v1.35.10

Full Changelog: v1.35.9..v1.35.10

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• [BREAKING CHANGE] Load balancer reconciliation now validates public IP resource group annotations, internal subnet annotations for internal Services, and, when Private Link Service is requested, its resource group, name, and subnet annotations against Azure’s documented naming rules. Surrounding whitespace in subnet annotation values is trimmed. correct annotation values that do not meet these rules. Affected Services will fail create/update reconciliation until corrected. (#11042, @Liunardy)
• [BREAKING CHANGE] fix: a Service whose service.beta.kubernetes.io/azure-pls-name matches a private link service already in use is now rejected, instead of repointing that private link service to the new Service. correct the annotation on any PLS-enabled Service reporting SyncLoadBalancerFailed after upgrade. (#11000, @Liunardy)
• [BREAKING CHANGE] fix: reject LoadBalancer Services that list a managed load balancer frontend IP in the service.beta.kubernetes.io/azure-additional-public-ips annotation. The annotation remains supported for IPs outside managed frontends, such as Azure Global-tier public IPs. remove managed frontend IPs from this annotation. (#11083, @Liunardy)

Changes by Kind

Bug or Regression

• Fix: keep the deny-all NSG rule intact for Services using azure-deny-all-except-load-balancer-source-ranges when another Service sharing one of its destinations is reconciled or deleted. Previously that destination could be dropped from the rule, leaving the Service reachable from anywhere in the virtual network rather than only its configured source ranges. fix: stop adding NSG rules for an IP family the Service does not serve. A single-stack Service with the floating IP disabled no longer gets rules for the other family’s node addresses, and any such rule already in the security group is removed the next time the Service is reconciled. (#11096, @Liunardy)
• Fix: preserve full registry hostnames in the ACR credential provider’s cloud-suffix fallback. (#11082, @Liunardy)

Dependencies

• ←Previous
• Next→