Workload Cluster Releases for AWS

• Oct 1, 2024 Workload cluster releases for AWS releases v20.1.5

  Upgrade Cilium to enhance performance when managing a large number of network policies within the cluster.

  Change details

  cilium 0.25.1

  Changed

  • Upgrade cilium to v1.15.6.
  • Fix regression setting Policy BPF Max map policyMapMax back to 65536 from 16384.

  Added

  Cilium ENI mode for CAPA becomes usable with these changes:

  • Add security group tag filter for pod network
  • Select subnets from secondary VPC CIDRs
• Jul 9, 2024 Workload cluster releases for AWS releases v20.1.4

  This patch release fixes an issue with cert-manager acme-http01-solver-image argument and improves container security.

  Change details

  cert-manager 3.7.9

  Fix

  • Remove quotes from acme-http01-solver-image argument. The quotes are used when looking up the image which causes an error.

  Update

  • Improves container security by setting runAsGroup and runAsUser greater than zero for all deployments.

  security-bundle 1.6.7

  Changed

  • Update kyverno (app) to v0.17.13.
  • Update trivy-operator (app) to v0.8.1.
  • Update starboard-exporter (app) to v0.7.10.
• Jul 3, 2024 Workload cluster releases for AWS releases v20.1.3

  This is a security release featuring latest version of Flatcar Container Linux with major CVE fix for OpenSSH CVE-2024-6387. Upgrade to this release will result in nodes rollout.

  Change details

  containerlinux 3815.2.5

  Changes since Stable 3815.2.4

  Security fixes:

  • openssh (CVE-2024-6387)

  Updates:

  • Linux (6.1.96)
  • openssh (9.7_p1)
• Jul 3, 2024 Workload cluster releases for AWS releases v19.3.5

  This is a security release featuring latest version of Flatcar Container Linux with major CVE fix for OpenSSH CVE-2024-6387. Upgrade to this release will result in nodes rollout.

  Change details

  containerlinux 3815.2.5

  Changes since Stable 3815.2.4

  Security fixes:

  • openssh (CVE-2024-6387)

  Updates:

  • Linux (6.1.96)
  • openssh (9.7_p1)
• Jun 26, 2024 Workload cluster releases for AWS releases v20.1.2

  Improves cert-manager CA injector on demanding clusters

  Change details

  cert-manager 3.7.7

  Changed

  • Changed the way the registry is being parsed in helm templates
  • Enable VPA by default for CA injector
• May 16, 2024 Workload cluster releases for AWS releases v20.1.1

  Fixes issue with cert-manager removing CRDs on rollback.

  Change details

  cert-manager 3.7.5

  Added

  • Added annotation helm.sh/resource-policy: keep on CRDs to prevent them from being pruned in an unexpected rollback event.
• Apr 29, 2024 Workload cluster releases for AWS releases v19.3.4

  This is a security release featuring latest version of Flatcar Container Linux.

  Change details

  containerlinux 3815.2.2

  Changes since Stable 3815.2.1

  Security fixes:

  • Linux (CVE-2023-28746, CVE-2023-47233, CVE-2023-52639, CVE-2023-6270, CVE-2023-7042, CVE-2024-22099, CVE-2024-23307, CVE-2024-24861, CVE-2024-26584, CVE-2024-26585, CVE-2024-26642, CVE-2024-26651, CVE-2024-26654, CVE-2024-26659, CVE-2024-26686, CVE-2024-26700, CVE-2024-26809)
  • Downgraded xz-utils to 5.4.2 as precaution even though Flatcar is not affected of the SSH backdoor (CVE-2024-3094)
  • openssh (CVE-2023-48795, CVE-2023-51384, CVE-2023-51385)

  Bug fixes:

  • Disabled user-configdrive.service on OpenStack when config drive is used, which caused the hostname to be overwritten. The coreos-cloudinit.service unit already runs on OpenStack if the system is not configured via ignition. (Flatcar#1385)
  • Fixed toolbox to prevent mounted ctr snapshots from being garbage-collected (toolbox#9)

  Changes:

  • Disabled real-time priority for multipathd as it prevents the cgroups2 cpu controller from working. (scripts#1771)
  • SDK: Unified qemu image formats, so that the qemu_uefi build target provides the regular qemu and the qemu_uefi_secure artifacts (scripts#1847)

  Updates:

  • Linux (6.1.85 (includes 6.1.84, 6.1.83, 6.1.82))
  • ca-certificates (3.99)
  • openssh (9.6p1)
• Apr 24, 2024 Workload cluster releases for AWS releases v20.1.0

  This release provides security updates for container linux and a fix for IMDSv2 only clusters.

  Change details

  aws-operator 16.1.1

  Fixed

  • Bump k8scc to fix issues with IMDS v2.

  cert-operator 3.4.0

  Changed

  • Avoid exiting with a failure at startup time if the PKI cleanup fails.

  cluster-operator 5.11.1

  Changed

  • Configure gsoci.azurecr.io as the default container image registry.

  Added

  • Add team label in resources.
  • Add global.podSecurityStandards.enforced value for PSS migration.

  Fixed

  • Fix release version check for PSS enforcement.

  containerlinux 3815.2.2

  Changes since Stable 3815.2.1

  Security fixes:

  • Linux (CVE-2023-28746, CVE-2023-47233, CVE-2023-52639, CVE-2023-6270, CVE-2023-7042, CVE-2024-22099, CVE-2024-23307, CVE-2024-24861, CVE-2024-26584, CVE-2024-26585, CVE-2024-26642, CVE-2024-26651, CVE-2024-26654, CVE-2024-26659, CVE-2024-26686, CVE-2024-26700, CVE-2024-26809)
  • Downgraded xz-utils to 5.4.2 as precaution even though Flatcar is not affected of the SSH backdoor (CVE-2024-3094)
  • openssh (CVE-2023-48795, CVE-2023-51384, CVE-2023-51385)

  Bug fixes:

  • Disabled user-configdrive.service on OpenStack when config drive is used, which caused the hostname to be overwritten. The coreos-cloudinit.service unit already runs on OpenStack if the system is not configured via ignition. (Flatcar#1385)
  • Fixed toolbox to prevent mounted ctr snapshots from being garbage-collected (toolbox#9)

  Changes:

  • Disabled real-time priority for multipathd as it prevents the cgroups2 cpu controller from working. (scripts#1771)
  • SDK: Unified qemu image formats, so that the qemu_uefi build target provides the regular qemu and the qemu_uefi_secure artifacts (scripts#1847)

  Updates:

  • Linux (6.1.85 (includes 6.1.84, 6.1.83, 6.1.82))
  • ca-certificates (3.99)
  • openssh (9.6p1)

  etcd 3.5.13

  etcd server

  • Fix leases wrongly revoked by the leader by ignoring old leader’s leases revoking request.
  • Fix no progress notification being sent for watch that doesn’t get any events.
  • Fix watch event loss after compaction.

  Package clientv3

  • Add client backoff and retry config options.
  • Ignore SetKeepAlivePeriod errors on OpenBSD.
  • Support unix/unixs socket in client or peer URLs

  gRPC Proxy

  • Add three flags (see below) for grpc-proxy
    • --dial-keepalive-time
    • --dial-keepalive-timeout
    • --permit-without-stream

  Dependencies

  • Upgrade bbolt to v1.3.9.
  • Compile binaries using go 1.21.8.
  • Upgrade google.golang.org/protobuf to v1.33.0 to address CVE-2024-24786.
  • Upgrade github.com/sirupsen/logrus to v1.9.3 to address PRISMA-2023-0056.

  Others

  • Make CGO_ENABLED configurable.

  app-operator 6.11.0

  Added

  • Add support for App resources having a dependency on HelmReleases.

  vertical-pod-autoscaler 5.1.0

  Added

  • Repository: Add ATS. (#267)

  Changed

  • Chart: Improve readability of image tag. (#263)
  • Repository: Chores. (#266)
    • Repository: Move .kube-linter.yaml.
    • Repository: Rework ABS.
    • Repository: Rework CircleCI.
    • Repository: Rework README.
    • Chart: Regenerate values schema JSON.
    • Chart: Rework Chart.yaml.
    • Chart: Rework README.md.gotmpl.
  • Chart: Rework chart. (#269)
    • Chart: Rework helpers.
    • Chart: Rework vertical pod autoscalers.
    • Chart: Rework policy exceptions.
    • Chart: Rework network policies.
    • Chart: Rework CRD patch.
  • Chart: PSS compliance. (#270)

  Removed

  • Repository: Chores. (#266)
    • Repository: Remove unused script.
    • Repository: Remove .nancy-ignore*.
    • Repository: Remove images.
    • Repository: Remove config.
    • Repository: Remove .gitignore.
    • Chart: Remove .helmignore.
    • Chart: Remove useless CI values.
  • Chart: Rework chart. (#269)
    • Chart: Remove global network policies.

  etcd-kubernetes-resources-count-exporter 1.10.0

  Changed

  • Set min VPA settings and adjust CPU and memory resources.
  • Use PodMonitor instead of legacy labels for monitoring.

  observability-bundle 1.3.4

  Changed

  • Upgrade kube-prometheus-stack to 9.1.2.

  k8s-audit-metrics 0.9.0

  Added

  • Add team label in resources.
  • Use ServiceMonitor for monitoring.

  Changed

  • Configure gsoci.azurecr.io as the default container image registry.

  cert-manager 3.7.4

  Added

  • Added support for AzureDNS integration with a Service Principal on clusterIssuer helm chart .

  Changed

  • Changed appVersion to v1.14.2

  chart-operator 3.2.1

  Fixed

  • Use separate rest configs for different Kubernetes clients.

  cilium 0.22.0

  Added

  • Add helm values schema.

  Changed

  • Add safe-to-evict annotations to Hubble Relay and UI pods.
  • Enable deletion of extra network policies.
  • Update team label to cabbage

  cluster-autoscaler 1.25.3-gs2

  Added

  • Add possibility to use egress proxy.

  Changed

  • Chart: Improve proxy settings. (#249)

  external-dns 3.1.0

  Changed

  • Remove default namespaceFilter configuration. (#324).
• Dec 14, 2023 Workload cluster releases for AWS releases v19.2.1

  This patch release of the 19.2 series addresses an error in the calculation of max pods per node when using Cilium in ENI IPAM mode.

  Change details

  aws-operator 14.23.1

  Fixed

  • Bump k8scc to 16.6.1 to fix max pod calculation.
• Dec 14, 2023 Workload cluster releases for AWS releases v19.3.1

  This patch release addresses an error in the calculation of max pods per node when using Cilium in ENI IPAM mode.

  Change details

  aws-operator 15.0.0

  Fixed

  • Bump k8scc to fix calculation of max pods per node when in ENI mode.

  Changed

  • [Breaking change] Removed code that allowed switching from AWS-CNI to Cilium. Releases using this AWS-operator can’t be upgraded to from v18 releases.

  containerlinux 3602.2.3

  Changes since Stable 3602.2.2

  Security fixes:

  • Linux (CVE-2023-46862, CVE-2023-6121)

  Bug fixes:

  • Deleted files in /etc that have a tmpfiles rule that normally would recreate them will now show up again through the /etc lowerdir (Flatcar#1265, bootengine#79)

  Updates:

  • Linux (5.15.142 (includes 5.15.141, 5.15.140, 5.15.139))
  • ca-certificates (3.95)

  etcd 3.5.11

  etcd server

  • Fix distributed tracing by ensuring --experimental-distributed-tracing-sampling-rate configuration option is available to set tracing sample rate.
  • Fix url redirects while checking peer urls during new member addition

  Dependencies

  • Compile binaries using go 1.20.12
  • Fix CVE-2023-47108 by bumping go.opentelemetry.io/otel to 1.20.0 and go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to 0.46.0.

  app-operator 6.10.2

  Changed

  • Set gsoci.azurecr.io as the default container registry for this app’s image(s).

  external-dns 3.0.0

  Added

  • Add vendir for upstream sync.
  • Add namespaced feature to scope permissions to one namespace.
  • Add support for Gateway API (#305).

  Changed

  • Deployment: Align to upstream (#255).
    • Use crd.podSecurityContext for crd job.
    • Rename global.resources as resources.
    • Rename externalDNS.extraArgs as extraArgs.
    • Rename externalDNS.policy as policy.
    • Rename externalDNS.sources as sources and adjust default value.
    • Rename externalDNS.interval as interval.
    • Rename global.image as image using helper for name composition.
    • Move global.securityContext to podSecurityContext and align names.
  • Service: Align to upstream (#243).
    • Replace global.metrics.port value with service.port.
    • Add service annotations with GS defaults.
    • Set readinessProbe and livenessProbe from values.
    • Move podAnnotations to values.
  • Update README and config docs (#290).
  • Switch Registry to ACR (#318).

  Removed

  • Deployment: Align to upstream (#255).
    • Remove dedicated option for min-event-sync-interval and set it in extraArgs.
    • Remove externalDNS.dryRun option.
  • Secrets: Remove deprecated values for AWS Route53 external authentication #266.
  • Remove support for KIAM (#278).
  • Remove aws.iam.customRoleName value (#278).
  • Remove aws, gcpProject and externalDNS values (#284).
  • Remove Azure volume configuration (#284).
  • Remove unused helpers (#290).
  • Remove PSP (#305).

  net-exporter 1.18.2

  Changed

  • Configure gsoci.azurecr.io as the default container image registry.

  security-bundle 1.4.2

  Changed

  • Update to kyverno-app (app) version v0.16.4.
  • Update to kyverno-policies (app) version v0.20.2.
  • Update to exception-recommender (app) to v0.0.6.
  • Update to starboard-exporter (app) version v0.7.5.

  Added

  • Add options to individual app settings to allow custom timeout values.

  chart-operator 3.1.1

  Changed

  • Configure gsoci.azurecr.io as the registry to use by default

  cluster-autoscaler 1.24.3-gs4

  Added

  • Service monitor.

  coredns 1.20.0

  Added

  • Add NET_BIND_SERVICE capability back to containers.

  Changed

  • Upgrade CoreDNS to v1.11.1.