Automatically adjust resources for your workloads

Security

The release images were rebuilt with Go 1.26.10, which includes the crypto/x509 mitigation for CVE-2026-111943 / GO-2026-6809. The refreshed Distroless trust bundle excludes emSign ECC Root CA - G3 and AAA Certificate Services, addressing the image rebuild request in #10621.

Changes by Kind

Bug or Regression

• Exclude GPU-labeled unmanaged nodes with unavailable GPU capacity from GPU quota usage, logging a warning instead of blocking cluster-wide scale-up. (#10407, @MaximilianoUribe)
• AWS: correctly extract placeholder instance names when an Auto Scaling Group name contains /. (#10352, @ketanjani21)
• AWS: fix integer overflow in memory calculations for ASGs using attribute-based InstanceRequirements without instance-type overrides. A MemoryMiB.Min of 2048 or greater could produce a zero-memory template node and prevent scale-up. (#10272, @pujitha24)
• Azure: fix VMSS instance deletion when disableAzureStackCloud is enabled. (#10086, @tallaxes)
• Cluster API: allow scale-down of MachinePool-backed node groups when no per-node Machine can be resolved, after verifying that the node belongs to the MachinePool, by decrementing the pool's replica count. (#10387, @mnaissiou)
• OCI: recover node pools when failed node creation leaves a node without an instance ID. (#10109, @jlamillan)
• OCI: treat instances from node pools outside the configured autoscaler scope as existing unmanaged instances instead of returning node-pool lookup errors. (#10335, @shreyshj)
• OCI: use registered nodes' actual ephemeral-storage capacity and allocatable values in existing node-pool templates, preserving configured template values if lookup fails. (#10513, @Debasish-87)

Other (Cleanup or Flake)

• Update Kubernetes dependencies to v1.36.6. (#10614, @jackfrancis)
• Change the default staging build/push destination to us-central1-docker.pkg.dev/k8s-staging-images/autoscaling. Production image URLs remain under registry.k8s.io/autoscaling. (#10601, @maxsxu)

Images

• registry.k8s.io/autoscaling/cluster-autoscaler:v1.36.2
• registry.k8s.io/autoscaling/cluster-autoscaler-amd64:v1.36.2
• registry.k8s.io/autoscaling/cluster-autoscaler-arm64:v1.36.2
• registry.k8s.io/autoscaling/cluster-autoscaler-s390x:v1.36.2

Full Changelog: cluster-autoscaler-1.36.1...cluster-autoscaler-1.36.2

Security

The release images were rebuilt with Go 1.26.10, which includes the crypto/x509 mitigation for CVE-2026-111943 / GO-2026-6809. The refreshed Distroless trust bundle excludes emSign ECC Root CA - G3 and AAA Certificate Services, addressing the image rebuild request in #10621.

Changes by Kind

Bug or Regression

• Exclude GPU-labeled unmanaged nodes with unavailable GPU capacity from GPU quota usage, logging a warning instead of blocking cluster-wide scale-up. (#10408, @MaximilianoUribe)
• AWS: correctly extract placeholder instance names when an Auto Scaling Group name contains /. (#10351, @ketanjani21)
• AWS: fix integer overflow in memory calculations for ASGs using attribute-based InstanceRequirements without instance-type overrides. A MemoryMiB.Min of 2048 or greater could produce a zero-memory template node and prevent scale-up. (#10271, @pujitha24)
• Azure: fix VMSS instance deletion when disableAzureStackCloud is enabled. (#10085, @tallaxes)
• Cluster API: allow scale-down of MachinePool-backed node groups when no per-node Machine can be resolved, after verifying that the node belongs to the MachinePool, by decrementing the pool's replica count. (#10485, @iamjanr)
• OCI instance pools: align HasInstance and NodeGroupForNode instance mappings, compare pool states case-insensitively, and improve diagnostic logging. (#9385, @jlamillan)
• OCI: include the fault-domain label on node-pool templates so pods with fault-domain scheduling constraints can select zero-size pools. (#10049, @jlamillan)
• OCI: recover node pools when failed node creation leaves a node without an instance ID. (#10118, @jlamillan)
• Pass build-tag and linker flags to Docker image builds so BUILD_TAGS and LDFLAGS are honored, including provider-specific builds that avoid compiling unused cloud providers. (#10623, @Choraden)

Other (Cleanup or Flake)

• Update Kubernetes dependencies to v1.35.10. (#10613, @jackfrancis)
• Move the release-image builder to Go 1.26. (#10581, @GaneshBannur)
• Change the default staging build/push destination to us-central1-docker.pkg.dev/k8s-staging-images/autoscaling. Production image URLs remain under registry.k8s.io/autoscaling. (#10600, @maxsxu)

Images

• registry.k8s.io/autoscaling/cluster-autoscaler:v1.35.3
• registry.k8s.io/autoscaling/cluster-autoscaler-amd64:v1.35.3
• registry.k8s.io/autoscaling/cluster-autoscaler-arm64:v1.35.3
• registry.k8s.io/autoscaling/cluster-autoscaler-s390x:v1.35.3

Full Changelog: cluster-autoscaler-1.35.2...cluster-autoscaler-1.35.3

Security

The release images were rebuilt with Go 1.26.10, which includes the crypto/x509 mitigation for CVE-2026-111943 / GO-2026-6809. The refreshed Distroless trust bundle excludes emSign ECC Root CA - G3 and AAA Certificate Services, addressing the image rebuild request in #10621.

Changes by Kind

Bug or Regression

• Exclude GPU-labeled unmanaged nodes with unavailable GPU capacity from GPU quota usage, logging a warning instead of blocking cluster-wide scale-up. (#10409, @MaximilianoUribe)
• AWS: correctly extract placeholder instance names when an Auto Scaling Group name contains /. (#10350, @ketanjani21)
• OCI instance pools: align HasInstance and NodeGroupForNode instance mappings, compare pool states case-insensitively, and improve diagnostic logging. (#9383, @jlamillan)
• OCI: include the fault-domain label on node-pool templates so pods with fault-domain scheduling constraints can select zero-size pools. (#10048, @jlamillan)

Other (Cleanup or Flake)

• Update Kubernetes dependencies to v1.34.13. The Go module's minimum version increases from 1.24 to 1.25; the published release images use Go 1.26.10 as noted above. (#10612, @jackfrancis)
• Move the release-image builder to Go 1.26. (#10582, @GaneshBannur)
• Change the default staging build/push destination to us-central1-docker.pkg.dev/k8s-staging-images/autoscaling. Production image URLs remain under registry.k8s.io/autoscaling. (#10599, @maxsxu)

Images

• registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.6
• registry.k8s.io/autoscaling/cluster-autoscaler-amd64:v1.34.6
• registry.k8s.io/autoscaling/cluster-autoscaler-arm64:v1.34.6
• registry.k8s.io/autoscaling/cluster-autoscaler-s390x:v1.34.6

Full Changelog: cluster-autoscaler-1.34.5...cluster-autoscaler-1.34.6

Scales Kubernetes worker nodes within autoscaling groups.

Urgent Upgrade Notes

Action Required

• CapacityQuota users: update the CapacityQuota CRD and migrate manifests to autoscaling.x-k8s.io/v1beta1. The v1alpha1 API remains served but is deprecated; v1beta1 is now the storage version. The updated CRD is available in this release. (#9890, @norbertcyran)

Changes by Kind

API Change

• Add observedGeneration to CapacityQuota status. (#9864, @norbertcyran)
• Add readyReplicas to CapacityBuffer status to report buffer chunks schedulable on existing nodes. The bundled core library reconciles this field when CapacityBuffer pod injection is enabled; reconciliation is controlled by --capacity-buffer-ready-replicas-enabled, which defaults to true. (#10342, core #213, @norbertcyran)
• External gRPC: add maxNodeStartupDuration and allowNonAtomicScaleUpToMax to NodeGroupAutoscalingOptions. This preserves MaxNodeStartupTime returned by NodeGroupGetOptions, preventing newly registered nodes from being classified as Unready instead of NotStarted, and adds support for AllowNonAtomicScaleUpToMax. (#10266, @LakshmirajSunilSawant)
• External gRPC: add optional resourceSliceBytes to NodeGroupTemplateNodeInfoResponse, allowing providers to return node-local DRA ResourceSlices for template nodes and support scale-from-zero for pods using ResourceClaims. (#10303, @Despire)

Feature

• Add opt-in graceful degradation for large unschedulable-pod backlogs. With --enable-graceful-degradation, scheduling simulations can stop at --pending-pods-batching-timeout and proceed with a subset of pods instead of blocking the autoscaling loop indefinitely. This can trade optimal scaling decisions for continued progress under heavy load. (#9242, @damikag)
• Add a delay_reason label to the node_removal_latency_seconds metric to identify technical blockers that delayed scale-down, such as BlockedByPod or AtomicScaleDownFailed. (#9721, @ttetyanka)
• Expire ProvisioningRequest capacity bookings once all associated pods are scheduled, setting the BookingExpired condition with reason CapacityBookingConsumed. (#9806, @cvgenesis)
• CoreWeave: implement GPULabel so GPU nodes are tracked as upcoming while device plugins start, add rdma/ib capacity to node templates, and add missing instance types including b300-8x. (#10295, @chunter-bits)
• DigitalOcean: support scale-from-zero for AMD GPU nodes and use cpuMilliCores for more precise CPU allocatable calculations. (#10509, @m3co-code)
• GCE: add pricing calculations for the E4 machine family. (#9516, @harrisgu-Google)
• GCE: add pricing information for the Z4D machine family. (#9791, @mariafromano-25)
• GCE: add pricing information for the Z4M machine family. (#10270, @yangspirit)
• GCE: proactively refresh cached MIG information after scale-down. (#9915, @tetianakh)
• GCE: add the CLOUD_KMS_ERROR error code to identify Cloud Key Management Service failures. (#10230, @MatthewGree)
• Hetzner: add a per-nodepool firewalls field to nodeConfigs in HCLOUD_CLUSTER_CONFIG. Firewalls specified by ID or name are attached at server creation in addition to the cluster-wide HCLOUD_FIREWALL. (#9810, @tjorri)

Bug or Regression

• Fix CapacityBuffer sizing when both replicas and percentage are specified: use the maximum rather than the minimum, and round fractional percentage-based chunk counts up. (#9959, @walidghallab)
• AWS: fix scale-from-zero for node groups using CSI-backed volumes with topology constraints. (#10133, @Debasish-87)
• AWS: fix integer overflow in memory calculations for ASGs using attribute-based InstanceRequirements without instance-type overrides. A MemoryMiB.Min of 2048 or greater could produce a zero-memory template node and prevent scale-up. (#10171, @pujitha24)
• Azure: invalidate the instance cache after an ETag precondition refresh so instance-derived data is recomputed from fresh state. (#9991, @MaximilianoUribe)
• Azure: fix VMSS instance deletion when disableAzureStackCloud is enabled. (#10082, @tallaxes)
• Cluster API: fix DRA scale-from-zero by generating ResourceSlices with a valid resource-slice count. (#10200, @dlanov)
• Cluster API: include topology.kubernetes.io/zone in extracted node-template labels so pods with zone constraints can trigger scale-up. (#10258, @SISheogorath)
• GCE: on a cache miss with an otherwise warm MIG cache, fetch only the missing MIG rather than rebuilding the entire cache. (#9917, @tetianakh)
• GCE: treat nodes with non-GCE or empty provider IDs as unmanaged rather than returning an error. (#10274, @ppmechlinski)
• OCI: recover node pools when failed node creation leaves a node without an instance ID. (#9703, @jlamillan)
• OCI: include the fault-domain label on node-pool templates so pods with fault-domain scheduling constraints can select zero-size pools. (#10047, @jlamillan)
• Scaleway: report nodes in an error state as InstanceCreating so failed provisioning is detected sooner. (#9949, @Tomy2e)

Other (Cleanup or Flake)

• Rename the Cluster Autoscaler-managed CapacityQuota Valid condition to cluster-autoscaler.kubernetes.io/valid to distinguish it from the public CapacityQuota API. (#9863, @norbertcyran)
• Propagate cancellation through Autoscaler.RunOnce and cancel the main context on termination signals so long-running iterations can be interrupted during graceful shutdown. (#9887, #10511, @yashrajshuklaaa, @norbertcyran)
• Add --scheduler-verbosity to reduce the verbosity of imported scheduler logs without lowering Cluster Autoscaler's overall log verbosity. (#9977, @chmurka1)
• Azure: redact query parameters and escape paths when logging ResponseError, through the updated Azure SDK dependencies. (#9919, @theunrepentantgeek)
• Consume the extracted core implementation from the sigs.k8s.io/cluster-autoscaler module; provider integrations in this repository use the shared core packages and interfaces. (#10002, @Choraden)
• Update Kubernetes dependencies to v1.37.1 and Cluster Autoscaler Core to v0.0.0-k8s.v1.37.1. (#10366, #10544, @jackfrancis)

Images

• registry.k8s.io/autoscaling/cluster-autoscaler:v1.37.0
• registry.k8s.io/autoscaling/cluster-autoscaler-amd64:v1.37.0
• registry.k8s.io/autoscaling/cluster-autoscaler-arm64:v1.37.0
• registry.k8s.io/autoscaling/cluster-autoscaler-s390x:v1.37.0

Full Changelog: cluster-autoscaler-1.36.0...cluster-autoscaler-1.37.0

Automatically adjust resources for your workloads

Changes by Kind

Dependency

• Bump Go to 1.26.10 (#10454, @adrianmoisey)

Bug or Regression

• Fix VPA updater treating a days-old lastState OOM as a fresh quick OOM under InPlace (#10385, @locker95)
• Fixed VPA updater logic to determine DaemonSet replica count from DaemonSet.Status.DesiredNumberScheduled instead of DaemonSet.Status.NumberReady (#10373, @dippynark)

Other (Cleanup or Flake)

• Bump VPA to 1.8.1 (#10359, @adrianmoisey)

Changes by Kind

Dependency

• Bump Go to 1.26.10 (#10456, @adrianmoisey)

Bug or Regression

• Fix VPA updater treating a days-old lastState OOM as a fresh quick OOM under InPlace (#10386, @adrianmoisey)
• Fixed VPA updater logic to determine DaemonSet replica count from DaemonSet.Status.DesiredNumberScheduled instead of DaemonSet.Status.NumberReady (#10372, @dippynark)

Other (Cleanup or Flake)

• Bump VPA to 1.7.3 (#10360, @adrianmoisey)

Automatically adjust resources for your workloads