInProcessFunc
. Deprecatesdk/testing/server.RunInProcessFunc
(#3388, @ntnn) - Serve both
v1alpha1
andv1alpha2
ofAPIBindings
in theAPIExport
Virtual Workspace (#3430, @xmudrii) - Fix a panic in the OpenAPI v3 endpoint for Virtual Workspaces happening if there's a resource with two or more versions
Feature
- Add Replication virtual workspace for
CachedResource
. Endpoint for the Replication VW is now displayed in its respectiveCachedResourceEndpointSlice
(#3480, @gman0) - Add a new
--root-identities-file
CLI flag tokcp
used to bootstrap APIExport identities inside the root workspace (#3400, @gman0) - Add a controller to automatically keep defaultAPIBindings defined in a
WorkspaceType
up to date in all workspaces that derive from it. This behaviour is enabled by configuring.spec.defaultAPIBindingLifecycle
(#3381, @MisterMX) - Enable CLI flag
--encryption-provider-config
in thekcp
binary (#3470, @adrianrobotka) - Print flags in sections for
kcp-front-proxy
binary (#3385, @sttts) - Run the admission chain in the virtual workspace (forwarding) registry with the
create
verb upon creating a new object using server-side apply. As a result, running the server-side apply for a claimed resource in the APIExport Virtual Workspace requires thecreate
verb (#3439, @xmudrii) - The kcp specific CRDs are now bundled into one yaml file that is part of the release (#3466, @mikkeldamsgaard)
Bug or Regression
- Authorization checks on resources from an
APIExport
delegate to the next authorizer if theAPIExport
is not found (#3467, @ntnn) - Disable the
cd semantic
notice when--short
is provided (#3423, @ntnn) - Fix
--bind-address
not being honoured in some generated configuration files (#3418, @ntnn) - Fix
APIResourceSchema
name for theWorkspaceTypes
resource to unblock upgrade from previous versions (#3349, @embik) - Fix URL update when logicalcluster URL changes but workspace URL is not updated (#3474, @mjudeikis)
- Only set
experimental.tenancy.kcp.io/owner
annotation onLogicalCluster
ifWorkspace
has the annotation (#3438, @embik) - Remove
VOLUME
from Dockerfile so no/data
volume is mounted anymore (#3434, @embik)
Other (Cleanup or Flake)
- Fix consistency for DynamicRestMapper & workspace cleaner (#3447, @mjudeikis)
- Move to use dynamicRestMapper everywhere to dynamically resolve Kind to resource and vice versa (#3462, @mjudeikis)
- Update to Go 1.23.10 (#3443, @xrstf)
- Update to kcp/code-generator v3 (#3406, @xrstf)
- Stop exposing mini-front-proxy handlers (including
/metrics
) on kcp server unless--additional-mappings-file
is passed (#3361, @embik)
Dependencies
Added
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.24.2
- github.com/Microsoft/hnslib: v0.0.8
- github.com/containerd/containerd/api: v1.7.19
- github.com/containerd/errdefs: v0.1.0
- github.com/containerd/log: v0.1.0
- github.com/kcp-dev/code-generator/v3: 4094fb8
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/externaljwt: ddbe171
- github.com/klauspost/compress: v1.17.11
- github.com/kylelemons/godebug: v1.1.0
- github.com/moby/sys/userns: v0.1.0
- github.com/planetscale/vtprotobuf: 0393e58
- go.opentelemetry.io/auto/sdk: v1.1.0
- go.opentelemetry.io/contrib/detectors/gcp: v1.31.0
- go.opentelemetry.io/otel/sdk/metric: v1.31.0
Changed
- cel.dev/expr: v0.15.0 → v0.19.1
- cloud.google.com/go/accessapproval: v1.7.1 → v1.7.5
- cloud.google.com/go/accesscontextmanager: v1.8.1 → v1.8.5
- cloud.google.com/go/aiplatform: v1.48.0 → v1.60.0
- cloud.google.com/go/analytics: v0.21.3 → v0.23.0
- cloud.google.com/go/apigateway: v1.6.1 → v1.6.5
- cloud.google.com/go/apigeeconnect: v1.6.1 → v1.6.5
- cloud.google.com/go/apigeeregistry: v0.7.1 → v0.8.3
- cloud.google.com/go/appengine: v1.8.1 → v1.8.5
- cloud.google.com/go/area120: v0.8.1 → v0.8.5
- cloud.google.com/go/artifactregistry: v1.14.1 → v1.14.7
- cloud.google.com/go/asset: v1.14.1 → v1.17.2
- cloud.google.com/go/assuredworkloads: v1.11.1 → v1.11.5
- cloud.google.com/go/automl: v1.13.1 → v1.13.5
- cloud.google.com/go/baremetalsolution: v1.1.1 → v1.2.4
- cloud.google.com/go/batch: v1.3.1 → v1.8.0
- cloud.google.com/go/beyondcorp: v1.0.0 → v1.0.4
- cloud.google.com/go/bigquery: v1.53.0 → v1.59.1
- cloud.google.com/go/billing: v1.16.0 → v1.18.2
- cloud.google.com/go/binaryauthorization: v1.6.1 → v1.8.1
- cloud.google.com/go/certificatemanager: v1.7.1 → v1.7.5
- cloud.google.com/go/channel: v1.16.0 → v1.17.5
- cloud.google.com/go/cloudbuild: v1.13.0 → v1.15.1
- cloud.google.com/go/clouddms: v1.6.1 → v1.7.4
- cloud.google.com/go/cloudtasks: v1.12.1 → v1.12.6
- cloud.google.com/go/compute/metadata: v0.3.0 → v0.5.2
- cloud.google.com/go/compute: v1.23.0 → v1.24.0
- cloud.google.com/go/contactcenterinsights: v1.10.0 → v1.13.0
- cloud.google.com/go/container: v1.24.0 → v1.31.0
- cloud.google.com/go/containeranalysis: v0.10.1 → v0.11.4
- cloud.google.com/go/datacatalog: v1.16.0 → v1.19.3
- cloud.google.com/go/dataflow: v0.9.1 → v0.9.5
- cloud.google.com/go/dataform: v0.8.1 → v0.9.2
- cloud.google.com/go/datafusion: v1.7.1 → v1.7.5
- cloud.google.com/go/datalabeling: v0.8.1 → v0.8.5
- cloud.google.com/go/dataplex: v1.9.0 → v1.14.2
- cloud.google.com/go/dataproc/v2: v2.0.1 → v2.4.0
- cloud.google.com/go/dataqna: v0.8.1 → v0.8.5
- cloud.google.com/go/datastore: v1.13.0 → v1.15.0
- cloud.google.com/go/datastream: v1.10.0 → v1.10.4
- cloud.google.com/go/deploy: v1.13.0 → v1.17.1
- cloud.google.com/go/dialogflow: v1.40.0 → v1.49.0
- cloud.google.com/go/dlp: v1.10.1 → v1.11.2
- cloud.google.com/go/documentai: v1.22.0 → v1.25.0
- cloud.google.com/go/domains: v0.9.1 → v0.9.5
- cloud.google.com/go/edgecontainer: v1.1.1 → v1.1.5
- cloud.google.com/go/essentialcontacts: v1.6.2 → v1.6.6
- cloud.google.com/go/eventarc: v1.13.0 → v1.13.4
- cloud.google.com/go/filestore: v1.7.1 → v1.8.1
- cloud.google.com/go/firestore: v1.12.0 → v1.14.0
- cloud.google.com/go/functions: v1.15.1 → v1.16.0
- cloud.google.com/go/gkebackup: v1.3.0 → v1.3.5
- cloud.google.com/go/gkeconnect: v0.8.1 → v0.8.5
- cloud.google.com/go/gkehub: v0.14.1 → v0.14.5
- cloud.google.com/go/gkemulticloud: v1.0.0 → v1.1.1
- cloud.google.com/go/gsuiteaddons: v1.6.1 → v1.6.5
- cloud.google.com/go/iam: v1.1.1 → v1.1.6
- cloud.google.com/go/iap: v1.8.1 → v1.9.4
- cloud.google.com/go/ids: v1.4.1 → v1.4.5
- cloud.google.com/go/iot: v1.7.1 → v1.7.5
- cloud.google.com/go/kms: v1.15.0 → v1.15.7
- cloud.google.com/go/language: v1.10.1 → v1.12.3
- cloud.google.com/go/lifesciences: v0.9.1 → v0.9.5
- cloud.google.com/go/logging: v1.7.0 → v1.9.0
- cloud.google.com/go/longrunning: v0.5.1 → v0.5.5
- cloud.google.com/go/managedidentities: v1.6.1 → v1.6.5
- cloud.google.com/go/maps: v1.4.0 → v1.6.4
- cloud.google.com/go/mediatranslation: v0.8.1 → v0.8.5
- cloud.google.com/go/memcache: v1.10.1 → v1.10.5
- cloud.google.com/go/metastore: v1.12.0 → v1.13.4
- cloud.google.com/go/monitoring: v1.15.1 → v1.18.0
- cloud.google.com/go/networkconnectivity: v1.12.1 → v1.14.4
- cloud.google.com/go/networkmanagement: v1.8.0 → v1.9.4
- cloud.google.com/go/networksecurity: v0.9.1 → v0.9.5
- cloud.google.com/go/notebooks: v1.9.1 → v1.11.3
- cloud.google.com/go/optimization: v1.4.1 → v1.6.3
- cloud.google.com/go/orchestration: v1.8.1 → v1.8.5
- cloud.google.com/go/orgpolicy: v1.11.1 → v1.12.1
- cloud.google.com/go/osconfig: v1.12.1 → v1.12.5
- cloud.google.com/go/oslogin: v1.10.1 → v1.13.1
- cloud.google.com/go/phishingprotection: v0.8.1 → v0.8.5
- cloud.google.com/go/policytroubleshooter: v1.8.0 → v1.10.3
- cloud.google.com/go/privatecatalog: v0.9.1 → v0.9.5
- cloud.google.com/go/pubsub: v1.33.0 → v1.36.1
- cloud.google.com/go/recaptchaenterprise/v2: v2.7.2 → v2.9.2
- cloud.google.com/go/recommendationengine: v0.8.1 → v0.8.5
- cloud.google.com/go/recommender: v1.10.1 → v1.12.1
- cloud.google.com/go/redis: v1.13.1 → v1.14.2
- cloud.google.com/go/resourcemanager: v1.9.1 → v1.9.5
- cloud.google.com/go/resourcesettings: v1.6.1 → v1.6.5
- cloud.google.com/go/retail: v1.14.1 → v1.16.0
- cloud.google.com/go/run: v1.2.0 → v1.3.4
- cloud.google.com/go/scheduler: v1.10.1 → v1.10.6
- cloud.google.com/go/secretmanager: v1.11.1 → v1.11.5
- cloud.google.com/go/security: v1.15.1 → v1.15.5
- cloud.google.com/go/securitycenter: v1.23.0 → v1.24.4
- cloud.google.com/go/servicedirectory: v1.11.0 → v1.11.4
- cloud.google.com/go/shell: v1.7.1 → v1.7.5
- cloud.google.com/go/spanner: v1.47.0 → v1.56.0
- cloud.google.com/go/speech: v1.19.0 → v1.21.1
- cloud.google.com/go/storagetransfer: v1.10.0 → v1.10.4
- cloud.google.com/go/talent: v1.6.2 → v1.6.6
- cloud.google.com/go/texttospeech: v1.7.1 → v1.7.5
- cloud.google.com/go/tpu: v1.6.1 → v1.6.5
- cloud.google.com/go/trace: v1.10.1 → v1.10.5
- cloud.google.com/go/translate: v1.8.2 → v1.10.1
- cloud.google.com/go/video: v1.19.0 → v1.20.4
- cloud.google.com/go/videointelligence: v1.11.1 → v1.11.5
- cloud.google.com/go/vision/v2: v2.7.2 → v2.8.0
- cloud.google.com/go/vmmigration: v1.7.1 → v1.7.5
- cloud.google.com/go/vmwareengine: v1.0.0 → v1.1.1
- cloud.google.com/go/vpcaccess: v1.7.1 → v1.7.5
- cloud.google.com/go/webrisk: v1.9.1 → v1.9.5
- cloud.google.com/go/websecurityscanner: v1.6.1 → v1.6.5
- cloud.google.com/go/workflows: v1.11.1 → v1.12.4
- cloud.google.com/go: v0.110.7 → v0.112.0
- github.com/Azure/go-ansiterm: d185dfc → 306776e
- github.com/Microsoft/go-winio: v0.6.0 → v0.6.2
- github.com/antlr4-go/antlr/v4: v4.13.0 → v4.13.1
- github.com/armon/circbuf: bbbad09 → 5111143
- github.com/cncf/xds/go: 555b57e → b4127c9
- github.com/containerd/ttrpc: v1.2.2 → v1.2.5
- github.com/coredns/corefile-migration: v1.0.23 → v1.0.24
- github.com/cpuguy83/go-md2man/v2: v2.0.4 → v2.0.6
- github.com/cyphar/filepath-securejoin: v0.2.4 → v0.3.4
- github.com/distribution/reference: v0.5.0 → v0.6.0
- github.com/emicklei/go-restful/v3: v3.11.0 → v3.12.1
- github.com/envoyproxy/go-control-plane: v0.12.0 → v0.13.1
- github.com/envoyproxy/protoc-gen-validate: v1.0.4 → v1.1.0
- github.com/exponent-io/jsonpath: d6023ce → 1de76d7
- github.com/fatih/color: v1.15.0 → v1.18.0
- github.com/golang-jwt/jwt/v4: v4.5.0 → v4.5.2
- github.com/golang/glog: v1.2.1 → v1.2.2
- github.com/google/btree: v1.0.1 → v1.1.3
- github.com/google/cadvisor: v0.49.0 → v0.51.0
- github.com/google/cel-go: v0.20.1 → v0.22.1
- github.com/google/go-cmp: v0.6.0 → v0.7.0
- github.com/google/pprof: 4bfdf5a → 40e02aa
- github.com/gregjones/httpcache: 9cad4c3 → 901d907
- github.com/grpc-ecosystem/grpc-gateway/v2: v2.20.0 → v2.25.1
- github.com/jonboulle/clockwork: v0.2.2 → v0.4.0
- github.com/kcp-dev/apimachinery/v2: 431177b → ebb573a
- github.com/kcp-dev/client-go: 3dea338 → decc4df
- github.com/kcp-dev/embeddedetcd: v1.0.2 → 89d1631
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/api: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/apiextensions-apiserver: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/apimachinery: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/apiserver: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/cli-runtime: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/client-go: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/cloud-provider: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/cluster-bootstrap: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/code-generator: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-base: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-helpers: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/controller-manager: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/cri-api: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/cri-client: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/csi-translation-lib: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/dynamic-resource-allocation: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/endpointslice: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/kms: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-aggregator: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-controller-manager: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-proxy: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-scheduler: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/kubectl: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/kubelet: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/metrics: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/mount-utils: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/pod-security-admission: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes/staging/src/k8s.io/sample-apiserver: 0011b8c → ddbe171
- github.com/kcp-dev/kubernetes: 0011b8c → ddbe171
- github.com/mattn/go-isatty: v0.0.17 → v0.0.20
- github.com/moby/spdystream: v0.4.0 → v0.5.0
- github.com/moby/sys/mountinfo: v0.7.1 → v0.7.2
- github.com/mohae/deepcopy: 491d360 → c48cc78
- github.com/onsi/ginkgo/v2: v2.19.0 → v2.22.1
- github.com/onsi/gomega: v1.33.1 → v1.36.2
- github.com/opencontainers/runc: v1.1.13 → v1.2.1
- github.com/opencontainers/runtime-spec: 494a5a6 → v1.2.0
- github.com/opencontainers/selinux: v1.11.0 → v1.11.1
- github.com/prometheus/client_golang: v1.19.1 → v1.20.5
- github.com/prometheus/common: v0.55.0 → v0.61.0
- github.com/rogpeppe/go-internal: v1.12.0 → v1.13.1
- github.com/spf13/cobra: v1.8.1 → v1.9.1
- github.com/stretchr/testify: v1.9.0 → v1.10.0
- github.com/vishvananda/netlink: v1.1.0 → 62fb240
- github.com/xiang90/probing: 43a291a → a49e3df
- go.etcd.io/bbolt: v1.3.9 → v1.3.11
- go.etcd.io/etcd/api/v3: v3.5.14 → v3.5.17
- go.etcd.io/etcd/client/pkg/v3: v3.5.14 → v3.5.17
- go.etcd.io/etcd/client/v2: v2.305.13 → v2.305.16
- go.etcd.io/etcd/client/v3: v3.5.14 → v3.5.17
- go.etcd.io/etcd/pkg/v3: v3.5.13 → v3.5.16
- go.etcd.io/etcd/raft/v3: v3.5.13 → v3.5.16
- go.etcd.io/etcd/server/v3: v3.5.13 → v3.5.16
- go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: v0.53.0 → v0.58.0
- go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.53.0 → v0.58.0
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.27.0 → v1.33.0
- go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.28.0 → v1.33.0
- go.opentelemetry.io/otel/metric: v1.28.0 → v1.33.0
- go.opentelemetry.io/otel/sdk: v1.28.0 → v1.33.0
- go.opentelemetry.io/otel/trace: v1.28.0 → v1.33.0
- go.opentelemetry.io/otel: v1.28.0 → v1.33.0
- go.opentelemetry.io/proto/otlp: v1.3.1 → v1.5.0
- go.uber.org/zap: v1.26.0 → v1.27.0
- golang.org/x/crypto: v0.35.0 → v0.37.0
- golang.org/x/exp: f3d0a9c → 7e4ce0a
- golang.org/x/mod: v0.23.0 → v0.24.0
- golang.org/x/net: v0.36.0 → v0.39.0
- golang.org/x/oauth2: v0.21.0 → v0.29.0
- golang.org/x/sync: v0.11.0 → v0.13.0
- golang.org/x/sys: v0.30.0 → v0.32.0
- golang.org/x/term: v0.29.0 → v0.31.0
- golang.org/x/text: v0.22.0 → v0.24.0
- golang.org/x/time: v0.3.0 → v0.11.0
- golang.org/x/tools: v0.30.0 → v0.32.0
- golang.org/x/xerrors: 04be3eb → 5ec99f8
- google.golang.org/appengine: v1.6.7 → v1.4.0
- google.golang.org/genproto/googleapis/api: 5315273 → 5f5ef82
- google.golang.org/genproto/googleapis/rpc: f6361c8 → 5f5ef82
- google.golang.org/genproto: b8732ec → 012b6fc
- google.golang.org/grpc: v1.65.0 → v1.69.2
- google.golang.org/protobuf: v1.36.5 → v1.36.2
- k8s.io/gengo/v2: 51d4e06 → 2b36238
- k8s.io/kube-openapi: 70dd376 → 2c72e55
- k8s.io/system-validators: v1.8.0 → v1.9.1
- k8s.io/utils: 18e509b → 24370be
- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.30.3 → v0.31.1
- sigs.k8s.io/json: bc3834c → cfa47c3
- sigs.k8s.io/kustomize/api: v0.17.2 → v0.18.0
- sigs.k8s.io/kustomize/kustomize/v5: v5.4.2 → v5.5.0
- sigs.k8s.io/kustomize/kyaml: v0.17.1 → v0.18.1
- sigs.k8s.io/structured-merge-diff/v4: v4.4.1 → v4.5.0
Removed
- github.com/Microsoft/hcsshim: v0.8.26
- github.com/checkpoint-restore/go-criu/v5: v5.3.0
- github.com/cilium/ebpf: v0.9.1
- github.com/containerd/cgroups: v1.1.0
- github.com/containerd/console: v1.0.3
- github.com/daviddengcn/go-colortext: v1.0.0
- github.com/imdario/mergo: v0.3.12
- github.com/seccomp/libseccomp-golang: v0.10.0
- github.com/shurcooL/sanitized_anchor_name: v1.0.0
- github.com/syndtr/gocapability: 42c35b4
- github.com/urfave/cli: v1.22.1
- go.opencensus.io: v0.24.0
- go.starlark.net: a134d8f