v0.28.0

Changes by Kind

Security

• Update github.com/golang-jwt/jwt/v4 to v4.5.2 (addressing CVE-2025-30204) (#3352, @embik) (#3454, @xrstf)

Deprecation

• Deprecate APIExport Virtual Workspace URL population. Add feature flag EnableDeprecatedAPIExportVirtualWorkspacesUrls to re-enable deprecated APIExport Virtual Workspace URLs (#3411, @mjudeikis)

API Change

• Add caching API under cache.kcp.io to be able to interact with cache server programmatically (#3382, @mjudeikis)
• Add optional spec.mount to Workspace objects to stabilize mount API (#3380, @mjudeikis)
• Add CachedResourcesEndpointSlice resource (#3442, @gman0)
• Add new version of APIBinding to apis.kcp.io/v1alpha2 (#3384, @xmudrii)
• Add new version of APIExport to apis.kcp.io/v1alpha2 (#3318, @xrstf)
• Implement support for verbs in PermissionClaims (#3402, @xmudrii)
• Make CachedResource GVR immutable and unique in the logical cluster (#3476, @gman0)
• Rebase to Kubernetes v1.32.3 (#3383, @gman0)
  • ValidatingAdmissionPolicy has been removed from admissionregistration.k8s.io/v1alpha1 as per Kubernetes v1.32 API lifecycle management
  • admissionregistration.k8s.io/v1alpha1 is no longer being served by default
• Stop printing Ready column for APIExports as virtual workspace URLs are no longer populated by default (#3493, @embik)
• Add sdk/testing/server.ContextRunInProcessFunc. Deprecate sdk/testing/server.RunInProcessFunc (#3388, @ntnn)
• Serve both v1alpha1 and v1alpha2 of APIBindings in the APIExport Virtual Workspace (#3430, @xmudrii)
  • Fix a panic in the OpenAPI v3 endpoint for Virtual Workspaces happening if there's a resource with two or more versions

Feature

• Add Replication virtual workspace for CachedResource. Endpoint for the Replication VW is now displayed in its respective CachedResourceEndpointSlice (#3480, @gman0)
• Add a new --root-identities-file CLI flag to kcp used to bootstrap APIExport identities inside the root workspace (#3400, @gman0)
• Add a controller to automatically keep defaultAPIBindings defined in a WorkspaceType up to date in all workspaces that derive from it. This behaviour is enabled by configuring .spec.defaultAPIBindingLifecycle (#3381, @MisterMX)
• Enable CLI flag --encryption-provider-config in the kcp binary (#3470, @adrianrobotka)
• Print flags in sections for kcp-front-proxy binary (#3385, @sttts)
• Run the admission chain in the virtual workspace (forwarding) registry with the create verb upon creating a new object using server-side apply. As a result, running the server-side apply for a claimed resource in the APIExport Virtual Workspace requires the create verb (#3439, @xmudrii)
• The kcp specific CRDs are now bundled into one yaml file that is part of the release (#3466, @mikkeldamsgaard)

Bug or Regression

• Authorization checks on resources from an APIExport delegate to the next authorizer if the APIExport is not found (#3467, @ntnn)
• Disable the cd semantic notice when --short is provided (#3423, @ntnn)
• Fix --bind-address not being honoured in some generated configuration files (#3418, @ntnn)
• Fix APIResourceSchema name for the WorkspaceTypes resource to unblock upgrade from previous versions (#3349, @embik)
• Fix URL update when logicalcluster URL changes but workspace URL is not updated (#3474, @mjudeikis)
• Only set experimental.tenancy.kcp.io/owner annotation on LogicalCluster if Workspace has the annotation (#3438, @embik)
• Remove VOLUME from Dockerfile so no /data volume is mounted anymore (#3434, @embik)

Other (Cleanup or Flake)

• Fix consistency for DynamicRestMapper & workspace cleaner (#3447, @mjudeikis)
• Move to use dynamicRestMapper everywhere to dynamically resolve Kind to resource and vice versa (#3462, @mjudeikis)
• Update to Go 1.23.10 (#3443, @xrstf)
• Update to kcp/code-generator v3 (#3406, @xrstf)
• Stop exposing mini-front-proxy handlers (including /metrics) on kcp server unless --additional-mappings-file is passed (#3361, @embik)

Dependencies

Added

• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.24.2
• github.com/Microsoft/hnslib: v0.0.8
• github.com/containerd/containerd/api: v1.7.19
• github.com/containerd/errdefs: v0.1.0
• github.com/containerd/log: v0.1.0
• github.com/kcp-dev/code-generator/v3: 4094fb8
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/externaljwt: ddbe171
• github.com/klauspost/compress: v1.17.11
• github.com/kylelemons/godebug: v1.1.0
• github.com/moby/sys/userns: v0.1.0
• github.com/planetscale/vtprotobuf: 0393e58
• go.opentelemetry.io/auto/sdk: v1.1.0
• go.opentelemetry.io/contrib/detectors/gcp: v1.31.0
• go.opentelemetry.io/otel/sdk/metric: v1.31.0

Changed

• cel.dev/expr: v0.15.0 → v0.19.1
• cloud.google.com/go/accessapproval: v1.7.1 → v1.7.5
• cloud.google.com/go/accesscontextmanager: v1.8.1 → v1.8.5
• cloud.google.com/go/aiplatform: v1.48.0 → v1.60.0
• cloud.google.com/go/analytics: v0.21.3 → v0.23.0
• cloud.google.com/go/apigateway: v1.6.1 → v1.6.5
• cloud.google.com/go/apigeeconnect: v1.6.1 → v1.6.5
• cloud.google.com/go/apigeeregistry: v0.7.1 → v0.8.3
• cloud.google.com/go/appengine: v1.8.1 → v1.8.5
• cloud.google.com/go/area120: v0.8.1 → v0.8.5
• cloud.google.com/go/artifactregistry: v1.14.1 → v1.14.7
• cloud.google.com/go/asset: v1.14.1 → v1.17.2
• cloud.google.com/go/assuredworkloads: v1.11.1 → v1.11.5
• cloud.google.com/go/automl: v1.13.1 → v1.13.5
• cloud.google.com/go/baremetalsolution: v1.1.1 → v1.2.4
• cloud.google.com/go/batch: v1.3.1 → v1.8.0
• cloud.google.com/go/beyondcorp: v1.0.0 → v1.0.4
• cloud.google.com/go/bigquery: v1.53.0 → v1.59.1
• cloud.google.com/go/billing: v1.16.0 → v1.18.2
• cloud.google.com/go/binaryauthorization: v1.6.1 → v1.8.1
• cloud.google.com/go/certificatemanager: v1.7.1 → v1.7.5
• cloud.google.com/go/channel: v1.16.0 → v1.17.5
• cloud.google.com/go/cloudbuild: v1.13.0 → v1.15.1
• cloud.google.com/go/clouddms: v1.6.1 → v1.7.4
• cloud.google.com/go/cloudtasks: v1.12.1 → v1.12.6
• cloud.google.com/go/compute/metadata: v0.3.0 → v0.5.2
• cloud.google.com/go/compute: v1.23.0 → v1.24.0
• cloud.google.com/go/contactcenterinsights: v1.10.0 → v1.13.0
• cloud.google.com/go/container: v1.24.0 → v1.31.0
• cloud.google.com/go/containeranalysis: v0.10.1 → v0.11.4
• cloud.google.com/go/datacatalog: v1.16.0 → v1.19.3
• cloud.google.com/go/dataflow: v0.9.1 → v0.9.5
• cloud.google.com/go/dataform: v0.8.1 → v0.9.2
• cloud.google.com/go/datafusion: v1.7.1 → v1.7.5
• cloud.google.com/go/datalabeling: v0.8.1 → v0.8.5
• cloud.google.com/go/dataplex: v1.9.0 → v1.14.2
• cloud.google.com/go/dataproc/v2: v2.0.1 → v2.4.0
• cloud.google.com/go/dataqna: v0.8.1 → v0.8.5
• cloud.google.com/go/datastore: v1.13.0 → v1.15.0
• cloud.google.com/go/datastream: v1.10.0 → v1.10.4
• cloud.google.com/go/deploy: v1.13.0 → v1.17.1
• cloud.google.com/go/dialogflow: v1.40.0 → v1.49.0
• cloud.google.com/go/dlp: v1.10.1 → v1.11.2
• cloud.google.com/go/documentai: v1.22.0 → v1.25.0
• cloud.google.com/go/domains: v0.9.1 → v0.9.5
• cloud.google.com/go/edgecontainer: v1.1.1 → v1.1.5
• cloud.google.com/go/essentialcontacts: v1.6.2 → v1.6.6
• cloud.google.com/go/eventarc: v1.13.0 → v1.13.4
• cloud.google.com/go/filestore: v1.7.1 → v1.8.1
• cloud.google.com/go/firestore: v1.12.0 → v1.14.0
• cloud.google.com/go/functions: v1.15.1 → v1.16.0
• cloud.google.com/go/gkebackup: v1.3.0 → v1.3.5
• cloud.google.com/go/gkeconnect: v0.8.1 → v0.8.5
• cloud.google.com/go/gkehub: v0.14.1 → v0.14.5
• cloud.google.com/go/gkemulticloud: v1.0.0 → v1.1.1
• cloud.google.com/go/gsuiteaddons: v1.6.1 → v1.6.5
• cloud.google.com/go/iam: v1.1.1 → v1.1.6
• cloud.google.com/go/iap: v1.8.1 → v1.9.4
• cloud.google.com/go/ids: v1.4.1 → v1.4.5
• cloud.google.com/go/iot: v1.7.1 → v1.7.5
• cloud.google.com/go/kms: v1.15.0 → v1.15.7
• cloud.google.com/go/language: v1.10.1 → v1.12.3
• cloud.google.com/go/lifesciences: v0.9.1 → v0.9.5
• cloud.google.com/go/logging: v1.7.0 → v1.9.0
• cloud.google.com/go/longrunning: v0.5.1 → v0.5.5
• cloud.google.com/go/managedidentities: v1.6.1 → v1.6.5
• cloud.google.com/go/maps: v1.4.0 → v1.6.4
• cloud.google.com/go/mediatranslation: v0.8.1 → v0.8.5
• cloud.google.com/go/memcache: v1.10.1 → v1.10.5
• cloud.google.com/go/metastore: v1.12.0 → v1.13.4
• cloud.google.com/go/monitoring: v1.15.1 → v1.18.0
• cloud.google.com/go/networkconnectivity: v1.12.1 → v1.14.4
• cloud.google.com/go/networkmanagement: v1.8.0 → v1.9.4
• cloud.google.com/go/networksecurity: v0.9.1 → v0.9.5
• cloud.google.com/go/notebooks: v1.9.1 → v1.11.3
• cloud.google.com/go/optimization: v1.4.1 → v1.6.3
• cloud.google.com/go/orchestration: v1.8.1 → v1.8.5
• cloud.google.com/go/orgpolicy: v1.11.1 → v1.12.1
• cloud.google.com/go/osconfig: v1.12.1 → v1.12.5
• cloud.google.com/go/oslogin: v1.10.1 → v1.13.1
• cloud.google.com/go/phishingprotection: v0.8.1 → v0.8.5
• cloud.google.com/go/policytroubleshooter: v1.8.0 → v1.10.3
• cloud.google.com/go/privatecatalog: v0.9.1 → v0.9.5
• cloud.google.com/go/pubsub: v1.33.0 → v1.36.1
• cloud.google.com/go/recaptchaenterprise/v2: v2.7.2 → v2.9.2
• cloud.google.com/go/recommendationengine: v0.8.1 → v0.8.5
• cloud.google.com/go/recommender: v1.10.1 → v1.12.1
• cloud.google.com/go/redis: v1.13.1 → v1.14.2
• cloud.google.com/go/resourcemanager: v1.9.1 → v1.9.5
• cloud.google.com/go/resourcesettings: v1.6.1 → v1.6.5
• cloud.google.com/go/retail: v1.14.1 → v1.16.0
• cloud.google.com/go/run: v1.2.0 → v1.3.4
• cloud.google.com/go/scheduler: v1.10.1 → v1.10.6
• cloud.google.com/go/secretmanager: v1.11.1 → v1.11.5
• cloud.google.com/go/security: v1.15.1 → v1.15.5
• cloud.google.com/go/securitycenter: v1.23.0 → v1.24.4
• cloud.google.com/go/servicedirectory: v1.11.0 → v1.11.4
• cloud.google.com/go/shell: v1.7.1 → v1.7.5
• cloud.google.com/go/spanner: v1.47.0 → v1.56.0
• cloud.google.com/go/speech: v1.19.0 → v1.21.1
• cloud.google.com/go/storagetransfer: v1.10.0 → v1.10.4
• cloud.google.com/go/talent: v1.6.2 → v1.6.6
• cloud.google.com/go/texttospeech: v1.7.1 → v1.7.5
• cloud.google.com/go/tpu: v1.6.1 → v1.6.5
• cloud.google.com/go/trace: v1.10.1 → v1.10.5
• cloud.google.com/go/translate: v1.8.2 → v1.10.1
• cloud.google.com/go/video: v1.19.0 → v1.20.4
• cloud.google.com/go/videointelligence: v1.11.1 → v1.11.5
• cloud.google.com/go/vision/v2: v2.7.2 → v2.8.0
• cloud.google.com/go/vmmigration: v1.7.1 → v1.7.5
• cloud.google.com/go/vmwareengine: v1.0.0 → v1.1.1
• cloud.google.com/go/vpcaccess: v1.7.1 → v1.7.5
• cloud.google.com/go/webrisk: v1.9.1 → v1.9.5
• cloud.google.com/go/websecurityscanner: v1.6.1 → v1.6.5
• cloud.google.com/go/workflows: v1.11.1 → v1.12.4
• cloud.google.com/go: v0.110.7 → v0.112.0
• github.com/Azure/go-ansiterm: d185dfc → 306776e
• github.com/Microsoft/go-winio: v0.6.0 → v0.6.2
• github.com/antlr4-go/antlr/v4: v4.13.0 → v4.13.1
• github.com/armon/circbuf: bbbad09 → 5111143
• github.com/cncf/xds/go: 555b57e → b4127c9
• github.com/containerd/ttrpc: v1.2.2 → v1.2.5
• github.com/coredns/corefile-migration: v1.0.23 → v1.0.24
• github.com/cpuguy83/go-md2man/v2: v2.0.4 → v2.0.6
• github.com/cyphar/filepath-securejoin: v0.2.4 → v0.3.4
• github.com/distribution/reference: v0.5.0 → v0.6.0
• github.com/emicklei/go-restful/v3: v3.11.0 → v3.12.1
• github.com/envoyproxy/go-control-plane: v0.12.0 → v0.13.1
• github.com/envoyproxy/protoc-gen-validate: v1.0.4 → v1.1.0
• github.com/exponent-io/jsonpath: d6023ce → 1de76d7
• github.com/fatih/color: v1.15.0 → v1.18.0
• github.com/golang-jwt/jwt/v4: v4.5.0 → v4.5.2
• github.com/golang/glog: v1.2.1 → v1.2.2
• github.com/google/btree: v1.0.1 → v1.1.3
• github.com/google/cadvisor: v0.49.0 → v0.51.0
• github.com/google/cel-go: v0.20.1 → v0.22.1
• github.com/google/go-cmp: v0.6.0 → v0.7.0
• github.com/google/pprof: 4bfdf5a → 40e02aa
• github.com/gregjones/httpcache: 9cad4c3 → 901d907
• github.com/grpc-ecosystem/grpc-gateway/v2: v2.20.0 → v2.25.1
• github.com/jonboulle/clockwork: v0.2.2 → v0.4.0
• github.com/kcp-dev/apimachinery/v2: 431177b → ebb573a
• github.com/kcp-dev/client-go: 3dea338 → decc4df
• github.com/kcp-dev/embeddedetcd: v1.0.2 → 89d1631
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/api: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/apiextensions-apiserver: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/apimachinery: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/apiserver: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cli-runtime: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/client-go: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cloud-provider: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cluster-bootstrap: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/code-generator: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-base: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/component-helpers: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/controller-manager: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cri-api: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/cri-client: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/csi-translation-lib: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/dynamic-resource-allocation: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/endpointslice: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kms: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-aggregator: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-controller-manager: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-proxy: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kube-scheduler: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kubectl: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/kubelet: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/metrics: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/mount-utils: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/pod-security-admission: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes/staging/src/k8s.io/sample-apiserver: 0011b8c → ddbe171
• github.com/kcp-dev/kubernetes: 0011b8c → ddbe171
• github.com/mattn/go-isatty: v0.0.17 → v0.0.20
• github.com/moby/spdystream: v0.4.0 → v0.5.0
• github.com/moby/sys/mountinfo: v0.7.1 → v0.7.2
• github.com/mohae/deepcopy: 491d360 → c48cc78
• github.com/onsi/ginkgo/v2: v2.19.0 → v2.22.1
• github.com/onsi/gomega: v1.33.1 → v1.36.2
• github.com/opencontainers/runc: v1.1.13 → v1.2.1
• github.com/opencontainers/runtime-spec: 494a5a6 → v1.2.0
• github.com/opencontainers/selinux: v1.11.0 → v1.11.1
• github.com/prometheus/client_golang: v1.19.1 → v1.20.5
• github.com/prometheus/common: v0.55.0 → v0.61.0
• github.com/rogpeppe/go-internal: v1.12.0 → v1.13.1
• github.com/spf13/cobra: v1.8.1 → v1.9.1
• github.com/stretchr/testify: v1.9.0 → v1.10.0
• github.com/vishvananda/netlink: v1.1.0 → 62fb240
• github.com/xiang90/probing: 43a291a → a49e3df
• go.etcd.io/bbolt: v1.3.9 → v1.3.11
• go.etcd.io/etcd/api/v3: v3.5.14 → v3.5.17
• go.etcd.io/etcd/client/pkg/v3: v3.5.14 → v3.5.17
• go.etcd.io/etcd/client/v2: v2.305.13 → v2.305.16
• go.etcd.io/etcd/client/v3: v3.5.14 → v3.5.17
• go.etcd.io/etcd/pkg/v3: v3.5.13 → v3.5.16
• go.etcd.io/etcd/raft/v3: v3.5.13 → v3.5.16
• go.etcd.io/etcd/server/v3: v3.5.13 → v3.5.16
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: v0.53.0 → v0.58.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.53.0 → v0.58.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.27.0 → v1.33.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.28.0 → v1.33.0
• go.opentelemetry.io/otel/metric: v1.28.0 → v1.33.0
• go.opentelemetry.io/otel/sdk: v1.28.0 → v1.33.0
• go.opentelemetry.io/otel/trace: v1.28.0 → v1.33.0
• go.opentelemetry.io/otel: v1.28.0 → v1.33.0
• go.opentelemetry.io/proto/otlp: v1.3.1 → v1.5.0
• go.uber.org/zap: v1.26.0 → v1.27.0
• golang.org/x/crypto: v0.35.0 → v0.37.0
• golang.org/x/exp: f3d0a9c → 7e4ce0a
• golang.org/x/mod: v0.23.0 → v0.24.0
• golang.org/x/net: v0.36.0 → v0.39.0
• golang.org/x/oauth2: v0.21.0 → v0.29.0
• golang.org/x/sync: v0.11.0 → v0.13.0
• golang.org/x/sys: v0.30.0 → v0.32.0
• golang.org/x/term: v0.29.0 → v0.31.0
• golang.org/x/text: v0.22.0 → v0.24.0
• golang.org/x/time: v0.3.0 → v0.11.0
• golang.org/x/tools: v0.30.0 → v0.32.0
• golang.org/x/xerrors: 04be3eb → 5ec99f8
• google.golang.org/appengine: v1.6.7 → v1.4.0
• google.golang.org/genproto/googleapis/api: 5315273 → 5f5ef82
• google.golang.org/genproto/googleapis/rpc: f6361c8 → 5f5ef82
• google.golang.org/genproto: b8732ec → 012b6fc
• google.golang.org/grpc: v1.65.0 → v1.69.2
• google.golang.org/protobuf: v1.36.5 → v1.36.2
• k8s.io/gengo/v2: 51d4e06 → 2b36238
• k8s.io/kube-openapi: 70dd376 → 2c72e55
• k8s.io/system-validators: v1.8.0 → v1.9.1
• k8s.io/utils: 18e509b → 24370be
• sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.30.3 → v0.31.1
• sigs.k8s.io/json: bc3834c → cfa47c3
• sigs.k8s.io/kustomize/api: v0.17.2 → v0.18.0
• sigs.k8s.io/kustomize/kustomize/v5: v5.4.2 → v5.5.0
• sigs.k8s.io/kustomize/kyaml: v0.17.1 → v0.18.1
• sigs.k8s.io/structured-merge-diff/v4: v4.4.1 → v4.5.0

Removed

• github.com/Microsoft/hcsshim: v0.8.26
• github.com/checkpoint-restore/go-criu/v5: v5.3.0
• github.com/cilium/ebpf: v0.9.1
• github.com/containerd/cgroups: v1.1.0
• github.com/containerd/console: v1.0.3
• github.com/daviddengcn/go-colortext: v1.0.0
• github.com/imdario/mergo: v0.3.12
• github.com/seccomp/libseccomp-golang: v0.10.0
• github.com/shurcooL/sanitized_anchor_name: v1.0.0
• github.com/syndtr/gocapability: 42c35b4
• github.com/urfave/cli: v1.22.1
• go.opencensus.io: v0.24.0
• go.starlark.net: a134d8f