kOps v1.36.1 - Nodeup And Hetzner Fixes

kOps v1.36.1 was published on July 28, 2026, with a focused correction to node bootstrap state handling. The main operator visible change prevents nodeup from mutating the cluster specification while clearing authenticator configuration. A second fix narrows Hetzner load balancer comparison so WellKnownServices no longer creates a difference during reconciliation.

The full release notes and downloads are on the GitHub release page.

nodeup now avoids changing the cluster specification object as it clears authenticator configuration. The change arrives through pull request 18602, an automated cherry pick of the fix identified in the notes as 18600.

That distinction matters during node bootstrap. Clearing runtime authentication data and rewriting the desired cluster specification are separate operations. The patch keeps the cleanup from altering the specification passed through that path. The release notes do not claim a new flag, configuration key, or API shape, so operators should treat this as a correctness fix inside existing behavior.

The notes describe the operation narrowly: authenticator configuration is cleared, but the cluster specification is not mutated as a side effect. They do not identify a persisted field or show a before and after document. Reviewers should therefore avoid assuming that every authenticator related write has changed.

For validation, capture the cluster specification before and after a representative node bootstrap. The expected signal is stability in that object while authenticator cleanup still completes. This check is useful for automation that serializes or compares cluster state around node provisioning.

Hetzner users get a separate reconciliation fix in pull request 18633. The load balancer comparison now ignores WellKnownServices. A difference in that value alone should therefore no longer make two load balancers appear different to kOps.

This targets comparison semantics, not traffic handling. The release notes make no broader claim about listener configuration, health checks, target membership, API requests, or performance. That narrow boundary matters for rollback and incident review: the documented patch changes which value participates in comparison, while making no promise about other load balancer behavior.

After rollout, watch reconciliation logs and provider side load balancer updates. Fewer repeated update attempts caused only by WellKnownServices would confirm the intended effect. Differences in fields that still participate in comparison need separate investigation.

The release contains three listed entries. Two are automated cherry picks for the fixes above. The third, pull request 18634, performs the release itself and is internal release work rather than an operator feature.

There are no documented breaking changes, migration steps, new command flags, or new cluster specification fields. That is not a guarantee for every deployment path, especially where bootstrap hooks or provider automation inspect internal state. A staged rollout remains appropriate. Check node bootstrap first, then verify reconciliation on one Hetzner cluster before expanding the update.

The notes also provide the full comparison with v1.36.0. For this patch, the practical review surface remains the nodeup mutation fix and the Hetzner comparison fix. The release page is the authoritative summary.