## Release notes for kOps 1.37 series

**&#9888; kOps 1.37 has not been released yet! &#9888;**

This is a document to gather the release notes prior to the release.

# Significant changes

* Support for AWS Classic Load Balancer (CLB) for the API, deprecated since kOps 1.26, has been removed. See the breaking changes section below for the required actions.

* On AWS, the new `spec.cloudProvider.aws.useIPBasedNodeNames` field (`spec.cloudConfig.useIPBasedNodeNames` in the v1alpha2 API) names Kubernetes nodes after the EC2 private DNS name (e.g. `ip-10-0-0-1.eu-west-1.compute.internal`) instead of the EC2 instance ID, restoring the naming used before kOps 1.24. Only newly launched nodes are affected; roll the cluster to rename existing nodes.

## Removal of gossip DNS

Support for gossip DNS, deprecated since kOps 1.29, has been removed. New gossip clusters will be rejected, and existing clusters will need to migrate before they can be upgraded. This affects clusters whose name ends in `.k8s.local` and that were not created with `--dns=none`; clusters using `--dns=none`, even with a `.k8s.local` name, are not affected.

Migrate to `--dns=none` or a hosted DNS zone using kOps 1.36 before upgrading; kOps 1.36 introduced hybrid bootstrap to make that migration easier. See the [gossip documentation](https://kops.sigs.k8s.io/gossip/) for the migration steps.

As part of this removal, the `protokube` component, whose only remaining responsibility was gossip DNS, is no longer built, shipped, or run on nodes. The `gossipConfig` and `dnsControllerGossipConfig` cluster spec fields are deprecated, no longer have any effect, and must be removed from cluster specs.

# Other changes of note

* On DigitalOcean, Hetzner, and Scaleway, control-plane user data no longer includes cloud API credentials. Components that still require them receive them through manifests generated by `kops update cluster`. If an `additionalUserData` script or `spec.hooks` unit relied on these variables, set them in the script or unit itself.

* On AWS, when `spec.iam.useServiceAccountExternalPermissions` is enabled, the control-plane instance role no longer includes Route 53 permissions. Grant affected workloads access through `spec.additionalPolicies` or a service account IAM role.

* On AWS, the `ec2:ModifyInstanceAttribute` permission granted to nodes for kube-router and kindnet is now limited to instances tagged as belonging to the cluster.

* On AWS, `ec2:DescribeInstanceTypes` is no longer granted unconditionally to every instance role. Instance roles receive the permission when Nvidia GPU support or Cilium ENI IPAM is enabled, and clusters using the AWS VPC CNI keep it as part of the CNI permissions. The cluster autoscaler permissions also omit it when `spec.clusterAutoscaler.awsUseStaticInstanceList` is enabled.

* On AWS, `ec2:DescribeRegions` is no longer granted for etcd-manager, which reads the region from the instance metadata service instead of calling the EC2 API.

* On AWS, the KMS permissions for customer managed keys now restrict `kms:CreateGrant` to grants created by AWS services on the role's behalf, and the remaining KMS actions to calls made through EC2 or S3. With `spec.encryptionConfig` enabled, control-plane roles keep unconditional access to the data actions so a kms-plugin can call KMS directly. Other direct KMS calls under an instance role, including `kms:CreateGrant`, require `spec.additionalPolicies` or a service account IAM role.

* On AWS, instance roles that require no permissions, such as the bastion role and the default worker node role, no longer have an inline IAM policy. `kops update cluster` deletes the previously created inline policy from such roles. With the Terraform target, the corresponding `aws_iam_role_policy` resources are removed from the configuration and destroyed on the next apply.

* Private cluster asset repositories now support AWS `s3://` URLs in addition to existing GCE `gs://` URLs, both for `KOPS_BASE_URL` (nodeup download) and `spec.assets.fileRepository`. Nodes authenticate with their instance credentials; see the [asset repository documentation](https://kops.sigs.k8s.io/operations/asset-repository/) for the required permissions. The AWS nodeup download requires node images with curl 8.0 or newer.

* Private cluster asset repositories now also support Azure `azureblob://<account>/<container>/<prefix>` URLs, both for `KOPS_BASE_URL` (nodeup download) and `spec.assets.fileRepository`. Nodes authenticate with their system-assigned managed identity, which has to be granted the `Storage Blob Data Reader` role on the assets container; see the [asset repository documentation](https://kops.sigs.k8s.io/operations/asset-repository/) for the details and warnings.

# Breaking changes

* Support for AWS Classic Load Balancer (CLB) for the API has been removed. Clusters with `spec.api.loadBalancer.class: Classic` (or with no explicit `class`, which previously defaulted to Classic) fail validation, and the long-deprecated `kops create cluster --api-loadbalancer-class` flag has been removed. Existing clusters using a CLB must migrate to a Network Load Balancer (NLB) using kOps 1.36 or earlier before upgrading to kOps 1.37, following the [CLB to NLB migration guide](https://github.com/kubernetes/kops/blob/master/permalinks/acm_nlb.md). Attaching instance groups to externally-managed Classic Load Balancers via `spec.externalLoadBalancers[].loadBalancerName` remains supported.
* Support for gossip DNS was removed. Existing gossip clusters must migrate to `--dns=none` or a hosted DNS zone using kOps 1.36 before upgrading.
* The `protokube` binary is no longer part of kOps releases, and nodes no longer install or run it.
* The `spec.gossipConfig` and `spec.dnsControllerGossipConfig` cluster spec fields are deprecated, no longer have any effect, and must be removed from cluster specs.

## Other breaking changes

* None at this time

# Known Issues

* None at this time

# Deprecations

* Support for Kubernetes version 1.31 is removed in kOps 1.37.

* Support for Kubernetes version 1.32 is deprecated and will be removed in kOps 1.38.

* Support for AWS Classic Load Balancer (CLB) for the API is removed in kOps 1.37.

* Support for containerd versions older than 2.2 (all end of life upstream) is deprecated and will be removed in kOps 1.38.

* Support for gossip DNS, deprecated since kOps 1.29, is removed in kOps 1.37.
