Skip to main content

hetzner-apalla-1-36-v8

Supported Latest

Last updated

Configure a cluster Update to this release

Release Notes

Security

  • Kernel 6.18.59; OS packages refreshed (OpenSSL 3.5.9, OpenSSH 10.6p1, containerd 2.3.7, util-linux 2.41.6, expat 2.9.0, QEMU-GA 11.0.5, NVIDIA 595.112.07/580.196.07, linux-firmware 20261019, tzdata 2026e); node binaries on Go 1.26.10.
  • CA bundle updated to 2026-10-20, dropping the distrusted eMudhra/emSign roots. Clusters were not affected.
  • STIG hardening: controller-manager and scheduler match the API server's TLS floor and ciphers; full default admission-plugin set listed; two kernel sysctls corrected.

Update

  • Kubernetes 1.36.5 to 1.36.6.
  • Cilium 1.20.2 to 1.20.4 (+ Envoy), KubeGate 0.0.10, CoreDNS autoscaler 1.11.0.
  • Hetzner CSI 2.24.1 (provisioner 6.4.0, resizer 2.3.0); CSI token now read from a file.

Fix

  • KubeGate uses the same resource settings as the other control-plane pods, avoiding an out-of-memory kill.
  • Node image-cache images are pinned, so garbage collection no longer evicts and re-pulls them.
  • Bare metal: LVM metadata backup directories are recreated each boot under /var.
  • syself-agent now waits three minutes of failed checks before restarting kubelet or containerd, then backs off.

Removed

  • Unused GPU CDI-refresh units and unshipped systemd units removed.

What’s Included in This Stack

Components packages and containers running on that node.
  • etcdctl etcdctl, the command-line client for administering the etcd key-value store. 3.6.8 CLI
    • 14
      • C 0
      • H 0
      • M 0
      • L 0
    • T 14
     Open all CVEs for etcdctl
  • etcd_image Container image of etcd, the key-value store backing the Kubernetes control plane. 3.6.8-0 Container
    • 73
      • C 0
      • H 0
      • M 0
      • L 0
    • T 73
     Open all CVEs for etcd_image
  • kube_apiserver The Kubernetes API server — the front door and central hub of the control plane. 1.36.6 from 1.36.5 Container
    • 32
      • C 0
      • H 0
      • M 0
      • L 0
    • T 32
     Open all CVEs for kube_apiserver
  • kube_controller_manager Runs the core Kubernetes controllers that reconcile cluster state to the desired spec. 1.36.6 from 1.36.5 Container
    • 32
      • C 0
      • H 0
      • M 0
      • L 0
    • T 32
     Open all CVEs for kube_controller_manager
  • kube_scheduler Assigns newly created pods to the most suitable nodes in the cluster. 1.36.6 from 1.36.5 Container
    • 32
      • C 0
      • H 0
      • M 0
      • L 0
    • T 32
     Open all CVEs for kube_scheduler
  • kubegate Syself Kubegate: secure access to the cluster's control plane. v0.0.10 from v0.0.7 Container
  • kernel The Linux kernel — the core of the OS that runs every container and drives the hardware. 6.18.59 from 6.18.54 Kernel
    • 1048
      • C 0
      • H 0
      • M 0
      • L 1
    • T 1049
     Open all CVEs for kernel
  • intel_microcode Intel CPU microcode applied at boot to patch processor errata and hardware security issues. 20260925 Firmware
    • 11
      • C 0
      • H 0
      • M 0
      • L 0
    • T 11
     Open all CVEs for intel_microcode
  • linux_firmware Vendor firmware blobs the kernel loads for network, storage and other hardware devices. 20261019 from 20260916 Firmware
    • 5
      • C 0
      • H 0
      • M 0
      • L 0
    • T 5
     Open all CVEs for linux_firmware
  • grub The GRUB bootloader that loads and starts the Linux kernel when the node powers on. 2.14 CLI
    • 9
      • C 0
      • H 0
      • M 0
      • L 0
    • T 9
     Open all CVEs for grub
  • glibc The GNU C library — the core system library nearly every program links against. 2.43 Library
    • 26
      • C 0
      • H 0
      • M 0
      • L 0
    • T 26
     Open all CVEs for glibc
  • libgcc GCC runtime support library providing low-level routines that compiled programs depend on. 14.2.0-19 Library
    • 3
      • C 0
      • H 0
      • M 0
      • L 0
    • T 3
     Open all CVEs for libgcc
  • zlib Widely used data compression library (DEFLATE/gzip) linked by many system components. 1.3.2 Library
    • 2
      • C 0
      • H 0
      • M 0
      • L 0
    • T 2
     Open all CVEs for zlib
  • zstd Zstandard compression library offering fast, high-ratio compression used across the system. 1.5.7 Library
  • libxcrypt Modern password-hashing library providing the crypt() functions used for local logins. 4.4.38 Library

What’s a Cluster Stack?

A Cluster Stack pins everything your cluster runs to one tested release: the Kubernetes version, the node image, and the in-cluster components like CNI and DNS. Syself builds and tests them together, so your team never has to check hundreds of moving parts by hand.

Each stack fits the provider, node role, and hardware it runs on. Syself also tests the upgrade paths between Cluster Stack releases, so a cluster moves forward safely over time.

  • Tested Together

    Syself tests the Kubernetes version, the node image, the in-cluster components, and every upgrade path together, then ships them as one release.

  • Applied Per Node

    Each Cluster Stack fits the infrastructure it runs on. The provisioner installs only what a node needs for its role and its hardware, nothing more.

  • Continuously Maintained

    Syself tracks versions, vulnerabilities, fixes, and upgrade paths. Releases on the same minor keep behavior stable; a new minor adds new Kubernetes features.

Related Resources

Go deeper on how Cluster Stacks are built, how clusters move between versions, and how Syself runs them day to day.

See All