KubeOps 2.2.0

KubeOps 2.2.0 - Release Date 30.09.2026

Changelog KubeOpsCtl 2.2.0

Whats new?

- Added Traefik support for kubeopsctl
- Added Kubevirt-Manager support for kubeopsctl
- Added Kubernetes 1.36 support
- Added Advanced Parameters for static Registry mount path, check out the file format [Cluster Values YAML](/kubeopsctl-2.0/reference/fileformats/#cluster-valuesyaml)

Fixes

- fixed a podman bug affecting pull packages
- fixed a harbor bug setting up cluster
- added creation of nginx ingressclass, when installing traefik for backwards compatabilty
- fixed default secret for kubeops-dashboard
- kubeopsctl pull command now verifies if the specified tool value file exists
- Added kubeops-harbor-secret for pulling images from the internal private harbor project 'kubeops'
- fixed a bug that prevented to create the kubeops harbor project as private 
- fixed a bug that prevented to change the kubeops harbor project to private 
- fixed a bug that prevented the image push of the kubernetes images to local-registry 
- changed the 'localhost' reference to '127.0.0.1' for enterprise-tools in preperation for the kubernetes 1.36 support
- fix image push in local registry
- fixed duplicated coredns in 1.36.1
- updated kosi versions for consistent installation
- updated Harbor ImagePullSecret with 127.0.0.1 instead of master1 IP
- remove hardcoded plugin versions in cluster prepare node
- fixed a bug in rook delete section
- fixed a bug in nginx ingressclass for traefik
- added default secret for grafana
- added role bindings for the kubevirt roles
- fixed delete ingresses in update process 
- OpenSearch users created in the Dashboards Security UI now persist across package updates 
- OpenSearch TLS certificates are no longer regenerated on every install/update, preventing certificate rotation on running clusters 
- Fixed OpenSearch SSO returning 401 Unauthorized by reliably applying the openid security configuration to the backend after deploy 
- Added a Keycloak protocol mapper so realm roles are propagated to OpenSearch for backend role mapping 
- Added Single Sign-On (SSO) with Keycloak (OpenID Connect) for OpenSearch and OpenSearch Dashboards 
- Added username/password fallback authentication for OpenSearch alongside SSO 
- Made the OpenSearch admin password configurable via the new `adminPassword` package value (opensearch-os & opensearch-dashboards) 
- Added `hostname` package value for opensearch-os to point OpenSearch at the Keycloak SSO endpoint 
- Refresh the Keycloak admin token before each step of the OpenSearch Dashboards OIDC join so long-running joins no longer fail with 401 once the 60s token lifespan is exceeded
- fixed an error in OpenSearch when it was not installed in the `logging` namespace
- fixed an issue in kubeopsctl where `tools-values.yaml` and `cluster-values.yaml` were not always stored as secrets in the cluster
- changed the netpols for traefik-nginx and ingress-nginx to make the dashboards available
- helm-plugin now parses the flags correctly in all possible actions (install, upgrade, delete)
- fixed missing kosi update on nodes, if packageRepository: local
- fixed missing opensearch-dashboards plugins and wrong version
- template network policies with default deny rules
- by default, netpols are not enabled
- when installing the tools, apply cluster- and tools-values

Known Issues

Versions KubeOps 2.2.0