KubeVPN release v2.11.1

KubeVPN v2.11.1 is available now ! 🎉

Download KubeVPN for your platform

Mac (x86-64/Intel)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.1/kubevpn_v2.11.1_darwin_amd64.zip && unzip -d kubevpn kubevpn.zip

Mac (AArch64/Apple M1 silicon)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.1/kubevpn_v2.11.1_darwin_arm64.zip && unzip -d kubevpn kubevpn.zip

Linux (x86-64)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.1/kubevpn_v2.11.1_linux_amd64.zip && unzip -d kubevpn kubevpn.zip

Linux (AArch64)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.1/kubevpn_v2.11.1_linux_arm64.zip && unzip -d kubevpn kubevpn.zip

Linux (i386)

curl -Lo kubevpn.zip https://github.com/kubenetworks/kubevpn/releases/download/v2.11.1/kubevpn_v2.11.1_linux_386.zip && unzip -d kubevpn kubevpn.zip

Windows (x86-64)

curl -LO https://github.com/kubenetworks/kubevpn/releases/download/v2.11.1/kubevpn_v2.11.1_windows_amd64.zip

Windows (AArch64)

curl -LO https://github.com/kubenetworks/kubevpn/releases/download/v2.11.1/kubevpn_v2.11.1_windows_arm64.zip

Windows (i386)

curl -LO https://github.com/kubenetworks/kubevpn/releases/download/v2.11.1/kubevpn_v2.11.1_windows_386.zip

Checksums

SHA256 checksums available for compiled binaries. Run shasum -a 256 -c checksums.txt to verify.

Upgrading

Run kubevpn upgrade to upgrade from a previous version.

Changelog

• 302f2be6 naison 2026-07-12 refactor(core): per-client gvisor stack with control/data plane separation
• f6ec0484 naison 2026-07-12 fix(core): use correct sniffer direction for INBOUND packets
• 8078228c naison 2026-07-12 refactor(core): replace gopacket logIPPacket with gvisor sniffer for richer packet logging
• b2983509 naison 2026-07-12 fix(handler): refresh ConfigMap cache after inject so status sees ProxyList immediately
• d3aae47c naison 2026-07-12 fix(handler): refresh macOS CIDR routes after TUN IP change to prevent EADDRNOTAVAIL
• 665abf43 naison 2026-07-12 fix(handler): pre-route traffic manager ClusterIP before async route watcher
• f48b1dc9 naison 2026-07-12 fix(daemon): refresh sudo health cache after connect; retry sync status in tests
• 8225492c naison 2026-07-12 fix(util): expand short resource names in byte-backed Factory RESTMapper
• bb0984a9 naison 2026-07-12 fix(handler): prevent flaky liveness test by placing sessionStart before MarkReply
• 5f3943a6 naison 2026-07-12 docs: document heartbeat-driven port-forward liveness; drop xDS health-check references
• 67253ef3 naison 2026-07-12 fix(handler): drive port-forward reconnect from data-plane heartbeat; remove xDS health check
• aabfd335 naison 2026-07-12 perf(cidr): drop probe pod from GetCIDR; report pod CIDR as its own step
• 9b7119a7 naison 2026-07-12 feat(progress): heartbeat lines for long steps on the non-TTY path
• 2a83afc5 naison 2026-07-12 fix(progress): gate spinner on smart TTY to stop non-TTY frame leaks
• 0b6a42ba naison 2026-07-12 feat(cidr): bounded upward merge of inferred Pod/Service CIDRs
• c3e24b5c naison 2026-07-12 docs: correct VPN sidecar security context to privileged
• 6f9c5f9b naison 2026-07-12 docs: document peer liveness monitor, Connect idempotency, control-plane-in-status
• 9f6e69d7 naison 2026-07-12 docs(grpcutil): harden ListenCancel invariant with a regression test
• 000ed379 naison 2026-07-12 feat(status): reflect xds control-plane health in connection status
• 86dcc181 naison 2026-07-12 feat(daemon): add user->root liveness monitor with cached health snapshot
• f42cf358 naison 2026-07-12 fix(daemon): surface sudo-probe errors and invalidate stale cached client
• 25b26580 naison 2026-07-12 fix(daemon): make root-daemon Connect idempotent per ConnectionID
• f0d21532 naison 2026-07-12 fix(daemon): cache-only ConfigMap reads so status stops blocking on unreachable clusters
• f568c65e naison 2026-07-12 feat(xds): server-side CIDR & DNS detection warm-up (client offload)
• 27b3865a naison 2026-07-12 docs: design for server-side CIDR & DNS detection (client offload)
• f1adf232 naison 2026-07-12 perf(core): cap packet channel depth to bound client memory
• 53bbf3f5 naison 2026-07-12 fix(upgrade): harden self-upgrade & traffic-manager upgrade paths
• aac87447 naison 2026-07-12 docs+refactor: realign docs with code; unify temp-file naming; tidy xds/idioms
• a799addb naison 2026-07-12 refactor: unify rollback registry, harden temp-dir cleanup & dir perms
• 1a07e9a4 naison 2026-07-12 refactor: drop temp kubeconfig files, build Factory from bytes
• e4eb1131 naison 2026-07-12 fix(netutil): add echo id/seq to GenICMPPacketIPv6
• 06e35a04 naison 2026-07-11 fix(tun): delete IPv6 TUN address via SIOCDIFADDR_IN6 ioctl on macOS, verify removal
• 7b5abea0 naison 2026-07-11 fix(handler): route service ClusterIPs from server-side discovery
• 7c2804d7 kubenetworks 2026-07-05 Update charts/index.yaml
• a29b15ec wencaiwulue 2026-07-05 feat: update krew index version to refs/tags/v2.11.0