What's Changed

OpenKruise v1.9.2 Release Notes

Bug-fix and security release for the v1.9 line, cherry-picked onto release-1.9 on top of v1.9.1.

Disable pprof by default in kruise-manager and kruise-daemon — #2613 by @furykerry
The pprof endpoints were enabled by default and bound to all interfaces (:8090 manager, :10222 daemon) with no auth or TLS. Any pod on the cluster network could reach them and drive the manager into resource exhaustion; since the same process serves OpenKruise's fail-closed admission webhooks, that could block pod creation cluster-wide. --enable-pprof now defaults to false.

WorkloadSpread: prevent panic on nil spec.parallelism and replicas — #2568 by @neo0007777 (fixes #2523, #2569)
A batch/v1.Job without spec.parallelism set crashed the controller manager with a nil pointer dereference; Deployment/StatefulSet/ReplicaSet/CloneSet with unset replicas could trigger the same. Now safely defaults to 1 via ptr.Deref(..., 1), including in the shared controllerfinder package.
PodUnavailableBudget: prevent panic on nil Spec.Replicas during update event — #2529 by @vishalmore90
NodePodProbe: fix nil labels panic — #2500 by @Jayant-kernel

Fix occasional restarts of kruise-controller-manager — #2382 by @PersistentJZH
Registers built-in API field indexes first and fails fast for them, while retrying CRD field-index registration when discovery has not yet observed the resource.
AdvancedCronJob: watch batchv1.Job with owner AdvancedCronJob instead of BroadcastJob — #2594 by @bhuvan-somisetty (fixes #2593)
The wrong owner type caused controller-runtime to reject all child-Job events, leaving status.active stale and postponing history-limit cleanup.
DaemonSet: handle legacy owner reference versions — #2518 by @Colvin-Y (fixes #2517)
Resolves Pod owner references by Group and Kind so v1alpha1-created Pods continue to enqueue the v1beta1 controller after upgrade; skips parsing for unrelated controllers' owner refs.
CloneSet: fix Pods remaining NotReady when UpdateStrategy is OnDelete — #2291 by @zmberg
ImagePullJob: join image name and digest with @ instead of : — #2556 by @qnduncan
Recombination sites used :, producing invalid references like name:sha256:...; any ImagePullJob whose spec.image carried a digest failed on every node until backoffLimit was exhausted. Adds daemonutil.JoinImageNameTag and fixes the CRI pull paths, ContainsImage, secret auth-info parsing, and related logs/events/status.

Calculator: reject malformed numbers instead of reading them as 0 — #2595 by @anishmehta24
UnitedDeployment: format dereferenced replicas count in validation error — #2597 by @bhuvan-somisetty
expectedReplicas (an *int32) was printed with %d without dereferencing, showing a memory address in admission errors.
PodProbeMarker: correct field paths in validation webhook — #2602 by @bhuvan-somisetty
Paths are now properly indexed slice paths (e.g. spec.probes[i].probe, spec.probes[i].markerPolicy[j]) instead of flat root paths.

Bump golangci-lint-action to v9.3.0 — fixes cache-restore failure from v8.0.0's dependency-cache logic.
Bump trivy-action to v0.36.0 — the floating master-branch pin defaulted to trivy v0.65.0, which was deleted upstream (HTTP 404), failing the lint job on every PR.

go build ./...
go vet on all changed packages
Unit tests for changed packages pass
Note: TestMatchRegistryAuths/test_credential_plugin_if_matched fails identically on base release-1.9 (environmental — requires a credential-plugin binary); unrelated to this PR.

Full Changelog: v1.9.1...v1.9.2