Release Notes

• 1: KubeOps Versions
• 2: KubeOps 2.2.0_Beta0
• 3: KubeOps 2.2.0_Alpha5
• 4: KubeOps 2.2.0_Alpha4
• 5: KubeOps 2.2.0_Alpha3
• 6: KubeOps 2.2.0_Alpha2
• 7: KubeOps 2.2.0_Alpha1
• 8: KubeOps 2.2.0_Alpha0
• 9: KubeOps 2.1.0
• 10: KubeOps 2.1.0_Beta0
• 11: KubeOps 2.1.0_Alpha0
• 12: KubeOps 2.0.5
• 13: KubeOps 2.0.4
• 14: KubeOps 2.0.3
• 15: KubeOps 2.0.2
• 16: KubeOps 2.0.1

1 - KubeOps Versions

Here is the KubeOps and it’s supported tools versions list. Make sure to install or upgrade according to supported versions only.

2 - KubeOps 2.2.0_Beta0

KubeOps 2.2.0_Beta0 - Release Date 30.07.2026

Changelog KubeOpsCtl 2.2.0_Beta0

Whats new?

- Added Traefik support for kubeopsctl
- Added Kubevirt-Manager support for kubeopsctl
- Added Kubernetes 1.35 support
- Added Kubernetes 1.36 support
- Added Advanced Parameters for static Registry mount path, check out the file format [Cluster Values YAML](/docs/kubeopsctl-2.0/reference/fileformats/#cluster-valuesyaml)

Fixes

- fixed a podman bug affecting pull packages
- fixed a harbor bug setting up cluster
- added creation of nginx ingressclass, when installing traefik for backwards compatabilty
- fixed default secret for kubeops-dashboard
- kubeopsctl pull command now verifies if the specified tool value file exists
- Added kubeops-harbor-secret for pulling images from the internal private harbor project 'kubeops'
- fixed a bug that prevented to create the kubeops harbor project as private 
- fixed a bug that prevented to change the kubeops harbor project to private 
- fixed a bug that prevented the image push of the kubernetes images to local-registry 
- changed the 'localhost' reference to '127.0.0.1' for enterprise-tools in preperation for the kubernetes 1.36 support
- fix image push in local registry
- fixed duplicated coredns in 1.36.1
- updated kosi versions for consistent installation
- updated Harbor ImagePullSecret with 127.0.0.1 instead of master1 IP
- remove hardcoded plugin versions in cluster prepare node
- fixed a bug in rook delete section
- fixed a bug in nginx ingressclass for traefik
- added default secret for grafana
- added role bindings for the kubevirt roles
- fixed delete ingresses in update process 
- OpenSearch users created in the Dashboards Security UI now persist across package updates 
- OpenSearch TLS certificates are no longer regenerated on every install/update, preventing certificate rotation on running clusters 
- Fixed OpenSearch SSO returning 401 Unauthorized by reliably applying the openid security configuration to the backend after deploy 
- Added a Keycloak protocol mapper so realm roles are propagated to OpenSearch for backend role mapping 
- Added Single Sign-On (SSO) with Keycloak (OpenID Connect) for OpenSearch and OpenSearch Dashboards 
- Added username/password fallback authentication for OpenSearch alongside SSO 
- Made the OpenSearch admin password configurable via the new `adminPassword` package value (opensearch-os & opensearch-dashboards) 
- Added `hostname` package value for opensearch-os to point OpenSearch at the Keycloak SSO endpoint 
- Refresh the Keycloak admin token before each step of the OpenSearch Dashboards OIDC join so long-running joins no longer fail with 401 once the 60s token lifespan is exceeded

Known Issues

Versions KubeOps 2.2.0_Beta0

3 - KubeOps 2.2.0_Alpha5

KubeOps 2.2.0_Alpha5 - Release Date 21.07.2026

Changelog KubeOpsCtl 2.2.0_Alpha5

Whats new?

• Added Traefik support for kubeopsctl
• Added Kubevirt-Manager support for kubeopsctl
• Added Kubernetes 1.35 support
• Added Kubernetes 1.36 support
• Added Advanced Parameters for static Registry mount path, check out the file format Cluster Values YAML

Bugfixes

* OpenSearch users created in the Dashboards Security UI now persist across package updates (DEV-2868)
* OpenSearch TLS certificates are no longer regenerated on every install/update, preventing certificate rotation on running clusters (DEV-2868)
* Fixed OpenSearch SSO returning 401 Unauthorized by reliably applying the openid security configuration to the backend after deploy (DEV-2868)
* Added a Keycloak protocol mapper so realm roles are propagated to OpenSearch for backend role mapping (DEV-2868)
* Added Single Sign-On (SSO) with Keycloak (OpenID Connect) for OpenSearch and OpenSearch Dashboards (DEV-2868)
* Added username/password fallback authentication for OpenSearch alongside SSO (DEV-2868)
* Made the OpenSearch admin password configurable via the new `adminPassword` package value (opensearch-os & opensearch-dashboards) (DEV-2868)
* Added `hostname` package value for opensearch-os to point OpenSearch at the Keycloak SSO endpoint (DEV-2868)

KubeOps 2.2.0_Alpha5

4 - KubeOps 2.2.0_Alpha4

KubeOps 2.2.0_Alpha4 - Release Date 15.07.2026

Changelog KubeOpsCtl 2.2.0_Alpha4

Whats new?

• Added Traefik support for kubeopsctl
• Added Kubevirt-Manager support for kubeopsctl
• Added Kubernetes 1.35 support
• Added Kubernetes 1.36 support
• Added Advanced Parameters for static Registry mount path, check out the file format Cluster Values YAML

Bugfixes

* Added kubeops-harbor-secret for pulling images from the internal private harbor project 'kubeops' (DEV-2849)
* fixed a bug that prevented to create the kubeops harbor project as private (DEV-2848)
* fixed a bug that prevented to change the kubeops harbor project to private (DEV-2848)
* fixed a bug that prevented the image push of the kubernetes images to local-registry (DEV-2848)
* changed the 'localhost' reference to '127.0.0.1' for enterprise-tools in preperation for the kubernetes 1.36 support (DEV-2848)
* fix image push in local registry (DEV-2848)
* fixed duplicated coredns in 1.36.1 (DEV-2858)
* updated kosi versions for konsistent installation in  (DEV-2846)
* updated Harbor ImagePullSecret with 127.0.0.1 instead of masster1 IP (DEV-2848)
* remove hardcoded plugin versions in cluster prepare node (DEV-2845)
* fixed a bug in rook delete section (DEV-2813)
* fixed a bug in nginx ingressclass for traefik (DEV-2789)
* added default secret for grafana (DEV-2866)
* added role bindings for the kubevirt roles (DEV-2851)
* fixed delete ingresses in update process (DEV-2852)

KubeOps 2.2.0_Alpha4

5 - KubeOps 2.2.0_Alpha3

KubeOps 2.2.0_Alpha3 - Release Date 06.07.2026

Changelog KubeOpsCtl 2.2.0_Alpha3

Whats new?

• Added Traefik support for kubeopsctl
• Added Kubevirt-Manager support for kubeopsctl
• Added Kubernetes 1.35 support
• Added Kubernetes 1.36 support
• Added Advanced Parameters for static Registry mount path, check out the file format Cluster Values YAML

Bugfixes

+ fixed a podman bug affecting pull packages
+ fixed a harbor bug setting up cluster
+ added creation of nginx ingressclass, when installing traefik for backwards compatabilty
+ fixed default secret for kubeops-dashboard
* kubeopsctl pull command now verifies if the specified tool value file exists

KubeOps 2.2.0_Alpha3

6 - KubeOps 2.2.0_Alpha2

KubeOps 2.2.0_Alpha2 - Release Date 15.06.2026

Changelog KubeOpsCtl 2.2.0_Alpha2

Whats new?

• Added support for OpenSUSE MicroOS
• Added Traefik support for kubeopsctl
• Added Kubevirt-Manager support for kubeopsctl
• Added Kubernetes 1.35 support
• Added Kubernetes 1.36 support
• Added Advanced Parameters for static Registry mount path, check out the file format Cluster Values YAML

Bugfixes

+ fixed a bug affecting pull packages
+ fixed a bug setting up cluster

KubeOps 2.2.0_Alpha2 Versions

7 - KubeOps 2.2.0_Alpha1

KubeOps 2.2.0_Alpha1 - Release Date 08.06.2026

Changelog KubeOpsCtl 2.2.0_Alpha1

Whats new?

• Added support for OpenSUSE MicroOS
• Added Traefik support for kubeopsctl
• Added Kubevirt-Manager support for kubeopsctl
• Added Kubernetes 1.35 support
• Added Kubernetes 1.36 support
• Added Advanced Parameters for static Registry mount path, check out the file format Cluster Values YAML

8 - KubeOps 2.2.0_Alpha0

KubeOps 2.2.0_Alpha0 - Release Date 26.05.2026

Changelog KubeOpsCtl 2.2.0_Alpha0

Whats new?

• Added support for OpenSUSE MicroOS
• Added Traefik support for kubeopsctl
• Added Kubevirt-Manager support for kubeopsctl
• Added Kubernetes 1.35 support
• Added Kubernetes 1.36 support
• Added Advanced Parameters for static Registry mount path, check out the file format Cluster Values YAML

9 - KubeOps 2.1.0

KubeOps 2.1.0 - Release Date 16.06.2026

Changelog KubeOpsCtl 2.1.0

Whats new?

- Added Single Sign-On (SSO) with Keycloak for Rook-Ceph
- Added Single Sign-On (SSO) with Keycloak for Harbor
- Added Single Sign-On (SSO) with Keycloak for Grafana
- Added Single Sign-On (SSO) with Keycloak for KubeOps Dashboard
- Added Single Sign-On (SSO) with Keycloak for OpenSearch Dashboard
- Added Traefik for manual installation
- Added CloudNativePG operator for manual installation
- Added command kubeopsctl check-connections -f cluster-values.yaml
- Added check-connections before kubeopsctl apply
- Improved cert-manager package to install lets-encrypt-staging as inital CA for SSO support
- Improved harbor backup by adding pre.hook.backup.velero.io in harbor package
- Improved keycloak backup by adding pre.hook.backup.velero.io in harbor package
- Improved kubeopsctl apply no longer throws an exception when cluster-values.yaml is missing.
- Added Kubernetes 1.35 support
- Added Kubernetes 1.36 support for non-airgap only

Fixes

- Implemented fixes for the following CVEs affecting the `rook-ceph` package:
    - CVE-2025-68121
    - CVE-2026-33186
- Implemented fixes for the following CVEs affecting the `ingress-nginx` package:
    - CVE-2025-68121
- Implemented fixes for the `keycloak` package:
    - A Keycloak bug has been fixed where the database was not persistent
- Implemented fixes for the `opensearch-os` package:
    - A bug has been fixed that prevented usernames and passwords from being retained after the upgrade

Versions KubeOps 2.1.0

10 - KubeOps 2.1.0_Beta0

KubeOps 2.1.0_Beta0 - Release Date 13.04.2026

Changelog KubeOpsCtl 2.1.0_Beta0

Whats new?

- Added Single Sign-On (SSO) with Keycloak for Harbor
- Added Single Sign-On (SSO) with Keycloak for Grafana
- Added Single Sign-On (SSO) with Keycloak for KubeOps Dashboard
- Added Traefik for manual installation
- Added CloudNativePG operator for manual installation
- Added command kubeopsctl check-connections -f cluster-values.yaml
- Added check-connections before kubeopsctl apply
- Improved cert-manager package to install lets-encrypt-staging as inital CA for SSO support
- Improved harbor backup by adding pre.hook.backup.velero.io in harbor package
- Improved keycloak backup by adding pre.hook.backup.velero.io in harbor package
- Improved kubeopsctl apply no longer throws an exception when cluster-values.yaml is missing.

Versions KubeOps 2.1.0_Beta0

11 - KubeOps 2.1.0_Alpha0

KubeOps 2.1.0_Alpha0 - Release Date 09.03.2026

Changelog KubeOpsCtl 2.1.0_Alpha0

Whats new?

+ Added Single Sign-On (SSO) with Keycloak for Rook-Ceph
+ Added Single Sign-On (SSO) with Keycloak for Harbor
+ Added Single Sign-On (SSO) with Keycloak for Grafana
+ Added Single Sign-On (SSO) with Keycloak for KubeOps Dashboard
+ Added Single Sign-On (SSO) with Keycloak for OpenSearch Dashboard
+ Added Traefik for manual installation
+ Added CloudNativePG operator for manual installation
+ Added command kubeopsctl check-connections -f cluster-values.yaml
+ Added check-connections before kubeopsctl apply
+ Improved cert-manager package to install lets-encrypt-staging as inital CA for SSO support
+ Improved harbor backup by adding pre.hook.backup.velero.io in harbor package
+ Improved keycloak backup by adding pre.hook.backup.velero.io in harbor package
+ Improved kubeopsctl apply no longer throws an exception when cluster-values.yaml is missing.

12 - KubeOps 2.0.5

KubeOps 2.0.5 - Release Date 08.05.2026

Changelog KubeOpsCtl 2.0.5

Fixes

- Implemented fixes for the following CVEs affecting the `rook-ceph` package:
    - CVE-2025-68121
    - CVE-2026-33186
- Implemented fixes for the following CVEs affecting the `ingress-nginx` package:
    - CVE-2025-68121
- Implemented fixes for the `keycloak` package:
    - A Keycloak bug has been fixed where the database was not persistent
- Implemented fixes for the `opensearch-os` package:
    - A bug has been fixed that prevented usernames and passwords from being retained after the upgrade
- Implemented fixes for RHEL:
    - A bug has been fixed that prevented users from using a repository other than “kubeops-repo”

Versions KubeOps 2.0.5

13 - KubeOps 2.0.4

KubeOps 2.0.4 - Release Date 02.03.2026

Changelog KubeOpsCtl 2.0.4

Fixes

- Implemented fixes for the following CVEs affecting the `harbor` package:
    - CVE-2025-27151
    - CVE-2025-49844
- Implemented fixes for the following CVEs affecting the `opensearch` package:
    - CVE-2025-68428
    - CVE-2025-9288
- Implemented fixes for the following CVEs affecting the `opensearch-dashboards` package:
    - App Version 3.4.0, Chart Version 3.4.0
    - CVE-2025-68428
    - CVE-2025-9288

Versions KubeOps 2.0.4

14 - KubeOps 2.0.3

KubeOps 2.0.3 - Release Date 10.02.2026

Changelog KubeOpsCtl 2.0.3

Fixes

- Implemented fixes for the following CVEs affecting the `ingress-nginx` package:
    - CVE-2025-15467
    - CVE-2025-49794
    - CVE-2025-49796

Versions KubeOps 2.0.3

15 - KubeOps 2.0.2

KubeOps 2.0.2 - Release Date 28.01.2026

Changelog KubeOpsCtl 2.0.2

Whats new?

- Added --delete-emptydir-data while draining nodes
- Added Repo support for the KOSI installation packages

Fixes

- Fixed a bug where imagePullSecrets were not created

Versions KubeOps 2.0.2

16 - KubeOps 2.0.1

KubeOps 2.0.1 - Release Date 22.12.2025

Changelog KubeOpsCtl 2.0.1

Whats new?

- Supports KubeVIP
- Supports Ubuntu 24.04 LTS
- Supports RHEL 9.6
- Supports Cilium CNI
- Reworked Cluster creation process
- Reworked Cluster upgrade process
- Reworked Compliance application installation process
- Reworked Compliance application update process
- Introduced new value format for cluster-values.yaml
- Introduced new value format for enterprise-values.yaml
- Introduced selfcontained air-gap packages
- Improve the Cluster creation process
- Improve the Cluster upgrade process
- Improve the Compliance application installation process
- Improve the Compliance application update process
- Improve the Cluster creation/upgrade speed
- Improve the Compliance application installation/update speed
- Updated opensearch package from 1.7.6 to 2.0.0
- Updated opensearch-dashboard package from 1.7.6 to 2.0.0
- Updated velero package from 1.7.6 to 2.0.0
- Enterprise packages are only pulled if they are marked as `enabled: true` in the enterprise-values.yaml

Fixes

- "Delete Node" now works over multiple zones
- An invalid cluster-values.yaml is now caught before cluster creation
- If no helm chart is installed the cluster creation process will still run through
- Harbor: fixed missing template for hostname
- nginx-ingress: updated netpols
- opensearch-dashboard: changed issuer to cluster-issuer
- airgap-packages are pulled from locally installed harbor registry instead of public registries

Known Issues

Versions KubeOps 2.0.1