Release Notes

• 1: KubeOps Versions
• 2: KubeOps 2.1.1
• 3: KubeOps 2.2.0_Beta1
• 4: KubeOps 2.2.0_Beta0
• 5: KubeOps 2.1.0
• 6: KubeOps 2.1.0_Beta0
• 7: KubeOps 2.0.5
• 8: KubeOps 2.0.4
• 9: KubeOps 2.0.3
• 10: KubeOps 2.0.2
• 11: KubeOps 2.0.1

1 - KubeOps Versions

Here is the KubeOps and it’s supported tools versions list. Make sure to install or upgrade according to supported versions only.

2 - KubeOps 2.1.1

KubeOps 2.1.1 - Release Date ??.08.2026

Changelog KubeOpsCtl 2.1.1

Fixes

- fixed missing opensearch-dashboards plugins and wrong version 

Versions KubeOps 2.1.1

3 - KubeOps 2.2.0_Beta1

KubeOps 2.2.0_Beta1 - Release Date 02.08.2026

Changelog KubeOpsCtl 2.2.0_Beta1

Whats new?

- Added Traefik support for kubeopsctl
- Added Kubevirt-Manager support for kubeopsctl
- Added Kubernetes 1.36 support
- Added Advanced Parameters for static Registry mount path, check out the file format [Cluster Values YAML](/docs/kubeopsctl-2.0/reference/fileformats/#cluster-valuesyaml)

Fixes

- fixed a podman bug affecting pull packages
- fixed a harbor bug setting up cluster
- added creation of nginx ingressclass, when installing traefik for backwards compatabilty
- fixed default secret for kubeops-dashboard
- kubeopsctl pull command now verifies if the specified tool value file exists
- Added kubeops-harbor-secret for pulling images from the internal private harbor project 'kubeops'
- fixed a bug that prevented to create the kubeops harbor project as private 
- fixed a bug that prevented to change the kubeops harbor project to private 
- fixed a bug that prevented the image push of the kubernetes images to local-registry 
- changed the 'localhost' reference to '127.0.0.1' for enterprise-tools in preperation for the kubernetes 1.36 support
- fix image push in local registry
- fixed duplicated coredns in 1.36.1
- updated kosi versions for consistent installation
- updated Harbor ImagePullSecret with 127.0.0.1 instead of master1 IP
- remove hardcoded plugin versions in cluster prepare node
- fixed a bug in rook delete section
- fixed a bug in nginx ingressclass for traefik
- added default secret for grafana
- added role bindings for the kubevirt roles
- fixed delete ingresses in update process 
- OpenSearch users created in the Dashboards Security UI now persist across package updates 
- OpenSearch TLS certificates are no longer regenerated on every install/update, preventing certificate rotation on running clusters 
- Fixed OpenSearch SSO returning 401 Unauthorized by reliably applying the openid security configuration to the backend after deploy 
- Added a Keycloak protocol mapper so realm roles are propagated to OpenSearch for backend role mapping 
- Added Single Sign-On (SSO) with Keycloak (OpenID Connect) for OpenSearch and OpenSearch Dashboards 
- Added username/password fallback authentication for OpenSearch alongside SSO 
- Made the OpenSearch admin password configurable via the new `adminPassword` package value (opensearch-os & opensearch-dashboards) 
- Added `hostname` package value for opensearch-os to point OpenSearch at the Keycloak SSO endpoint 
- Refresh the Keycloak admin token before each step of the OpenSearch Dashboards OIDC join so long-running joins no longer fail with 401 once the 60s token lifespan is exceeded
- fixed an error in OpenSearch when it was not installed in the `logging` namespace
- fixed an issue in kubeopsctl where `tools-values.yaml` and `cluster-values.yaml` were not always stored as secrets in the cluster
- changed the netpols for traefik-nginx and ingress-nginx to make the dashboards available
- helm-plugin now parses the flags correctly in all possible actions (install, upgrade, delete)
- fixed missing kosi update on nodes, if packageRepository: local
- fixed missing opensearch-dashboards plugins and wrong version
- template network policies with default deny rules
- when installing the tools, apply cluster- and tools-values

Known Issues

Versions KubeOps 2.2.0_Beta1

4 - KubeOps 2.2.0_Beta0

KubeOps 2.2.0_Beta0 - Release Date 30.07.2026

Changelog KubeOpsCtl 2.2.0_Beta0

Whats new?

- Added Traefik support for kubeopsctl
- Added Kubevirt-Manager support for kubeopsctl
- Added Kubernetes 1.36 support
- Added Advanced Parameters for static Registry mount path, check out the file format [Cluster Values YAML](/docs/kubeopsctl-2.0/reference/fileformats/#cluster-valuesyaml)

Fixes

- fixed a podman bug affecting pull packages
- fixed a harbor bug setting up cluster
- added creation of nginx ingressclass, when installing traefik for backwards compatabilty
- fixed default secret for kubeops-dashboard
- kubeopsctl pull command now verifies if the specified tool value file exists
- Added kubeops-harbor-secret for pulling images from the internal private harbor project 'kubeops'
- fixed a bug that prevented to create the kubeops harbor project as private 
- fixed a bug that prevented to change the kubeops harbor project to private 
- fixed a bug that prevented the image push of the kubernetes images to local-registry 
- changed the 'localhost' reference to '127.0.0.1' for enterprise-tools in preperation for the kubernetes 1.36 support
- fix image push in local registry
- fixed duplicated coredns in 1.36.1
- updated kosi versions for consistent installation
- updated Harbor ImagePullSecret with 127.0.0.1 instead of master1 IP
- remove hardcoded plugin versions in cluster prepare node
- fixed a bug in rook delete section
- fixed a bug in nginx ingressclass for traefik
- added default secret for grafana
- added role bindings for the kubevirt roles
- fixed delete ingresses in update process 
- OpenSearch users created in the Dashboards Security UI now persist across package updates 
- OpenSearch TLS certificates are no longer regenerated on every install/update, preventing certificate rotation on running clusters 
- Fixed OpenSearch SSO returning 401 Unauthorized by reliably applying the openid security configuration to the backend after deploy 
- Added a Keycloak protocol mapper so realm roles are propagated to OpenSearch for backend role mapping 
- Added Single Sign-On (SSO) with Keycloak (OpenID Connect) for OpenSearch and OpenSearch Dashboards 
- Added username/password fallback authentication for OpenSearch alongside SSO 
- Made the OpenSearch admin password configurable via the new `adminPassword` package value (opensearch-os & opensearch-dashboards) 
- Added `hostname` package value for opensearch-os to point OpenSearch at the Keycloak SSO endpoint 
- Refresh the Keycloak admin token before each step of the OpenSearch Dashboards OIDC join so long-running joins no longer fail with 401 once the 60s token lifespan is exceeded

Known Issues

Versions KubeOps 2.2.0_Beta0

5 - KubeOps 2.1.0

KubeOps 2.1.0 - Release Date 16.06.2026

Changelog KubeOpsCtl 2.1.0

Whats new?

- Added Single Sign-On (SSO) with Keycloak for Rook-Ceph
- Added Single Sign-On (SSO) with Keycloak for Harbor
- Added Single Sign-On (SSO) with Keycloak for Grafana
- Added Single Sign-On (SSO) with Keycloak for KubeOps Dashboard
- Added Single Sign-On (SSO) with Keycloak for OpenSearch Dashboard
- Added Traefik for manual installation
- Added CloudNativePG operator for manual installation
- Added command kubeopsctl check-connections -f cluster-values.yaml
- Added check-connections before kubeopsctl apply
- Improved cert-manager package to install lets-encrypt-staging as inital CA for SSO support
- Improved harbor backup by adding pre.hook.backup.velero.io in harbor package
- Improved keycloak backup by adding pre.hook.backup.velero.io in harbor package
- Improved kubeopsctl apply no longer throws an exception when cluster-values.yaml is missing.
- Added Kubernetes 1.35 support

Fixes

- Implemented fixes for the following CVEs affecting the `rook-ceph` package:
    - CVE-2025-68121
    - CVE-2026-33186
- Implemented fixes for the following CVEs affecting the `ingress-nginx` package:
    - CVE-2025-68121
- Implemented fixes for the `keycloak` package:
    - A Keycloak bug has been fixed where the database was not persistent
- Implemented fixes for the `opensearch-os` package:
    - A bug has been fixed that prevented usernames and passwords from being retained after the upgrade

Versions KubeOps 2.1.0

6 - KubeOps 2.1.0_Beta0

KubeOps 2.1.0_Beta0 - Release Date 13.04.2026

Changelog KubeOpsCtl 2.1.0_Beta0

Whats new?

- Added Single Sign-On (SSO) with Keycloak for Harbor
- Added Single Sign-On (SSO) with Keycloak for Grafana
- Added Single Sign-On (SSO) with Keycloak for KubeOps Dashboard
- Added Traefik for manual installation
- Added CloudNativePG operator for manual installation
- Added command kubeopsctl check-connections -f cluster-values.yaml
- Added check-connections before kubeopsctl apply
- Improved cert-manager package to install lets-encrypt-staging as inital CA for SSO support
- Improved harbor backup by adding pre.hook.backup.velero.io in harbor package
- Improved keycloak backup by adding pre.hook.backup.velero.io in harbor package
- Improved kubeopsctl apply no longer throws an exception when cluster-values.yaml is missing.

Versions KubeOps 2.1.0_Beta0

7 - KubeOps 2.0.5

KubeOps 2.0.5 - Release Date 08.05.2026

Changelog KubeOpsCtl 2.0.5

Fixes

- Implemented fixes for the following CVEs affecting the `rook-ceph` package:
    - CVE-2025-68121
    - CVE-2026-33186
- Implemented fixes for the following CVEs affecting the `ingress-nginx` package:
    - CVE-2025-68121
- Implemented fixes for the `keycloak` package:
    - A Keycloak bug has been fixed where the database was not persistent
- Implemented fixes for the `opensearch-os` package:
    - A bug has been fixed that prevented usernames and passwords from being retained after the upgrade
- Implemented fixes for RHEL:
    - A bug has been fixed that prevented users from using a repository other than “kubeops-repo”

Versions KubeOps 2.0.5

8 - KubeOps 2.0.4

KubeOps 2.0.4 - Release Date 02.03.2026

Changelog KubeOpsCtl 2.0.4

Fixes

- Implemented fixes for the following CVEs affecting the `harbor` package:
    - CVE-2025-27151
    - CVE-2025-49844
- Implemented fixes for the following CVEs affecting the `opensearch` package:
    - CVE-2025-68428
    - CVE-2025-9288
- Implemented fixes for the following CVEs affecting the `opensearch-dashboards` package:
    - App Version 3.4.0, Chart Version 3.4.0
    - CVE-2025-68428
    - CVE-2025-9288

Versions KubeOps 2.0.4

9 - KubeOps 2.0.3

KubeOps 2.0.3 - Release Date 10.02.2026

Changelog KubeOpsCtl 2.0.3

Fixes

- Implemented fixes for the following CVEs affecting the `ingress-nginx` package:
    - CVE-2025-15467
    - CVE-2025-49794
    - CVE-2025-49796

Versions KubeOps 2.0.3

10 - KubeOps 2.0.2

KubeOps 2.0.2 - Release Date 28.01.2026

Changelog KubeOpsCtl 2.0.2

Whats new?

- Added --delete-emptydir-data while draining nodes
- Added Repo support for the KOSI installation packages

Fixes

- Fixed a bug where imagePullSecrets were not created

Versions KubeOps 2.0.2

11 - KubeOps 2.0.1

KubeOps 2.0.1 - Release Date 22.12.2025

Changelog KubeOpsCtl 2.0.1

Whats new?

- Supports KubeVIP
- Supports Ubuntu 24.04 LTS
- Supports RHEL 9.6
- Supports Cilium CNI
- Reworked Cluster creation process
- Reworked Cluster upgrade process
- Reworked Compliance application installation process
- Reworked Compliance application update process
- Introduced new value format for cluster-values.yaml
- Introduced new value format for enterprise-values.yaml
- Introduced selfcontained air-gap packages
- Improve the Cluster creation process
- Improve the Cluster upgrade process
- Improve the Compliance application installation process
- Improve the Compliance application update process
- Improve the Cluster creation/upgrade speed
- Improve the Compliance application installation/update speed
- Updated opensearch package from 1.7.6 to 2.0.0
- Updated opensearch-dashboard package from 1.7.6 to 2.0.0
- Updated velero package from 1.7.6 to 2.0.0
- Enterprise packages are only pulled if they are marked as `enabled: true` in the enterprise-values.yaml

Fixes

- "Delete Node" now works over multiple zones
- An invalid cluster-values.yaml is now caught before cluster creation
- If no helm chart is installed the cluster creation process will still run through
- Harbor: fixed missing template for hostname
- nginx-ingress: updated netpols
- opensearch-dashboard: changed issuer to cluster-issuer
- airgap-packages are pulled from locally installed harbor registry instead of public registries

Known Issues

Versions KubeOps 2.0.1