The agent reports what kind of Kubernetes cluster it runs on and sends the cluster inventory as soon as it connects, starts under restricted Pod Security and on OpenShift, and picks up five HTTP/2 security fixes in a shipped dependency; two breaking changes concern the shipped Kubernetes manifests and the Docker Hub tags.
Breaking changes
This release contains breaking changes. Read the upgrade notes below before upgrading.
Read the marker, not the version number. Version numbers do not carry a semver major warning: a breaking change can ship in a minor release. Rely on the breaking-change marker, not on the version number.
The collector fleet DaemonSet in the agent's Kubernetes manifests now limits the supervisor container to 500m CPU / 512Mi memory and requests 100m / 256Mi.
Detected in the release
Before you upgrade
WHO IS AFFECTED. Clusters where you re-apply the collector fleet manifest shipped with the agent. Pods already running are untouched until you re-apply. In a namespace without a LimitRange the supervisor ran unbounded before.
BEFORE YOU RE-APPLY:
- Run kubectl top pod -n linkmesh-system and compare each collector's usage with the new limits (500m CPU, 512Mi memory) and requests (100m, 256Mi).
- If a collector on a busy node uses more than 512Mi it would now be OOM-killed: raise the limits in the manifest before applying.
- If a node does not have 100m CPU and 256Mi memory free, its pod stays Pending: free capacity or lower the requests.
docker.io/opensight/linkmesh-agent:edge stops updating; only released agent versions appear on Docker Hub, and the shipped Kubernetes DaemonSet manifest now uses :latest.
Detected in the release
Before you upgrade
WHO IS AFFECTED. Anyone pulling docker.io/opensight/linkmesh-agent:edge (or :edge-amd64 / :edge-arm64) or an unreleased agent version from Docker Hub. Those tags stop updating, and new agent versions appear on Docker Hub only when they are released.
WHAT TO DO:
- Switch to :latest, or pin a released version such as 1.82.2.
- If you keep your own copy of the Kubernetes DaemonSet manifest, note that the shipped one now uses :latest; pin a version there if you prefer controlled upgrades.
Security updates
No security updates in this release.
Fixes
- S-5312 S-5507 S-5208The agent and collector fleet manifests start on OpenShift under its default security constraints and in namespaces that enforce restricted Pod Security, and the fleet declares its resource requests and limits.
- S-5403The Kubernetes inventory reports a pod as ready from its Ready condition.
- S-5415Security: golang.org/x/net updated to v0.60.0, which fixes five HTTP/2 issues (CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032).
- S-4482Only released agent versions are published to Docker Hub.
Features and improvements
- S-5270On Kubernetes the agent reports the cluster's platform signals, so the server can name EKS, RKE2, k3s and kubeadm, and sends the cluster inventory as soon as it connects.
- S-5128Live Capture on Kubernetes runs through the agent on the collector's own node, with a summary mode.
- S-5129 S-5125The collector fleet's role grants node metrics access for the kubelet and cAdvisor scrape sources, and covers the owner chain the server's workload enrichment reads.
19 further changes — build and test work, internal refactoring, and changes with no effect you could observe — were reviewed and deliberately left out.
4 other dependency updates in shipped components, with no security relevance.