Skip to content

v2026.9.2 release notes

Release date: 2026-09-01

Availability: Use this release only when v2026.9.2 appears on the public Releases page. If it is not listed there, the candidate has not been published and its tag, image, chart, and download URLs must not be used.

Recovery from the unpublished September candidates: The signed v2026.9.0 workflow stopped in draft-visibility preflight before it built or staged any artifact. The corrected v2026.9.1 workflow completed, staged the expected 16 draft assets, and pushed signed image and OCI chart tags, but its pre-publication image scan found fixed HIGH/CRITICAL dependency findings. Maintainers therefore made a no-go decision. Neither draft was published, and neither candidate triggered documentation deployment or a Krew update. Their immutable tags will not be moved or deleted. v2026.9.2 contains the dependency remediation and is the replacement September release; its product delta is measured from the last official release, v2026.8.1.

This update adds an Alpha controller-extension foundation and inspectable controller build identity, and strengthens source installation, release provenance, vulnerability gating, and redistributed licensing. It retains the existing IOS-XE, NX-OS, credential-rotation, telemetry, operations, and software lifecycle functionality from v2026.8.1.

In plain English: what is new since v2026.8.1

  • You get two new Kubernetes CRD contracts and the manager scaffold needed for future external-controller integrations. You do not get a working Catalyst Center, APIC, Meraki, or other controller adapter in this release.
  • IOS-XE and NX-OS device behavior is unchanged. Automatic rollout after a referenced credential Secret changes already existed in v2026.8.1; this release documents that behavior and its security boundary more clearly.
  • The dependencies implicated by the rejected v2026.9.1 image findings are upgraded, and both controller-image architectures now have hard HIGH/CRITICAL vulnerability gates before merge and during release.
  • Controller and plugin version reporting, reproducible packaging, signing, provenance checks, and redistributed license material are more strictly verified. These changes make the same deliverables easier to inspect and trust; they do not add new device commands.
  • The release publishes rebuilt v2026.9.2 plugin archives. After publication, automation opens the normal upstream Krew index update PR; Krew users receive v2026.9.2 only after that PR merges. The plugin's commands and supported platforms are unchanged.
  • Existing Helm installations must apply the two new CRDs before upgrading. Fresh installations receive them from the chart automatically.

Highlights

Alpha network-controller extension foundation

Two new namespaced CRDs establish a generic boundary for future external controller integrations:

  • NetworkController (cisco.vk/v1alpha1) declares an HTTPS endpoint, adapter type, credential and trust references, connection limits, and administrator-approved intent Secret aliases.
  • NetworkControllerConfig (config.cisco.vk/v1alpha1) carries resolved, explicitly versioned controller-centric Network as Code intent, managed sections, ownership, and policy.

The manager includes adapter registration contracts, duplicate-endpoint fencing, isolated per-endpoint worker orchestration, material-rotation handling, and fail-closed validation. These are extension contracts, not a product integration: the v2026.9.2 image contains zero product adapters and cannot contact or mutate an external controller. The shipped boundary is report-only; apply, prune, remote-delete behavior, and mutation RBAC remain unimplemented.

See the Network Controller Extension Guide and CRD Reference.

Existing device-credential rollout clarified

This rollout behavior is not new in v2026.9.2: v2026.8.1 already watched referenced credential Secrets. Updating a Secret referenced by CiscoDevice.spec.credentialSecretRef causes the manager to update the pod-template cisco.vk/credential-resource-version annotation and roll every affected VK Deployment. An explicit kubectl rollout restart is no longer part of the normal credential-rotation path.

This release clarifies the security boundary around that existing behavior. The manager observes a typed Secret object's resourceVersion; reconciliation does not inspect .data, but Secret data can still enter the manager's cache/API client. The manager's Secret RBAC and memory therefore remain in the credential trust boundary. See Bulk rotation and Security principles.

Dependency remediation and hard vulnerability gates

  • The controller moves from golang.org/x/crypto v0.52.0 to v0.55.0 and selects golang.org/x/net v0.57.0. The separate Terraform helper moves from golang.org/x/net v0.55.0 to the fixed v0.56.0.
  • These updates remediate the versioned dependencies reported for CVE-2026-56854 and CVE-2026-46600 in the unpublished v2026.9.1 image. Symbol-aware govulncheck found no reachable vulnerable call path in that candidate, but maintainers declined to publish while fixed HIGH/CRITICAL dependencies remained.
  • The required pre-merge controller-image scans and the exact tagged-image scans now fail on any fixed HIGH/CRITICAL finding on either Linux AMD64 or ARM64. This supplements the existing symbol-aware controller and Terraform govulncheck gates. Mutable 2026.9 and latest image aliases move only after both platform scans and all chart, plugin, and curated-draft staging complete successfully.

Verifiable build identity and distribution hardening

  • Release-built cisco-vk version and cisco-vk --version report the exact release tag, full source commit, and reproducible RFC3339 UTC build time. Direct development builds identify themselves as devel.
  • The existing Linux AMD64/ARM64 non-root controller images now use a pinned Go 1.26.7 builder and digest-pinned builder/runtime bases, use reproducible build flags, and redistribute the project, dependency, Go toolchain, NOTICE, and patent material applicable to their binaries.
  • The existing plugin archives remain available for Linux and macOS on AMD64 and ARM64. They now include applicable Go license/patent files and undergo exact archive installation and execution checks through Krew; Windows remains unsupported.
  • Signed image, chart, checksum, plugin, SBOM, and provenance artifacts already existed in v2026.8.1. This release strengthens their immutable tool pins, draft/asset checks, and pre- and post-publication verification.
  • The source installer now checksum-verifies Linux AMD64/ARM64 Go downloads, installs a private versioned toolchain without replacing /usr/local/go, and limits itself to building and installing the binary. It no longer tries to create TLS files or a systemd unit; Helm remains the supported cluster installation path.
  • Documentation build dependencies and browser assets are pinned and license-checked. The website dependency updates include the nanoid 3.3.18 security fix. Generated IOS-XE family-page additions document fields that the runtime already supported; they do not add device behavior.

See the CLI and plugin reference, Getting Started, and the project licensing summary.

Required upgrade action: apply both new CRDs first

Helm installs files under crds/ on a fresh installation but does not apply new or updated CRDs during helm upgrade. An existing installation must apply the NetworkController and NetworkControllerConfig CRDs before upgrading.

After the release is published:

kubectl apply --server-side -f \
  https://raw.githubusercontent.com/cisco-open/cisco-virtual-kubelet/v2026.9.2/config/crd/cisco.vk_networkcontrollers.yaml
kubectl apply --server-side -f \
  https://raw.githubusercontent.com/cisco-open/cisco-virtual-kubelet/v2026.9.2/config/crd/config.cisco.vk_networkcontrollerconfigs.yaml

kubectl wait --for=condition=Established --timeout=60s \
  crd/networkcontrollers.cisco.vk \
  crd/networkcontrollerconfigs.config.cisco.vk

helm upgrade cvk \
  oci://ghcr.io/cisco-open/charts/cisco-virtual-kubelet \
  --version 2026.9.2 \
  --namespace cvk-system \
  --reuse-values --wait --timeout 5m

kubectl rollout restart \
  deployment/cvk-cisco-virtual-kubelet-controller \
  --namespace cvk-system
kubectl rollout status \
  deployment/cvk-cisco-virtual-kubelet-controller \
  --namespace cvk-system --timeout=5m

If either new CRD is absent when the new manager first starts, existing CiscoDevice reconcilers continue running, but NetworkController registration is disabled for that process. Apply the CRDs and restart the manager to enable the Alpha scaffold. The restart does not add a product adapter or enable external-controller mutations.

For a release name other than cvk, resolve the controller Deployment from its Helm labels instead of copying the example name. See Upgrading CRDs for the complete procedure and rollback cautions.

Compatibility and security notes

  • Source builds require Go 1.26.7 or a later 1.26 patch, or Go 1.27.0 or a later 1.27 patch. The release build is pinned to Go 1.26.7.
  • Chart users need Helm 3.21+ or 4.2+. The release is validated with exact Helm 3.21.4 and 4.2.4 binaries.
  • The two new CRDs use CEL transition rules for immutable identity fields. Kubernetes 1.29 or later supports this behavior as GA. On Kubernetes 1.28, CustomResourceValidationExpressions must remain enabled.
  • Controller workers use namespace-scoped RBAC and caches. Endpoints or config authors that do not trust one another should use separate namespaces.
  • Duplicate fencing compares the exact stored endpoint string only within one namespace; it does not normalize equivalent URLs or coordinate across namespaces or clusters.
  • Network-controller credentials and intent values are projected into a worker by the kubelet. The Alpha runtime must not emit desired or observed values in status, events, or logs.
  • No IOS-XE YANG source or generated schema source changed from v2026.8.1. The existing generated material retains its recorded upstream provenance and applicable licensing notices.

Known limitations

  • No Catalyst Center, APIC, Meraki, or other product adapter ships in this release. NetworkController and NetworkControllerConfig alone are not a usable controller integration.
  • Network-controller apply, prune, and remote-delete operations are reserved for future gated implementations. The current foundation is report-only.
  • Helm upgrades require the explicit CRD application and manager restart described above. Helm rollback does not remove CRDs or stored custom resources.
  • The kubectl plugin's ad-hoc exec command is IOS-XE-only, read-only, and requires the per-device deployment mode. Windows plugin archives are not produced.
  • NX-OS, device configuration, operational actions, software lifecycle, and telemetry surfaces retain the maturity levels documented in Feature Maturity; their v1alpha1 APIs may continue to evolve.

Documentation map

After publication, the complete source comparison will be available at v2026.8.1...v2026.9.2.