Skip to content

Cisco Virtual Kubelet v2026.11.0

Rejected and unpublished — 29 October 2026. v2026.11.0 is an immutable recovery marker, not an installable approved release. Inspection of the exact staged image found MPL-labelled embedded SD-WAN JSON missing from its copied source and attribution bundle, failing the release licensing gate. Never publish this draft, move/delete its tag or replace its staged artifacts. The proposed corrected candidate is v2026.11.1; the previous published baseline remains v2026.10.0. The original preparation record below is preserved as history, not current publication guidance.

Target release date: 1 November 2026. Comparison baseline: published v2026.10.0. The GitHub release page is the authority for publication status and signed artifacts. Until it is public, use the published October release; preparation notes do not make an artifact available.

November builds on October's app hosting, managed topology and secure IOS-XE software workflows. It adds staged software activation, bounded topology extensions and two Alpha controller adapters, with clearer documentation for platform engineers, network operators, security reviewers and contributors.

Highlights

A simpler documentation path

The dynamic website introduces app hosting, configuration and operations through short explanations and diagrams. MkDocs separates how CVK works, deployment guides, operations and technical reference.

Managed topology, Security and Operations now have short overviews and focused task pages. Existing section links remain usable. The content distinguishes application placement from device operating-system changes, and corrects credential, permission and runtime claims against the implementation.

Staged IOS-XE maintenance and topology extensions

October already included managed topology and IOSXESoftwareRollout. November extends that opt-in workflow with:

  • PrepareOnly and durable preparation receipts, followed by separately approved, receipt-bound activation;
  • accepted network observations, claim-time checks and health checks through recovery, with administrator disruption protections and overlapping risk budgets;
  • bounded image-transfer pacing, read-only accepted-topology diagnostics and additional protocol, drain and ownership-recovery safeguards; and
  • validated, revision-bound public device-HTTPS CA projection through spec.tls.caSecretRef.

Start with the topology overview, then choose application scheduling or the IOS-XE campaign procedure. Read the recovery procedure before changing retained ownership. The bounded implementation scope records the qualification limits; it is not evidence for a different release candidate.

Controller adapters — Alpha

Catalyst SD-WAN: native reconciliation of supported controller intent, configuration verification and ownership tracking, without a Terraform runtime dependency. Coverage is fixture-qualified and does not imply full model parity or general live attachment/activation qualification. Remote prune/import and ownership release remain restricted; use the supported Retain behavior. See the SD-WAN guide and qualification backlog.

Nexus Dashboard: controller health, version and paginated inventory, with optional adoption of reachable NX-OS switches as CiscoDevice resources. Adoption is disabled by default; removal defaults to Retain. The adapter does not manage Nexus Dashboard configuration. Production-size pagination and multi-fabric operation need additional qualification before opting into pruning. See the Nexus Dashboard guide.

Runtime and dependency maintenance

  • Virtual Kubelet advances from 1.12.0 to 1.14.1, with Go 1.26.10 and controller-runtime 0.25.2. Kubernetes client libraries advance to the 0.37 series; this does not change the managed-topology server floor below.
  • Managed workers preserve their reachable Pod-IP kubelet endpoint on port 10250, while the manager retains ownership of protected Node identity.
  • The documentation stack includes Next.js 16.4.3 and Mermaid 12.2.0, with updated math rendering and dependency/browser-runtime license bundles. Security scans remain required on the actual candidate and staged images.

Upgrade from October

Use chart 2026.11.0 and image v2026.11.0 together after publication. Before upgrading, save the current Helm values, CRD definitions and custom-resource instances. Read the installation maintenance guide.

  1. Review the complete CRD directory from the signed November chart. Existing CiscoDevice, NetworkController, IOSXESoftwareRollout and IOSXESoftwareUpgrade schemas have substantive changes; other generated CRD manifests are refreshed. There is no new CRD kind in this delta.
  2. Apply all reviewed chart CRDs and wait for them to be Established before upgrading the controller. Helm does not upgrade CRDs automatically.
  3. Keep CRDs, chart, admission policies, manager and workers matched. Preserve prior gate settings while validating migration. Review unresolved claims, active campaigns and prepared receipts before the maintenance window; do not overlap migration with disruptive device work.
  4. Follow the managed enablement and identity-handoff procedure where applicable. A combined-to-split worker migration requires a live Helm upgrade; do not substitute pruning of retained identities or policy objects.
  5. Verify manager and worker readiness, device conditions, existing application health and controller-adapter permissions before enabling new capabilities.

The APIs remain v1alpha1. A Helm rollback does not restore stored objects, undo OS activation or authorize an older manager to consume newer protocol state. Do not remove Leases, claims, finalizers or receipts to bypass a block. Use the recovery and retirement guide.

Compatibility and known limits

  • Managed topology requires Kubernetes 1.35+ and its documented native admission and functional ServiceAccount controls. It remains disabled by default; network management starts read-only. Software mutation and drain require explicit opt-in.
  • PDB-aware drain remains a disabled-by-default development preview, with limited workload eligibility. The recorded physical cohort does not establish service-through-reload, multi-site fault tolerance or a zero-downtime guarantee.
  • Native TAS is a separate experimental Kubernetes 1.37 lane. It is not a baseline dependency or full physical grouped-workload qualification; grouped drain remains unsupported.
  • IOS-XE software campaigns do not provide generic NX-OS or IOS-XR rollouts. NX-OS app hosting and configuration remain Beta. Controller adapters remain Alpha; adapters absent from this release are not enabled by adding a CRD.
  • Hosted-app logs, exec, attach and port-forward remain unsupported through the VK kubelet API. Worker logs and supported device diagnostics remain available. Device metrics do not provide per-Pod CPU/memory usage.
  • App-hosting identities still need cluster-wide workload Secret reads. Separate namespaces and cache filters do not eliminate that exposure. Review the authorization boundary and TLS/credential guides.

See feature availability for the full maturity table. Existing lab records apply only to their recorded source, platform and test conditions. They do not certify the final November candidate.

Release authorization and verification

One normal current-head Approve review from an eligible maintainer other than the release operator is sufficient under the release policy. No prescribed review comment or separate draft approval is required. All branch checks, candidate qualification, vulnerability gates and staged-artifact verification still apply.

The November preparation record separates preparation checks from final publication evidence. The GitHub Release is published only after staging and verification pass. Signed image/chart tags may already be public during staging; their existence does not mean the release is approved for use. The websites build from the exact published tag.