Workload cluster release cloud-director-36.2.0 for CAPVCD
Changes compared to v36.1.1
Components
- cluster-cloud-director from v9.0.0 to v9.4.0
- cluster from v9.0.2 to v9.4.0
- Flatcar from v4757.2.1 to v4757.2.2
Added
- Apps: Add
providerIntegration.apps.<app>.extraConfigs so provider charts can add templated config maps or secrets to an app’s values. - Ignition: Expose
sysctl and sysfs configuration per node pool via kernel.sysctls (/etc/sysctl.d/90-node-pool.conf) and kernel.sysfs (/etc/tmpfiles.d/00-node-pool.conf). The parameters required by kubelet’s protectKernelDefaults cannot be set by name, and the Image Builder and Cilium sysctl configuration keeps precedence. - Apps: Add
global.connectivity.cni.managed (default true). When false, Cilium isn’t rendered and is dropped from the dependencies of every app. - Workers: Add
nodeLabelsTemplateName and taintsTemplateName hooks under providerIntegration.workers.kubeadmConfig. They name provider templates, rendered once per node pool, that add kubelet node labels and taints.
Changed
- Ignition: Rename
/etc/sysctl.d/hardening.conf to 80-hardening.conf so it sorts after Flatcar’s 65-baselayout.conf but before Image Builder’s 99-sysctl.conf and Cilium’s 99-zzz-override_cilium.conf. Previously the unprefixed file sorted last and overrode both. As a result, nodes now run with fs.inotify.max_user_watches = 524288 (previously 16384) and net.ipv4.conf.all.rp_filter = 0 (previously 1). - Ignition: Clean up sysctl hardening. Drop keys already set by Image Builder or Cilium (
fs.inotify.max_user_watches, fs.inotify.max_user_instances, net.ipv4.conf.all.rp_filter, vm.overcommit_memory, kernel.panic, kernel.panic_on_oops). Stop disabling net.ipv4.tcp_timestamps, since modern kernels randomize timestamp offsets.
Removed
- Ignition: Remove
os-hardening.service. Its sysctl -p duplicated what systemd-sysctl already applies at boot. Its gpasswd calls had no effect: glibc merges group memberships from /usr/share/baselayout/group (via nss-usrfiles) regardless of /etc/group. - Apps: Remove the static
aks exceptions for the Cilium dependency of network policies and CoreDNS. - Workers: Remove the
karpenter.sh/unregistered:NoExecute taint from Karpenter node pools. Provider charts must add it via taintsTemplateName.
Apps
- cert-manager from v4.1.1 to v4.1.2
- cilium from v1.6.1 to v1.6.2
- coredns from v1.34.0 to v1.35.0
- etcd-defrag from v1.2.12 to v1.2.13
- k8s-dns-node-cache from v2.11.0 to v2.11.1
- network-policies from v0.3.2 to v0.5.0
- observability-bundle from v3.5.0 to v3.6.0
Added
- cert-manager-giantswarm-clusterissuer: Allow setting
cnameStrategy per DNS01 solver with acme.dns01.cloudflare.cnameStrategy, acme.dns01.route53.cnameStrategy and acme.dns01.azureDNS.cnameStrategy, so a _acme-challenge CNAME can delegate the challenge to a zone the solver can write to.
Changed
- Use
imagePullPolicy: IfNotPresent for the cert-manager-giantswarm-clusterissuer hook Job, so a retried Helm hook reuses the image already present on the node instead of downloading it again. - Run the E2E test suites automatically on release PRs by adding
.github/release-pr-body.md. - Increase clusterIssuer job memory limit from 250Mi to 512Mi.
- The ACME HTTP-01 solver of the
letsencrypt-giantswarm ClusterIssuer now uses Gateway API (gatewayHTTPRoute) instead of an Ingress, and targets Envoy Gateway.
Removed
giantSwarmClusterIssuer.acme.http01.enabled and giantSwarmClusterIssuer.acme.http01.ingressClassName (which defaulted to nginx). Setting either now fails the Helm render with a message pointing at the replacement values.
Fixed
- Trim the
helm.sh/chart label of the Giant Swarm resources (VPAs, PodLogs, proxy ConfigMap) to end on an alphanumeric character. A long dev version cut at 63 characters could end on a ., and the API server rejected the resource.
Changed
- Upgrade Cilium to v1.20.4.
- Envoy xDS mode defaults to
split again, following upstream (cilium/cilium#49383). - Restore upstream
cilium-operator tolerations instead of tolerating all taints. - Exclude the Lens namespace label
k8slens-edit-resource-version from identity computation.
Added
- Support the forward
max_age option (#528)
Changed
- Update
coredns image to 1.15.0. - Update gsoci.azurecr.io/giantswarm/docker-kubectl to v1.37.1 (#520)
Fixed
- Render forward integer options when set to
0 (#528) - Validate
additionalZones cache, forward, kubernetes, log and loadbalance blocks against the public and cluster zone schemas (#528)
Changed
- Chart: Update dependency ahrtr/etcd-defrag to v0.46.0. (#156)
Added
- Chart metadata: add
io.giantswarm.application.managed annotation ("true"). - Chart metadata: add
keywords.
Fixed
- Make the DNS Service redirected by the
CiliumLocalRedirectPolicy configurable. - The
helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
Added
- Add
hubbleRelay to allow the AKS ACNS hubble-relay through the default deny. - Add
allowEgressToUpstreamDNS to allow pods with dnsPolicy: Default to reach upstream DNS resolvers. - Add
azureWorkloadIdentityWebhook to allow the AKS workload identity webhook through the default deny.
Changed
- Move the chart to
helm/network-policies to match its name, in preparation for devctl-generated CI.
Added
- KSM custom resource state: Add
status_parent_accepted and status_parent_resolved_refs gauges for Gateway API HTTPRoute, one series per parent with the condition reason as label. - KSM custom resource state: Add
target_info and status_ancestor_accepted metrics for Envoy Gateway SecurityPolicy, BackendTrafficPolicy, ClientTrafficPolicy and EnvoyExtensionPolicy.
Changed
- !Breaking change: Turn
apps.<appName>.dependsOn from a list into a map from dependency name to true/false, so that a provider can turn off a single dependency (for example kyverno-crds on clusters without the security bundle) instead of overriding the whole list.
