v2.9.0

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.9.0

Documentation

Changelog since v2.8.4

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• Action required
  Add missing permissions for controller. Its recommended that you update your CloudFormation stack. (#​5537, @​richardcase)
• Action required
  Garbage collection graduated out of experimental. If you don't want this feature enabled please see the docs on how to disabled it. (#​5348, @​richardcase)
• Action required
  Support setting role path and permissions boundary on managed IAM roles. If you want to use permission boundaries, then you will need to update your IAM permissions by running clusterawsadm bootstrap iam create-cloudformation-stack again. (#​5286, @​robinkb)
• Action required
  Support storing Ignition user data in S3 bucket for AWSMachinePool. If you plan to use this feature then you will need to update the permissions for CAPA using clusterawsadm. (#​5318, @​AndiDog)

Changes by Kind

Support

• Add machine pool template for Flatcar Linux (#​5522, @​AndiDog)
• Bump calico used in e2e tests to newest version. (#​5459, @​richardcase)
• Bump github.com/golang/glog to v1.2.5 (#​5590, @​damdo)
• Bump to go 1.23 (#​5437, @​damdo)

Deprecation

• Migrate ServiceLimiters to AWS SDK V2 (#​5574, @​punkwalker)
• Migrate autoscaling to AWS SDK V2 (#​5497, @​alexander-demicev)
• Migrate elb to AWS SDK v2 (#​5572, @​phuhung273)
• Migrate iam to aws sdk v2 (#​5526, @​alexander-demicev)
• Migrate instancestate code to AWS SDK v2 (#​5562, @​phuhung273)
• Migrate sts to sdk v2 (#​5601, @​alexander-demicev)

API Change

• Add support for managed machine AMI types BottleRocket, AL2023 and Windows (#​5540, @​afarbos)

Feature

• Add ClusterClass support for EKS clusters (#​5375, @​alexander-demicev)
• Add support for 'fast' channelGroupType in ROSA provider (#​5587, @​cblecker)
• Adds the capability of provisioning machines on to dedicated hosts. (#​5548, @​rvanderp3)
• Control plane load balancers are created concurrently, reducing cluster
  installation time when specifying a secondary control plane load balancer. (#​5569, @​mdbooth)
• Migrate EC2 packages to AWS SDK v2 (#​5521, @​yiannistri)
• Migrate EKS packages to AWS SDK v2 (#​5498, @​punkwalker)
• Migrate Node packages to AWS SDK v2 (#​5584, @​LiangquanLi930)
• Migrate secretsmanager code to AWS SDK v2 (#​5615, @​LiangquanLi930)
• Migrate ssm code to AWS SDK v2 (#​5529, @​miyadav)
• Migrate the S3 service to aws-sdk-go-v2 (#​5389, @​punkwalker)
• Support additional security group ingress rules for all nodes (#​5224, @​AndiDog)
• Support running EC2 instances with capacity reservation preferences. i.e. capacityReservationPreference: none (#​5609, @​BraeTroutman)
• ✨ Added support for Amazon Linux 2023 and Amazon Linux 2023 GPU AMI lookup in EKS optimized AMI workflow. (#​5517, @​matzegebbe)

Documentation

• Add feature gate environment variable for machine pool machines (#​5575, @​AndiDog)
• Update docs on generating clusterclass based test flavours. (#​5466, @​richardcase)

Bug or Regression

• Add Version to ROSA Control Plane Status (#​5443, @​PanSpagetka)
• Apply CAPI machinepool changes to ROSAMachinePool (#​5386, @​PanSpagetka)
• Don't overwrite subnet spec tags with tags from the subnet on AWS (#​5474, @​fiunchinho)
• Enable NLB target group connection draining to allow for graceful shutdown of apiserver processes (#​5589, @​benluddy)
• Fix addition logic of getAttemptContextMiddleware (#​5580, @​punkwalker)
• Fix determined value for MinSize field of ASG, avoiding unnecessary updates to ASG (#​5523, @​AndiDog)
• Fix error message text in rosa control plane controller (#​5456, @​mzazrivec)
• Fix issue with creation of ec2 instances when specifying an existing network interface (#​5595, @​kylewuolle)
• Fix update ROSA-HCP version channel group (#​5616, @​serngawy)
• Fix: Ignore conflict resolution and correctly compare configuration for AddOn reconciliation (#​5458, @​mloiseleur)
• Fix: disallow setting of CapacityReservationPreference: CapacityReservationsOnly when MarketType: Spot or SpotMarketOptions is set (#​5633, @​BraeTroutman)
• Fixed the default AMI lookup when using a bastion. (#​5531, @​richardcase)
• LaunchTemplate needs to be updated if spot options are changed (#​5496, @​fiunchinho)
• Set conditions to true when reconciliation is successful (#​5591, @​fiunchinho)
• Update launch template if PrivateDnsName changes (#​5508, @​fiunchinho)
• Update launch template if capacity-block reservation id changes (#​5506, @​fiunchinho)
• Update launch template if ssh key name changes (#​5507, @​fiunchinho)
• Wire logger into machine scope (#​5462, @​fiunchinho)
• 🐛 Fix missing CRD validation for Amazon Linux 2023 eksLookupType enum values, completing the AL2023 support introduced in v2.8. (#​5558, @​AmitSahastra)

Other (Cleanup or Flake)

• AWS SDK V1 Cleanup (#​5620, @​punkwalker)
• Migrate ELB garbage collection to AWS SDK v2 (#​5518, @​Danil-Grigorev)

Uncategorized

• Add Kubernetes API Linter to project. (#​5392, @​richardcase)
• Adding support for custom Lifecycle Hooks in AWSMachinePools for external hooks (e.g support for the aws-node-termination-handler with SQS) (#​4875, @​sebltm)
• Bump CAPI to v1.10.2 (#​5447, @​tamalsaha)
• Skip adding reserved aws internal tags to resources as they are invalid (#​5461, @​athiruma)
• Update documentation to refer to new e2e documentation link. (#​5545, @​rvanderp3)

The images for this release are:

registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.9.0

Thanks to all our contributors.

v2.8.4

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.8.4

Documentation

Changelog since v2.8.3

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

Add missing permissions for controller. Its recommended that you update your CloudFormation stack. (#​5539, @​k8s-infra-cherrypick-robot)

Changes by Kind

Uncategorized

• Add machine pool template for Flatcar Linux (#​5534, @​k8s-infra-cherrypick-robot)
• Fix: Ignore conflict resolution and correctly compare configuration for AddOn reconciliation (#​5501, @​k8s-infra-cherrypick-robot)
• Fixed the default AMI lookup when using a bastion. (#​5533, @​k8s-infra-cherrypick-robot)
• ✨ Added support for Amazon Linux 2023 and Amazon Linux 2023 GPU AMI lookup in EKS optimized AMI workflow. (#​5555, @​k8s-infra-cherrypick-robot)
• 🐛 Fix missing CRD validation for Amazon Linux 2023 eksLookupType enum values, completing the AL2023 support introduced in v2.8. (#​5566, @​k8s-infra-cherrypick-robot)

The images for this release are:

registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.8.4

Thanks to all our contributors.

v2.8.3

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.8.3

Documentation

Changelog since v2.8.2

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (#​5436, @​damdo)

Uncategorized

• Bump calico used in e2e tests to newest version. (#​5463, @​k8s-infra-cherrypick-robot)
• Fix: Ignore conflict resolution and correctly compare configuration for AddOn reconciliation (#​5501, @​k8s-infra-cherrypick-robot)

The images for this release are:
registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.8.3

Thanks to all our contributors.

v2.8.2

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.8.2

Documentation

Changelog since v2.8.1

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (#​5436, @​damdo)

The images for this release are:
registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.8.2

Thanks to all our contributors.

v2.8.1

Release notes for Cluster API Provider AWS (CAPA) v2.8.1

Documentation

There is no v2.8.0 GitHub release due to issues during the release process.

Changelog since v2.7.1

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• Action required
  Bump CAPI to v1.9.z
  !! ACTION REQUIRED BEFORE UPGRADING !!
  If you are using the AWSManagedControlPlane to provision EKS clusters and you do not have a spec.Version specified in such resource (meaning you are relying on the default that AWS provides), you will need to either:
  a) explicitly set such spec.Version field before upgrading CAPA
  or b) disable the MachineSetPreflightChecks in your cluster either:
  b1) by setting this core CAPI feature gate to false
  b2) or by disabling it via the relevant annotation on all the machineSets belonging to said cluster (follow this guide on how to do this: https://cluster-api.sigs.k8s.io/tasks/experimental-features/machineset-preflight-checks).
  This is necessary as core CAPI 1.9 introduces a feature gate change, setting MachineSetPreflightChecks=true, which in turn relies on the presence of spec.Version and status.Version on the AWSManagedControlPlane object.
  We are planning a future refactor of these API fields in v1beta3 (#​3853).
  Other places where you can find details on this are:
  • #​5225
  • kubernetes-sigs/cluster-api#11117
  • https://kubernetes.slack.com/archives/CD6U2V71N/p1739783013734149 (#​5209, @​damdo)
• Action required
  From this release onwards we recommend not creating clusters using the classic ELB (which is the default for the API). Classic ELB support is deprected and support will be removed in a future version.
  For new & existing clusters that use a classic elb AND do not specify the health check protocol then the protocol will be changed/set to TCP instead of SSL.
  If you want to use a classic elb with an SSL healthcheck then you will need to specify the cipher suites to use in the KubeadmControlPlane:

apiVersion: controlplane.cluster.x-k8s.io/v1beta1
kind: KubeadmControlPlane
metadata:
  name: "${CLUSTER_NAME}-control-plane"
spec:
  kubeadmConfigSpec:
    clusterConfiguration:
      apiServer:
        extraArgs:
          cloud-provider: external

### This is needed for Kubernetes v1.30+ since else it uses the Go defaults which don't
### work with AWS classic load balancers, see

### https://github.com/kubernetes-sigs/cluster-api-provider-aws/issues/5139. If you use
### another load balancer type such as NLB, this is not needed.
          #

### The list consists of the secure ciphers from Go 1.23.3, plus some less secure
### RSA ciphers which the AWS classic load balancer instance health check supports.
          tls-cipher-suites: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

(#​5346, @​richardcase)

• If deploying clusters to an existing VPC (not managed by the AWS provider), the provider will no longer automatically create a security group rule allowing traffic from all addresses (0.0.0.0/0). You may need to update AWSCluster.spec.controlPlaneLoadBalancer.ingressRules with the source address of your Management Cluster. (#​5198, @​sl1pm4t)

Changes by Kind

Support

• Add devbox and devcontainer configuration (#​5301, @​faermanj)
• Update metadata file for v2.7.0 release. (#​5187, @​richardcase)
• Update metadata for release v2.8.x (#​5397, @​richardcase)

API Change

• Adds optional Conditions field to Status for AWSManagedCluster, ROSACluster. Sets Paused condition when reconciliation is paused (Contract change) (#​5394, @​theobarberbany)

Feature

• Add AWSMachines to back the EC2 instances in AWSMachinePools and AWSManagedMachinePools (#​5319, @​AndiDog)
• Add ROSA-HCP version channel group for Machine Pools (#​5332, @​PanSpagetka)
• Add VolumeSize parameter for RosaMachinePool. (#​5270, @​PanSpagetka)
• Add flag to support BootstrapSelfManagedAddons to provision Bare EKS cluster without default addons (coreDNS, kube-proxy, aws-vpc-cni) (#​5222, @​jas-nik)
• Add support for creating instances with elastic fabric adapter interface type. (#​5275, @​RadekManak)
• Avoid reconciling AWSMachinePools when only the status field has changed (#​5333, @​fiunchinho)
• Introduce the --disable-controllers argument to the controller manager binary. (#​5395, @​nrb)
• Log AWS account being used when the e2e tests run. (#​5250, @​richardcase)
• Support running EC2 instances from a reserved capacity block (new API field marketType). i.e, marketType: capacity-block (#​5211, @​athiruma)
• Templates: start explicitly using NLB (Network Load Balancer) + HTTPS checks for the Control Plane Load Balancer (#​5345, @​damdo)
• Wait for AWSCluster dependent object to be deleted (#​5365, @​alexander-demicev)

Documentation

• Fix typo on table of feature gates (#​5273, @​Rudro-25)
• Release notes include reminder to update Prow jobs. (#​5204, @​richardcase)
• Update links to new 2025 meeting notes doc (#​5277, @​richardcase)

Failing Test

• Fix the EFS & classic elb e2e tests. (#​5418, @​richardcase)
• Remove CoreDNS check from EKS e2e after a change by AWS to EKS. (#​5239, @​nrb)
• Updates to e2e tests to stop using v1.23 (#​5297, @​richardcase)
• Upgrade to CAPI 1.8.6 (#​5249, @​nrb)

Bug or Regression

• 1. fixed adding a secondary load balancer to existing aws cluster (#​5248, @​alexeysofin)
• Filter out AWS internal tags when reconciling AWS infra (#​5181, @​fiunchinho)
• Fix OIDC unit test after test runner go version change. (#​5352, @​richardcase)
• Fix ROSA doc formatting (#​5324, @​mzazrivec)
• Fix cluster deletion when using BYO AWS infra mode and Secondary CIDR (#​5291, @​adriananeci)
• Fix delay in reconciliation caused by patching wrong object with new paused condition. (#​5425, @​richardcase)
• Fix nil pointer dereference in reconcileNodegroupVersion by adding a check for nodegroup version. (#​5019, @​nueavv)
• Fix self hosted e2e test caused by disk pressure. (#​5288, @​richardcase)
• Fix subnet sorting with multiple vpcs when launching an instance (#​5114, @​cnmcavoy)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (#​5199, @​gutmensch)
• Fixed RosaMachinePool typo. (#​5244, @​tinaafitz)
• Remove placeholder CA bundles from webhook configuration to support Kubernetes 1.31. (#​5197, @​robinkb)
• Tags defined in subnet spec should be applied (#​5175, @​fiunchinho)
• Use different names for controllers watching AWSCluster objects (#​5313, @​AndiDog)

Other (Cleanup or Flake)

• Update PR verifier to be inline with upstream CAPI. (#​5300, @​richardcase)

Uncategorized

• Add ROSA-HCP version channel group (#​5279, @​serngawy)
• Feat: enable support for service account authentication in ROSA installations (#​5233, @​mzazrivec)
• Fixed a few typos. (#​5238, @​tinaafitz)
• Set Paused condition on reconciled resources status upon pausing reconciliation (CAPI provider contract change) (#​5383, @​theobarberbany)
• Update ROSA upgrade documentation (#​5235, @​serngawy)

The images for this release are:
docker pull registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.8.1

Thanks to all our contributors.

v2.7.2

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.7.2

Documentation

Changelog since v2.7.1

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (#​5435, @​damdo)

Uncategorized

• Add devbox and devcontainer configuration (#​5317, @​k8s-infra-cherrypick-robot)
• Fix OIDC unit test after test runner go version change. (#​5353, @​k8s-infra-cherrypick-robot)
• Fix self hosted e2e test caused by disk pressure. (#​5293, @​k8s-infra-cherrypick-robot)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (#​5202, @​k8s-infra-cherrypick-robot)
• Update PR verifier to be inline with upstream CAPI. (#​5302, @​k8s-infra-cherrypick-robot)
• Updates to e2e tests to stop using v1.23 (#​5310, @​k8s-infra-cherrypick-robot)
• Upgrade to CAPI 1.8.6 (#​5328, @​k8s-infra-cherrypick-robot)

The images for this release are:

registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.7.2

Thanks to all our contributors.

v2.7.1

Compare Source

Release notes for Cluster API Provider AWS (CAPA) v2.7.1

Documentation

Changelog since v2.6.1

NOTE: there is no v2.7.0 release available due to an issue encountered during the release process.

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• A new community owned AWS account is now being used for publishing AMIs. The old account owner by a company is no longer accessible and the images are being automatically deleted by AWS. Support for ubuntu 18.04 & 20.04 has been dropped and ubuntu 24.04 is now the default OS if no OS is supplied. (#​5133, @​richardcase)
• View the projects policy on publishing AMIs here.
• There is known issue creating clusters with Kubernetes v1.30 or greater when the load balancer is an ELB (which is the default). Its recommended for new clusters that you use an NLB instead, See #​5139 for further details.

Changes by Kind

Support

• Add issue templates for reviewer and maintainer changes (#​5079, @​richardcase)
• Bump CAPI to v1.8.4 (#​5061, @​damdo)
• Switch PodDisruptionBudget in templates to policy/v1 (#​5102, @​AndiDog)
• Templates: align cluster-template.yaml and cluster-template-machinepool.yaml, use external cloud controller and CSI (#​5136, @​AndiDog)
• Update metadata file for v2.7.0 release. (#​5187, @​richardcase)

Feature

• Add NonRootVolumes to AWSMachinePool launch template. (#​4954, @​mnitchev)
• Add ROSA Control plane registry configuration. (#​5132, @​serngawy)
• Change prevenet deletion label to be specific to CAPA. (#​5072, @​richardcase)
• Feat: add support for additionalControlPlaneIngressRules in AWSManagedControlPlane (#​4783, @​fad3t)
• New AMI building workflow that allows a packer vars file to be passed in. (#​5152, @​richardcase)
• New AWSCluster.spec.network.NodePortIngressRuleCidrBlocks parameter which allows to specify IPv4 CIDR blocks for Security group rule "Node Port Services" instead of default 0.0.0.0/. (#​5147, @​krasoffski)
• New workflow to publish CAPA AMIs (#​5138, @​richardcase)
• Support adding custom secondary VPC CIDR blocks in AWSCluster (#​4898, @​AndiDog)
• Support setting maxHealthyPercentage to configure ASG instance refresh (#​5140, @​fiunchinho)

Bug or Regression

• A missing permission needed for using nlbs (#​5154, @​richardcase)
• Check for the LB "active" status instead of trying to resolve the DNS name to validate the LB is ready. (#​5093, @​r4f4)
• Fix duplicated/leaked EIP when using BYO IPv4 on Machines. (#​5039, @​mtulio)
• Fix kustomize issue with e2e tests. (#​5167, @​richardcase)
• Fix: do not attach security groups for Network Load Balancers in secret regions. (#​5030, @​r4f4)
• Mark S3BucketCreated condition ready after successful reconciliation (#​5089, @​AndiDog)
• Updates EKS e2e tests after recent bumping of EKS versions. (#​5185, @​richardcase)

Uncategorized

• Add versionGate Acknowledgement for upgrading ROSA-HCP y-stream versions (#​5166, @​serngawy)
• Fix: Fargate: Standardize cluster name in role names to avoid errors on mismatch between Cluster CR and EKS cluster name (#​5111, @​alam0rt)
• Update Flatcar template to use external CCM. (#​5099, @​ader1990)

The images for this release are:

registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.7.1

Thanks to all our contributors.

v2.7.0

Compare Source