v1.35.9

Cloud Provider Azure v1.35.9

Full Changelog: v1.35.8..v1.35.9

Changes by Kind

Feature

  • Added AccountOptions.IsNFSEncryptionInTransitEnabled to enable per-protocol NFS encryption in transit on newly created storage accounts. The field is optional, leaving it as nil preserves the existing behavior. (#10822, @rnhan)
  • Feat: support AllowCrossTenantReplication in AccountOptions (#10823, @andyzhangx)
  • Feat: support separate resource group for private DNS zone via PrivateDNSZoneResourceGroup in AccountOptions (#10824, @andyzhangx)
  • Fix: InvalidSourceRanges, InvalidAllowedIPRanges and ConflictConfiguration warning events are now emitted when a Service is created or updated instead of only during delete, and are no longer emitted when the configuration is rejected and no security group change is made. Deleting a Service is no longer blocked when both spec.loadBalancerSourceRanges and the service.beta.kubernetes.io/azure-allowed-ip-ranges annotation are set. feat: a new IPRangeFamilyMismatch warning event reports IP ranges from spec.loadBalancerSourceRanges, service.beta.kubernetes.io/load-balancer-source-ranges, and service.beta.kubernetes.io/azure-allowed-ip-ranges whose IP family the Service does not have. (#10894, @Liunardy)

Bug or Regression

  • Added AccountOptions.SkipHTTPSTrafficOnlyMatch to opt out of EnableHTTPSTrafficOnly equality when reusing an existing storage account. Useful for callers such as NFS file share requests where the setting has no effect on the mount protocol and existing accounts should be reused regardless of their EnableHTTPSTrafficOnly value. (#10828, @andyzhangx)
  • Bug fix: sends extended location when update vmss. (#10819, @wonderyl)
  • Fix Azure failed-VM refresh operations to use PATCH so recovery is not rejected with LocationRequired. (#10790, @stbenjam)
  • Fix workload-identity storage account key retrieval failing with AADSTS500011 in sovereign clouds (Azure China / US Gov / AzureStack) by threading the cloud config into the client assertion credential and the ARM client. (#10905, @andyzhangx)
  • The service.beta.kubernetes.io/azure-pip-tags annotation no longer sets the Public IP tag keys managed by the controller (k8s-azure-cluster-name, k8s-azure-service, k8s-azure-dns-label-service, and their legacy names). Such keys in the annotation are now ignored, in any letter case, and a Warning event with reason IgnoredPIPTagKeys is emitted on the Service. (#10900, @Liunardy)

Dependencies

Added

  • cloud.google.com/go/auth: v0.18.2
  • github.com/google/s2a-go: v0.1.9
  • github.com/googleapis/enterprise-certificate-proxy: v0.3.11
  • github.com/googleapis/gax-go/v2: v2.17.0

Changed

Removed

Nothing has changed.

Last modified September 15, 2026: Update release notes for v1.35.9 (#10977) (766c74e22)