github.com/digitalocean/digitalocean-cloud-controller-manager

See the CHANGELOG for details.

• Add handling for private IP only droplets (@gottwald)
• Replace alpine:3.15 with distroless static-debian13 nonroot base image (@thearyanahmed)
• Updated dependencies (@gottwald)

See the CHANGELOG for details.

• Updates dependencies: (@schekuri)
  • github.com/digitalocean/godo v1.188.0
  • go.uber.org/zap v1.28.0
  • k8s.io/api v0.36.0
  • k8s.io/apimachinery v0.36.0
  • k8s.io/client-go v0.36.0
  • k8s.io/cloud-provider v0.36.0
  • k8s.io/component-base v0.36.0
  • k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
  • sigs.k8s.io/controller-runtime v0.24.0

See the CHANGELOG for details.

• Add public ipv6 node address handling (@gottwald)
• Add automatic dual-stack support for REGIONAL_NETWORK load balancers when all cluster nodes support dual-stack networking (@gottwald)
• Add node filtering to load balancers: only LB-Ready nodes with appropriate IP addresses are included in load balancers (@gottwald)
• Emit Kubernetes events when load balancer configuration errors occur (e.g., explicit dual-stack annotation with IPv4-only nodes) (@gottwald)

See the CHANGELOG for details.

• Fix syncTags error handling bug (@gottwald)
• Updates dependencies: (@dependabot)
  • sigs.k8s.io/controller-runtime v0.22.4
  • go.uber.org/zap v1.27.1
  • golang.org/x/crypto v0.45.0
  • golang.org/x/sync v0.19.0
  • k8s.io/api v0.35.0
  • k8s.io/apimachinery v0.35.0
  • k8s.io/client-go v0.35.0
  • k8s.io/cloud-provider v0.35.0
  • k8s.io/component-base v0.35.0
  • k8s.io/klog/v2 v2.130.1
  • k8s.io/utils v0.0.0-20260108192941-914a6e750570
  • sigs.k8s.io/controller-runtime v0.22.4
• Update actions/checkout to 6.0.0 (@dependabot)

See the CHANGELOG for details.

• Updates dependencies: (@okamidash)
  • k8s.io/api v0.34.1
    • k8s.io/apimachinery v0.34.1
    • k8s.io/client-go v0.34.1
    • k8s.io/cloud-provider v0.34.1
    • k8s.io/component-base v0.34.1
  • sigs.k8s.io/controller-runtime v0.22.2
  • k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
  • github.com/digitalocean/[email protected]
  • github.com/prometheus/[email protected]
  • golang.org/x/lint v0.0.0-20241112194109-818c5a804067
    • golang.org/x/oauth2 v0.32.0
    • golang.org/x/sync v0.17.0
• Update actions/checkout to 5.0.0 (@dependabot)
• Fixes an issue that caused CCM to crash when the certificate ID annotation is removed #845 (@okamidash)

See the CHANGELOG for details.

• Add network-stack annotation to allow configuration of IPV4 or DUALSTACK networking for load balancers (@jvasilevsky)

See the CHANGELOG for details.

• Add optional DEFAULT_LB_TYPE environment variable to configure the default load balancer type between REGIONAL and REGIONAL_NETWORK (@olove)
• Restrict the kube-proxy health port to be accessible by the load balancer only instead of allowing all IPv4 and IPv6 addresses (@olove)
• Fixes an issue with nodes that don't have their providerID set from the kubelet configuration. From now on, if the node object node.Spec.ProviderID property is empty, we will retrieve the information using the DO API by listing the droplets with that name.

See the CHANGELOG for details.

• Ensure Network LoadBalancer (NLB) is the default loadbalancer type (@olove)

See the CHANGELOG for details.

• Updates kubernetes dependencies: (@olove)
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
• Backfill service.beta.kubernetes.io/do-loadbalancer-type annotation into existing LoadBalancers (@olove)
• Update Go to 1.24.3 (@olove)
• Fix Certificate ID annotation being erroneously overwritten (@okamidash)

See the CHANGELOG for details.

• Add an initial random delay when syncing the tags to load balancers (@olove)

• Add IPv6 address to the LoadBalancer Service Ingress list (@jvasilevsky)
• Update dependencies: (@eomolo)
  • k8s.io packages v0.32.0
  • sigs.k8s.io/controller-runtime v0.20.0
  • github.com/prometheus/client_golang v1.20.5
  • godo v1.133.0
• Update go to 1.23.4 (@eomolo)
• Reduce the number of results per page when listing objects via DO API (@d-honeybadger)

• Update dependencies
  • godo v1.131.0
• Migrate to CCM InstancesV2

• Update dependencies: (@d-honeybadger)
  • k8s.io packages v0.31.0
  • sigs.k8s.io/controller-runtime v0.19.0
  • github.com/prometheus/client_golang v1.20.2
• Update go to 1.23 (@d-honeybadger)

• When using the LoadBalancer service.beta.kubernetes.io/do-loadbalancer-type=REGIONAL_NETWORK (under closed beta), firewall rules are added to open up the underlying health check port and all the defined (port, protocols) defined on the service. This is to permit traffic to arrive directly on the underlying worker nodes.

• Fixes an issue with load balancer health checks when the LB is using PROXY protocol. The new health check implementation (introduced in v0.1.51), now probes either kube proxy (Cluster) or the health check node port (Local). If the LB enables PROXY protocol, this alters the health check behavior to also use PROXY protocol. Since these Kubernetes components don't support PROXY protocol, this caused worker nodes to be marked as unhealthy. Support was added to the load balancer health check to optionally enable/disable PROXY protocol. When using the default health check implementation the health check will disable PROXY protocol. If the service.beta.kubernetes.io/do-loadbalancer-override-health-check is provided, then the health check will default to the setting on the LB.

• Adding support for internal load balancers (NOTE: this is a closed beta feature, contact DigitalOcean support to review its public availability). This is enabled by setting a new annotation service.beta.kubernetes.io/do-loadbalancer-network to INTERNAL.

• Adding support for specifiying loadBalancerSourceRanges in the service spec. Source ranges take precedence over annotation based allow rules (service.beta.kubernetes.io/do-loadbalancer-allow-rules).

• Adjusts load balancer health check behaviour to probe Kubernetes components correctly, ensuring that LB traffic stops in time in case of unavailability and pending node replacements. The concrete health check configuration depends on the specified external traffic policy. See the extended documentation for details.
• Adding new annotation service.beta.kubernetes.io/do-loadbalancer-certificate-name to configure which TLS certificate to use for HTTPs forwarding rules. This can be used instead of service.beta.kubernetes.io/do-loadbalancer-certificate-id which needs to be manually updated when using Let's Encrypt certificates. This is due to the certificate ID updating each time the certificate is rotated. If both annotations are provided, then service.beta.kubernetes.io/do-loadbalancer-certificate-id takes precedence.

• Updates kubernetes dependencies: (@ihwang)
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
• Update Go to v1.22 (@ihwang)

• Fix load balancer admission webhook to handle load balancer ID changes gracefully (@prichrd)

• Split release manifests to allow optional deployment of admission server (@prichrd)
• Add documentation for the admission server (@prichrd)

• Add validation webhook for LoadBalancer services (@prichrd)

• Updates kubernetes dependencies: (@kperath)
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
• Updates K8s Registry Location (@userbradley)

• Update retry duration when DO LoadBalancer is being created (@olove)
• Updates kubernetes dependencies: (@olove)
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]

• Remove deny and allow load balancer firewall rules when annotations are removed (@olove)

• Updates kubernetes dependencies: (@olove)
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]

• Updates kubernetes dependencies: (@olove)
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]
  • k8s.io/[email protected]

• Add annotation for customizing Load Balancer HTTP Idle Timeout (@StephenVarela)
• Add annotations for Load Balancers Firewalls (@jrolheiser)
• Relax validation for Load Balancers UDP ports (@anitgandhi)
• Deprecate annotation for customizing Load Balancer algorithm (@anitgandhi)

• Support setting DO API rate limit (@timoreimann)
• Update Go to v1.19 (@timoreimann)
• Support specifying region explicitly (@shatoboar)
• Support custom annotation to specify HTTP3 entry ports for Load Balancers (@anitgandhi)