Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Releases

This page details the official releases of the Node Readiness Controller.

v0.5.0

Date: 2026-08-16

This release introduces an official Helm chart for installing the Node Readiness Controller, published as an OCI artifact on registry.k8s.io, along with a scale-test suite for validating behavior on large clusters. It also fixes a status leak where failedNodes entries lingered for deleted nodes, makes bootstrap completion and taint writes mutually exclusive; adds a node_readiness_build_info metric and per-rule labels on evaluation duration, and supports querying rules by field selectors. The client-side QPS throttling is now disabled by default and will rely on server-side APF for better scaling. Dependencies are bumped to Go 1.26 and controller-runtime v0.24.

Release Notes

Features & Enhancements

  • Add Helm chart for installing the controller (#163)
  • Expose controller tuning flags (concurrency, QPS, burst) in Helm values (#392)
  • Rename Helm chart from nrr-controller to node-readiness-controller (#407)
  • Publish Helm chart as an OCI artifact to registry.k8s.io (#402)
  • Support querying NodeReadinessRule objects by field selectors (#312)
  • Add node_readiness_build_info metric (#406)
  • Add rule label to node_readiness_evaluation_duration_seconds metric (#244)
  • Add --pprof-bind-address flag to the controller (#322)
  • Disable client-side QPS throttling as the default behavior (#316)
  • Add scale test suite (#284)
  • Emit JUnit XML report from the scale test (#415)
  • Add demo environment for local testing (#326)

Bug Fixes

  • Make bootstrap completion and taint writes mutually exclusive (#417)
  • Remove stale failedNodes entries for deleted nodes (#204)
  • Isolate rule status cache per rule-reconcile worker (#332)
  • Compare node labels in both directions in the update predicate (#348)
  • Increment metrics.Failures counter on node reconciler evaluation error (#219)
  • Clean up evaluation duration metric on rule deletion (#330)
  • Reporter: reject non-positive CHECK_INTERVAL and HEARTBEAT_PERIOD (#367)
  • Reporter: limit response body read to prevent unbounded memory consumption (#370)
  • Reporter: call flag.Parse to activate klog flags (#337)
  • Helm: add events.k8s.io to the manager ClusterRole (#351)
  • Helm: stop the chart suggesting an empty nodeSelector (#404)
  • Fix gcloud image tag (#303)

Code Cleanup & Maintenance

  • Bump controller-runtime to v0.24 and Go to 1.26 (#319)
  • Align reporter builder with Go 1.26 (#355)
  • Replace metric label literals with constants (#353)
  • Run helm via go run so it works without a preinstalled binary (#405)
  • Add kind to hack tools (#300)
  • Remove test-e2e GitHub Actions workflow (#307)
  • verify-govulncheck: handle Prow’s shallow checkout and non-main base branches (#305)
  • Fix lint failure (#328)

Documentation & Examples

  • Add Problem-gate (NPD) example using defaultStatus (#317)
  • Add reporter configuration reference and document HEARTBEAT_PERIOD behaviour (#314)
  • Document rule field selectors (#324)
  • Add rule label docs for node_readiness_evaluation_duration_seconds (#329)
  • Note inotify limits for the scale test (#360)
  • Sync netlify Go version with Makefile (#361)
  • Update v0.4.1 release notes (#309)

Images

The following container images are published as part of this release.

// Node readiness controller
registry.k8s.io/node-readiness-controller/node-readiness-controller:v0.5.0

// Report component readiness condition from the node
registry.k8s.io/node-readiness-controller/node-readiness-reporter:v0.5.0

Helm Chart

The Helm chart is published as an OCI artifact.

helm install node-readiness-controller \
  oci://registry.k8s.io/node-readiness-controller/charts/node-readiness-controller \
  --version 0.5.0 --namespace nrr-system --create-namespace

Contributors

  • ajaysundar.k
  • Alan Huang
  • Arnab Nandi
  • Arunit Chakraborty
  • Bhuvan Somisetty
  • Daniel Mungai Chege
  • Dasmat Hansda
  • Divyansh Rawat
  • Hong Hai
  • Mohana Katari
  • Priyanka Saggu
  • Rawad Hossain
  • Shaurya Srivastava
  • Shreya2005-2005
  • Tejas Singh Bhati
  • Vishnu Kothakapu
  • Vitor Floriano

v0.4.1

Date: 2026-07-12

This release includes critical bug fixes, most notably optimistic locking for taint updates so NRC plays well with other concurrent taint-management controllers like Karpenter, along with bootstrap-mode correctness, handling of long rule names, and reconcile retries. It also adds configurable defaults for missing conditions, letting continuous mode work naturally with problem states — such as those reported by NPD — to keep workloads off nodes where critical readiness is missing.

Note: This release was originally tagged v0.4.0, but the image build for that tag failed to publish. The images were retagged and published as v0.4.1 with no other code changes.

Release Notes

Features & Enhancements

  • Add optional DefaultStatus field to ConditionRequirement for missing node conditions (#283)
  • Prevent setting defaultStatus in bootstrap-only enforcement mode within validation webhook (#291)
  • Add options to tune concurrency, QPS, and burst (#287)
  • Reduce API-server load in reporter by skipping unchanged node conditions (#263)
  • Add Effect and DryRun printcolumns to NodeReadinessRule (#193)
  • Add govulncheck GitHub Actions workflow (#186)

Bug Fixes

  • Enhance uninstall target to wait for full deletion of CRDs (#296)
  • Handle long rule names in bootstrap annotation keys (#224)
  • Webhook fails closed when rule listing errors (#252)
  • Detect matchExpression selector overlaps in webhook (#246)
  • Improve nodeSelectorsOverlap to detect subset overlaps (#212)
  • Target metrics patches to metrics-service only (#277)
  • Add subject to certificates to satisfy cert-manager (#280)
  • Avoid double-counting bootstrap completion metric (#206)
  • Remove duplicate bootstrap duration observation in taint removal path (#285)
  • Only append to appliedNodes after successful node evaluation (#216)
  • Reconcile retry on rule processing errors (#222)
  • Taint optimistic locking fix (#180)

Code Cleanup & Maintenance

  • Harden GitHub Actions workflows security (#200)
  • Add test-e2e-kind target with hack script and artifact collection (#270)
  • Output test coverprofile to Artifacts tab in Prow (#257)
  • Remove dead cleanupNodesAfterSelectorChange code path (#250)
  • Replace kb.io placeholder with NRC API domain in webhook name (#265)
  • Add issue templates (#262)

Documentation & Examples

  • Fix 404s and improve instructions for cluster creation (#281)
  • Fix invalid taint key names (#275)
  • Replace blockquotes with admonitions (#274)
  • Clarify CNI readiness reporter as DaemonSet instead of sidecar (#181)
  • Add new metrics and testing documentation (#271)

Images

The following container images are published as part of this release.

// Node readiness controller
registry.k8s.io/node-readiness-controller/node-readiness-controller:v0.4.1

// Report component readiness condition from the node
registry.k8s.io/node-readiness-controller/node-readiness-reporter:v0.4.1

Contributors

  • ajaysundar.k
  • Anurag Pathak
  • Arunit Chakraborty
  • Avinesh Tripathi
  • Dorothy
  • Himanshu Choudhary
  • Justin
  • Karthik Bhat
  • Mohammad Faraz
  • Priyanka Saggu
  • Rawad Hossain
  • Sahitya Chandra
  • Shreya2005-2005
  • Sujal Shah
  • Vishnu Kothakapu
  • Vitor Floriano

v0.3.0

Date: 2026-03-18

This release focuses on security hardening, observability, and flexibility. Key updates include immutability for NodeReadinessRule spec fields, constrained impersonation for secure node status updates, and support for static pod installation flows. It also introduces node events for taint operations and several maintenance updates to address vulnerabilities.

Release Notes

Features & Enhancements

  • Make NodeReadinessRule spec fields immutable (#164)
  • Add graceful shutdown and propagate context in readiness-condition-reporter (#174)
  • Propagate context and use merge patch in bootstrap completion tracking (#173)
  • Improve security posture by pruning unnecessary RBAC (#172)
  • Add CEL validation for taint key format against Kubernetes qualified name rule (#155)
  • Support static pod installation flow for control-plane nodes (#162)
  • Add Podman support (#157)
  • Constrained impersonation for secure node status updates (#143)
  • Add node events for taint operations (TaintAdded, TaintRemoved, TaintAdopted) (#158)
  • Restrict NodeReadinessRuleSpec.Taint to “readiness.k8s.io/” prefix (#112)
  • Add TLS and webhook installation support to Makefile (#146)

Code Cleanup & Maintenance

  • Update manager.yaml to modify nodeSelector and tolerations (#129)
  • Bump golang version to address vulnerabilities (#169)
  • Fix linter and bump golangci-lint version (#168)
  • CVE fix: update otel sdk to 1.40.0 (#170)
  • Add release automation workflow (#144)

Documentation & Examples

  • Add NPD (node problem detector) variant for security-agent-readiness example (#154)
  • Add link checker to fix broken links in markdown (#140)
  • Update release notes for checking image promotion (#149)
  • Add controller metrics reference (#153)
  • Add installation steps for deploy-full target (#147)
  • Update Test_README file with small format change (#145)
  • Fix NodeReadinessGates KEP number - KEP-5233 (#156)

Images

The following container images are published as part of this release.

// Node readiness controller
registry.k8s.io/node-readiness-controller/node-readiness-controller:v0.3.0

// Report component readiness condition from the node
registry.k8s.io/node-readiness-controller/node-readiness-reporter:v0.3.0

Contributors

  • ajaysundar.k
  • Ali Abbasi Alaei
  • Anish Ramasekar
  • Avinesh Tripathi
  • Karthik Bhat
  • Mohammad Faraz
  • Priyanka Saggu
  • Rohit Chaudhari
  • Sathvik S
  • Swarom

v0.2.0

Date: 2026-02-28

This release brings several new features, including a validating admission webhook that validates NodeReadinessRule configurations, prevents conflicting rules with overlapping node selectors, and warns against risky NoExecute enforcement. It also introduces metrics manifests natively integrated with Kustomize, which includes support for secure metrics via TLS. Finally, this release includes major documentation improvements.

Release Notes

Features & Enhancements

  • Add webhook as kustomize component (#122)
  • Enable metrics manifests (#79)
  • Use status.patch api for node updates (#104)
  • Mark controller as system-cluster-critical to prevent eviction (#108)
  • Enhance Dockerfiles and bump Go module version (#113)
  • Add build-installer make target to create CRD and install manifests (#95, #93)
  • Add a pull request template (#110)

Bug Fixes

  • Fix dev-container: disable moby in newer version of debian (#127)
  • Add missing boilerplate headers in metrics.go (#119)
  • Update path to logo in README (#115)

Code Cleanup & Maintenance

  • Remove unused globalDryRun feature (#123, #130)
  • Bump versions for devcontainer and golangci-kal (#132)

Documentation & Examples

  • Document NoExecute taint risks and add admission warning (#120)
  • Updates on getting-started guide and installation docs (#135, #92)
  • Add example for security agent readiness (#101)
  • Managing CNI-readiness with node-readiness-controller and switch reporter to daemonset (#99, #116)
  • Update cni-patcher to use registry.k8s.io image (#96)
  • Add video demo (#114) and update heptagon logo (#109)
  • Remove stale docs/spec.md (#126)

Images

The following container images are published as part of this release.

// Node readiness controller
registry.k8s.io/node-readiness-controller/node-readiness-controller:v0.2.0

// Report component readiness condition from the node
registry.k8s.io/node-readiness-controller/node-readiness-reporter:v0.2.0

Installation

Prerequisites: If you plan to install with all optional features enabled (install-full.yaml), you must have cert-manager installed in your cluster.

To install the CRDs, apply the crds.yaml manifest for this version:

kubectl apply -f https://github.com/kubernetes-sigs/node-readiness-controller/releases/download/v0.2.0/crds.yaml

To install the controller, choose one of the following manifests based on your requirements:

ManifestContentsPrerequisites
install.yamlCore ControllerNone
install-full.yamlCore Controller + Metrics (Secure) + Validation Webhookcert-manager

Standard Installation (Minimal): The simplest way to deploy the controller with no external dependencies.

kubectl apply -f https://github.com/kubernetes-sigs/node-readiness-controller/releases/download/v0.2.0/install.yaml

Full Installation (Production Ready): Includes secure metrics (TLS-protected) and validating webhooks for rule conflict prevention. Requires cert-manager to be installed in your cluster.

kubectl apply -f https://github.com/kubernetes-sigs/node-readiness-controller/releases/download/v0.2.0/install-full.yaml

This will deploy the controller into any available node in the nrr-system namespace in your cluster. Check here for more detailed installation instructions.

Contributors

  • ajaysundark
  • arnab-logs
  • AvineshTripathi
  • GGh41th
  • Hii-Himanshu
  • ketanjani21
  • knechtionscoding
  • OneUpWallStreet
  • pehlicd
  • Priyankasaggu11929
  • sats-23

v0.1.1

Date: 2026-01-19

This patch release includes important regression bug fixes and documentation updates made since v0.1.0.

Release Notes

Bug or Regression

  • Fix race condition where deleting a rule could leave taints stuck on nodes (#84)
  • Ensure new node evaluation results are persisted to rule status (#87]

Documentation

  • Add/update Concepts documentation (enforcement modes, dry-run, condition reporting) (#74)
  • Add v0.1.0 release notes to docs (#76)

Images

The following container images are published as part of this release.

// Node readiness controller
registry.k8s.io/node-readiness-controller/node-readiness-controller:v0.1.1

// Report component readiness condition from the node
registry.k8s.io/node-readiness-controller/node-readiness-reporter:v0.1.1

Installation

To install the CRDs, apply the crds.yaml manifest for this version:

kubectl apply -f https://github.com/kubernetes-sigs/node-readiness-controller/releases/download/v0.1.1/crds.yaml

To install the controller, apply the install.yaml manifest for this version:

kubectl apply -f https://github.com/kubernetes-sigs/node-readiness-controller/releases/download/v0.1.1/install.yaml

This will deploy the controller into any available node in the nrr-system namespace in your cluster. Check here for more installation instructions.

Contributors

  • ajaysundark

v0.1.0

Date: 2026-01-14

This is the first official release of the Node Readiness Controller.

Release Notes

  • Initial implementation of the Node Readiness Controller.
  • Support for NodeReadinessRule API (readiness.node.x-k8s.io/v1alpha1).
  • Defines custom readiness rules for k8s nodes based on node conditions.
  • Manages node taints to prevent scheduling until readiness rules are met.
  • Includes modes for bootstrap-only and continuous readiness enforcement.
  • Readiness condition reporter for reporting component health.

Images

The following container images are published as part of this release.

// Node readiness controller
registry.k8s.io/node-readiness-controller/node-readiness-controller:v0.1.0

// Report component readiness condition from the node
registry.k8s.io/node-readiness-controller/node-readiness-reporter:v0.1.0

Installation

To install the CRDs, apply the crds.yaml manifest for this version:

kubectl apply -f https://github.com/kubernetes-sigs/node-readiness-controller/releases/download/v0.1.0/crds.yaml

To install the controller, apply the install.yaml manifest for this version:

kubectl apply -f https://github.com/kubernetes-sigs/node-readiness-controller/releases/download/v0.1.0/install.yaml

This will deploy the controller into any available node in the nrr-system namespace in your cluster. Check here for more installation instructions.

Contributors

  • ajaysundark
  • Karthik-K-N
  • Priyankasaggu11929
  • sreeram-venkitesh
  • Hii-Himanshu
  • Serafeim-Katsaros
  • arnab-logs
  • Yuan-prog
  • AvineshTripathi