v1.24 release

Announcing Knative v1.24 Release¶

A new version of Knative is now available across multiple components.

Follow the instructions in Installing Knative to install the components you require.

Deprecations and retiring components

As part of a community repository review, the following integrations are deprecated and their repositories will be archived:

autoscaler-keda
backstage-plugins (including the Event Mesh plugin)
discovery
eventing-autoscaler-keda
func-tastic (template repository for func create)
kn-plugin-sample
kn-plugin-service-log
kn-plugin-source-kamelet
security-guard (including QPOptions)

Existing release binaries, images, and installation assets are preserved. The Knative Operator will emit a non-blocking status warning when Security Guard is enabled, and the setting will become a no-op in Operator v1.25. If you rely on any of these components, see knative/community#1802 for details and alternatives.

Highlights¶

Kafka runtime sidecar in Functions, enabling language-agnostic Kafka event sourcing with TLS/SASL support and KEDA consumer-lag scaling
Maximum backoff duration for Eventing delivery retries, giving finer control over retry behavior
OAUTHBEARER support in the Kafka Broker, propagating SASL JAAS configuration from auth secrets
Generic resource patches in the Operator, plus new Helm chart options and multicluster improvements
Deprecation of inactive integrations following the community repository review

Minimal supported version of Kubernetes is 1.35. See our release schedule for details.

Serving¶

Release notes: Knative Serving 1.24

This release is primarily a maintenance release with a DomainMapping traffic improvement.

Route Traffic for DomainMappings

DomainMappings can now copy the first matching cluster-local HTTP paths from the referenced Knative Service or Route into the DomainMapping Ingress, preserving the last-known-good configuration when the source is unavailable (#16685 by @kahirokunn). The behavior is opt-in through the domainmapping-direct-route-traffic flag in config-features and defaults to Disabled.

Kubernetes 1.36 and 1.37 in E2E

The kind E2E test matrix now includes Kubernetes 1.36 and 1.37 (#16713 by @dsimansk), validating Serving against upcoming Kubernetes releases.

Serving Networking Extensions¶

net-contour¶

Release notes: net-contour 1.24

Endpoint Probe Improvements

Backend ports and host rewrites are now preserved in endpoint probes (#1301 by @kahirokunn), fixing readiness checks for services that rewrite the Host header.

net-gateway-api¶

Release notes: net-gateway-api 1.24

Endpoint Probe Improvements

Host rewrites are now preserved in endpoint probes (#988 by @kahirokunn), aligning behavior with the other networking extensions.

Testing and Cleanup

Unit tests have been added for isHTTPRouteReady and isGatewayAdmitted (#983 by @brucearctor), and stale knative-sandbox organization references have been fixed (#982 by @brucearctor).

net-istio¶

Release notes: net-istio 1.24

A maintenance release with dependency updates and kind E2E tests on Kubernetes 1.35 and 1.36.

net-kourier¶

Release notes: net-kourier 1.24

A maintenance release with dependency updates and kind E2E tests on Kubernetes 1.35 and 1.36.

Eventing¶

Release notes: Knative Eventing 1.24

This release focuses on delivery retry improvements and reliability fixes.

Maximum Backoff Duration for Delivery Retries

A maximum backoff duration can now be configured for event delivery retries (#9279 by @kahirokunn), capping exponential backoff for retriable delivery spec fields, covered by E2E tests through Triggers (#9330 by @kahirokunn).

Bug Fixes

A duplicate reply deadlock in RequestReply has been fixed (#9191 by @rootp1)
Double injection of trust-bundle CA volumes in the reconcile loop has been fixed (#9260 by @dsimansk)
Deleted Subscriptions are now dropped from the tracker (#9421 by @pujitha24)
The first linear retry now waits one backoff delay before firing (#9425 by @kahirokunn)

Dependencies

The cert-manager libraries and resources have been updated to 1.20.3 (#9259 by @dsimansk).

Eventing Extensions¶

Apache Kafka Broker¶

Release notes: Kafka Broker 1.24

This release brings OAUTHBEARER support and multiple consumer group reliability fixes.

OAUTHBEARER Support

sasl.jaas.config and sasl.login.callback.handler.class are now propagated from the auth secret for OAUTHBEARER authentication (#4789 by @dmetzler), enabling OAuth-based authentication against Kafka clusters.

Consumer Group Reliability

Orphaned Kafka groups on ConsumerGroup deletion are now prevented (#4785 by @qaiser42)
Orphaned Kafka consumers that block ConsumerGroup finalization under load have been fixed (#4799 by @simkam)
The reconciler now requeues at a fixed interval while the consumer group is not empty (#4828 by @gauron99)

Bug Fixes

The tracing context is now isolated per record in the unordered consumer (#4800 by @jrangelramos)
The KafkaChannel subscriber ServiceAccount check now uses the configured system namespace (#4778 by @pujitha24)

RabbitMQ Broker and Source¶

Release notes: RabbitMQ 1.24

A maintenance release with dependency updates.

Functions¶

Release notes: Functions 1.24

A substantial release with a language-agnostic Kafka runtime, git-based deployments, and continued MCP server growth.

Language-Agnostic Kafka Runtime Sidecar

Kafka event sourcing is no longer limited to Go: functions of any runtime can consume Kafka events via a runtime sidecar (#4060 by @aliok), pinned to the released v0.1.0 image (#4095 by @aliok). The sidecar includes a startup probe (#4103 by @aliok) and a fix for volume mounts at a certificate path's parent directory (#4101 by @aliok).

Kafka TLS/SASL and KEDA Scaling

Kafka functions now support TLS and SASL authentication (#3975 by @aliok), and KEDA-based consumer-lag scaling is available via scale.keda (#4069 by @aliok), including RBAC grants for Kafka scalers (#4077 by @aliok).

Deploy from a Git Repository

Functions can now be deployed directly from a git repository without a local checkout (#4064 by @gauron99), with the remote source nameable via --source, --source-dir, and --revision (#4048 by @gauron99). Pipelines now ship the effective config inside the source upload (#3919 by @gauron99).

Top-Level scale Field in func.yaml

A top-level scale field has been added to func.yaml (#4063 by @aliok), collecting scaling settings such as scale.keda in one place.

func list Improvements

The RUNTIME column is now populated in func list (#4010 by @pmeida), and the replica count of deployed functions is shown (#4011 by @pmeida).

MCP Server Improvements

The MCP server gained many new tools: config_ci for CI/CD workflow generation (#3997), repository management (#3823), describe (#3995), invoke (#3986), run and run_stop (#3998), a version tool (#3996), a logs tool for deployed functions (#3819), structured JSON output from list (#4001), git config tools (#3818), and a parameterized onboard prompt (#4021) — mostly by @Ankitsinghsisodya. Read-only mode is now enforced in more handlers, blocking build --push (#3828 by @Ankitsinghsisodya, #3708 by @Elvand-Lie).

Cluster and Registry Improvements

func clusters migrated its registry from the host container to an in-cluster deployment (#3856 by @lkingland), installs act for local GitHub Actions runs (#3968 by @lkingland), and waits for the CoreDNS rollout during cluster creation (#4038 by @gauron99). Azure Container Registry login now uses the Azure SDK to obtain credentials and tokens (#3398 by @dbalseiro), and a single dockerconfigjson registry Secret is now shared by remote builds and the func-operator (#4082 by @gauron99).

Bug Fixes

Malformed subscribe filters are now rejected (#4036 by @axhatggg)
File modes are normalized in the Python image layer (#4037 by @matejvasek)
Orphaned local-run directories are cleaned up (#3989 by @Elvand-Lie)

Client¶

Release notes: Client 1.24

API Improvements

WatchServiceWithVersion is now exposed on the KnServingClient interface (#2274 by @cvas22), allowing library consumers to watch services for a specific Serving version.

Bug Fixes

An error is now returned instead of panicking on a valueless mount option (#2271 by @arpitjain099)
The sink type is formatted with %v instead of %q (#2276 by @gauron99)

Operator¶

Release notes: Operator 1.24

This release adds generic resource patches, Helm chart options, and multicluster improvements.

Generic Resource Patches

Knative resources can now be patched generically via the Operator spec (#2337 by @kahirokunn), reducing the need for specialized patching fields.

Helm Chart Improvements

The knative-operator chart now supports extraObjects (#2342 by @aqeelat), a configurable webhook replica count (#2353 by @kahirokunn), and an exposed nodeSelector (#2358 by @magic-peach).

Multicluster Improvements

The Operator migrated to Cluster Inventory API v0.2.0 (#2361 by @kahirokunn), installs remote Knative components in canonical namespaces (#2349 by @kahirokunn), makes multicluster CRD waits resilient (#2338 by @kahirokunn), and guards Knative readiness predicates against failed reads (#2348 by @kahirokunn).

Bug Fixes

The Kourier bootstrap namespace has been fixed (#2336 by @kahirokunn)
The Kafka 1.23 generated manifests have been updated (#2346 by @kahirokunn)

Thank you, contributors¶

Release Leads:

New Contributors 🎉:

Learn more¶

Knative is an open source project that anyone in the community can use, improve, and enjoy. We'd love you to join us!