KubeVPN release v2.11.0

KubeVPN v2.11.0 is available now ! 🎉

Download KubeVPN for your platform

Mac (x86-64/Intel)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.0/kubevpn_v2.11.0_darwin_amd64.zip && unzip -d kubevpn kubevpn.zip

Mac (AArch64/Apple M1 silicon)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.0/kubevpn_v2.11.0_darwin_arm64.zip && unzip -d kubevpn kubevpn.zip

Linux (x86-64)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.0/kubevpn_v2.11.0_linux_amd64.zip && unzip -d kubevpn kubevpn.zip

Linux (AArch64)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.0/kubevpn_v2.11.0_linux_arm64.zip && unzip -d kubevpn kubevpn.zip

Linux (i386)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.0/kubevpn_v2.11.0_linux_386.zip && unzip -d kubevpn kubevpn.zip

Windows (x86-64)

curl -LO https://github.com/kubenetworks/kubevpn/releases/download/v2.11.0/kubevpn_v2.11.0_windows_amd64.zip

Windows (AArch64)

curl -LO https://github.com/kubenetworks/kubevpn/releases/download/v2.11.0/kubevpn_v2.11.0_windows_arm64.zip

Windows (i386)

curl -LO https://github.com/kubenetworks/kubevpn/releases/download/v2.11.0/kubevpn_v2.11.0_windows_386.zip

Checksums

SHA256 checksums available for compiled binaries. Run shasum -a 256 -c checksums.txt to verify.

Upgrading

Run kubevpn upgrade to upgrade from a previous version.

Changelog

• 53c225c0 naison 2026-09-07 test(daemon): cover LoadFromConfig restore-entry branches
• 0b8905ce naison 2026-09-07 refactor(handler): move prepareSyncPodSpec to sync_podspec.go; add tests
• 7f247f04 naison 2026-09-06 refactor(dhcp): extract retryUpdate wrapper for the stateless mutate sites
• 459937a4 naison 2026-09-06 refactor(core): split tun_client.go by concern
• 4e2126e0 naison 2026-09-06 refactor(util): split cidr.go into pure helpers vs cluster-I/O detectors
• 87bc4aa2 naison 2026-09-06 test(util): cover cidr.go pure functions without a cluster
• 80101b48 naison 2026-09-06 fix(daemon): clear currentConnectionID on Quit; add connection concurrency tests
• 616abad5 naison 2026-09-06 test(inject): guard envoyRuleSpec completeness; enforce fargate port invariant
• 8f611a41 naison 2026-09-06 refactor: replace hand-rolled supervision loops with wait.UntilWithContext
• b1eec9ed naison 2026-09-06 refactor(handler): extract cohesive helpers from startTUN and setupDNS
• 95249bfe naison 2026-09-06 refactor(xds): split tun_config.go god file by concern
• df43b75b naison 2026-09-06 test(controlplane): add Virtual serialization round-trip tests; document key format
• a835dd13 naison 2026-09-06 refactor(handler): parameterize duplicated RBAC generators
• fd280dc1 naison 2026-09-06 refactor(util): extract GetNamespace helper to dedupe kubeconfig namespace lookup
• 4addbd76 naison 2026-09-06 fix(daemon): stop sync early-error from crashing the daemon; don't undo on leave
• 2ef8e6c6 fengcaiwen 2026-09-06 fix(util): retry pod-exec on transient stream errors with bounded backoff
• 29d335f9 naison 2026-09-06 ci: fix macOS build failure (merge conflict, TMPDIR, go version)
• 8e9f5da6 naison 2026-09-06 fix(inject): always redirect Service targetPort in fargate/service mode
• 64f658a7 naison 2026-09-06 fix(daemon): leave proxies before tearing down the VPN on quit/disconnect
• 22e7f963 naison 2026-09-06 build: add ut-compile to catch integration-tagged build breakage without a cluster
• 024d0f4d naison 2026-09-06 fix(handler): rename integration test type status to avoid grpc/status import clash
• 20adc69a naison 2026-09-05 docs: pure server-side injection + dual-scope proxy RBAC
• e0929770 naison 2026-09-05 feat(rbac): connect uses a ClusterRole for the central (kubevpn-namespace) manager
• 0afffcc8 naison 2026-09-05 refactor(handler): pure server-side proxy/leave, remove local injection fallback
• bb9261b3 naison 2026-09-05 feat(xds): LeaveInject supports leave-all-by-owner for disconnect cleanup
• 1c0297cd naison 2026-09-05 feat(rbac): proxy ClusterRole for helm central install + namespaced Role for connect
• 87c619d7 naison 2026-08-30 feat(xds): server-side sidecar injection via TunConfigService.ProxyInject
• 396daca1 naison 2026-08-30 refactor(controlplane): extract envoy config types to break inject↔xds cycle
• 9282a35f naison 2026-08-30 fix(dns): scope Linux cluster DNS to the TUN (split), never global resolv.conf
• c22c74f6 naison 2026-08-30 feat(xds): clean up abandoned envoy rules after a TTL (not on lease reap)
• bdad6287 naison 2026-08-30 perf(handler): exponential backoff for port-forward reconnect; extract+test applyRouteFrame
• 110cc1cf naison 2026-08-29 perf(dns): real answer/negative cache with singleflight and cancel-on-first-win
• 96f641c9 naison 2026-08-29 docs: document server-side route/service discovery (44) + update 01/19/24
• 80d0fb4d naison 2026-08-29 test(xds): cover WatchNamespaceRoutes snapshot/delta, CIDR aggregation, degrade
• 5f0ab71c naison 2026-08-29 feat(handler,dns): consume server-side route discovery; drop client pod/svc informers
• 50719938 naison 2026-08-29 revert(xds): do not remove envoy rules on lease expiry
• c10e6430 naison 2026-08-23 feat(xds): server-side per-namespace route/service discovery pushed to clients
• 4a9b188c naison 2026-08-23 perf(gvisor): enable GVisorGSO on client local stacks for consistency
• 2cdf4b12 naison 2026-08-23 fix(core): stop gvisor ICMP handler from double-freeing injected packets
• 0d8641f9 naison 2026-08-23 refactor(core): make the inter-client gvisor stack transport-level
• abed43bd naison 2026-08-23 perf(gvisor): revert TCP buffer caps to gvisor defaults for shared-tunnel model
• 37e65b6e naison 2026-08-22 docs: document conn-pool slot liveness (active-in-either-direction)
• 0e1d421c naison 2026-08-22 fix(core): keep an actively-sending conn-pool slot alive
• 2407379d naison 2026-08-22 perf(gvisor): set TCP send/receive buffer size ranges
• b417618c naison 2026-08-22 feat(tun): upgrade wireguard-go and add segment-aware batched TUN IO
• 16aa23d3 naison 2026-08-22 chore(deps): upgrade gvisor to go-branch tip (2026-06-29)
• b0aac455 naison 2026-08-16 chore(build): bump Go toolchain to 1.26
• 2f41c9d0 naison 2026-08-16 fix(ci,test): make macOS mesh e2e resilient to apiserver flakiness
• 3f23a55c naison 2026-08-16 test(handler): fail fast in commonTest when no active connection
• fde51d65 naison 2026-08-16 fix(xds): make TunConfigServer init fatal with retry, not silent nil
• 75b6f683 fengcaiwen 2026-08-16 fix(docs): resolve duplicate document number 41, rename origin-loopback-cluster to 42
• 76ce0f2f naison 2026-08-15 refactor(inject): drop -s $POD_IP PREROUTING loop guard, now covered by loopback cluster
• f734de89 naison 2026-08-15 fix(xds): route mesh declared-port origin return path over loopback
• 1e3cc471 fengcaiwen 2026-08-15 test(ssh): add testify assert for SSH start error check
• 9a2e49f4 naison 2026-08-15 refactor(dns): resolve extra-domain/ExternalName via in-cluster DNS, drop dnsutils
• 3eae62a7 naison 2026-08-15 feat(core): partition connection pool by five-tuple hash
• e20b57e4 naison 2026-08-09 fix(core): harden data-plane reconnect against ghost-conn black-holing
• 9bd9d07a fengcaiwen 2026-08-09 fix(log): per-RPC Level propagation, context-aware debug gating
• 525a80d8 naison 2026-08-09 fix(inject,ci): envoy ORIGINAL_DST loop guard, pod IP via Downward API
• 8bc541ea naison 2026-08-09 refactor: decouple session layer, unify envoy writes, split net utils
• 2e436e72 naison 2026-08-09 build: force LF for YAML to keep go:embed configs CRLF-free on Windows
• 198471c5 naison 2026-08-08 fix(handler): re-create traffic manager when only a stale pod lingers
• 68384a2f naison 2026-08-08 test(daemon/action): close daemon.log before TempDir cleanup
• 6cb7b70a naison 2026-08-08 fix(inject): match baked traffic-manager address regardless of line ending
• 8b2602e3 naison 2026-08-08 test(handler): prefix e2e subtest labels with phase names
• fe5d358c naison 2026-08-08 fix(run): leave proxy on exit, clean Ctrl-C teardown, animated progress
• b7140b2e naison 2026-08-02 fix(sync): wait for rollout before tearing down the SSH tunnel
• b3cfc198 naison 2026-08-02 refactor(dhcp): stamp host mask (/32,/128) on TUN leases
• 3e819678 naison 2026-08-02 refactor(naming): rename envoy-proxy->envoy and control-plane->xds
• d4212498 naison 2026-08-02 docs(controlplane): clarify the stale-echo guard is a TOCTOU, not cache staleness
• 0e03f814 naison 2026-08-02 test(controlplane): reproduce TUN_ALLOCS manual-edit reconcile oscillation
• df8b3f46 naison 2026-08-01 docs: add design docs for previously undocumented subsystems
• 05bcba7b naison 2026-08-01 feat(progress): style proxy-out managed SOCKS lines as bold-green success
• 969f0d36 naison 2026-08-01 feat(exitcode): rich exit-code taxonomy carried via gRPC error details
• 03f638ba naison 2026-08-01 docs(dhcp): document hostname field in TUN_ALLOCS lease record
• a9196bf8 naison 2026-08-01 feat(cli): classified process exit codes
• 0bef3e6f naison 2026-08-01 feat(dhcp): record client hostname in TUN_ALLOCS
• 310279a2 naison 2026-07-26 fix(controlplane): deliver RDS over ADS and add envoy xDS keepalive
• ebf71d55 naison 2026-07-26 fix(inject): re-inject sidecar when traffic-manager namespace changes
• dd5ffb18 naison 2026-07-26 feat(progress): render command steps as a kind-style spinner
• f8e03a73 naison 2026-07-26 fix: triage PR [#784] CI failures — container cleanup, empty-TUN-IP route, diagnostics
• d4a47884 naison 2026-07-26 test(handler): dump run container output on startup timeout
• 1f621055 naison 2026-07-26 fix(controlplane): replay pending TUN IP proposal to reconnected watcher
• 1c885e63 naison 2026-07-25 fix(controlplane): persist TUN_ALLOCS rejection annotation atomically
• e6654447 naison 2026-07-25 fix(core): clone heartbeat broadcast per slot to avoid a shared-buffer data race
• 8da57fe1 naison 2026-07-25 perf(core): halve the gvisor boundary copy with AsSlices
• ad40eaa4 naison 2026-07-25 refactor(core): unify data-plane buffer layout and make datagram framing zero-copy
• 412c6187 naison 2026-07-25 fix: cross-platform CI failures (windows units, macOS TUN v6, e2e expectations)
• f52e1285 naison 2026-07-25 fix(inject,tun,core,daemon): drop manager SA, split kubeconfig tests, re-apply verified fixes
• 56cf4034 naison 2026-07-19 feat(tun): operator-editable TUN IP via TUN_ALLOCS (dry-run, IPv4+IPv6)
• 33461bac naison 2026-07-19 fix(ci): unblock e2e (version gate), make versions consistent, English docs
• 19564386 naison 2026-07-19 fix(core): tolerate transient TUN read errors instead of tearing down the data plane
• 36d33d33 naison 2026-07-19 feat(status): report real data-plane connectivity via heartbeat echo replies
• 054f6124 naison 2026-07-19 fix(sync): pin manager namespace in cloned workload's nested proxy
• abb6baaf naison 2026-07-19 fix(test,rollout): green CI by bounding rollout waits and flaky port/raw-socket tests
• c9bb7af2 naison 2026-07-18 refactor(core): symmetric TUN device with a transport strategy
• 7f463dbb naison 2026-07-18 feat(logging): full-debug daemon log file, per-connection log tagging, debug sidecars
• a872d90b naison 2026-07-18 test: fix UDP e2e round-trip and harden sync/run e2e against hangs
• 30ecb450 naison 2026-07-18 fix(inject): let mesh-mode UDP reach the envoy UDP listener
• 69cce701 naison 2026-07-18 test(controlplane): real-Envoy end-to-end tests and bootstrap fix
• c46922f5 naison 2026-07-18 fix: harden TUN IP allocation for multi-cluster and multi-user
• 9597929f naison 2026-07-12 refactor: extract magic numbers into named constants
• c72c55c0 naison 2026-07-12 fix(ci): make integration tests reliable under sudo and fail fast
• 72d4d888 naison 2026-07-12 refactor: complete code refactoring, update docs and implementation
• 8c4d781b naison 2026-07-12 feat: image copy with DSN-style credentials and auto TLS detection
• d1b9b29b naison 2026-07-12 refactor: CIDR helpers, remove webhook, align Helm chart
• afb5d061 naison 2026-07-12 refactor: logging architecture, CLI output isolation
• 3a248989 naison 2026-07-11 test: integration tests for multi-user, fault injection, design docs
• 78f7a968 naison 2026-07-11 fix: memory leaks, crash restart, deprecated proto cleanup
• cc039b11 naison 2026-07-11 refactor: traffic manager to user daemon, ExcludeIPs, OwnerID rules
• 88e9d324 naison 2026-07-11 refactor: lease-based IP management, OwnerID ownership, persistence
• ec38b97e naison 2026-07-11 feat: TUN IP hot-update via control-plane TunConfigService
• c72ed6a9 naison 2026-07-11 refactor: extract K8sClient, helpers across handler/daemon/ssh/util
• 4a08846d naison 2026-07-05 refactor(controlplane/inject): SchemaVersion, OwnerID, envoyRuleSpec
• 37c0fdc6 naison 2026-07-05 fix: goroutine leaks, race conditions, error handling
• f90219be naison 2026-07-05 refactor+fix: error formatting and logic fixes
• 2e43b574 naison 2026-07-05 docs: add doc comments to all exported symbols
• 685316c8 naison 2026-07-05 refactor: modernize Go patterns — interface{} to any, deprecated APIs
• be965997 naison 2026-07-05 fix: nil pointers, test cleanup, signal handling
• bd1327e3 naison 2026-07-04 refactor: extract helpers, split files, cross-package cleanup
• d7a9a5a1 naison 2026-07-04 feat+test+docs: helper types, unit tests, architecture docs
• 6b8453ae naison 2026-07-04 refactor: inject strategy pattern, Fargate mode, connection pool
• cbe4fcfd naison 2026-07-04 docs: add data flow analysis and iteration history
• 127425c2 naison 2026-07-04 perf+fix(core): eliminate memcpys, fix heartbeat and connection stability
• 84f391d8 naison 2026-07-04 refactor(core): extract RouteHub, protocol registry, simplify gvisor stack
• 731738c7 Pierluigi Lenoci 2026-06-13 Honor stderrthreshold when logtostderr is enabled (#782)
• 48808275 naison 2026-04-19 feat: update krew index version to refs/tags/v2.10.2 (#779)
• 7f9860d6 naison 2026-04-19 Update charts/index.yaml (#780)
• 9bef1e83 fengcaiwen 2026-04-19 docs: add ask deepwiki badge