v1.27.2 release

What's Changed

• [release-1.27] feat: Add CSI-specific Prometheus metrics by @k8s-infra-cherrypick-robot in #2295
• [release-1.27] chore: upgrade azcopy to v10.31.1 to fix CVEs by @k8s-infra-cherrypick-robot in #2297
• [release-1.27] feat: Add detection for blobfuse-proxy failures by @k8s-infra-cherrypick-robot in #2301
• [release-1.27] feat: install blobfuse 2.5.2 as default version by @andyzhangx in #2303
• [release-1.27] test: fix CVE-2025-61726 trivy failure by @k8s-infra-cherrypick-robot in #2309
• [release-1.27] fix: replace os.ReadDir with fs.ReadDir(1) to avoid OOMs by @k8s-infra-cherrypick-robot in #2311
• doc: cut v1.27.2 release by @andyzhangx in #2314

Full Changelog: v1.27.1...v1.27.2

v1.26.9 release

What's Changed

• [release-1.26] chore: upgrade azcopy to v10.31.1 to fix CVEs by @k8s-infra-cherrypick-robot in #2298
• [release-1.26] feat: install blobfuse 2.5.2 as default version by @andyzhangx in #2304
• [release-1.26] test: fix CVE-2025-61726 trivy failure by @k8s-infra-cherrypick-robot in #2310
• [release-1.26] fix: replace os.ReadDir with fs.ReadDir(1) to avoid OOMs by @k8s-infra-cherrypick-robot in #2312
• doc: cut v1.26.9 release by @andyzhangx in #2313

Full Changelog: v1.26.8...v1.26.9

v1.27.1 release

What's Changed

• [release-1.27] fix: China cloud endpoints by @k8s-infra-cherrypick-robot in #2164
• [release-1.27] fix(proxy_installer): add necessary mounts for cos,gardenlinux bin paths by @andyzhangx in #2176
• [release-1.27] test: refine verify-helm-chart-index.sh by @k8s-infra-cherrypick-robot in #2177
• [release-1.27] chore(deps): bump build-image/debian-base from bookworm-v1.0.5 to bookworm-v1.0.6 in /pkg/blobplugin by @k8s-infra-cherrypick-robot in #2181
• [release-1.27] chore: upgrade azcopy to v10.30.1 by @k8s-infra-cherrypick-robot in #2185
• [release-1.27] chore: upgrade sidecar image versions by @andyzhangx in #2189
• [release-1.27] fix: blobfuse-proxy install on OpenShift 4.19 by @k8s-infra-cherrypick-robot in #2194
• [release-1.27] feat: install blobfuse 2.5.1 as default version by @andyzhangx in #2206
• [release-1.27] fix: install blobfuse2 binary failure on rhcos by @k8s-infra-cherrypick-robot in #2211
• [release 1.27] 🌈 Feature: Add support for Flatcar Container Linux by @t-lo in #2213
• [release-1.27] test: fix CVE-2025-47912 error by @k8s-infra-cherrypick-robot in #2223
• [release-1.27] 🐞 fix: shasum in blobfuse-proxy installer for Flatcar, fix PATH in blobfuse-proxy.service by @k8s-infra-cherrypick-robot in #2221
• [release-1.27] chore: upgrade azcopy to v10.31.0 by @k8s-infra-cherrypick-robot in #2227
• [release-1.27] fix: skip chmod setting in readonly mode by @k8s-infra-cherrypick-robot in #2232
• [release-1.27] chore: upgrade sidecar image versions by @andyzhangx in #2235
• [release-1.27] Revert "fix: respect secretName during volume creation" by @k8s-infra-cherrypick-robot in #2238
• [release-1.27] fix: CVE-2025-52881 by @k8s-infra-cherrypick-robot in #2242
• [release-1.27] fix: snapshot restore and volume clone failure in some new sovereign … by @k8s-infra-cherrypick-robot in #2251
• [release-1.27] chore: upgrade AzureAD lib by @k8s-infra-cherrypick-robot in #2254
• [release-1.27] fix: CVE-2025-58181 by @andyzhangx in #2258
• [release-1.27] test: fix trivy CVE-2025-61727 by @k8s-infra-cherrypick-robot in #2265
• [release-1.27] feat: add telemetry as part of mount options for blobfuse mounts by @k8s-infra-cherrypick-robot in #2270
• [release-1.27] cleanup: clientID should be optional when mount with workload identity token by @k8s-infra-cherrypick-robot in #2275
• [release-1.27] fix: CVE-2025-13281 by @andyzhangx in #2278
• [release-1.27] chore: upgrade csi-provisioner to v6.1.0 by @andyzhangx in #2283
• [release-1.27] fix: remove global lock from blobfuse proxy service by @k8s-infra-cherrypick-robot in #2286
• [release-1.27] chore: increase blobfuse mount timeout by @k8s-infra-cherrypick-robot in #2289
• doc: cut v1.27.1 release by @andyzhangx in #2291

Full Changelog: v1.27.0...v1.27.1

v1.26.8 release

What's Changed

• [release-1.26] test: ignore latest tgz file in helm chart index verification by @k8s-infra-cherrypick-robot in #2145
• [release-1.26] fix: CVE-2025-5187 by @andyzhangx in #2152
• [release-1.26] fix: respect secretName during volume creation by @k8s-infra-cherrypick-robot in #2154
• [release-1.26] fix: China cloud endpoints by @k8s-infra-cherrypick-robot in #2165
• [release-1.26] fix(proxy_installer): add necessary mounts for cos, gardenlinux bin paths by @andyzhangx in #2174
• [release-1.26] test: refine verify-helm-chart-index.sh by @k8s-infra-cherrypick-robot in #2178
• [release-1.26] chore(deps): bump build-image/debian-base from bookworm-v1.0.5 to bookworm-v1.0.6 in /pkg/blobplugin by @k8s-infra-cherrypick-robot in #2182
• [release-1.26] chore: upgrade azcopy to v10.30.1 by @k8s-infra-cherrypick-robot in #2186
• [release-1.26] fix: blobfuse-proxy install on OpenShift 4.19 by @k8s-infra-cherrypick-robot in #2195
• [release-1.26] feat: install blobfuse 2.5.1 as default version by @andyzhangx in #2207
• [release-1.26] fix: install blobfuse2 binary failure on rhcos by @k8s-infra-cherrypick-robot in #2212
• [release 1.26] 🌈 Feature: Add support for Flatcar Container Linux by @t-lo in #2214
• [release-1.26] test: fix CVE-2025-47912 error by @k8s-infra-cherrypick-robot in #2224
• [release-1.26] 🐞 fix: shasum in blobfuse-proxy installer for Flatcar, fix PATH in blobfuse-proxy.service by @k8s-infra-cherrypick-robot in #2222
• [release-1.26] chore: upgrade azcopy to v10.31.0 by @k8s-infra-cherrypick-robot in #2228
• [release-1.26] fix: skip chmod setting in readonly mode by @k8s-infra-cherrypick-robot in #2233
• [release-1.26] chore: upgrade sidecar image versions by @andyzhangx in #2236
• [release-1.26] Revert "fix: respect secretName during volume creation" by @k8s-infra-cherrypick-robot in #2239
• [release-1.26] fix: CVE-2025-52881 by @andyzhangx in #2243
• [release-1.26] fix: snapshot restore and volume clone failure in some new sovereign … by @k8s-infra-cherrypick-robot in #2252
• [release-1.26] chore: upgrade AzureAD lib by @k8s-infra-cherrypick-robot in #2255
• [release-1.26] fix: CVE-2025-58181 by @andyzhangx in #2259
• [release-1.26] test: fix trivy CVE-2025-61727 by @k8s-infra-cherrypick-robot in #2266
• [release-1.26] fix: CVE-2025-13281 by @andyzhangx in #2279
• [release-1.26] chore: upgrade csi-provisioner to v6.1.0 by @andyzhangx in #2284
• doc: cut v1.26.8 release by @andyzhangx in #2290

Full Changelog: v1.26.7...v1.26.8

v1.25.10 release

What's Changed

• [release-1.25] cleanup: decrease parsing volumeID log level by @k8s-infra-cherrypick-robot in #2075
• [release-1.25] cleanup: fix incorrect logging info when volume is already mounted by @k8s-infra-cherrypick-robot in #2080
• [release-1.25] feat: use kubelet identity by default in msi auth by @k8s-infra-cherrypick-robot in #2083
• [release-1.25] feat: install blobfuse 2.5.0 as default version by @andyzhangx in #2088
• [release-1.25] fix: CVE-2025-22868 by @andyzhangx in #2092
• [release-1.25] feat: support blobStorageAccountType parameter in storage class or pv by @andyzhangx in #2104
• [release-1.25] test: fix CVE-2025-47907 traivy test failure by @k8s-infra-cherrypick-robot in #2115
• [release-1.25] chore: upgrade azcopy to v10.30.0 by @k8s-infra-cherrypick-robot in #2120
• [release-1.25] test: ignore latest tgz file in helm chart index verification by @k8s-infra-cherrypick-robot in #2146
• [release-1.25] fix: CVE-2025-5187 by @andyzhangx in #2153
• [release-1.25] fix: respect secretName during volume creation by @k8s-infra-cherrypick-robot in #2155
• [release-1.25] fix: China cloud endpoints by @andyzhangx in #2166
• [release-1.25] test: refine verify-helm-chart-index.sh by @k8s-infra-cherrypick-robot in #2179
• [release-1.25] chore(deps): bump build-image/debian-base from bookworm-v1.0.5 to bookworm-v1.0.6 in /pkg/blobplugin by @k8s-infra-cherrypick-robot in #2183
• [release-1.25] chore: upgrade azcopy to v10.30.1 by @k8s-infra-cherrypick-robot in #2187
• doc: cut v1.25.10 release by @andyzhangx in #2190

Full Changelog: v1.25.9...v1.25.10

v1.27.0 release

What's Changed

• doc: cut v1.26.0 release by @andyzhangx in #1853
• fix: avoid duplicate ssl mounts on Fedora node in AzureStack environment by @andyzhangx in #1872
• doc: update new chart versions by @andyzhangx in #1876
• chore: increase liveness-probe timeout by @andyzhangx in #1878
• chore(deps): bump k8s.io/mount-utils from 0.32.2 to 0.32.3 in the k8s group by @dependabot[bot] in #1881
• test: ignore CVE-2025-22870 in azcopy by @andyzhangx in #1882
• feat: support workload identity by @cvvz in #1798
• test: ut for parseServiceAccountToken by @cvvz in #1890
• chore: upgrade azure cloud provider lib by @andyzhangx in #1894
• feat: add metrics on node config by @andyzhangx in #1896
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.23.0 to 2.23.2 by @dependabot[bot] in #1902
• fix: CVE-2025-30204 by @andyzhangx in #1905
• chore(deps): bump google.golang.org/protobuf from 1.36.5 to 1.36.6 by @dependabot[bot] in #1909
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.23.2 to 2.23.3 by @dependabot[bot] in #1911
• chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault from 1.4.0 to 1.5.0 by @dependabot[bot] in #1913
• chore: upgrade azcopy to v10.28.1 by @andyzhangx in #1914
• chore(deps): bump github.com/onsi/gomega from 1.36.2 to 1.36.3 by @dependabot[bot] in #1919
• chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 by @dependabot[bot] in #1924
• doc: update new chart versions by @andyzhangx in #1925
• fix: storageEndPointSuffix setting in on-prem cluster by @andyzhangx in #1927
• chore(deps): bump github.com/onsi/gomega from 1.36.3 to 1.37.0 by @dependabot[bot] in #1930
• chore(deps): bump golang.org/x/sync from 0.12.0 to 0.13.0 by @dependabot[bot] in #1931
• test: fix CVE-2025-22871 in trivy action by @andyzhangx in #1933
• chore(deps): bump golang.org/x/net from 0.38.0 to 0.39.0 by @dependabot[bot] in #1932
• doc: add ClientID parameter in doc by @andyzhangx in #1938
• fix: allow clientID, tenantID workload identity parameters in storage class by @andyzhangx in #1939
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 by @dependabot[bot] in #1943
• cleanup: remove deprecated wait.PollImediate function by @andyzhangx in #1944
• chore(deps): bump go.uber.org/mock from 0.5.0 to 0.5.1 by @dependabot[bot] in #1946
• fix: goroutine leak when timeout by @cvvz in #1947
• fix: grpc connection was not closed properly by @cvvz in #1951
• test: ignore CVE-2025-22872 in azcopy by @andyzhangx in #1960
• chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage from 1.7.0 to 1.8.0 by @dependabot[bot] in #1959
• chore(deps): bump k8s.io/mount-utils from 0.32.3 to 0.32.4 in the k8s group by @dependabot[bot] in #1962
• fix: incorrect metris log in NodeStageVolume by @andyzhangx in #1964
• feat: add VerticalPodAutoscaler to blob csi controller pod by @umagnus in #1971
• doc: Remove the obsolete comment by @mathieu-clnk in #1970
• chore: upgrade k8s.io/mount-utils by @andyzhangx in #1972
• cleanup: refine Dockerfile by @andyzhangx in #1973
• chore: upgrade azcopy to v10.29.0 by @andyzhangx in #1974
• chore(deps): bump go.uber.org/mock from 0.5.1 to 0.5.2 by @dependabot[bot] in #1979
• test: add UT coverage for blob/nodeserver.go by @Zhupku in #1980
• doc: fix volumeHandle doc by @andyzhangx in #1981
• chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 by @dependabot[bot] in #1984
• feat: add VNetLinkName and PublicNetworkAccess in account creation by @andyzhangx in #1983
• chore(deps): bump golang.org/x/net from 0.39.0 to 0.40.0 by @dependabot[bot] in #1990
• fix: add mountWithWorkloadIdentityToken parameter by @andyzhangx in #1988
• doc: update tips for fsGroupChangePolicy parameter setting by @andyzhangx in #1996
• cleanup: disable version check in blobfuse2 driver by default by @andyzhangx in #1994
• test: add UT coverage for blob/nodeserver.go by @Zhupku in #2001
• doc: update new chart versions by @andyzhangx in #2002
• chore(deps): bump k8s.io/mount-utils from 0.33.0 to 0.33.1 in the k8s group by @dependabot[bot] in #2004
• chore: upgrade to aznfs v2.0.12 by @andyzhangx in #2006
• cleanup: remove unused getCloudEnvironment func by @andyzhangx in #2005
• fix: csi driver metrics to collect errors by @andyzhangx in #2008
• chore: upgrade azcopy to v10.29.1 by @andyzhangx in #2010
• Revert "cleanup: disable version check in blobfuse2 driver by default" by @andyzhangx in #2019
• cleanup: disable version check in blobfuse2 driver by default by @andyzhangx in #2024
• chore(deps): bump golang.org/x/sync from 0.14.0 to 0.15.0 by @dependabot[bot] in #2026
• chore(deps): bump golang.org/x/net from 0.40.0 to 0.41.0 by @dependabot[bot] in #2027
• chore: migrate csi-resizer sidecar image to dalec image by @andyzhangx in #2028
• chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets from 1.3.1 to 1.4.0 by @dependabot[bot] in #2031
• test: fix CVE-2025-4673 in trivy action by @andyzhangx in #2032
• chore: migrate csi driver sidecar images to dalec images by @andyzhangx in #2042
• fix: only use the permission bits for chmod by @nearora-msft in #2041
• chore(deps): bump build-image/debian-base from bookworm-v1.0.4 to bookworm-v1.0.5 in /pkg/blobplugin by @dependabot[bot] in #2045
• chore(deps): bump github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus from 1.0.1 to 1.1.0 by @dependabot[bot] in #2044
• fix: CVE-2025-4563 by @andyzhangx in #2053
• chore(deps): bump k8s.io/mount-utils from 0.33.1 to 0.33.2 in the k8s group by @dependabot[bot] in #2051
• chore(deps): bump sigs.k8s.io/yaml from 1.4.0 to 1.5.0 by @dependabot[bot] in #2055
• fix: don't change subnet.PrivateEndpointNetworkPolicies if it's already set by @andyzhangx in #2056
• chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage from 1.8.0 to 1.8.1 by @dependabot[bot] in #2057
• chore(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 b...

v1.26.7 release

What's Changed

• [release-1.26] cleanup: decrease parsing volumeID log level by @k8s-infra-cherrypick-robot in #2074
• [release-1.26] cleanup: fix incorrect logging info when volume is already mounted by @k8s-infra-cherrypick-robot in #2079
• [release-1.26] feat: use kubelet identity by default in msi auth by @k8s-infra-cherrypick-robot in #2082
• [release-1.26] feat: install blobfuse 2.5.0 as default version by @andyzhangx in #2087
• [release-1.26] chore: allow package install downgrade by default by @andyzhangx in #2090
• [release-1.26] fix: CVE-2025-22868 by @andyzhangx in #2091
• [release-1.26] cleanup: refine Dockerfile by @k8s-infra-cherrypick-robot in #2096
• [release-1.26] Revert "fix: ignore specific blobfuse version install failure" by @k8s-infra-cherrypick-robot in #2100
• [release-1.26] feat: support blobStorageAccountType parameter in storage class or pv by @andyzhangx in #2103
• [release-1.26] test: fix CVE-2025-47907 traivy test failure by @k8s-infra-cherrypick-robot in #2114
• [release-1.26] chore: upgrade azcopy to v10.30.0 by @k8s-infra-cherrypick-robot in #2119
• [release-1.26] cleanup: add more logging in blobfuse-proxy when blobfuse2 not found by @k8s-infra-cherrypick-robot in #2131
• [release-1.26] fix: support blobfuse2 install for GKE cos node by @k8s-infra-cherrypick-robot in #2132
• [release-1.26] chore: upgrade CSI driver sidecar images by @andyzhangx in #2136
• [release-1.26] feat: support blobfuse2 preview package install by @k8s-infra-cherrypick-robot in #2139
• doc: cut v1.26.7 release by @andyzhangx in #2140

Full Changelog: v1.26.6...v1.26.7

v1.26.6 release

What's Changed

• [release-1.26] cleanup: disable version check in blobfuse2 driver by default by @k8s-infra-cherrypick-robot in #2025
• [release-1.26] chore: migrate csi-resizer sidecar image to dalec image by @andyzhangx in #2029
• [release-1.26] test: fix CVE-2025-4673 in trivy action by @k8s-infra-cherrypick-robot in #2033
• [release-1.26] chore: migrate csi driver sidecar images to dalec images by @andyzhangx in #2043
• [release-1.26] fix: only use the permission bits for chmod by @k8s-infra-cherrypick-robot in #2046
• [release-1.26] chore(deps): bump build-image/debian-base from bookworm-v1.0.4 to bookworm-v1.0.5 in /pkg/blobplugin by @k8s-infra-cherrypick-robot in #2047
• [release-1.26] fix: CVE-2025-4563 by @andyzhangx in #2054
• [release-1.26] chore: fix helm chart index on release-1.26 by @andyzhangx in #2058
• doc: cut v1.26.6 release by @andyzhangx in #2063

Full Changelog: v1.26.5...v1.26.6

v1.25.9 release

What's Changed

• [release-1.25] chore: migrate csi-resizer sidecar image to dalec image by @andyzhangx in #2030
• [release-1.25] test: fix CVE-2025-4673 in trivy action by @k8s-infra-cherrypick-robot in #2034
• [release-1.25] test: fix golint errors by @andyzhangx in #2037
• [release-1.25] chore(deps): bump build-image/debian-base from bookworm-v1.0.4 to bookworm-v1.0.5 in /pkg/blobplugin by @k8s-infra-cherrypick-robot in #2048
• [release-1.25] chore: fix helm chart index on release-1.25 by @andyzhangx in #2059
• doc: cut v1.25.9 release by @andyzhangx in #2062

Full Changelog: v1.25.8...v1.25.9

v1.24.11 release

What's Changed

• [release-1.24] test: fix CVE-2025-4673 in trivy action by @k8s-infra-cherrypick-robot in #2035
• [release-1.24] test: fix golint errors by @andyzhangx in #2038
• [release-1.24] chore(deps): bump build-image/debian-base from bookworm-v1.0.4 to bookworm-v1.0.5 in /pkg/blobplugin by @k8s-infra-cherrypick-robot in #2049
• [release-1.24] chore: fix helm chart index on release-1.24 by @andyzhangx in #2060
• doc: cut v1.24.11 release by @andyzhangx in #2061

Full Changelog: v1.24.10...v1.24.11