v1.34.0

Features

• chart: expose podSecurityContext and securityContext values (#1258) (ebd8cd4)

Bug Fixes

• routes: reject IPv6 routes early (#1280) (0cba535)
• drop warning for untagged clouds (#1281) (574262f)

v1.33.0

Changed

Renamed HCLOUD_SERVER_CACHE_TTL to HCLOUD_SERVER_CACHE_MAX_AGE. The server cache lifetime is now configured via HCLOUD_SERVER_CACHE_MAX_AGE (default 10s). Individual controllers may override this default for specific lookups — for example, the routes controller uses a longer max age. Action required: if you set HCLOUD_SERVER_CACHE_TTL, switch to HCLOUD_SERVER_CACHE_MAX_AGE; the old variable is no longer recognized.

Removed

Removed the hcops/AllServersCache.* operation metrics. The legacy AllServersCache was replaced by the shared server cache, so the following cloud_controller_manager_operations_total series labeled op="hcops/AllServersCache.*" are no longer emitted:

• hcops/AllServersCache.ByID
• hcops/AllServersCache.ByName
• hcops/AllServersCache.ByPrivateIP
• hcops/AllServersCache.getCache
• hcops/AllServersCache.refreshCache

They are superseded by the new server cache metric cloud_controller_manager_server_cache_requests_total, a counter partitioned by subsystem, mode, and result:

• subsystem: instances_v2, routes (or none when unset)
• mode: all, one, off
• result: hit, miss

cloud_controller_manager_server_cache_requests_total{subsystem="instances_v2", mode="all", result="hit"}
cloud_controller_manager_server_cache_requests_total{subsystem="routes",       mode="all", result="miss"}

Update any dashboards or alerts referencing the old op series accordingly.

Features

• cache: replace TTL with max-age
• cache: use server cache in routes controller

Bug Fixes

• cache: when api returns not found do not return an expired entry (#1271)

v1.32.0

Cache Server Lookups in Node Controllers

This release introduces an experimental server cache to reduce Hetzner Cloud API calls. During an experimental phase, breaking changes on those features may occur within minor releases.

The node and node lifecycle controllers look up Servers by ID or name, generating significant API traffic during cluster scaling. A new cache sits between the controllers and the API to serve these lookups, reducing the number of requests.

It is enabled by default since we believe the implementation is safe in practice, but is experimental and may see breaking changes within minor releases. Configure it via environment variables:

• HCLOUD_SERVER_CACHE_MODE (all | one | off, default all):

  • all — fetch all Servers once and serve lookups from the snapshot until the TTL expires.
  • one — cache each Server individually with its own expiration.
  • off — disable caching; every lookup hits the API.

• HCLOUD_SERVER_CACHE_TTL (duration, default 10s): lifetime of cached entries (e.g. 30s, 2m); values above a minute are not recommended.

Features

• instances: cache server lookups to reduce API calls (#1252)

v1.31.1

Bug Fixes

• routes controller on node name drift (#1221)

v1.31.0

Features

• robot: allow Robot support without API credentials for IP-based LB targets (#1163)
• helm: allow customizing chart deployment strategy (#1190)
• support Kubernetes v1.36
• drop support for Kubernetes v1.32

Bug Fixes

• helm: remove permissions for persistentvolumes (#1203)
• route: error handling on locked networks (#1215)

v1.30.1

Datacenter Deprecation

The server.datacenter field is deprecated and will be removed from the API response after July 2026: https://docs.hetzner.cloud/changelog#2025-12-16-phasing-out-datacenters

To avoid a breaking change in HCCM, we decided to statically map from the old location names to the existing datacenter names for the topology.kubernetes.io/zone label. For new locations we will return the location name without a -dcxx suffix.

Deployments of hcloud-cloud-controller-manager that are not updated when the field is removed from the API will panic with the following error:

"Observed a panic" panic="runtime error: invalid memory address or nil pointer dereference" panicGoValue=""invalid memory address or nil pointer dereference""

We have published an RFC which details how we want to continue utilizing the labels topology.kubernetes.io/zone and topology.kubernetes.io/region: #1146 (comment)

Bug Fixes

• statically map deprecated datacenter names (#1159)

v1.30.0

Features

• support Kubernetes v1.35
• drop support for Kubernetes v1.31

Bug Fixes

• load-balancer: wait for action of managed certificate (#1144)

v1.29.2

Bug Fixes

• tcp service created for service with unsupported load balancer protocol (#1129)

v1.29.1

Bug Fixes

• respect proxy protocol default from config for load balancer status (#1131)

v1.29.0

Watch-Based Route Reconciliation

Previously, route reconciliation is performed at a fixed interval of 30s. This leads to unnecessary API requests, as a GET /v1/networks/{id} call is triggered every 30s, even when no changes have occurred.

Upstream, we have contributed an event-driven approach, similar to the mechanisms used by other controllers such as the Load Balancer controller. With this new approach, route reconciliation is triggered by node additions, node deletions, or changes to a node’s PodCIDRs or Addresses. Additionally, to ensure consistency, reconciliation still occurs periodically at a randomized interval between 12 and 24 hours.

Enabled by default

This feature is now enabled by default.

If you encounter any problems you can disable the feature by setting the following Helm value:

args.feature-gates=CloudControllerManagerWatchBasedRoutesReconciliation=false

Global Load Balancer Defaults

Configure cluster-wide defaults for Load Balancers via the extended HCLOUD_LOAD_BALANCERS_* env vars. These values automatically apply during Load Balancer creation and reconciliation whenever annotations are omitted. Learn more about it in the reference documentation

Features

• extend environment variables for default load balancer configuration (#1052)
• enable watch based route reconciliation by default (#1112)