v1.37.0

Cloud Provider Azure v1.37.0

Full Changelog: v1.36.0..v1.37.0

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

  • [BREAKING CHANGE] fix: a Service whose service.beta.kubernetes.io/azure-pls-name matches a private link service already in use is now rejected, instead of repointing that private link service to the new Service. correct the annotation on any PLS-enabled Service reporting SyncLoadBalancerFailed after upgrade. (#10943, @Liunardy)

Changes by Kind

Feature

  • Add a configurable grace period (nodeInstanceNotFoundGracePeriodInSeconds) in the cloud config for newly registered Kubernetes nodes whose backing Azure VM/VMSS instance is not immediately visible in ARM. (#10605, @robbiezhang)
  • Added ServiceGatewayClient to the Azure client factory for managing Azure Service Gateway resources. (#10066, @georgeedward2000)
  • Added AccountOptions.IsNFSEncryptionInTransitEnabled to enable per-protocol NFS encryption in transit on newly created storage accounts. The field is optional, leaving it as nil preserves the existing behavior. (#10812, @rnhan)
  • Added the service.beta.kubernetes.io/azure-disable-load-balancer-nsg-rule Service annotation to disable cloud-provider-managed LoadBalancer NSG rule creation for Services whose NSG rules are intentionally managed by operators. (#10508, @nilo19)
  • Fix: InvalidSourceRanges, InvalidAllowedIPRanges and ConflictConfiguration warning events are now emitted when a Service is created or updated instead of only during delete, and are no longer emitted when the configuration is rejected and no security group change is made. Deleting a Service is no longer blocked when both spec.loadBalancerSourceRanges and the service.beta.kubernetes.io/azure-allowed-ip-ranges annotation are set. feat: a new IPRangeFamilyMismatch warning event reports IP ranges from spec.loadBalancerSourceRanges, service.beta.kubernetes.io/load-balancer-source-ranges, and service.beta.kubernetes.io/azure-allowed-ip-ranges whose IP family the Service does not have. (#10864, @Liunardy)
  • The ACR credential provider supports user-assigned managed identities on Azure Arc-enabled servers. (#10830, @hanlin-openai)

Bug or Regression

  • Added AccountOptions.SkipHTTPSTrafficOnlyMatch to opt out of EnableHTTPSTrafficOnly equality when reusing an existing storage account. Useful for callers such as NFS file share requests where the setting has no effect on the mount protocol and existing accounts should be reused regardless of their EnableHTTPSTrafficOnly value. (#10826, @andyzhangx)

  • Bug fix: sends extended location when update vmss. (#10816, @wonderyl)

  • External LoadBalancer Services with invalid or non-public pinned LoadBalancer IPs now fail fast with a validation error instead of listing Azure Public IPs. (#10507, @nilo19)

  • Fix Azure failed-VM refresh operations to use PATCH so recovery is not rejected with LocationRequired. (#10763, @stbenjam)

  • Fix workload-identity storage account key retrieval failing with AADSTS500011 in sovereign clouds (Azure China / US Gov / AzureStack) by threading the cloud config into the client assertion credential and the ARM client. (#10903, @andyzhangx)

  • Fix(multi-slb): deduplicate IP addresses in local service backend pool updates to prevent DuplicateResourceName errors during EndpointSlice churn (#10445, @Liunardy)

  • Fix(multi-slb): select existing LB with no rules over creating a new one (#10514, @Liunardy)

  • Fix(multi-slb): support switching internal/external when IP sharing across multiple services

    Correctly clean up stale rules and probes when services sharing a frontend IP switch between external and internal in multi-SLB mode. (#10211, @Liunardy)

  • Fix: IPv6 PIP name lookup on single-stack IPv4 services incorrectly returned the IPv4 annotation value, causing redundant public IP lookups. (#10540, @Liunardy)

  • Fix: serialize backendPoolUpdater with service reconciliation to prevent concurrent backend pool writes in multi-standard-load-balancer configurations with externalTrafficPolicy: Local (#10328, @Liunardy)

  • Fix: use network subscription for zone discovery when NetworkResourceSubscriptionID is set (#10515, @Liunardy)

  • Match Azure Container Registry regional (geo-replica) login server endpoints of the form <registry>.<region>.geo.azurecr.io explicitly in the ACR credential provider’s acrRE pattern, instead of relying on the fallback substring match, and add regression tests. (#10720, @lizMSFT)

  • Preserves –node-monitor-period support when upgrading to Kubernetes 1.37 dependencies and adds –concurrent-node-lifecycle-syncs, defaulting to 1. (#11024, @anndono)

  • The service.beta.kubernetes.io/azure-pip-tags annotation no longer sets the Public IP tag keys managed by the controller (k8s-azure-cluster-name, k8s-azure-service, k8s-azure-dns-label-service, and their legacy names). Such keys in the annotation are now ignored, in any letter case, and a Warning event with reason IgnoredPIPTagKeys is emitted on the Service. (#10897, @Liunardy)

Dependencies

Added

  • cloud.google.com/go/auth: v0.18.2
  • github.com/go-openapi/swag/cmdutils: v0.27.1
  • github.com/go-openapi/swag/conv: v0.27.1
  • github.com/go-openapi/swag/fileutils: v0.27.1
  • github.com/go-openapi/swag/jsonutils: v0.27.1
  • github.com/go-openapi/swag/jsonutils/fixtures_test: v0.27.1
  • github.com/go-openapi/swag/loading: v0.27.1
  • github.com/go-openapi/swag/mangling: v0.27.1
  • github.com/go-openapi/swag/netutils: v0.27.1
  • github.com/go-openapi/swag/pools: v0.27.1
  • github.com/go-openapi/swag/stringutils: v0.27.1
  • github.com/go-openapi/swag/typeutils: v0.27.1
  • github.com/go-openapi/swag/yamlutils: v0.27.1
  • github.com/go-openapi/testify/enable/yaml/v2: v2.6.0
  • github.com/go-openapi/testify/v2: v2.6.0
  • github.com/google/s2a-go: v0.1.9
  • github.com/googleapis/enterprise-certificate-proxy: v0.3.11
  • github.com/googleapis/gax-go/v2: v2.17.0
  • go.opentelemetry.io/otel/metric/x: v0.68.0

Changed

Removed

  • github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v6: v6.4.0
  • github.com/gogo/protobuf: v1.3.2
  • github.com/kisielk/errcheck: v1.5.0
  • github.com/kisielk/gotool: v1.0.0
  • github.com/pkg/errors: v0.9.1
  • golang.org/x/xerrors: 5ec99f8
Last modified September 24, 2026: Update release notes for v1.37.0 (#11039) (e58add1d2)