kubernetes-sigs · MaxRink · Jul 5, 2026 · Jul 5, 2026 · Jul 17, 2026 · Aug 11, 2026
diff --git a/images/capi/Makefile b/images/capi/Makefile
@@ -1258,8 +1258,12 @@ update-all-iso-checksums: update-ubuntu-iso-checksums \
 
 update-all-iso-checksums: ## Updates checksums for all ISOs
 
+.PHONY: update-ubuntu-iso-urls
+update-ubuntu-iso-urls: ## Updates Ubuntu ISO URLs to latest point releases
+	hack/update-ubuntu-iso-urls.sh
+
 .PHONY: update-ubuntu-iso-checksums
-update-ubuntu-iso-checksums: ## Updates checksums for Ubuntu ISOs
+update-ubuntu-iso-checksums: update-ubuntu-iso-urls ## Updates URLs and checksums for Ubuntu ISOs
 	hack/update-iso-checksums.sh ubuntu false SHA256SUMS "*iso_file_name" 1
 	$(MAKE) json-sort
 

diff --git a/images/capi/hack/update-iso-checksums.sh b/images/capi/hack/update-iso-checksums.sh
@@ -24,22 +24,29 @@ _checksum_file=${3:-}
 _checksum_search_pattern=${4:-}
 _checksum_position=${5:-}
 
-_configs_with_iso_url=($(grep -ilR "iso_url" packer/**/*${_os}*.json))
+_configs_with_iso_url=()
+while IFS= read -r -d '' file; do
+    _configs_with_iso_url+=("${file}")
+done < <(find packer -type f -name "*${_os}*.json" -print0)
 
 for file in "${_configs_with_iso_url[@]}"; do
-    iso_url=$(jq -r ".iso_url" $file)
-    iso_checksum_type=$(jq -r ".iso_checksum_type" $file)
-    if [ -z "$iso_checksum_type" ]; then
-        iso_checksum_type=sha256
+    iso_url=$(jq -r ".iso_url // empty" "${file}")
+    [[ -n "${iso_url}" ]] || continue
+
+    iso_file_name=$(basename "${iso_url}")
+    if [[ "${iso_file_name}" != *.iso ]]; then
+        echo "Skipping non-ISO artifact ${iso_url}"
+        continue
     fi
+
+    iso_checksum_type=$(jq -r '.iso_checksum_type // "sha256"' "${file}")
     if [[ "${_compute_checksum}" = "true" ]]; then
-        iso_checksum=$(curl -SsL  $iso_url | ${iso_checksum_type}sum | awk '{print $1}')
+        iso_checksum=$(curl -SsL "${iso_url}" | "${iso_checksum_type}"sum | awk '{print $1}')
     else
-        iso_file_name=$(basename $iso_url)
-        sha256sums_url="$(dirname $iso_url)/${_checksum_file}"
+        sha256sums_url="$(dirname "${iso_url}")/${_checksum_file}"
         _checksum_search_pattern=${4/iso_file_name/$iso_file_name}
-        iso_checksum=$(curl -SsL $sha256sums_url | grep "${_checksum_search_pattern}" | awk -v col=$_checksum_position '{print $col}')
+        iso_checksum=$(curl -SsL "${sha256sums_url}" | grep "${_checksum_search_pattern}" | awk -v col="${_checksum_position}" '{print $col}')
     fi
     tmp=$(mktemp)
-    jq --arg iso_checksum $iso_checksum --arg iso_checksum_type ${iso_checksum_type} '.iso_checksum = $iso_checksum | .iso_checksum_type = $iso_checksum_type' $file > "$tmp" && mv "$tmp" $file
+    jq --arg iso_checksum "${iso_checksum}" --arg iso_checksum_type "${iso_checksum_type}" '.iso_checksum = $iso_checksum | .iso_checksum_type = $iso_checksum_type' "${file}" > "${tmp}" && mv "${tmp}" "${file}"
 done
diff --git a/images/capi/hack/update-ubuntu-iso-urls.sh b/images/capi/hack/update-ubuntu-iso-urls.sh
@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+cache_dir="$(mktemp -d)"
+trap 'rm -rf "${cache_dir}"' EXIT
+
+find_latest_iso() {
+    local series=$1
+    local arch=$2
+    local checksum_url=$3
+    local url_style=$4
+    local cache_key="${series}-${arch}-${url_style}"
+    local checksum_data
+    local checksum_data_file
+    local http_status
+    local latest_entry
+    local latest_version
+
+    if [[ -s "${cache_dir}/${cache_key}.file" ]]; then
+        latest_iso_file="$(cat "${cache_dir}/${cache_key}.file")"
+        latest_iso_checksum="$(cat "${cache_dir}/${cache_key}.checksum")"
+        latest_iso_url="$(cat "${cache_dir}/${cache_key}.url")"
+        return 0
+    fi
+
+    if [[ -e "${cache_dir}/${cache_key}.skip" ]]; then
+        return 1
+    fi
+
+    checksum_data_file="${cache_dir}/${cache_key}.raw"
+    if ! http_status="$(curl -sSL -o "${checksum_data_file}" -w '%{http_code}' "${checksum_url}")"; then
+        echo "ERROR: network error fetching ${checksum_url}" >&2
+        exit 1
+    fi
+
+    if [[ "${http_status}" == "404" ]]; then
+        echo "WARNING: ${checksum_url} returned 404; Ubuntu ${series} has no point release yet; skipping ${arch}" >&2
+        touch "${cache_dir}/${cache_key}.skip"
+        return 1
+    fi
+
+    if [[ "${http_status}" != "200" ]]; then
+        echo "ERROR: ${checksum_url} returned HTTP ${http_status}" >&2
+        exit 1
+    fi
+
+    checksum_data="$(cat "${checksum_data_file}")"
+
+    latest_entry="$(
+        printf '%s\n' "${checksum_data}" |
+            awk -v series="${series}" -v arch="${arch}" '
+                $2 ~ "\\*ubuntu-" series "\\.[0-9]+-live-server-" arch "\\.iso$" {
+                    print $1, substr($2, 2)
+                }
+            ' |
+            sort -k2,2V |
+            tail -n1
+    )"
+
+    if [[ -z "${latest_entry}" ]]; then
+        echo "WARNING: ${checksum_url} has no point-release live-server ISO for Ubuntu ${series} ${arch}" >&2
+        touch "${cache_dir}/${cache_key}.skip"
+        return 1
+    fi
+
+    latest_iso_file="${latest_entry#* }"
+    latest_iso_checksum="${latest_entry%% *}"
+    latest_version="${latest_iso_file#ubuntu-}"
+    latest_version="${latest_version%-live-server-"${arch}".iso}"
+
+    case "${url_style}" in
+        releases)
+            latest_iso_url="https://releases.ubuntu.com/${latest_version}/${latest_iso_file}"
+            ;;
+        cdimage)
+            latest_iso_url="https://cdimage.ubuntu.com/releases/${latest_version}/release/${latest_iso_file}"
+            ;;
+        *)
+            echo "ERROR: unsupported Ubuntu ISO URL style: ${url_style}" >&2
+            return 1
+            ;;
+    esac
+
+    printf '%s\n' "${latest_iso_file}" > "${cache_dir}/${cache_key}.file"
+    printf '%s\n' "${latest_iso_checksum}" > "${cache_dir}/${cache_key}.checksum"
+    printf '%s\n' "${latest_iso_url}" > "${cache_dir}/${cache_key}.url"
+}
+
+while IFS= read -r -d '' file; do
+    iso_url="$(jq -r '.iso_url // empty' "${file}")"
+    [[ -n "${iso_url}" ]] || continue
+
+    iso_file_name="$(basename "${iso_url}")"
+    if [[ ! "${iso_file_name}" =~ ^ubuntu-([0-9]{2}\.[0-9]{2})(\.[0-9]+)?-live-server-(amd64|arm64)\.iso$ ]]; then
+        continue
+    fi
+
+    series="${BASH_REMATCH[1]}"
+    arch="${BASH_REMATCH[3]}"
+    case "${iso_url}" in
+        https://releases.ubuntu.com/*)
+            checksum_url="https://releases.ubuntu.com/${series}/SHA256SUMS"
+            url_style="releases"
+            ;;
+        https://cdimage.ubuntu.com/releases/*)
+            checksum_url="https://cdimage.ubuntu.com/releases/${series}/release/SHA256SUMS"
+            url_style="cdimage"
+            ;;
+        *)
+            continue
+            ;;
+    esac
+
+    find_latest_iso "${series}" "${arch}" "${checksum_url}" "${url_style}" || continue
+
+    current_checksum="$(jq -r '.iso_checksum // empty' "${file}")"
+    if [[ "${iso_url}" == "${latest_iso_url}" && "${current_checksum}" == "${latest_iso_checksum}" ]]; then
+        continue
+    fi
+
+    tmp="$(mktemp)"
+    jq \
+        --arg iso_url "${latest_iso_url}" \
+        --arg iso_checksum "${latest_iso_checksum}" \
+        --arg iso_file "${latest_iso_file}" \
+        '
+          .iso_url = $iso_url
+          | .iso_checksum = $iso_checksum
+          | .iso_checksum_type = (.iso_checksum_type // "sha256")
+          | if (.iso_target_path? | type) == "string" then
+              .iso_target_path |= sub("ubuntu-[0-9]+\\.[0-9]+(\\.[0-9]+)?-live-server-(amd64|arm64)\\.iso$"; $iso_file)
+            else
+              .
+            end
+        ' "${file}" > "${tmp}"
+    mv "${tmp}" "${file}"
+
+    echo "Updated ${file} to ${latest_iso_file}"
+done < <(find packer -type f -name '*ubuntu*.json' -print0)
diff --git a/images/capi/packer/maas/maas-ubuntu-2404-arm64.json b/images/capi/packer/maas/maas-ubuntu-2404-arm64.json
@@ -9,10 +9,10 @@
   "goss_arch": "arm64",
   "guest_os_type": "ubuntu-64",
   "http_directory": "./packer/maas/linux/ubuntu/http/24.04.arm64",
-  "iso_checksum": "2ee2163c9b901ff5926400e80759088ff3b879982a3956c02100495b489fd555",
+  "iso_checksum": "9a6ce6d7e66c8abed24d24944570a495caca80b3b0007df02818e13829f27f32",
   "iso_checksum_type": "sha256",
-  "iso_target_path": "/tmp/packer_cache/ubuntu-24.04.3-live-server-arm64.iso",
-  "iso_url": "https://cdimage.ubuntu.com/releases/24.04/release/ubuntu-24.04.3-live-server-arm64.iso",
+  "iso_target_path": "/tmp/packer_cache/ubuntu-24.04.4-live-server-arm64.iso",
+  "iso_url": "https://cdimage.ubuntu.com/releases/24.04.4/release/ubuntu-24.04.4-live-server-arm64.iso",
   "memory": "4096",
   "os_display_name": "Ubuntu 24.04",
   "shutdown_command": "shutdown -P now",

diff --git a/images/capi/packer/maas/maas-ubuntu-2404-efi.json b/images/capi/packer/maas/maas-ubuntu-2404-efi.json
@@ -7,7 +7,7 @@
   "guest_os_type": "ubuntu-64",
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
-  "iso_url": "https://releases.ubuntu.com/releases/24.04/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04",
   "shutdown_command": "shutdown -P now",
   "unmount_iso": "true"

diff --git a/images/capi/packer/ova/ubuntu-2404-efi.json b/images/capi/packer/ova/ubuntu-2404-efi.json
@@ -12,7 +12,7 @@
   "guest_os_type": "ubuntu-64",
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
-  "iso_url": "https://releases.ubuntu.com/noble/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04",
   "shutdown_command": "shutdown -P now",
   "vsphere_guest_os_type": "ubuntu64Guest"

diff --git a/images/capi/packer/ova/ubuntu-2404.json b/images/capi/packer/ova/ubuntu-2404.json
@@ -11,7 +11,7 @@
   "guest_os_type": "ubuntu-64",
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
-  "iso_url": "https://releases.ubuntu.com/noble/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04",
   "shutdown_command": "shutdown -P now",
   "vsphere_guest_os_type": "ubuntu64Guest"

diff --git a/images/capi/packer/proxmox/README.md b/images/capi/packer/proxmox/README.md
@@ -12,7 +12,7 @@ To use existing ISO files, set the `ISO_FILE` environment variable to the path o
 For example, to use a local ISO file, set the `ISO_FILE` environment variable like this:
 
 ```
-export ISO_FILE="local:iso/ubuntu-24.04.3-live-server-amd64.iso"
+export ISO_FILE="local:iso/ubuntu-24.04.4-live-server-amd64.iso"
 ```
 
 ## Flatcar for Proxmox

diff --git a/images/capi/packer/proxmox/ubuntu-2404-efi.json b/images/capi/packer/proxmox/ubuntu-2404-efi.json
@@ -7,7 +7,7 @@
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
   "iso_file": "{{env `ISO_FILE`}}",
-  "iso_url": "https://releases.ubuntu.com/noble/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04",
   "unmount_iso": "true",
   "version": "24.04"

diff --git a/images/capi/packer/proxmox/ubuntu-2404.json b/images/capi/packer/proxmox/ubuntu-2404.json
@@ -6,7 +6,7 @@
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
   "iso_file": "{{env `ISO_FILE`}}",
-  "iso_url": "https://releases.ubuntu.com/noble/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04",
   "source_image": "ubuntu-20-04-x64",
   "unmount_iso": "true",

diff --git a/images/capi/packer/qemu/qemu-ubuntu-2404-efi.json b/images/capi/packer/qemu/qemu-ubuntu-2404-efi.json
@@ -7,7 +7,7 @@
   "guest_os_type": "ubuntu-64",
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
-  "iso_url": "https://releases.ubuntu.com/releases/24.04/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04",
   "shutdown_command": "shutdown -P now",
   "unmount_iso": "true"

diff --git a/images/capi/packer/qemu/qemu-ubuntu-2404-immutable.json b/images/capi/packer/qemu/qemu-ubuntu-2404-immutable.json
@@ -16,7 +16,7 @@
   "immutable_tmpfs_paths": "/tmp,/var/tmp",
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
-  "iso_url": "https://releases.ubuntu.com/releases/24.04/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04 immutable",
   "shutdown_command": "shutdown -P now",
   "unmount_iso": "true"

diff --git a/images/capi/packer/qemu/qemu-ubuntu-2404.json b/images/capi/packer/qemu/qemu-ubuntu-2404.json
@@ -6,7 +6,7 @@
   "guest_os_type": "ubuntu-64",
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
-  "iso_url": "https://releases.ubuntu.com/releases/24.04/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04",
   "shutdown_command": "shutdown -P now",
   "unmount_iso": "true"

diff --git a/images/capi/packer/qemu/scripts/render_ubuntu_autoinstall_test.py b/images/capi/packer/qemu/scripts/render_ubuntu_autoinstall_test.py
@@ -204,6 +204,17 @@ def test_immutable_template_runs_cleanup_in_target(self):
         self.assertIn("curtin in-target --target=/target -- apt-get clean", template)
         self.assertNotIn("    - swapoff -a\n", template)
 
+    def test_immutable_qemu_target_uses_point_release_iso_url(self):
+        target = (
+            pathlib.Path(__file__).resolve().parents[1]
+            / "qemu-ubuntu-2404-immutable.json"
+        )
+
+        self.assertRegex(
+            json.loads(target.read_text(encoding="utf-8"))["iso_url"],
+            r"^https://releases\.ubuntu\.com/(24\.04\.\d+)/ubuntu-\1-live-server-amd64\.iso$",
+        )
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/images/capi/packer/raw/raw-ubuntu-2404-efi.json b/images/capi/packer/raw/raw-ubuntu-2404-efi.json
@@ -10,7 +10,7 @@
   "guest_os_type": "ubuntu-64",
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
-  "iso_url": "https://releases.ubuntu.com/releases/24.04/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04",
   "shutdown_command": "shutdown -P now",
   "unmount_iso": "true"

diff --git a/images/capi/packer/raw/raw-ubuntu-2404.json b/images/capi/packer/raw/raw-ubuntu-2404.json
@@ -9,7 +9,7 @@
   "guest_os_type": "ubuntu-64",
   "iso_checksum": "e907d92eeec9df64163a7e454cbc8d7755e8ddc7ed42f99dbc80c40f1a138433",
   "iso_checksum_type": "sha256",
-  "iso_url": "https://releases.ubuntu.com/releases/24.04/ubuntu-24.04.4-live-server-amd64.iso",
+  "iso_url": "https://releases.ubuntu.com/24.04.4/ubuntu-24.04.4-live-server-amd64.iso",
   "os_display_name": "Ubuntu 24.04",
   "shutdown_command": "shutdown -P now",
   "unmount_iso": "true"