Release Proposal v2.26.1

[yankay]

Changes by Kind

Feature

• Default to Kubernetes v1.30.6 ([2.26] Make Kubernetes v1.30.6 default #11673, @robertvolkmann)
• Bump ingress-nginx to 1.11.5 and certgen to 1.5.2 ([release-2.26] Bump ingress-nginx to 1.11.5 and certgen to 1.5.2 #12081, @tico88612)

Container-Managers

• Default to containerd 1.7.23 ([2.26] Bump containerd 1.7.23 #11643, @robertvolkmann)
• Update runc to v1.1.14 and nerdctl to 1.7.7 ([2.26] Update to last patch versions (runc, nerdctl, etcd) (#11576) #12817, @rptaylor)

Bug or Regression

• Always copy cert generation scripts to first etcd to pick up fixes on existing clusters ([release-2.26] Always copy cert generation scripts to first etcd #11615, @k8s-infra-cherrypick-robot)
• Fix: cannot stop & remove all cri containers via remove_node.yml ([release-2.26] Fix: cannot stop & remove all cri containers via remove_node.yml #11637, @k8s-infra-cherrypick-robot)
• Fix kubecontrollersconfigurations list permission ([release-2.26] [calico] fix: kubecontrollersconfigurations list permission #12038, @k8s-infra-cherrypick-robot)
• Workaround missing etcd certs on control plane node ([release-2.26] Workaround missing etcd certds on control plane node #12193, @k8s-infra-cherrypick-robot)
• Move 'pretend certificates' after cert distribution (release-2.26: Fix broken workaround for separate etcd setup #12222, @VannTen)
• Fix manage-offline-container-images.sh get image_id ([release-2.26] fix: When running ./manage-offline-container-images.sh register using Podman, retrieving the image ID fails and the script stops. #12315, @k8s-infra-cherrypick-robot)
• Fix PodSecurity Admission "empty" definition handling ([release-2.26] Fix: Change "empty" definition for PodSecurity Admission configuration #12477, @k8s-infra-cherrypick-robot)

Components

• kubernetes v1.30.6
• etcd v3.5.16
• containerd 1.7.23
• runc v1.1.14
• nerdctl 1.7.7
• ingress-nginx v1.11.5
• cert-manager v1.14.7

Related: #12816

[yankay]

Hi approvers, this one is a small patch release for fixes already merged into release-2.26, including the component version updates discussed in #12816.

Could anyone take a look and confirm whether there are any blockers?

cc @VannTen @ant31 @tico88612 @mzaian

[mzaian]

Hi @yankay Look good to me. You can go ahead.

[tico88612]

Look good to me.

But I will purpose the release schedule. We've never finalized how we handle patch versions.
FYI: https://kubernetes.slack.com/archives/CDQSC941H/p1775563338852559?thread_ts=1775546736.286629&cid=CDQSC941H

[yankay]

Progress update:

• Fix: galaxy.yml set version to 2.26.1 #13153 — Bumps galaxy.yml version to 2.26.1. Ready for review, but blocked by a pre-existing tf-validate-nifcloud CI failure.
• [release-2.26] Remove nifcloud terraform provider support (it is no longer available) #13154 — Cherry-picks the nifcloud terraform removal (Remove nifcloud terraform provider support (it is no longer available) #12936) to release-2.26 to fix that CI failure.

Waiting for both PRs to be merged to complete the v2.26.1 release preparation.