v2.9.3

Release notes for Cluster API Provider AWS (CAPA) <RELEASE_VERSION>

Documentation

Changelog since <PREVIOUS_VERSION>

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• Action required
  Add missing permissions for controller. Its recommended that you update your CloudFormation stack. (kubernetes-sigs#5537, @richardcase)
• Action required
  Bump CAPI to v1.9.z
  !! ACTION REQUIRED BEFORE UPGRADING !!
  If you are using the AWSManagedControlPlane to provision EKS clusters and you do not have a spec.Version specified in such resource (meaning you are relying on the default that AWS provides), you will need to either:
  a) explicitly set such spec.Version field before upgrading CAPA
  or b) disable the MachineSetPreflightChecks in your cluster either:
  b1) by setting this core CAPI feature gate to false
  b2) or by disabling it via the relevant annotation on all the machineSets belonging to said cluster (follow this guide on how to do this: https://cluster-api.sigs.k8s.io/tasks/experimental-features/machineset-preflight-checks).
  This is necessary as core CAPI 1.9 introduces a feature gate change, setting MachineSetPreflightChecks=true, which in turn relies on the presence of spec.Version and status.Version on the AWSManagedControlPlane object.
  We are planning a future refactor of these API fields in v1beta3 (kubernetes-sigs#3853).
  Other places where you can find details on this are:
• kubernetes-sigs#5225
• kubernetes-sigs/cluster-api#11117
• https://kubernetes.slack.com/archives/CD6U2V71N/p1739783013734149 (kubernetes-sigs#5209, @damdo)
• Action required
  From this release onwards we recommend not creating clusters using the classic ELB (which is the default for the API). Classic ELB support is deprected and support will be removed in a future version.
  For new & existing clusters that use a classic elb AND do not specify the health check protocol then the protocol will be changed/set to TCP instead of SSL.
  If you want to use a classic elb with an SSL healthcheck then you will need to specify the cipher suites to use in the KubeadmControlPlane:

apiVersion: controlplane.cluster.x-k8s.io/v1beta1
kind: KubeadmControlPlane
metadata:
name: "${CLUSTER_NAME}-control-plane"
spec:
kubeadmConfigSpec:
clusterConfiguration:
apiServer:
extraArgs:
cloud-provider: external

        # This is needed for Kubernetes v1.30+ since else it uses the Go defaults which don't
        # work with AWS classic load balancers, see
        # https://github.com/kubernetes-sigs/cluster-api-provider-aws/issues/5139. If you use
        # another load balancer type such as NLB, this is not needed.
        #
        # The list consists of the secure ciphers from Go 1.23.3, plus some less secure
        # RSA ciphers which the AWS classic load balancer instance health check supports.
        tls-cipher-suites: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (#5346, @richardcase)

• Action required
  Garbage collection graduated out of experimental. If you don't want this feature enabled please see the docs on how rto disabled it. (kubernetes-sigs#5348, @richardcase)
• Action required
  Support setting role path and permissions boundary on managed IAM roles. If you want to use permission boundaries, then you will need to update your IAM permissions by running clusterawsadm bootstrap iam create-cloudformation-stack again. (kubernetes-sigs#5286, @robinkb)
• Action required
  Support storing Ignition user data in S3 bucket for AWSMachinePool. If you plan to use this feature then you will need to update the permissions for CAPA using clusterawsadm. (kubernetes-sigs#5318, @AndiDog)
• Action required
  The short name for AWSManagedClusterTemplate has changed from amct to awsmct. If you have any automation that relies on the short name it will needf to be updated. (kubernetes-sigs#5663, @k8s-infra-cherrypick-robot)
• If deploying clusters to an existing VPC (not managed by the AWS provider), the provider will no longer automatically create a security group rule allowing traffic from all addresses (0.0.0.0/0). You may need to update AWSCluster.spec.controlPlaneLoadBalancer.ingressRules with the source address of your Management Cluster. (kubernetes-sigs#5198, @sl1pm4t)

Changes by Kind

Support

• Add devbox and devcontainer configuration (kubernetes-sigs#5301, @faermanj)
• Add machine pool template for Flatcar Linux (kubernetes-sigs#5522, @AndiDog)
• Bump calico used in e2e tests to newest version. (kubernetes-sigs#5459, @richardcase)
• Bump github.com/golang/glog to v1.2.5 (kubernetes-sigs#5590, @damdo)
• Bump to go 1.23 (kubernetes-sigs#5437, @damdo)
• Update metadata file for v2.7.0 release. (kubernetes-sigs#5187, @richardcase)
• Update metadata for release v2.8.x (kubernetes-sigs#5397, @richardcase)

Deprecation

• Migrate ServiceLimiters to AWS SDK V2 (kubernetes-sigs#5574, @punkwalker)
• Migrate autoscaling to AWS SDK V2 (kubernetes-sigs#5497, @alexander-demicev)
• Migrate elb to AWS SDK v2 (kubernetes-sigs#5572, @phuhung273)
• Migrate iam to aws sdk v2 (kubernetes-sigs#5526, @alexander-demicev)
• Migrate instancestate code to AWS SDK v2 (kubernetes-sigs#5562, @phuhung273)
• Migrate sts to sdk v2 (kubernetes-sigs#5601, @alexander-demicev)

API Change

• Add support for managed machine AMI types BottleRocket, AL2023 and Windows (kubernetes-sigs#5540, @afarbos)
• Adds optional Conditions field to Status for AWSManagedCluster, ROSACluster. Sets Paused condition when reconciliation is paused (Contract change) (kubernetes-sigs#5394, @theobarberbany)

Feature

• Add AWSMachines to back the EC2 instances in AWSMachinePools and AWSManagedMachinePools (kubernetes-sigs#5319, @AndiDog)
• Add ClusterClass support for EKS clusters (kubernetes-sigs#5375, @alexander-demicev)
• Add ROSA-HCP version channel group for Machine Pools (kubernetes-sigs#5332, @PanSpagetka)
• Add VolumeSize parameter for RosaMachinePool. (kubernetes-sigs#5270, @PanSpagetka)
• Add flag to support BootstrapSelfManagedAddons to provision Bare EKS cluster without default addons (coreDNS, kube-proxy, aws-vpc-cni) (kubernetes-sigs#5222, @jas-nik)
• Add support for 'fast' channelGroupType in ROSA provider (kubernetes-sigs#5587, @cblecker)
• Add support for creating instances with elastic fabric adapter interface type. (kubernetes-sigs#5275, @RadekManak)
• Adds the capability of provisioning machines on to dedicated hosts. (kubernetes-sigs#5548, @rvanderp3)
• Avoid reconciling AWSMachinePools when only the status field has changed (kubernetes-sigs#5333, @fiunchinho)
• Control plane load balancers are created concurrently, reducing cluster
  installation time when specifying a secondary control plane load balancer. (kubernetes-sigs#5569, @mdbooth)
• Introduce the --disable-controllers argument to the controller manager binary. (kubernetes-sigs#5395, @nrb)
• Log AWS account being used when the e2e tests run. (kubernetes-sigs#5250, @richardcase)
• Migrate EC2 packages to AWS SDK v2 (kubernetes-sigs#5521, @yiannistri)
• Migrate EKS packages to AWS SDK v2 (kubernetes-sigs#5498, @punkwalker)
• Migrate Node packages to AWS SDK v2 (kubernetes-sigs#5584, @LiangquanLi930)
• Migrate secretsmanager code to AWS SDK v2 (kubernetes-sigs#5615, @LiangquanLi930)
• Migrate ssm code to AWS SDK v2 (kubernetes-sigs#5529, @miyadav)
• Migrate the S3 service to aws-sdk-go-v2 (kubernetes-sigs#5389, @punkwalker)
• Support additional security group ingress rules for all nodes (kubernetes-sigs#5224, @AndiDog)
• Support running EC2 instances from a reserved capacity block (new API field marketType). i.e, marketType: capacity-block (kubernetes-sigs#5211, @athiruma)
• Support running EC2 instances with capacity reservation preferences. i.e. capacityReservationPreference: none (kubernetes-sigs#5609, @BraeTroutman)
• Templates: start explicitly using NLB (Network Load Balancer) + HTTPS checks for the Control Plane Load Balancer (kubernetes-sigs#5345, @damdo)
• Wait for AWSCluster dependent object to be deleted (kubernetes-sigs#5365, @alexander-demicev)
• ✨ Added support for Amazon Linux 2023 and Amazon Linux 2023 GPU AMI lookup in EKS optimized AMI workflow. (kubernetes-sigs#5517, @matzegebbe)

Documentation

• Add feature gate environment variable for machine pool machines (kubernetes-sigs#5575, @AndiDog)
• Fix typo on table of feature gates (kubernetes-sigs#5273, @Rudro-25)
• Release notes include reminder to update Prow jobs. (kubernetes-sigs#5204, @richardcase)
• Update docs on generating clusterclass based test flavours. (kubernetes-sigs#5466, @richardcase)
• Update links to new 2025 meeting notes doc (kubernetes-sigs#5277, @richardcase)

Failing Test

• Fix the EFS & classic elb e2e tests. (kubernetes-sigs#5418, @richardcase)
• Remove CoreDNS check from EKS e2e after a change by AWS to EKS. (kubernetes-sigs#5239, @nrb)
• Updates to e2e tests to stop using v1.23 (kubernetes-sigs#5297, @richardcase)
• Upgrade to CAPI 1.8.6 (kubernetes-sigs#5249, @nrb)

Bug or Regression

• 1. fixed adding a secondary load balancer to existing aws cluster (kubernetes-sigs#5248, @alexeysofin)
• Add Version to ROSA Control Plane Status (kubernetes-sigs#5443, @PanSpagetka)
• Apply CAPI machinepool changes to ROSAMachinePool (kubernetes-sigs#5386, @PanSpagetka)
• Don't overwrite subnet spec tags with tags from the subnet on AWS (kubernetes-sigs#5474, @fiunchinho)
• Enable NLB target group connection draining to allow for graceful shutdown of apiserver processes (kubernetes-sigs#5589, @benluddy)
• Filter out AWS internal tags when reconciling AWS infra (kubernetes-sigs#5181, @fiunchinho)
• Fix OIDC unit test after test runner go version change. (kubernetes-sigs#5352, @richardcase)
• Fix ROSA doc formatting (kubernetes-sigs#5324, @mzazrivec)
• Fix addition logic of getAttemptContextMiddleware (kubernetes-sigs#5580, @punkwalker)
• Fix cluster deletion when using BYO AWS infra mode and Secondary CIDR (kubernetes-sigs#5291, @adriananeci)
• Fix delay in reconciliation caused by patching wrong object with new paused condition. (kubernetes-sigs#5425, @richardcase)
• Fix determined value for MinSize fiel...

v2.7.9

Release notes for Cluster API Provider AWS (CAPA) <RELEASE_VERSION>

Documentation

Changelog since <PREVIOUS_VERSION>

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (kubernetes-sigs#5435, @damdo)
• Update metadata file for v2.7.0 release. (kubernetes-sigs#5187, @richardcase)

Uncategorized

• Add devbox and devcontainer configuration (kubernetes-sigs#5317, @k8s-infra-cherrypick-robot)
• Fix OIDC unit test after test runner go version change. (kubernetes-sigs#5353, @k8s-infra-cherrypick-robot)
• Fix self hosted e2e test caused by disk pressure. (kubernetes-sigs#5293, @k8s-infra-cherrypick-robot)
• Fix: Ignore conflict resolution and correctly compare configuration for AddOn reconciliation (kubernetes-sigs#5500, @k8s-infra-cherrypick-robot)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (kubernetes-sigs#5202, @k8s-infra-cherrypick-robot)
• Update PR verifier to be inline with upstream CAPI. (kubernetes-sigs#5302, @k8s-infra-cherrypick-robot)
• Updates to e2e tests to stop using v1.23 (kubernetes-sigs#5310, @k8s-infra-cherrypick-robot)
• Upgrade to CAPI 1.8.6 (kubernetes-sigs#5328, @k8s-infra-cherrypick-robot)

The images for this release are:
<ADD_IMAGE_HERE>

Thanks to all our contributors.

v2.7.8

Release notes for Cluster API Provider AWS (CAPA) <RELEASE_VERSION>

Documentation

Changelog since <PREVIOUS_VERSION>

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (kubernetes-sigs#5435, @damdo)
• Update metadata file for v2.7.0 release. (kubernetes-sigs#5187, @richardcase)

Uncategorized

• Add devbox and devcontainer configuration (kubernetes-sigs#5317, @k8s-infra-cherrypick-robot)
• Fix OIDC unit test after test runner go version change. (kubernetes-sigs#5353, @k8s-infra-cherrypick-robot)
• Fix self hosted e2e test caused by disk pressure. (kubernetes-sigs#5293, @k8s-infra-cherrypick-robot)
• Fix: Ignore conflict resolution and correctly compare configuration for AddOn reconciliation (kubernetes-sigs#5500, @k8s-infra-cherrypick-robot)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (kubernetes-sigs#5202, @k8s-infra-cherrypick-robot)
• Update PR verifier to be inline with upstream CAPI. (kubernetes-sigs#5302, @k8s-infra-cherrypick-robot)
• Updates to e2e tests to stop using v1.23 (kubernetes-sigs#5310, @k8s-infra-cherrypick-robot)
• Upgrade to CAPI 1.8.6 (kubernetes-sigs#5328, @k8s-infra-cherrypick-robot)

The images for this release are:
<ADD_IMAGE_HERE>

Thanks to all our contributors.

v2.7.7

Release notes for Cluster API Provider AWS (CAPA) <RELEASE_VERSION>

Documentation

Changelog since <PREVIOUS_VERSION>

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (kubernetes-sigs#5435, @damdo)
• Update metadata file for v2.7.0 release. (kubernetes-sigs#5187, @richardcase)

Uncategorized

• Add devbox and devcontainer configuration (kubernetes-sigs#5317, @k8s-infra-cherrypick-robot)
• Fix OIDC unit test after test runner go version change. (kubernetes-sigs#5353, @k8s-infra-cherrypick-robot)
• Fix self hosted e2e test caused by disk pressure. (kubernetes-sigs#5293, @k8s-infra-cherrypick-robot)
• Fix: Ignore conflict resolution and correctly compare configuration for AddOn reconciliation (kubernetes-sigs#5500, @k8s-infra-cherrypick-robot)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (kubernetes-sigs#5202, @k8s-infra-cherrypick-robot)
• Update PR verifier to be inline with upstream CAPI. (kubernetes-sigs#5302, @k8s-infra-cherrypick-robot)
• Updates to e2e tests to stop using v1.23 (kubernetes-sigs#5310, @k8s-infra-cherrypick-robot)
• Upgrade to CAPI 1.8.6 (kubernetes-sigs#5328, @k8s-infra-cherrypick-robot)

The images for this release are:
<ADD_IMAGE_HERE>

Thanks to all our contributors.

v2.7.6

Release notes for Cluster API Provider AWS (CAPA) <RELEASE_VERSION>

Documentation

Changelog since <PREVIOUS_VERSION>

Changes by Kind

Support

• Bump github.com/golang-jwt/jwt to 4.5.2 and 5.5.2 (kubernetes-sigs#5435, @damdo)
• Update metadata file for v2.7.0 release. (kubernetes-sigs#5187, @richardcase)

Uncategorized

• Add devbox and devcontainer configuration (kubernetes-sigs#5317, @k8s-infra-cherrypick-robot)
• Fix OIDC unit test after test runner go version change. (kubernetes-sigs#5353, @k8s-infra-cherrypick-robot)
• Fix self hosted e2e test caused by disk pressure. (kubernetes-sigs#5293, @k8s-infra-cherrypick-robot)
• Fix: Ignore conflict resolution and correctly compare configuration for AddOn reconciliation (kubernetes-sigs#5500, @k8s-infra-cherrypick-robot)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (kubernetes-sigs#5202, @k8s-infra-cherrypick-robot)
• Update PR verifier to be inline with upstream CAPI. (kubernetes-sigs#5302, @k8s-infra-cherrypick-robot)
• Updates to e2e tests to stop using v1.23 (kubernetes-sigs#5310, @k8s-infra-cherrypick-robot)
• Upgrade to CAPI 1.8.6 (kubernetes-sigs#5328, @k8s-infra-cherrypick-robot)

The images for this release are:
<ADD_IMAGE_HERE>

Thanks to all our contributors.

v2.7.5

Release notes for Cluster API Provider AWS (CAPA) <RELEASE_VERSION>

Documentation

Changelog since <PREVIOUS_VERSION>

Changes by Kind

Support

• Update metadata file for v2.7.0 release. (kubernetes-sigs#5187, @richardcase)

Uncategorized

• Add devbox and devcontainer configuration (kubernetes-sigs#5317, @k8s-infra-cherrypick-robot)
• Fix self hosted e2e test caused by disk pressure. (kubernetes-sigs#5293, @k8s-infra-cherrypick-robot)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (kubernetes-sigs#5202, @k8s-infra-cherrypick-robot)
• Update PR verifier to be inline with upstream CAPI. (kubernetes-sigs#5302, @k8s-infra-cherrypick-robot)
• Updates to e2e tests to stop using v1.23 (kubernetes-sigs#5310, @k8s-infra-cherrypick-robot)

The images for this release are:
<ADD_IMAGE_HERE>

Thanks to all our contributors.

v2.7.3

Release notes for Cluster API Provider AWS (CAPA) <RELEASE_VERSION>

Documentation

Changelog since <PREVIOUS_VERSION>

Changes by Kind

Support

• Update metadata file for v2.7.0 release. (kubernetes-sigs#5187, @richardcase)

Uncategorized

• Add devbox and devcontainer configuration (kubernetes-sigs#5317, @k8s-infra-cherrypick-robot)
• Fix self hosted e2e test caused by disk pressure. (kubernetes-sigs#5293, @k8s-infra-cherrypick-robot)
• Fix: Include AddOn configuration and conflict resolution for reconciliation (kubernetes-sigs#5202, @k8s-infra-cherrypick-robot)
• Update PR verifier to be inline with upstream CAPI. (kubernetes-sigs#5302, @k8s-infra-cherrypick-robot)
• Updates to e2e tests to stop using v1.23 (kubernetes-sigs#5310, @k8s-infra-cherrypick-robot)

The images for this release are:
<ADD_IMAGE_HERE>

Thanks to all our contributors.

v2.7.2

Release notes for Cluster API Provider AWS (CAPA) <RELEASE_VERSION>

Documentation

Changelog since <PREVIOUS_VERSION>

Changes by Kind

Support

• Update metadata file for v2.7.0 release. (kubernetes-sigs#5187, @richardcase)

Uncategorized

• Fix: Include AddOn configuration and conflict resolution for reconciliation (kubernetes-sigs#5202, @k8s-infra-cherrypick-robot)

The images for this release are:
<ADD_IMAGE_HERE>

Thanks to all our contributors.