From 4d3cd11d32f3e7578952163c7d5d7d83668c36ba Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Thu, 29 Jun 2023 14:33:04 +0200 Subject: [PATCH 01/55] fake release for testing --- README.md | 2 + aws/kustomization.yaml | 1 + aws/v19.1.0/README.md | 31 +++++++ aws/v19.1.0/kustomization.yaml | 2 + aws/v19.1.0/release.diff | 156 +++++++++++++++++++++++++++++++++ aws/v19.1.0/release.yaml | 85 ++++++++++++++++++ 6 files changed, 277 insertions(+) create mode 100644 aws/v19.1.0/README.md create mode 100644 aws/v19.1.0/kustomization.yaml create mode 100644 aws/v19.1.0/release.diff create mode 100644 aws/v19.1.0/release.yaml diff --git a/README.md b/README.md index ba71ca506..4dd1992a5 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,8 @@ to all Giant Swarm installations. ## AWS - v19 + - v19.1 + - [v19.1.0](https://github.com/giantswarm/releases/tree/master/aws/v19.1.0) - v19.0 - [v19.0.0](https://github.com/giantswarm/releases/tree/master/aws/v19.0.0) - [v19.0.0-beta1](https://github.com/giantswarm/releases/tree/master/aws/v19.0.0-beta1) diff --git a/aws/kustomization.yaml b/aws/kustomization.yaml index 7bdeed8e8..6f9617502 100644 --- a/aws/kustomization.yaml +++ b/aws/kustomization.yaml @@ -17,5 +17,6 @@ resources: - v19.0.0-alpha1 - v19.0.0-beta1 - v19.0.0 +- v19.1.0 transformers: - releaseNotesTransformer.yaml diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md new file mode 100644 index 000000000..4a3e9fa89 --- /dev/null +++ b/aws/v19.1.0/README.md @@ -0,0 +1,31 @@ +# :zap: Giant Swarm Release v19.1.0 for AWS :zap: + +<< Add description here >> + +## Change details + + +### kubernetes [1.24.15](https://github.com/kubernetes/kubernetes/releases/tag/v1.24.15) + +#### Feature +- Kubernetes 1.24.x is now built with Go 1.19.10 ([#118557](https://github.com/kubernetes/kubernetes/pull/118557), [@puerco](https://github.com/puerco)) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Node, Release, Storage and Testing] +#### Bug or Regression +- Fixes a bug at kube-apiserver start where APIService objects for custom resources could be deleted and recreated. ([#118104](https://github.com/kubernetes/kubernetes/pull/118104), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Testing] +- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#118192](https://github.com/kubernetes/kubernetes/pull/118192), [@dlipovetsky](https://github.com/dlipovetsky)) [SIG Cluster Lifecycle] +- Kubeadm: fix a bug where the static pod changes detection logic is inconsistent with kubelet ([#118069](https://github.com/kubernetes/kubernetes/pull/118069), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] +#### Dependencies +#### Added +- github.com/a8m/tree: [10a5fd5](https://github.com/a8m/tree/tree/10a5fd5) +- github.com/dougm/pretty: [2ee9d74](https://github.com/dougm/pretty/tree/2ee9d74) +- github.com/rasky/go-xdr: [4930550](https://github.com/rasky/go-xdr/tree/4930550) +- github.com/vmware/vmw-guestinfo: [25eff15](https://github.com/vmware/vmw-guestinfo/tree/25eff15) +#### Changed +- github.com/google/uuid: [v1.1.2 → v1.3.0](https://github.com/google/uuid/compare/v1.1.2...v1.3.0) +- github.com/kr/pretty: [v0.2.1 → v0.3.0](https://github.com/kr/pretty/compare/v0.2.1...v0.3.0) +- github.com/rogpeppe/go-internal: [v1.3.0 → v1.6.1](https://github.com/rogpeppe/go-internal/compare/v1.3.0...v1.6.1) +- github.com/vmware/govmomi: [v0.20.3 → v0.30.0](https://github.com/vmware/govmomi/compare/v0.20.3...v0.30.0) +#### Removed +_Nothing has changed._ + + + diff --git a/aws/v19.1.0/kustomization.yaml b/aws/v19.1.0/kustomization.yaml new file mode 100644 index 000000000..2c64a5163 --- /dev/null +++ b/aws/v19.1.0/kustomization.yaml @@ -0,0 +1,2 @@ +resources: +- release.yaml diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff new file mode 100644 index 000000000..7f20cac22 --- /dev/null +++ b/aws/v19.1.0/release.diff @@ -0,0 +1,156 @@ +# Generated with: # Generated with: +# devctl release create --name 19.0.0 --base 19.0.0-beta1 --pro | # devctl release create --provider aws --base v19.0.0 --name v1 +apiVersion: release.giantswarm.io/v1alpha1 apiVersion: release.giantswarm.io/v1alpha1 +kind: Release kind: Release +metadata: metadata: + annotations: annotations: + giantswarm.io/docs: https://docs.giantswarm.io/reference/cp giantswarm.io/docs: https://docs.giantswarm.io/reference/cp + creationTimestamp: null creationTimestamp: null + name: v19.0.0 | name: v19.1.0 +spec: spec: + apps: apps: + - componentVersion: 1.24.1 - componentVersion: 1.24.1 + name: aws-cloud-controller-manager name: aws-cloud-controller-manager + version: 1.24.1-gs7 version: 1.24.1-gs7 + dependsOn: < + - vertical-pod-autoscaler-crd < + - componentVersion: 1.15.0 - componentVersion: 1.15.0 + name: aws-ebs-csi-driver name: aws-ebs-csi-driver + version: 2.21.1 version: 2.21.1 + dependsOn: < + - vertical-pod-autoscaler-crd < + - name: cert-exporter - name: cert-exporter + version: 2.5.1 version: 2.5.1 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - vertical-pod-autoscaler-crd < + - componentVersion: 1.8.2 - componentVersion: 1.8.2 + name: cert-manager name: cert-manager + version: 2.21.0 version: 2.21.0 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - vertical-pod-autoscaler-crd < + - name: chart-operator - name: chart-operator + version: 2.35.0 version: 2.35.0 + - componentVersion: 1.13.0 - componentVersion: 1.13.0 + name: cilium name: cilium + version: 0.10.0 version: 0.10.0 + dependsOn: < + - aws-cloud-controller-manager < + - componentVersion: 1.24.0 - componentVersion: 1.24.0 + name: cluster-autoscaler name: cluster-autoscaler + version: 1.24.0-gs2 version: 1.24.0-gs2 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - vertical-pod-autoscaler-crd < + - componentVersion: 1.9.3 - componentVersion: 1.9.3 + name: coredns name: coredns + version: 1.17.0 version: 1.17.0 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - componentVersion: 0.11.0 - componentVersion: 0.11.0 + name: external-dns name: external-dns + version: 2.37.1 version: 2.37.1 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - vertical-pod-autoscaler-crd < + - componentVersion: 0.6.1 - componentVersion: 0.6.1 + name: metrics-server name: metrics-server + version: 2.2.0 version: 2.2.0 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - vertical-pod-autoscaler-crd < + - name: net-exporter - name: net-exporter + version: 1.15.0 version: 1.15.0 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - vertical-pod-autoscaler-crd < + - componentVersion: 1.3.1 - componentVersion: 1.3.1 + name: node-exporter name: node-exporter + version: 1.16.0 version: 1.16.0 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - vertical-pod-autoscaler-crd < + - componentVersion: 0.13.0 - componentVersion: 0.13.0 + name: vertical-pod-autoscaler name: vertical-pod-autoscaler + version: 3.5.2 version: 3.5.2 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - vertical-pod-autoscaler-crd < + - name: vertical-pod-autoscaler-crd - name: vertical-pod-autoscaler-crd + version: 2.0.1 version: 2.0.1 + - name: etcd-kubernetes-resources-count-exporter - name: etcd-kubernetes-resources-count-exporter + version: 1.2.0 version: 1.2.0 + dependsOn: < + - vertical-pod-autoscaler-crd < + - name: observability-bundle - name: observability-bundle + version: 0.5.1 version: 0.5.1 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - name: k8s-dns-node-cache-app - name: k8s-dns-node-cache-app + version: 2.1.0 version: 2.1.0 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - prometheus-operator-crd < + - vertical-pod-autoscaler-crd < + - name: prometheus-blackbox-exporter - name: prometheus-blackbox-exporter + version: 0.3.2 version: 0.3.2 + dependsOn: < + - aws-cloud-controller-manager < + - cilium < + - coredns < + - vertical-pod-autoscaler-crd < + - name: cilium-servicemonitors - name: cilium-servicemonitors + version: 0.1.1 version: 0.1.1 + dependsOn: < + - prometheus-operator-crd < + - name: irsa-servicemonitors - name: irsa-servicemonitors + version: 0.0.1 version: 0.0.1 + dependsOn: < + - prometheus-operator-crd < + components: components: + - name: app-operator - name: app-operator + version: 6.7.0 version: 6.7.0 + - name: aws-operator - name: aws-operator + > reference: 14.17.1-patch2 + releaseOperatorDeploy: true releaseOperatorDeploy: true + version: 14.17.1 version: 14.17.1 + reference: 14.17.1-patch2 < + - name: cert-operator - name: cert-operator + releaseOperatorDeploy: true releaseOperatorDeploy: true + version: 3.0.1 version: 3.0.1 + - name: cluster-operator - name: cluster-operator + releaseOperatorDeploy: true releaseOperatorDeploy: true + version: 5.6.1 version: 5.6.1 + - name: containerlinux - name: containerlinux + version: 3510.2.0 version: 3510.2.0 + - name: etcd - name: etcd + version: 3.5.7 version: 3.5.7 + - name: kubernetes - name: kubernetes + version: 1.24.13 | version: 1.24.15 + date: "2023-05-17T09:34:06Z" | date: "2023-06-29T12:32:17Z" + state: active state: active +status: status: + inUse: false inUse: false + ready: false ready: false diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml new file mode 100644 index 000000000..8962f5cbf --- /dev/null +++ b/aws/v19.1.0/release.yaml @@ -0,0 +1,85 @@ +# Generated with: +# devctl release create --provider aws --base v19.0.0 --name v19.1.0 --component kubernetes@1.24.15 +apiVersion: release.giantswarm.io/v1alpha1 +kind: Release +metadata: + annotations: + giantswarm.io/docs: https://docs.giantswarm.io/reference/cp-k8s-api/releases.release.giantswarm.io/ + creationTimestamp: null + name: v19.1.0 +spec: + apps: + - componentVersion: 1.24.1 + name: aws-cloud-controller-manager + version: 1.24.1-gs7 + - componentVersion: 1.15.0 + name: aws-ebs-csi-driver + version: 2.21.1 + - name: cert-exporter + version: 2.5.1 + - componentVersion: 1.8.2 + name: cert-manager + version: 2.21.0 + - name: chart-operator + version: 2.35.0 + - componentVersion: 1.13.0 + name: cilium + version: 0.10.0 + - componentVersion: 1.24.0 + name: cluster-autoscaler + version: 1.24.0-gs2 + - componentVersion: 1.9.3 + name: coredns + version: 1.17.0 + - componentVersion: 0.11.0 + name: external-dns + version: 2.37.1 + - componentVersion: 0.6.1 + name: metrics-server + version: 2.2.0 + - name: net-exporter + version: 1.15.0 + - componentVersion: 1.3.1 + name: node-exporter + version: 1.16.0 + - componentVersion: 0.13.0 + name: vertical-pod-autoscaler + version: 3.5.2 + - name: vertical-pod-autoscaler-crd + version: 2.0.1 + - name: etcd-kubernetes-resources-count-exporter + version: 1.2.0 + - name: observability-bundle + version: 0.5.1 + - name: k8s-dns-node-cache-app + version: 2.1.0 + - name: prometheus-blackbox-exporter + version: 0.3.2 + - name: cilium-servicemonitors + version: 0.1.1 + - name: irsa-servicemonitors + version: 0.0.1 + components: + - name: app-operator + version: 6.7.0 + - name: aws-operator + reference: 14.17.1-patch2 + releaseOperatorDeploy: true + version: 14.17.1 + - name: cert-operator + releaseOperatorDeploy: true + version: 3.0.1 + - name: cluster-operator + releaseOperatorDeploy: true + version: 5.6.1 + - name: containerlinux + version: 3510.2.0 + - name: etcd + version: 3.5.7 + - name: kubernetes + version: 1.24.15 + date: "2023-06-29T12:32:17Z" + state: active +status: + inUse: false + ready: false From 7f28ac49af324e9643bea1ba8f2664994486e4fd Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Thu, 29 Jun 2023 14:35:49 +0200 Subject: [PATCH 02/55] fake release for testing --- aws/v19.1.0/README.md | 36 ++++++++++++++++++++++++++++++++++++ aws/v19.1.0/release.diff | 36 ++++++++++++++++++------------------ aws/v19.1.0/release.yaml | 23 ++++++++++------------- 3 files changed, 64 insertions(+), 31 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 4a3e9fa89..f97306856 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -29,3 +29,39 @@ _Nothing has changed._ +### cert-manager [2.24.1](https://github.com/giantswarm/cert-manager-app/releases/tag/v2.24.1) + +#### Added +- Add `cluster-autoscaler safe-to-evict` annotation to `controller` and `cainjector` through newly introduced `controller.podAnnotations` and `cainjector.podAnnotations` values. ([#330](https://github.com/giantswarm/cert-manager-app/pull/330)) + + + +### net-exporter [1.16.2](https://github.com/giantswarm/net-exporter/releases/tag/v1.16.2) + +#### Changed +- Reduce CPU and Mem requests. + + + +### node-exporter [1.16.1](https://github.com/giantswarm/node-exporter-app/releases/tag/v1.16.1) + +#### Changed +- Enable service monitor. + + + +### observability-bundle [0.7.1](https://github.com/giantswarm/observability-bundle/releases/tag/v0.7.1) + +#### Changed +- Upgrade `promtail-app` to 1.1.1. +- Upgrade `prometheus-operator-app` to 5.0.6. + + + +### vertical-pod-autoscaler [3.5.3](https://github.com/giantswarm/vertical-pod-autoscaler-app/releases/tag/v3.5.3) + +#### Added +- Add `cluster-autoscaler safe-to-evict` annotation to `recommender` and `updater` + + + diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 7f20cac22..2dbd1d95a 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -21,14 +21,14 @@ spec: spec: - vertical-pod-autoscaler-crd < - name: cert-exporter - name: cert-exporter version: 2.5.1 version: 2.5.1 - dependsOn: < - - aws-cloud-controller-manager < + dependsOn: | - name: cert-manager + - aws-cloud-controller-manager | version: 2.24.1 - cilium < - coredns < - vertical-pod-autoscaler-crd < - - componentVersion: 1.8.2 - componentVersion: 1.8.2 - name: cert-manager name: cert-manager - version: 2.21.0 version: 2.21.0 + - componentVersion: 1.8.2 < + name: cert-manager < + version: 2.21.0 < dependsOn: < - aws-cloud-controller-manager < - cilium < @@ -72,23 +72,23 @@ spec: spec: - coredns < - vertical-pod-autoscaler-crd < - name: net-exporter - name: net-exporter - version: 1.15.0 version: 1.15.0 - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < + version: 1.15.0 | version: 1.16.2 + dependsOn: | - name: node-exporter + - aws-cloud-controller-manager | version: 1.16.1 + - cilium | - name: vertical-pod-autoscaler + - coredns | version: 3.5.3 - vertical-pod-autoscaler-crd < - - componentVersion: 1.3.1 - componentVersion: 1.3.1 - name: node-exporter name: node-exporter - version: 1.16.0 version: 1.16.0 + - componentVersion: 1.3.1 < + name: node-exporter < + version: 1.16.0 < dependsOn: < - aws-cloud-controller-manager < - cilium < - coredns < - vertical-pod-autoscaler-crd < - - componentVersion: 0.13.0 - componentVersion: 0.13.0 - name: vertical-pod-autoscaler name: vertical-pod-autoscaler - version: 3.5.2 version: 3.5.2 + - componentVersion: 0.13.0 < + name: vertical-pod-autoscaler < + version: 3.5.2 < dependsOn: < - aws-cloud-controller-manager < - cilium < @@ -101,7 +101,7 @@ spec: spec: dependsOn: < - vertical-pod-autoscaler-crd < - name: observability-bundle - name: observability-bundle - version: 0.5.1 version: 0.5.1 + version: 0.5.1 | version: 0.7.1 dependsOn: < - aws-cloud-controller-manager < - cilium < @@ -149,7 +149,7 @@ spec: spec: version: 3.5.7 version: 3.5.7 - name: kubernetes - name: kubernetes version: 1.24.13 | version: 1.24.15 - date: "2023-05-17T09:34:06Z" | date: "2023-06-29T12:32:17Z" + date: "2023-05-17T09:34:06Z" | date: "2023-06-29T12:35:42Z" state: active state: active status: status: inUse: false inUse: false diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 8962f5cbf..8d2fcdc02 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -1,5 +1,5 @@ # Generated with: -# devctl release create --provider aws --base v19.0.0 --name v19.1.0 --component kubernetes@1.24.15 +# devctl release create --provider aws --base v19.0.0 --name v19.1.0 --component kubernetes@1.24.15 --app cert-manager@2.24.1 --app net-exporter@1.16.2 --app node-exporter@1.16.1 --app observability-bundle@0.7.1 --app vertical-pod-autoscaler@3.5.3 --overwrite apiVersion: release.giantswarm.io/v1alpha1 kind: Release metadata: @@ -17,9 +17,8 @@ spec: version: 2.21.1 - name: cert-exporter version: 2.5.1 - - componentVersion: 1.8.2 - name: cert-manager - version: 2.21.0 + - name: cert-manager + version: 2.24.1 - name: chart-operator version: 2.35.0 - componentVersion: 1.13.0 @@ -38,19 +37,17 @@ spec: name: metrics-server version: 2.2.0 - name: net-exporter - version: 1.15.0 - - componentVersion: 1.3.1 - name: node-exporter - version: 1.16.0 - - componentVersion: 0.13.0 - name: vertical-pod-autoscaler - version: 3.5.2 + version: 1.16.2 + - name: node-exporter + version: 1.16.1 + - name: vertical-pod-autoscaler + version: 3.5.3 - name: vertical-pod-autoscaler-crd version: 2.0.1 - name: etcd-kubernetes-resources-count-exporter version: 1.2.0 - name: observability-bundle - version: 0.5.1 + version: 0.7.1 - name: k8s-dns-node-cache-app version: 2.1.0 - name: prometheus-blackbox-exporter @@ -78,7 +75,7 @@ spec: version: 3.5.7 - name: kubernetes version: 1.24.15 - date: "2023-06-29T12:32:17Z" + date: "2023-06-29T12:35:42Z" state: active status: inUse: false From 808cfb8ddbf483f35eb57aab4a54170a6794a373 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 3 Jul 2023 09:16:28 +0200 Subject: [PATCH 03/55] aws release 19.1.0 --- aws/v19.1.0/release.yaml | 108 +++++++++++++++++++++++++++++++++------ 1 file changed, 92 insertions(+), 16 deletions(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 8d2fcdc02..e17d961d0 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -1,82 +1,158 @@ # Generated with: -# devctl release create --provider aws --base v19.0.0 --name v19.1.0 --component kubernetes@1.24.15 --app cert-manager@2.24.1 --app net-exporter@1.16.2 --app node-exporter@1.16.1 --app observability-bundle@0.7.1 --app vertical-pod-autoscaler@3.5.3 --overwrite +# devctl release create --name 19.0.0 --base 19.0.0-beta1 --provider aws --overwrite --app aws-cloud-controller-manager@1.24.1-gs7@1.24.1 --app aws-ebs-csi-driver@2.21.1 --app cert-exporter@2.5.1 --app cert-manager@2.21.0@1.8.2 --app chart-operator@2.35.0 --app cilium@0.10.0@1.13.0 --app cluster-autoscaler@1.24.0-gs2@1.24.0 --app coredns@1.17.0@1.9.3 --app external-dns@2.37.1@0.11.0 --app metrics-server@2.2.0@0.6.1 --app net-exporter@1.15.0 --app node-exporter@1.16.0@1.3.1 --app vertical-pod-autoscaler@3.4.2@0.13.0 --app vertical-pod-autoscaler-crd@2.0.1 --app etcd-kubernetes-resources-count-exporter@1.2.0 --app observability-bundle@0.5.1 --app k8s-dns-node-cache@2.1.0 --app prometheus-blackbox-exporter@0.3.2 --app cilium-servicemonitors@0.1.1 --app irsa-servicemonitors@0.0.1 --component app-operator@6.7.0 --component aws-operator@14.17.1 --component cert-operator@3.0.1 --component cluster-operator@5.6.1 --component containerlinux@3510.2.0 --component etcd@3.5.7 --component kubernetes@1.24.13 apiVersion: release.giantswarm.io/v1alpha1 kind: Release metadata: annotations: giantswarm.io/docs: https://docs.giantswarm.io/reference/cp-k8s-api/releases.release.giantswarm.io/ creationTimestamp: null - name: v19.1.0 + name: v19.1.0-eni spec: apps: - componentVersion: 1.24.1 name: aws-cloud-controller-manager version: 1.24.1-gs7 + dependsOn: + - vertical-pod-autoscaler-crd - componentVersion: 1.15.0 name: aws-ebs-csi-driver version: 2.21.1 + dependsOn: + - vertical-pod-autoscaler-crd - name: cert-exporter version: 2.5.1 - - name: cert-manager - version: 2.24.1 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd + - componentVersion: 1.8.2 + name: cert-manager + version: 2.21.0 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd - name: chart-operator version: 2.35.0 - componentVersion: 1.13.0 name: cilium version: 0.10.0 + dependsOn: + - aws-cloud-controller-manager - componentVersion: 1.24.0 name: cluster-autoscaler version: 1.24.0-gs2 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd - componentVersion: 1.9.3 name: coredns version: 1.17.0 + dependsOn: + - aws-cloud-controller-manager + - cilium - componentVersion: 0.11.0 name: external-dns version: 2.37.1 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd - componentVersion: 0.6.1 name: metrics-server version: 2.2.0 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd - name: net-exporter - version: 1.16.2 - - name: node-exporter - version: 1.16.1 - - name: vertical-pod-autoscaler - version: 3.5.3 + version: 1.15.0 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd + - componentVersion: 1.3.1 + name: node-exporter + version: 1.16.0 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd + - componentVersion: 0.13.0 + name: vertical-pod-autoscaler + version: 3.5.2 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd - name: vertical-pod-autoscaler-crd version: 2.0.1 - name: etcd-kubernetes-resources-count-exporter version: 1.2.0 + dependsOn: + - vertical-pod-autoscaler-crd - name: observability-bundle - version: 0.7.1 + version: 0.5.1 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns - name: k8s-dns-node-cache-app version: 2.1.0 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - prometheus-operator-crd + - vertical-pod-autoscaler-crd - name: prometheus-blackbox-exporter version: 0.3.2 + dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd - name: cilium-servicemonitors version: 0.1.1 + dependsOn: + - prometheus-operator-crd - name: irsa-servicemonitors version: 0.0.1 + dependsOn: + - prometheus-operator-crd components: - name: app-operator version: 6.7.0 - name: aws-operator - reference: 14.17.1-patch2 + catalog: control-plane-test-catalog releaseOperatorDeploy: true - version: 14.17.1 + version: 14.17.2-dev + reference: 14.17.1-439caef942780d9ed98d985205a3475a39ed2534 - name: cert-operator releaseOperatorDeploy: true version: 3.0.1 - name: cluster-operator + catalog: control-plane-test-catalog releaseOperatorDeploy: true - version: 5.6.1 + version: 5.6.2-dev + reference: 5.6.1-795cabe20a30df24626b0762e9ddc7c0cb3a9b40 - name: containerlinux version: 3510.2.0 - name: etcd version: 3.5.7 - name: kubernetes - version: 1.24.15 - date: "2023-06-29T12:35:42Z" - state: active + version: 1.24.13 + date: "2023-05-17T09:34:06Z" + state: wip status: inUse: false ready: false From 1ea7dcec27e86e35947e685c5f025e73487b3fa7 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 3 Jul 2023 09:23:23 +0200 Subject: [PATCH 04/55] aws release 19.1.0 --- aws/v19.1.0/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index e17d961d0..ef21af5ef 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -6,7 +6,7 @@ metadata: annotations: giantswarm.io/docs: https://docs.giantswarm.io/reference/cp-k8s-api/releases.release.giantswarm.io/ creationTimestamp: null - name: v19.1.0-eni + name: v19.1.0 spec: apps: - componentVersion: 1.24.1 From f85c136f59b4b0a5e0cef348e9a888549d259262 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 28 Aug 2023 15:03:36 +0200 Subject: [PATCH 05/55] Update release.yaml --- aws/v19.1.0/release.yaml | 137 +++++++++++++++++++++++---------------- 1 file changed, 81 insertions(+), 56 deletions(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index ef21af5ef..35a559ba8 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -9,149 +9,174 @@ metadata: name: v19.1.0 spec: apps: - - componentVersion: 1.24.1 + - catalog: default + componentVersion: 1.24.1 + dependsOn: + - vertical-pod-autoscaler-crd name: aws-cloud-controller-manager - version: 1.24.1-gs7 + version: 1.24.1-gs9 + - catalog: default + componentVersion: 1.15.0 dependsOn: - vertical-pod-autoscaler-crd - - componentVersion: 1.15.0 name: aws-ebs-csi-driver version: 2.21.1 - dependsOn: - - vertical-pod-autoscaler-crd - - name: cert-exporter - version: 2.5.1 + - catalog: default dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd - - componentVersion: 1.8.2 - name: cert-manager - version: 2.21.0 + name: cert-exporter + version: 2.5.1 + - catalog: default + componentVersion: 1.8.2 dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd - - name: chart-operator + name: cert-manager + version: 2.24.1 + - catalog: default + name: chart-operator version: 2.35.0 - - componentVersion: 1.13.0 - name: cilium - version: 0.10.0 + - catalog: default-test + componentVersion: 1.13.0 dependsOn: - aws-cloud-controller-manager - - componentVersion: 1.24.0 - name: cluster-autoscaler - version: 1.24.0-gs2 + name: cilium + version: 0.11.0-d7765d2468ddd9ba6cb8c50fbf468851568bb82e + - catalog: default + componentVersion: 1.24.0 dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd - - componentVersion: 1.9.3 + name: cluster-autoscaler + version: 1.24.0-gs3 + - catalog: default + componentVersion: 1.9.3 + dependsOn: + - aws-cloud-controller-manager + - cilium name: coredns - version: 1.17.0 + version: 1.18.0 + - catalog: default + componentVersion: 0.11.0 dependsOn: - aws-cloud-controller-manager - cilium - - componentVersion: 0.11.0 + - coredns + - vertical-pod-autoscaler-crd name: external-dns version: 2.37.1 + - catalog: default + componentVersion: 0.6.1 dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd - - componentVersion: 0.6.1 name: metrics-server version: 2.2.0 + - catalog: default dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd - - name: net-exporter + name: net-exporter version: 1.15.0 + - catalog: default + componentVersion: 1.3.1 dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd - - componentVersion: 1.3.1 name: node-exporter version: 1.16.0 + - catalog: default + componentVersion: 0.13.0 dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd - - componentVersion: 0.13.0 name: vertical-pod-autoscaler version: 3.5.2 - dependsOn: - - aws-cloud-controller-manager - - cilium - - coredns - - vertical-pod-autoscaler-crd - - name: vertical-pod-autoscaler-crd + - catalog: default + name: vertical-pod-autoscaler-crd version: 2.0.1 - - name: etcd-kubernetes-resources-count-exporter - version: 1.2.0 + - catalog: default dependsOn: - vertical-pod-autoscaler-crd - - name: observability-bundle - version: 0.5.1 + name: etcd-kubernetes-resources-count-exporter + version: 1.2.0 + - catalog: default dependsOn: - aws-cloud-controller-manager - cilium - coredns - - name: k8s-dns-node-cache-app - version: 2.1.0 + name: observability-bundle + version: 0.5.1 + - catalog: default dependsOn: - aws-cloud-controller-manager - cilium - coredns - prometheus-operator-crd - vertical-pod-autoscaler-crd - - name: prometheus-blackbox-exporter - version: 0.3.2 + name: k8s-dns-node-cache-app + version: 2.4.0 + - catalog: default dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd - - name: cilium-servicemonitors - version: 0.1.1 + name: prometheus-blackbox-exporter + version: 0.3.2 + - catalog: default dependsOn: - prometheus-operator-crd - - name: irsa-servicemonitors - version: 0.0.1 + name: cilium-servicemonitors + version: 0.1.1 + - catalog: default dependsOn: - prometheus-operator-crd + name: irsa-servicemonitors + version: 0.0.1 components: - - name: app-operator + - catalog: control-plane-catalog + name: app-operator version: 6.7.0 - - name: aws-operator - catalog: control-plane-test-catalog + - catalog: control-plane-test-catalog + name: aws-operator + reference: 14.19.2-468a76ec119d72213c331556e16711bb6de43248 releaseOperatorDeploy: true - version: 14.17.2-dev - reference: 14.17.1-439caef942780d9ed98d985205a3475a39ed2534 - - name: cert-operator + version: 14.19.3-dev + - catalog: control-plane-catalog + name: cert-operator releaseOperatorDeploy: true version: 3.0.1 - - name: cluster-operator - catalog: control-plane-test-catalog + - catalog: control-plane-test-catalog + name: cluster-operator + reference: 5.7.1-37f1ad79d6f11b0f13baeb86123c187934ce9e7c releaseOperatorDeploy: true - version: 5.6.2-dev - reference: 5.6.1-795cabe20a30df24626b0762e9ddc7c0cb3a9b40 - - name: containerlinux + version: 5.7.2-dev + - catalog: control-plane-catalog + name: containerlinux version: 3510.2.0 - - name: etcd + - catalog: control-plane-catalog + name: etcd version: 3.5.7 - - name: kubernetes + - catalog: control-plane-catalog + name: kubernetes version: 1.24.13 - date: "2023-05-17T09:34:06Z" + date: "2023-08-02T09:59:41Z" state: wip status: inUse: false From 222465d70731d32a8456c76071bb7b5a8e4aa4d3 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 28 Aug 2023 16:15:32 +0200 Subject: [PATCH 06/55] Update release.yaml --- aws/v19.1.0/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 35a559ba8..33f6a443a 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -155,9 +155,9 @@ spec: version: 6.7.0 - catalog: control-plane-test-catalog name: aws-operator - reference: 14.19.2-468a76ec119d72213c331556e16711bb6de43248 + reference: 14.19.2-466c72e6cc11ad1a7dbbbd31a4156befe90f9b31 releaseOperatorDeploy: true - version: 14.19.3-dev + version: 14.19.3-eni - catalog: control-plane-catalog name: cert-operator releaseOperatorDeploy: true From 870e4a616afd2cc3c0b08f9c47b17174ad13159d Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Tue, 29 Aug 2023 11:41:45 +0200 Subject: [PATCH 07/55] Update release.yaml --- aws/v19.1.0/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 33f6a443a..cdd03173d 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -164,7 +164,7 @@ spec: version: 3.0.1 - catalog: control-plane-test-catalog name: cluster-operator - reference: 5.7.1-37f1ad79d6f11b0f13baeb86123c187934ce9e7c + reference: 5.7.1-14b34fe01fd81157bc7605d999bd3fca2def785d releaseOperatorDeploy: true version: 5.7.2-dev - catalog: control-plane-catalog From 726ae23d9e209f6e182eea95d6cea7830bff4fb3 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Tue, 29 Aug 2023 13:09:01 +0200 Subject: [PATCH 08/55] Update release.yaml --- aws/v19.1.0/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index cdd03173d..b5000ffa4 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -106,7 +106,7 @@ spec: - coredns - vertical-pod-autoscaler-crd name: vertical-pod-autoscaler - version: 3.5.2 + version: 3.5.4 - catalog: default name: vertical-pod-autoscaler-crd version: 2.0.1 @@ -121,7 +121,7 @@ spec: - cilium - coredns name: observability-bundle - version: 0.5.1 + version: 0.7.3 - catalog: default dependsOn: - aws-cloud-controller-manager From 43041eb7c5a949ff2dc1f07e227645e1cc86ea58 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Wed, 30 Aug 2023 12:53:17 +0200 Subject: [PATCH 09/55] Update release.yaml --- aws/v19.1.0/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index b5000ffa4..a8ca23cdd 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -164,7 +164,7 @@ spec: version: 3.0.1 - catalog: control-plane-test-catalog name: cluster-operator - reference: 5.7.1-14b34fe01fd81157bc7605d999bd3fca2def785d + reference: 5.7.1-eeedbe0f280c645ff5926dcd93ceea8cfd520689 releaseOperatorDeploy: true version: 5.7.2-dev - catalog: control-plane-catalog From aaba0f9cf72492e84fb8801b0ac6fbd7fb79776f Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Thu, 31 Aug 2023 08:12:58 +0200 Subject: [PATCH 10/55] Update release.yaml --- aws/v19.1.0/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index a8ca23cdd..5401d2912 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -99,14 +99,14 @@ spec: name: node-exporter version: 1.16.0 - catalog: default - componentVersion: 0.13.0 + componentVersion: 0.14.0 dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: vertical-pod-autoscaler - version: 3.5.4 + version: 4.0.0 - catalog: default name: vertical-pod-autoscaler-crd version: 2.0.1 From c0f5063187ee404af8ec0228b6f8342fd40adf47 Mon Sep 17 00:00:00 2001 From: Pau Date: Fri, 1 Sep 2023 14:43:24 +0200 Subject: [PATCH 11/55] manual --- aws/v19.1.0/release.diff | 12 +++++------- aws/v19.1.0/release.yaml | 14 ++++++-------- 2 files changed, 11 insertions(+), 15 deletions(-) diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 2dbd1d95a..3ef79b6b2 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -36,9 +36,9 @@ spec: spec: - vertical-pod-autoscaler-crd < - name: chart-operator - name: chart-operator version: 2.35.0 version: 2.35.0 - - componentVersion: 1.13.0 - componentVersion: 1.13.0 - name: cilium name: cilium - version: 0.10.0 version: 0.10.0 + - componentVersion: 1.13.0 < - componentVersion: 1.13.6 + name: cilium < name: cilium + version: 0.10.0 < version: 0.11.1 dependsOn: < - aws-cloud-controller-manager < - componentVersion: 1.24.0 - componentVersion: 1.24.0 @@ -133,16 +133,14 @@ spec: spec: - name: app-operator - name: app-operator version: 6.7.0 version: 6.7.0 - name: aws-operator - name: aws-operator - > reference: 14.17.1-patch2 releaseOperatorDeploy: true releaseOperatorDeploy: true - version: 14.17.1 version: 14.17.1 - reference: 14.17.1-patch2 < + version: 14.17.1 < version: 14.21.0 - name: cert-operator - name: cert-operator releaseOperatorDeploy: true releaseOperatorDeploy: true version: 3.0.1 version: 3.0.1 - name: cluster-operator - name: cluster-operator releaseOperatorDeploy: true releaseOperatorDeploy: true - version: 5.6.1 version: 5.6.1 + version: 5.6.1 < version: 5.8.0 - name: containerlinux - name: containerlinux version: 3510.2.0 version: 3510.2.0 - name: etcd - name: etcd diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 5401d2912..705a5b185 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -41,12 +41,12 @@ spec: - catalog: default name: chart-operator version: 2.35.0 - - catalog: default-test - componentVersion: 1.13.0 + - catalog: default + componentVersion: 1.13.6 dependsOn: - aws-cloud-controller-manager name: cilium - version: 0.11.0-d7765d2468ddd9ba6cb8c50fbf468851568bb82e + version: 0.11.1 - catalog: default componentVersion: 1.24.0 dependsOn: @@ -155,18 +155,16 @@ spec: version: 6.7.0 - catalog: control-plane-test-catalog name: aws-operator - reference: 14.19.2-466c72e6cc11ad1a7dbbbd31a4156befe90f9b31 releaseOperatorDeploy: true - version: 14.19.3-eni + version: 14.21.0 - catalog: control-plane-catalog name: cert-operator releaseOperatorDeploy: true version: 3.0.1 - - catalog: control-plane-test-catalog + - catalog: control-plane-catalog name: cluster-operator - reference: 5.7.1-eeedbe0f280c645ff5926dcd93ceea8cfd520689 releaseOperatorDeploy: true - version: 5.7.2-dev + version: 5.8.0 - catalog: control-plane-catalog name: containerlinux version: 3510.2.0 From 97c1b6a96a5a15679f7ee6c7df07a84d42674833 Mon Sep 17 00:00:00 2001 From: Pau Date: Fri, 1 Sep 2023 14:54:14 +0200 Subject: [PATCH 12/55] Update release 19.1.0 --- aws/v19.1.0/README.md | 149 ++++++++++++++++-- aws/v19.1.0/release.diff | 333 +++++++++++++++++++++------------------ aws/v19.1.0/release.yaml | 122 ++++++-------- 3 files changed, 365 insertions(+), 239 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index f97306856..5f5197d65 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -5,6 +5,68 @@ ## Change details +### app-operator [6.8.0](https://github.com/giantswarm/app-operator/releases/tag/v6.8.0) + +#### Added +- Add Service Monitor by default to make it complain with the latest monitoring improvements + + + +### aws-operator [14.21.0](https://github.com/giantswarm/aws-operator/releases/tag/v14.21.0) + +#### Added +- Allow newer flatcar releases for node pools as provided by AWS release. +- Add sigs.k8s.io/cluster-api-provider-aws/role tag to all subnets as preparation for migration to CAPI. + +#### Changed +- Unmanage interfaces for CNI eth[1-9] on workers eth[2-9] on masters +- [cilium eni mode] Only run aws-node, calico and kube-proxy on old nodes during migration to cilium. + + +### cert-operator [3.2.1](https://github.com/giantswarm/cert-operator/releases/tag/v3.2.1) + +#### Fixed +- Fix rule names of PolicyException. + + + +### cluster-operator [5.8.0](https://github.com/giantswarm/cluster-operator/releases/tag/v5.8.0) + +#### Added +- Add ENI mode for Cilium on AWS. +- Consider new control-plane label. +#### Changed +- Propagate `global.podSecurityStandards.enforced` value set to `true` for PSS migration +- Rename function for better readbility. + + + +### containerlinux [3510.2.6](https://www.flatcar-linux.org/releases/#release-3510.2.6) + + _Changes since **Stable 3510.2.5**_ + + #### Security fixes: + + - Linux ([CVE-2022-48502](https://nvd.nist.gov/vuln/detail/CVE-2022-48502), [CVE-2023-20593](https://nvd.nist.gov/vuln/detail/CVE-2023-20593), [CVE-2023-2898](https://nvd.nist.gov/vuln/detail/CVE-2023-2898), [CVE-2023-31248](https://nvd.nist.gov/vuln/detail/CVE-2023-31248), [CVE-2023-35001](https://nvd.nist.gov/vuln/detail/CVE-2023-35001), [CVE-2023-3611](https://nvd.nist.gov/vuln/detail/CVE-2023-3611), [CVE-2023-3776](https://nvd.nist.gov/vuln/detail/CVE-2023-3776), [CVE-2023-38432](https://nvd.nist.gov/vuln/detail/CVE-2023-38432), [CVE-2023-3863](https://nvd.nist.gov/vuln/detail/CVE-2023-3863)) + - linux-firmware ([CVE-2023-20593](https://nvd.nist.gov/vuln/detail/CVE-2023-20593)) + + #### Updates: + + - Linux ([5.15.122](https://lwn.net/Articles/939104) (includes [5.15.121](https://lwn.net/Articles/939016), [5.15.120](https://lwn.net/Articles/937404))) + - ca-certificates ([3.92](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_92.html)) + - linux-firmware ([20230625](https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tag/?h=20230625)) + + + +### etcd [3.5.9](https://github.com/etcd-io/etcd/releases/tag/v3.5.9) + +#### etcd server +- Fix [LeaseTimeToLive API may return keys to clients which have no read permission on the keys](https://github.com/etcd-io/etcd/pull/15815). +#### Dependencies +- Compile binaries using [go 1.19.9](https://github.com/etcd-io/etcd/pull/15822). + + + ### kubernetes [1.24.15](https://github.com/kubernetes/kubernetes/releases/tag/v1.24.15) #### Feature @@ -29,17 +91,25 @@ _Nothing has changed._ -### cert-manager [2.24.1](https://github.com/giantswarm/cert-manager-app/releases/tag/v2.24.1) +### cert-exporter [2.6.0](https://github.com/giantswarm/cert-exporter/releases/tag/v2.6.0) -#### Added -- Add `cluster-autoscaler safe-to-evict` annotation to `controller` and `cainjector` through newly introduced `controller.podAnnotations` and `cainjector.podAnnotations` values. ([#330](https://github.com/giantswarm/cert-manager-app/pull/330)) +#### Changed +- Remove the Exist toleration from deployment. This allows the pod to be rescheduled on a drained node sometimes causing the drain of a node to fail and require a manual fix -### net-exporter [1.16.2](https://github.com/giantswarm/net-exporter/releases/tag/v1.16.2) +### cilium [0.11.1](https://github.com/giantswarm/cilium-app/releases/tag/v0.11.1) #### Changed -- Reduce CPU and Mem requests. +- Create custom CNI config depending on provider to allow bigger customization. +- Bump all manifests to upstream version 1.13.6. + + + +### net-exporter [1.17.0](https://github.com/giantswarm/net-exporter/releases/tag/v1.17.0) + +#### Changed +- Add security context values to make chart comply to PodSecurityStandard restricted profile. @@ -50,18 +120,77 @@ _Nothing has changed._ -### observability-bundle [0.7.1](https://github.com/giantswarm/observability-bundle/releases/tag/v0.7.1) +### vertical-pod-autoscaler [4.0.0](https://github.com/giantswarm/vertical-pod-autoscaler-app/releases/tag/v4.0.0) + +#### Changed +WARNING: this version requires Cilium to run because of the dependency on the CiliumNetworkPolicy CRD +- Upgrade dependency chart to 9.2.0. +- Adjusted the resource and limits to accomodate larger clusters by default +- Adjusted the admission controller to give it more QPS against the API +- Adjusted the updater to give it more QPS against the API +- Adjusted the recommender to give it + - more QPS against the API + - doubling the memory in case of an OOMKilled event + - Using the 95% percentile for the calculation of the CPU usage: should allow to scale up more precisely to account for spikes in CPU consumption of the workload + - Adjusted the resource and limits to accomodate larger clusters by default + - Calculating recommendations only for workloads which do have a VPA custom resource, instead of all workloads + - Removed standard network policies to decrease maintenance burden + - Fixed Cilium Network Policy to allow CRD jobs execution + - Added Cilium Network Policy weight for an early execution + - Disabled VPA for the updater pod otherwise it keeps on getting re-scheduled because the memory consumption varies a lot between reconsiling resources and idle + - Disabled VPA for the recommender pod otherwise it keeps on getting re-scheduled because the memory consumption varies a lot between reconsiling resources and idle + + + +### aws-ebs-csi-driver [2.25.0](https://github.com/giantswarm/aws-ebs-csi-driver-app/releases/tag/v2.25.0) + +#### Changed +- Updated ebs-csi-driver to `v1.21.0` and updated sidecar images. + + + +### cluster-autoscaler [1.24.3](https://github.com/giantswarm/cluster-autoscaler-app/releases/tag/v1.24.3) #### Changed -- Upgrade `promtail-app` to 1.1.1. -- Upgrade `prometheus-operator-app` to 5.0.6. +- Change ScaleDownUtilizationThreshold default from 0.5 to 0.7 +- Update cluster-autoscaler to version `1.24.3`. + + + +### coredns [1.18.1](https://github.com/giantswarm/coredns-app/releases/tag/v1.18.1) + +#### Fixed +- Remove `fallthrough` for reverse zones from kubernetes plugin. -### vertical-pod-autoscaler [3.5.3](https://github.com/giantswarm/vertical-pod-autoscaler-app/releases/tag/v3.5.3) +### external-dns [2.39.0](https://github.com/giantswarm/external-dns-app/releases/tag/v2.39.0) + +#### Changed +- Replace monitoring labels with ServiceMonitor ([#296](https://github.com/giantswarm/external-dns-app/pull/296)). +- Update ATS to 0.4.1 and python deps ([#297](https://github.com/giantswarm/external-dns-app/pull/297)). + + + +### etcd-kubernetes-resources-count-exporter [1.4.0](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter/releases/tag/v1.4.0) + +#### Changed +- Add Max memory (default 500Mi) for VPA. + + + +### observability-bundle [0.7.5](https://github.com/giantswarm/observability-bundle/releases/tag/v0.7.5) #### Added -- Add `cluster-autoscaler safe-to-evict` annotation to `recommender` and `updater` +- Add extraConfig priority support. + + + +### cilium-servicemonitors [0.1.2](https://github.com/giantswarm/cilium-servicemonitors-app/releases/tag/v0.1.2) + +#### Changed +- Drop metrics with high cardinality. +- Increase scrape interval to 60s. diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 3ef79b6b2..7d318ef21 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -1,154 +1,179 @@ -# Generated with: # Generated with: -# devctl release create --name 19.0.0 --base 19.0.0-beta1 --pro | # devctl release create --provider aws --base v19.0.0 --name v1 -apiVersion: release.giantswarm.io/v1alpha1 apiVersion: release.giantswarm.io/v1alpha1 -kind: Release kind: Release -metadata: metadata: - annotations: annotations: - giantswarm.io/docs: https://docs.giantswarm.io/reference/cp giantswarm.io/docs: https://docs.giantswarm.io/reference/cp - creationTimestamp: null creationTimestamp: null - name: v19.0.0 | name: v19.1.0 -spec: spec: - apps: apps: - - componentVersion: 1.24.1 - componentVersion: 1.24.1 - name: aws-cloud-controller-manager name: aws-cloud-controller-manager - version: 1.24.1-gs7 version: 1.24.1-gs7 - dependsOn: < - - vertical-pod-autoscaler-crd < - - componentVersion: 1.15.0 - componentVersion: 1.15.0 - name: aws-ebs-csi-driver name: aws-ebs-csi-driver - version: 2.21.1 version: 2.21.1 - dependsOn: < - - vertical-pod-autoscaler-crd < - - name: cert-exporter - name: cert-exporter - version: 2.5.1 version: 2.5.1 - dependsOn: | - name: cert-manager - - aws-cloud-controller-manager | version: 2.24.1 - - cilium < - - coredns < - - vertical-pod-autoscaler-crd < - - componentVersion: 1.8.2 < - name: cert-manager < - version: 2.21.0 < - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < - - vertical-pod-autoscaler-crd < - - name: chart-operator - name: chart-operator - version: 2.35.0 version: 2.35.0 - - componentVersion: 1.13.0 < - componentVersion: 1.13.6 - name: cilium < name: cilium - version: 0.10.0 < version: 0.11.1 - dependsOn: < - - aws-cloud-controller-manager < - - componentVersion: 1.24.0 - componentVersion: 1.24.0 - name: cluster-autoscaler name: cluster-autoscaler - version: 1.24.0-gs2 version: 1.24.0-gs2 - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < - - vertical-pod-autoscaler-crd < - - componentVersion: 1.9.3 - componentVersion: 1.9.3 - name: coredns name: coredns - version: 1.17.0 version: 1.17.0 - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - componentVersion: 0.11.0 - componentVersion: 0.11.0 - name: external-dns name: external-dns - version: 2.37.1 version: 2.37.1 - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < - - vertical-pod-autoscaler-crd < - - componentVersion: 0.6.1 - componentVersion: 0.6.1 - name: metrics-server name: metrics-server - version: 2.2.0 version: 2.2.0 - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < - - vertical-pod-autoscaler-crd < - - name: net-exporter - name: net-exporter - version: 1.15.0 | version: 1.16.2 - dependsOn: | - name: node-exporter - - aws-cloud-controller-manager | version: 1.16.1 - - cilium | - name: vertical-pod-autoscaler - - coredns | version: 3.5.3 - - vertical-pod-autoscaler-crd < - - componentVersion: 1.3.1 < - name: node-exporter < - version: 1.16.0 < - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < - - vertical-pod-autoscaler-crd < - - componentVersion: 0.13.0 < - name: vertical-pod-autoscaler < - version: 3.5.2 < - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < - - vertical-pod-autoscaler-crd < - - name: vertical-pod-autoscaler-crd - name: vertical-pod-autoscaler-crd - version: 2.0.1 version: 2.0.1 - - name: etcd-kubernetes-resources-count-exporter - name: etcd-kubernetes-resources-count-exporter - version: 1.2.0 version: 1.2.0 - dependsOn: < - - vertical-pod-autoscaler-crd < - - name: observability-bundle - name: observability-bundle - version: 0.5.1 | version: 0.7.1 - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < - - name: k8s-dns-node-cache-app - name: k8s-dns-node-cache-app - version: 2.1.0 version: 2.1.0 - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < - - prometheus-operator-crd < - - vertical-pod-autoscaler-crd < - - name: prometheus-blackbox-exporter - name: prometheus-blackbox-exporter - version: 0.3.2 version: 0.3.2 - dependsOn: < - - aws-cloud-controller-manager < - - cilium < - - coredns < - - vertical-pod-autoscaler-crd < - - name: cilium-servicemonitors - name: cilium-servicemonitors - version: 0.1.1 version: 0.1.1 - dependsOn: < - - prometheus-operator-crd < - - name: irsa-servicemonitors - name: irsa-servicemonitors - version: 0.0.1 version: 0.0.1 - dependsOn: < - - prometheus-operator-crd < - components: components: - - name: app-operator - name: app-operator - version: 6.7.0 version: 6.7.0 - - name: aws-operator - name: aws-operator - releaseOperatorDeploy: true releaseOperatorDeploy: true - version: 14.17.1 < version: 14.21.0 - - name: cert-operator - name: cert-operator - releaseOperatorDeploy: true releaseOperatorDeploy: true - version: 3.0.1 version: 3.0.1 - - name: cluster-operator - name: cluster-operator - releaseOperatorDeploy: true releaseOperatorDeploy: true - version: 5.6.1 < version: 5.8.0 - - name: containerlinux - name: containerlinux - version: 3510.2.0 version: 3510.2.0 - - name: etcd - name: etcd - version: 3.5.7 version: 3.5.7 - - name: kubernetes - name: kubernetes - version: 1.24.13 | version: 1.24.15 - date: "2023-05-17T09:34:06Z" | date: "2023-06-29T12:35:42Z" - state: active state: active -status: status: - inUse: false inUse: false - ready: false ready: false +# Generated with: # Generated with: +# /home/whites/workspace/devctl/devctl release create --overwr | # devctl release create --name 19.1.0 --base 19.0.1 --provider +apiVersion: release.giantswarm.io/v1alpha1 apiVersion: release.giantswarm.io/v1alpha1 +kind: Release kind: Release +metadata: metadata: + annotations: annotations: + giantswarm.io/docs: https://docs.giantswarm.io/reference/c giantswarm.io/docs: https://docs.giantswarm.io/reference/c + creationTimestamp: null creationTimestamp: null + name: v19.0.1 | name: v19.1.0 +spec: spec: + apps: apps: + - componentVersion: 1.24.1 - componentVersion: 1.24.1 + > dependsOn: + > - vertical-pod-autoscaler-crd + name: aws-cloud-controller-manager name: aws-cloud-controller-manager + version: 1.24.1-gs9 version: 1.24.1-gs9 + > - componentVersion: 1.21.0 + dependsOn: dependsOn: + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - componentVersion: 1.15.0 < + name: aws-ebs-csi-driver name: aws-ebs-csi-driver + version: 2.21.1 | version: 2.25.0 + dependsOn: | - dependsOn: + - vertical-pod-autoscaler-crd < + - name: cert-exporter < + version: 2.5.1 < + dependsOn: < + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: cert-exporter + > version: 2.6.0 + - componentVersion: 1.8.2 - componentVersion: 1.8.2 + name: cert-manager < + version: 2.24.1 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: cert-manager + > version: 2.24.1 + - name: chart-operator - name: chart-operator + version: 2.35.0 version: 2.35.0 + - componentVersion: 1.13.0 | - dependsOn: + > - aws-cloud-controller-manager + name: cilium name: cilium + version: 0.11.0 | version: 0.11.1 + > - componentVersion: 1.24.3 + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - componentVersion: 1.24.0 < + name: cluster-autoscaler < + version: 1.24.0-gs3 < + dependsOn: < + - aws-cloud-controller-manager < + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: cluster-autoscaler + > version: 1.24.3 + - componentVersion: 1.9.3 - componentVersion: 1.9.3 + name: coredns < + version: 1.18.0 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + > name: coredns + > version: 1.18.1 + - componentVersion: 0.11.0 - componentVersion: 0.11.0 + name: external-dns < + version: 2.37.1 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: external-dns + > version: 2.39.0 + - componentVersion: 0.6.1 - componentVersion: 0.6.1 + name: metrics-server < + version: 2.2.0 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - name: net-exporter | name: metrics-server + version: 1.15.0 | version: 2.2.0 + dependsOn: | - dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - componentVersion: 1.3.1 | name: net-exporter + name: node-exporter | version: 1.17.0 + version: 1.16.0 | - dependsOn: + dependsOn: < + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - componentVersion: 0.14.0 | name: node-exporter + name: vertical-pod-autoscaler | version: 1.16.1 + version: 3.5.4 | - dependsOn: + dependsOn: < + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: vertical-pod-autoscaler + > version: 4.0.0 + - name: vertical-pod-autoscaler-crd - name: vertical-pod-autoscaler-crd + version: 2.0.1 version: 2.0.1 + - name: etcd-kubernetes-resources-count-exporter | - dependsOn: + version: 1.2.0 < + dependsOn: < + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - name: observability-bundle | name: etcd-kubernetes-resources-count-exporter + version: 0.5.1 | version: 1.4.0 + dependsOn: | - dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - name: k8s-dns-node-cache-app | name: observability-bundle + version: 2.4.0 | version: 0.7.5 + dependsOn: | - dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - prometheus-operator-crd - prometheus-operator-crd + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - name: prometheus-blackbox-exporter | name: k8s-dns-node-cache-app + version: 0.3.2 | version: 2.4.0 + dependsOn: | - dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - name: cilium-servicemonitors | name: prometheus-blackbox-exporter + version: 0.1.1 | version: 0.3.2 + dependsOn: | - dependsOn: + - prometheus-operator-crd - prometheus-operator-crd + - name: irsa-servicemonitors | name: cilium-servicemonitors + version: 0.0.1 | version: 0.1.2 + dependsOn: | - dependsOn: + - prometheus-operator-crd - prometheus-operator-crd + > name: irsa-servicemonitors + > version: 0.0.1 + components: components: + - name: app-operator - name: app-operator + version: 6.7.0 | version: 6.8.0 + - name: aws-operator - name: aws-operator + releaseOperatorDeploy: true < + version: 14.17.1 < + reference: 14.17.1-patch3 reference: 14.17.1-patch3 + > releaseOperatorDeploy: true + > version: 14.21.0 + - name: cert-operator - name: cert-operator + releaseOperatorDeploy: true releaseOperatorDeploy: true + version: 3.0.1 | version: 3.2.1 + - name: cluster-operator - name: cluster-operator + releaseOperatorDeploy: true < + version: 5.6.1 < + reference: 5.6.1-patch1 reference: 5.6.1-patch1 + > releaseOperatorDeploy: true + > version: 5.8.0 + - name: containerlinux - name: containerlinux + version: 3510.2.0 | version: 3510.2.6 + - name: etcd - name: etcd + version: 3.5.7 | version: 3.5.9 + - name: kubernetes - name: kubernetes + version: 1.24.13 | version: 1.24.15 + date: "2023-08-02T09:59:41Z" | date: "2023-09-01T12:53:28Z" + state: active state: active +status: status: + inUse: false inUse: false + ready: false ready: false diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 705a5b185..d82b4f9b6 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -1,5 +1,5 @@ # Generated with: -# devctl release create --name 19.0.0 --base 19.0.0-beta1 --provider aws --overwrite --app aws-cloud-controller-manager@1.24.1-gs7@1.24.1 --app aws-ebs-csi-driver@2.21.1 --app cert-exporter@2.5.1 --app cert-manager@2.21.0@1.8.2 --app chart-operator@2.35.0 --app cilium@0.10.0@1.13.0 --app cluster-autoscaler@1.24.0-gs2@1.24.0 --app coredns@1.17.0@1.9.3 --app external-dns@2.37.1@0.11.0 --app metrics-server@2.2.0@0.6.1 --app net-exporter@1.15.0 --app node-exporter@1.16.0@1.3.1 --app vertical-pod-autoscaler@3.4.2@0.13.0 --app vertical-pod-autoscaler-crd@2.0.1 --app etcd-kubernetes-resources-count-exporter@1.2.0 --app observability-bundle@0.5.1 --app k8s-dns-node-cache@2.1.0 --app prometheus-blackbox-exporter@0.3.2 --app cilium-servicemonitors@0.1.1 --app irsa-servicemonitors@0.0.1 --component app-operator@6.7.0 --component aws-operator@14.17.1 --component cert-operator@3.0.1 --component cluster-operator@5.6.1 --component containerlinux@3510.2.0 --component etcd@3.5.7 --component kubernetes@1.24.13 +# devctl release create --name 19.1.0 --base 19.0.1 --provider aws --overwrite --app cert-manager@2.24.1 --app cilium@0.11.1 --app observability-bundle@0.7.1 --app vertical-pod-autoscaler@3.5.3 --app node-exporter@1.16.1 --component kubernetes@1.24.15 --component aws-operator@14.21.0 --component cluster-operator@5.8.0 --app vertical-pod-autoscaler@4.0.0 apiVersion: release.giantswarm.io/v1alpha1 kind: Release metadata: @@ -9,28 +9,24 @@ metadata: name: v19.1.0 spec: apps: - - catalog: default - componentVersion: 1.24.1 + - componentVersion: 1.24.1 dependsOn: - vertical-pod-autoscaler-crd name: aws-cloud-controller-manager version: 1.24.1-gs9 - - catalog: default - componentVersion: 1.15.0 + - componentVersion: 1.21.0 dependsOn: - vertical-pod-autoscaler-crd name: aws-ebs-csi-driver - version: 2.21.1 - - catalog: default - dependsOn: + version: 2.25.0 + - dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: cert-exporter - version: 2.5.1 - - catalog: default - componentVersion: 1.8.2 + version: 2.6.0 + - componentVersion: 1.8.2 dependsOn: - aws-cloud-controller-manager - cilium @@ -38,42 +34,35 @@ spec: - vertical-pod-autoscaler-crd name: cert-manager version: 2.24.1 - - catalog: default - name: chart-operator + - name: chart-operator version: 2.35.0 - - catalog: default - componentVersion: 1.13.6 - dependsOn: + - dependsOn: - aws-cloud-controller-manager name: cilium version: 0.11.1 - - catalog: default - componentVersion: 1.24.0 + - componentVersion: 1.24.3 dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: cluster-autoscaler - version: 1.24.0-gs3 - - catalog: default - componentVersion: 1.9.3 + version: 1.24.3 + - componentVersion: 1.9.3 dependsOn: - aws-cloud-controller-manager - cilium name: coredns - version: 1.18.0 - - catalog: default - componentVersion: 0.11.0 + version: 1.18.1 + - componentVersion: 0.11.0 dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: external-dns - version: 2.37.1 - - catalog: default - componentVersion: 0.6.1 + version: 2.39.0 + - componentVersion: 0.6.1 dependsOn: - aws-cloud-controller-manager - cilium @@ -81,49 +70,40 @@ spec: - vertical-pod-autoscaler-crd name: metrics-server version: 2.2.0 - - catalog: default - dependsOn: + - dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: net-exporter - version: 1.15.0 - - catalog: default - componentVersion: 1.3.1 - dependsOn: + version: 1.17.0 + - dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: node-exporter - version: 1.16.0 - - catalog: default - componentVersion: 0.14.0 - dependsOn: + version: 1.16.1 + - dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: vertical-pod-autoscaler version: 4.0.0 - - catalog: default - name: vertical-pod-autoscaler-crd + - name: vertical-pod-autoscaler-crd version: 2.0.1 - - catalog: default - dependsOn: + - dependsOn: - vertical-pod-autoscaler-crd name: etcd-kubernetes-resources-count-exporter - version: 1.2.0 - - catalog: default - dependsOn: + version: 1.4.0 + - dependsOn: - aws-cloud-controller-manager - cilium - coredns name: observability-bundle - version: 0.7.3 - - catalog: default - dependsOn: + version: 0.7.1 + - dependsOn: - aws-cloud-controller-manager - cilium - coredns @@ -131,51 +111,43 @@ spec: - vertical-pod-autoscaler-crd name: k8s-dns-node-cache-app version: 2.4.0 - - catalog: default - dependsOn: + - dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: prometheus-blackbox-exporter version: 0.3.2 - - catalog: default - dependsOn: + - dependsOn: - prometheus-operator-crd name: cilium-servicemonitors - version: 0.1.1 - - catalog: default - dependsOn: + version: 0.1.2 + - dependsOn: - prometheus-operator-crd name: irsa-servicemonitors version: 0.0.1 components: - - catalog: control-plane-catalog - name: app-operator - version: 6.7.0 - - catalog: control-plane-test-catalog - name: aws-operator + - name: app-operator + version: 6.8.0 + - name: aws-operator + reference: 14.17.1-patch3 releaseOperatorDeploy: true version: 14.21.0 - - catalog: control-plane-catalog - name: cert-operator + - name: cert-operator releaseOperatorDeploy: true - version: 3.0.1 - - catalog: control-plane-catalog - name: cluster-operator + version: 3.2.1 + - name: cluster-operator + reference: 5.6.1-patch1 releaseOperatorDeploy: true version: 5.8.0 - - catalog: control-plane-catalog - name: containerlinux - version: 3510.2.0 - - catalog: control-plane-catalog - name: etcd - version: 3.5.7 - - catalog: control-plane-catalog - name: kubernetes - version: 1.24.13 - date: "2023-08-02T09:59:41Z" - state: wip + - name: containerlinux + version: 3510.2.6 + - name: etcd + version: 3.5.9 + - name: kubernetes + version: 1.24.15 + date: "2023-09-01T12:49:35Z" + state: active status: inUse: false ready: false From e3ffc65efeef531ad457eae94f2369c85cbedab7 Mon Sep 17 00:00:00 2001 From: Pau Date: Fri, 1 Sep 2023 15:34:52 +0200 Subject: [PATCH 13/55] Update observability bundle --- aws/v19.1.0/README.md | 66 +++++++++++++++++++++------------------- aws/v19.1.0/release.diff | 4 +-- aws/v19.1.0/release.yaml | 6 ++-- 3 files changed, 39 insertions(+), 37 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 5f5197d65..ea84dbeb0 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -98,25 +98,18 @@ _Nothing has changed._ -### cilium [0.11.1](https://github.com/giantswarm/cilium-app/releases/tag/v0.11.1) - -#### Changed -- Create custom CNI config depending on provider to allow bigger customization. -- Bump all manifests to upstream version 1.13.6. - - - -### net-exporter [1.17.0](https://github.com/giantswarm/net-exporter/releases/tag/v1.17.0) +### coredns [1.18.1](https://github.com/giantswarm/coredns-app/releases/tag/v1.18.1) -#### Changed -- Add security context values to make chart comply to PodSecurityStandard restricted profile. +#### Fixed +- Remove `fallthrough` for reverse zones from kubernetes plugin. -### node-exporter [1.16.1](https://github.com/giantswarm/node-exporter-app/releases/tag/v1.16.1) +### external-dns [2.39.0](https://github.com/giantswarm/external-dns-app/releases/tag/v2.39.0) #### Changed -- Enable service monitor. +- Replace monitoring labels with ServiceMonitor ([#296](https://github.com/giantswarm/external-dns-app/pull/296)). +- Update ATS to 0.4.1 and python deps ([#297](https://github.com/giantswarm/external-dns-app/pull/297)). @@ -142,55 +135,64 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### aws-ebs-csi-driver [2.25.0](https://github.com/giantswarm/aws-ebs-csi-driver-app/releases/tag/v2.25.0) +### observability-bundle [0.7.3](https://github.com/giantswarm/observability-bundle/releases/tag/v0.7.3) #### Changed -- Updated ebs-csi-driver to `v1.21.0` and updated sidecar images. +- Add extra config for `prometheus-operator-app` to be able to enable cilium. +#### Changed +- Upgrade `prometheus-operator-app` and `prometheus-operator-crd` to 5.1.0. -### cluster-autoscaler [1.24.3](https://github.com/giantswarm/cluster-autoscaler-app/releases/tag/v1.24.3) +### cilium-servicemonitors [0.1.2](https://github.com/giantswarm/cilium-servicemonitors-app/releases/tag/v0.1.2) #### Changed -- Change ScaleDownUtilizationThreshold default from 0.5 to 0.7 -- Update cluster-autoscaler to version `1.24.3`. +- Drop metrics with high cardinality. +- Increase scrape interval to 60s. -### coredns [1.18.1](https://github.com/giantswarm/coredns-app/releases/tag/v1.18.1) +### aws-ebs-csi-driver [2.25.0](https://github.com/giantswarm/aws-ebs-csi-driver-app/releases/tag/v2.25.0) -#### Fixed -- Remove `fallthrough` for reverse zones from kubernetes plugin. +#### Changed +- Updated ebs-csi-driver to `v1.21.0` and updated sidecar images. -### external-dns [2.39.0](https://github.com/giantswarm/external-dns-app/releases/tag/v2.39.0) +### cilium [0.11.1](https://github.com/giantswarm/cilium-app/releases/tag/v0.11.1) #### Changed -- Replace monitoring labels with ServiceMonitor ([#296](https://github.com/giantswarm/external-dns-app/pull/296)). -- Update ATS to 0.4.1 and python deps ([#297](https://github.com/giantswarm/external-dns-app/pull/297)). +- Create custom CNI config depending on provider to allow bigger customization. +- Bump all manifests to upstream version 1.13.6. -### etcd-kubernetes-resources-count-exporter [1.4.0](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter/releases/tag/v1.4.0) +### cluster-autoscaler [1.24.3](https://github.com/giantswarm/cluster-autoscaler-app/releases/tag/v1.24.3) #### Changed -- Add Max memory (default 500Mi) for VPA. +- Change ScaleDownUtilizationThreshold default from 0.5 to 0.7 +- Update cluster-autoscaler to version `1.24.3`. + +### net-exporter [1.17.0](https://github.com/giantswarm/net-exporter/releases/tag/v1.17.0) -### observability-bundle [0.7.5](https://github.com/giantswarm/observability-bundle/releases/tag/v0.7.5) +#### Changed +- Add security context values to make chart comply to PodSecurityStandard restricted profile. -#### Added -- Add extraConfig priority support. +### node-exporter [1.16.1](https://github.com/giantswarm/node-exporter-app/releases/tag/v1.16.1) -### cilium-servicemonitors [0.1.2](https://github.com/giantswarm/cilium-servicemonitors-app/releases/tag/v0.1.2) +#### Changed +- Enable service monitor. + + + +### etcd-kubernetes-resources-count-exporter [1.4.0](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter/releases/tag/v1.4.0) #### Changed -- Drop metrics with high cardinality. -- Increase scrape interval to 60s. +- Add Max memory (default 500Mi) for VPA. diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 7d318ef21..910388460 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -124,7 +124,7 @@ spec: spec: - cilium - cilium - coredns - coredns - name: k8s-dns-node-cache-app | name: observability-bundle - version: 2.4.0 | version: 0.7.5 + version: 2.4.0 | version: 0.7.3 dependsOn: | - dependsOn: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium @@ -172,7 +172,7 @@ spec: spec: version: 3.5.7 | version: 3.5.9 - name: kubernetes - name: kubernetes version: 1.24.13 | version: 1.24.15 - date: "2023-08-02T09:59:41Z" | date: "2023-09-01T12:53:28Z" + date: "2023-08-02T09:59:41Z" | date: "2023-09-01T13:32:54Z" state: active state: active status: status: inUse: false inUse: false diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index d82b4f9b6..51f2173cb 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -1,5 +1,5 @@ # Generated with: -# devctl release create --name 19.1.0 --base 19.0.1 --provider aws --overwrite --app cert-manager@2.24.1 --app cilium@0.11.1 --app observability-bundle@0.7.1 --app vertical-pod-autoscaler@3.5.3 --app node-exporter@1.16.1 --component kubernetes@1.24.15 --component aws-operator@14.21.0 --component cluster-operator@5.8.0 --app vertical-pod-autoscaler@4.0.0 +# devctl release create --name 19.1.0 --base 19.0.1 --provider aws --overwrite --app cert-manager@2.24.1 --app cilium@0.11.1 --app observability-bundle@0.7.3 --app vertical-pod-autoscaler@3.5.3 --app node-exporter@1.16.1 --component kubernetes@1.24.15 --component aws-operator@14.21.0 --component cluster-operator@5.8.0 --app vertical-pod-autoscaler@4.0.0 apiVersion: release.giantswarm.io/v1alpha1 kind: Release metadata: @@ -102,7 +102,7 @@ spec: - cilium - coredns name: observability-bundle - version: 0.7.1 + version: 0.7.3 - dependsOn: - aws-cloud-controller-manager - cilium @@ -146,7 +146,7 @@ spec: version: 3.5.9 - name: kubernetes version: 1.24.15 - date: "2023-09-01T12:49:35Z" + date: "2023-09-01T13:32:54Z" state: active status: inUse: false From baff6ed4d07e1483ab8f1b3d889c1ea7d1bf031c Mon Sep 17 00:00:00 2001 From: Pau Date: Fri, 1 Sep 2023 16:14:29 +0200 Subject: [PATCH 14/55] revert containerlinux --- aws/v19.1.0/README.md | 18 ------------------ aws/v19.1.0/release.diff | 2 +- aws/v19.1.0/release.yaml | 2 +- 3 files changed, 2 insertions(+), 20 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index ea84dbeb0..7fc010b31 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -40,24 +40,6 @@ - Rename function for better readbility. - -### containerlinux [3510.2.6](https://www.flatcar-linux.org/releases/#release-3510.2.6) - - _Changes since **Stable 3510.2.5**_ - - #### Security fixes: - - - Linux ([CVE-2022-48502](https://nvd.nist.gov/vuln/detail/CVE-2022-48502), [CVE-2023-20593](https://nvd.nist.gov/vuln/detail/CVE-2023-20593), [CVE-2023-2898](https://nvd.nist.gov/vuln/detail/CVE-2023-2898), [CVE-2023-31248](https://nvd.nist.gov/vuln/detail/CVE-2023-31248), [CVE-2023-35001](https://nvd.nist.gov/vuln/detail/CVE-2023-35001), [CVE-2023-3611](https://nvd.nist.gov/vuln/detail/CVE-2023-3611), [CVE-2023-3776](https://nvd.nist.gov/vuln/detail/CVE-2023-3776), [CVE-2023-38432](https://nvd.nist.gov/vuln/detail/CVE-2023-38432), [CVE-2023-3863](https://nvd.nist.gov/vuln/detail/CVE-2023-3863)) - - linux-firmware ([CVE-2023-20593](https://nvd.nist.gov/vuln/detail/CVE-2023-20593)) - - #### Updates: - - - Linux ([5.15.122](https://lwn.net/Articles/939104) (includes [5.15.121](https://lwn.net/Articles/939016), [5.15.120](https://lwn.net/Articles/937404))) - - ca-certificates ([3.92](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_92.html)) - - linux-firmware ([20230625](https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tag/?h=20230625)) - - - ### etcd [3.5.9](https://github.com/etcd-io/etcd/releases/tag/v3.5.9) #### etcd server diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 910388460..d19425f7e 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -167,7 +167,7 @@ spec: spec: > releaseOperatorDeploy: true > version: 5.8.0 - name: containerlinux - name: containerlinux - version: 3510.2.0 | version: 3510.2.6 + version: 3510.2.0 version: 3510.2.0 - name: etcd - name: etcd version: 3.5.7 | version: 3.5.9 - name: kubernetes - name: kubernetes diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 51f2173cb..401fe265f 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -141,7 +141,7 @@ spec: releaseOperatorDeploy: true version: 5.8.0 - name: containerlinux - version: 3510.2.6 + version: 3510.2.0 - name: etcd version: 3.5.9 - name: kubernetes From 225c7b1555c33cb3a50191679aeb1b2a0ce13fd9 Mon Sep 17 00:00:00 2001 From: Pau Date: Mon, 4 Sep 2023 09:57:24 +0200 Subject: [PATCH 15/55] Add security bundle and audit metrics --- aws/v19.1.0/release.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 401fe265f..7f223558b 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -126,6 +126,20 @@ spec: - prometheus-operator-crd name: irsa-servicemonitors version: 0.0.1 + - dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd + name: security-bundle + version: 0.16.2 + - dependsOn: + - aws-cloud-controller-manager + - cilium + - coredns + - vertical-pod-autoscaler-crd + name: k8s-audit-metrics + version: 0.5.3 components: - name: app-operator version: 6.8.0 From 1b8352e0af73822d1e5c0536dd694f623ecb1022 Mon Sep 17 00:00:00 2001 From: Pau Date: Mon, 4 Sep 2023 10:49:23 +0200 Subject: [PATCH 16/55] Update to latest --- aws/v19.1.0/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 7f223558b..82897c479 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -132,14 +132,14 @@ spec: - coredns - vertical-pod-autoscaler-crd name: security-bundle - version: 0.16.2 + version: 1.0.2 - dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: k8s-audit-metrics - version: 0.5.3 + version: 0.6.1 components: - name: app-operator version: 6.8.0 From 04dfdd689a823c893af8a7ae4ae2e7a0265e65d9 Mon Sep 17 00:00:00 2001 From: Pau Date: Mon, 4 Sep 2023 10:51:08 +0200 Subject: [PATCH 17/55] specify catalog --- aws/v19.1.0/release.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 82897c479..1cb5edb82 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -133,6 +133,7 @@ spec: - vertical-pod-autoscaler-crd name: security-bundle version: 1.0.2 + catalog: giantswarm - dependsOn: - aws-cloud-controller-manager - cilium From 210768aaa3fb4cf80925db45b92c63d24aed3529 Mon Sep 17 00:00:00 2001 From: Pau Date: Mon, 4 Sep 2023 10:59:05 +0200 Subject: [PATCH 18/55] update sec bundle --- aws/v19.1.0/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 1cb5edb82..6419981cf 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -132,7 +132,7 @@ spec: - coredns - vertical-pod-autoscaler-crd name: security-bundle - version: 1.0.2 + version: 0.16.0 catalog: giantswarm - dependsOn: - aws-cloud-controller-manager From 2e0d0b21afe9f95a1d009449b66b6b67ffe79ad9 Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 4 Sep 2023 14:14:57 +0200 Subject: [PATCH 19/55] Update release.yaml --- aws/v19.1.0/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 6419981cf..4d3436144 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -132,7 +132,7 @@ spec: - coredns - vertical-pod-autoscaler-crd name: security-bundle - version: 0.16.0 + version: 0.16.2 catalog: giantswarm - dependsOn: - aws-cloud-controller-manager From 9779c154de1f630a23063c713f30bc58d3ec7552 Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 4 Sep 2023 14:46:47 +0200 Subject: [PATCH 20/55] Add release notes --- aws/v19.1.0/README.md | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 7fc010b31..426bedfd2 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -1,6 +1,33 @@ # :zap: Giant Swarm Release v19.1.0 for AWS :zap: -<< Add description here >> +This is a maintainance release featuring latest 1.24 Kubernetes versions as well as components upgrades. This release also introduces new features which are described in next sections. + +***IAM Permissions Requirements*** +The minimal requirement for the IAM permissions is [Version 3.3.0](https://github.com/giantswarm/giantswarm-aws-account-prerequisites/blob/master/CHANGELOG.md#330---2023-05-11) of [giantswarm-aws-account-prerequisites](https://github.com/giantswarm/giantswarm-aws-account-prerequisites/) repository. + +## Cilium AWS ENI mode + +Following our work on changing the CNI of the Giant Swarm Workload Clusters towards Cilium, we have added a possibility to migrate to the Cilium AWS ENI mode instead of plain Cilium setup. + +> **WARNING:** The Cilium AWS ENI mode can be *ONLY* enabled while upgrading from `18.4.2` to `19.1.0` release. From that point forward the Workload Clusters will be running in Cilium AWS ENI mode and cannot be switched back to our default Cilium that comes with `19.0.0`. Both the Cilium and Cilium AWS ENI mode will receive the same level of support going forward. + +Feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` set on the Cluster CR while on `18.4.2` release prior to `19.1.0` upgrade. When the upgrade is triggered, the undelying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with kube-proxy. + +## Kyverno by default + +This is the release preparing for the migration away from Pod Security Policies (PSP) in favor of Pod Security Standards (PSS) in Kubernetes 1.25. Our `security-bundle` is now installed by default, and will deploy `kyverno` and `restricted` level PSS policies in `audit` mode. These resources are provided in order to allow time to create exceptions for workloads which need them before the policies are changed to `enforce` in a future release. For more information about PSS please read our official [documentation](https://docs.giantswarm.io/advanced/security-policy-enforcement/). Please also take a look at the `kyverno` [documentation](https://docs.giantswarm.io/platform-overview/security/platform-security/#kyverno) to utilize fully its potential. + +## AWSMachineDeployment CR's annotation to change the Flatcar Release Version + +This feature allows customer to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows to set `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or a higher. We have added this feautre to accomodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. + +Please read the detailed description of the designed behaviour of the annotation: +- when setting the annotation the TCNP Stack for the specific node pool is rolled and replaces the OS image +- when removing the annotation the node pool is updated and switches back to the default OS image which is coming from the AWS release +- when upgrading the cluster to a new AWS release, the node pool uses the specific flatcar release from the annotation as long as you don't change by either setting it to a higher version or removing the annotation. + + +> **WARNING:** If you are already running `kyverno` as Giant Swarm Managed App, the installation of `security-bundle` will fail. However the already existing `kyverno` deployment and its configuration can be adopted by the bundle after the upgrade is finished. Please talk to your Account Engineer if you have any questions. ## Change details @@ -177,4 +204,10 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci - Add Max memory (default 500Mi) for VPA. +### security-bundle [0.16.2](https://github.com/giantswarm/security-bundle/releases/tag/v0.16.2) + +#### Changed +- Update to `kyverno` (app) version 0.14.7, introducing exception mechanisms for `chart-operator` and restricting wildcards for Kinds. +- Disabled the default apps `falco`, `trivy`, `trivy-operator` and `starboard-exporter`. This apps can be manually enabled. + From b2dfd70ef1dc2f7dbfb76418f0067cea4f313adf Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 4 Sep 2023 14:47:16 +0200 Subject: [PATCH 21/55] Update README.md --- aws/v19.1.0/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 426bedfd2..a01a0a862 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -17,6 +17,8 @@ Feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` s This is the release preparing for the migration away from Pod Security Policies (PSP) in favor of Pod Security Standards (PSS) in Kubernetes 1.25. Our `security-bundle` is now installed by default, and will deploy `kyverno` and `restricted` level PSS policies in `audit` mode. These resources are provided in order to allow time to create exceptions for workloads which need them before the policies are changed to `enforce` in a future release. For more information about PSS please read our official [documentation](https://docs.giantswarm.io/advanced/security-policy-enforcement/). Please also take a look at the `kyverno` [documentation](https://docs.giantswarm.io/platform-overview/security/platform-security/#kyverno) to utilize fully its potential. +> **WARNING:** If you are already running `kyverno` as Giant Swarm Managed App, the installation of `security-bundle` will fail. However the already existing `kyverno` deployment and its configuration can be adopted by the bundle after the upgrade is finished. Please talk to your Account Engineer if you have any questions. + ## AWSMachineDeployment CR's annotation to change the Flatcar Release Version This feature allows customer to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows to set `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or a higher. We have added this feautre to accomodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. @@ -27,8 +29,6 @@ Please read the detailed description of the designed behaviour of the annotation - when upgrading the cluster to a new AWS release, the node pool uses the specific flatcar release from the annotation as long as you don't change by either setting it to a higher version or removing the annotation. -> **WARNING:** If you are already running `kyverno` as Giant Swarm Managed App, the installation of `security-bundle` will fail. However the already existing `kyverno` deployment and its configuration can be adopted by the bundle after the upgrade is finished. Please talk to your Account Engineer if you have any questions. - ## Change details From 8f6ecdb61468d52539312c91cd34841019734d94 Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 4 Sep 2023 14:50:20 +0200 Subject: [PATCH 22/55] Create announcement.md --- aws/v19.1.0/announcement.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 aws/v19.1.0/announcement.md diff --git a/aws/v19.1.0/announcement.md b/aws/v19.1.0/announcement.md new file mode 100644 index 000000000..16f2908e4 --- /dev/null +++ b/aws/v19.1.0/announcement.md @@ -0,0 +1 @@ +**Workload cluster release v19.1.0 for AWS is available**. This is a maintainance featuring latest Kubernetes versions and component upgrades. The new GS version is a preparation for the migrating away from Pod Security Policies(PSP) in favor of Pod Security Standards(PSS) in Kubernetes 1.25. We have also added two new feautres, the Cilium AWS ENI mode and new annotation for NodePools OS upgrades. Further details can be found in the [release notes](https://docs.giantswarm.io/changes/workload-cluster-releases-azure/releases/aws-v19.1.0/). From 0386b4819f79f21aa71e0082859bd8e6c0ef7a97 Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 4 Sep 2023 15:03:36 +0200 Subject: [PATCH 23/55] Update aws/v19.1.0/README.md Co-authored-by: Quentin Bisson --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index a01a0a862..06b5c04a9 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -1,6 +1,6 @@ # :zap: Giant Swarm Release v19.1.0 for AWS :zap: -This is a maintainance release featuring latest 1.24 Kubernetes versions as well as components upgrades. This release also introduces new features which are described in next sections. +This is a maintenance release featuring latest 1.24 Kubernetes versions as well as components upgrades. This release also introduces new features which are described in next sections. ***IAM Permissions Requirements*** The minimal requirement for the IAM permissions is [Version 3.3.0](https://github.com/giantswarm/giantswarm-aws-account-prerequisites/blob/master/CHANGELOG.md#330---2023-05-11) of [giantswarm-aws-account-prerequisites](https://github.com/giantswarm/giantswarm-aws-account-prerequisites/) repository. From 748fcaa66bbc353eaef9a81e4f9e3054c9813726 Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 4 Sep 2023 15:08:36 +0200 Subject: [PATCH 24/55] Update aws/v19.1.0/README.md Co-authored-by: Quentin Bisson --- aws/v19.1.0/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 06b5c04a9..f767e2203 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -35,7 +35,8 @@ Please read the detailed description of the designed behaviour of the annotation ### app-operator [6.8.0](https://github.com/giantswarm/app-operator/releases/tag/v6.8.0) #### Added -- Add Service Monitor by default to make it complain with the latest monitoring improvements + +- Add Service Monitor by default to make it compliant with the latest monitoring improvements From dde637c9feb2db1efe567efe61528e193635031a Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 4 Sep 2023 15:08:50 +0200 Subject: [PATCH 25/55] Update aws/v19.1.0/README.md Co-authored-by: Quentin Bisson --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index f767e2203..c4301f835 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -65,7 +65,7 @@ Please read the detailed description of the designed behaviour of the annotation - Consider new control-plane label. #### Changed - Propagate `global.podSecurityStandards.enforced` value set to `true` for PSS migration -- Rename function for better readbility. +- Rename function for better readability. ### etcd [3.5.9](https://github.com/etcd-io/etcd/releases/tag/v3.5.9) From a4b46c97d198076b87bad411b1882219292eed69 Mon Sep 17 00:00:00 2001 From: Lorenzo Date: Wed, 6 Sep 2023 11:49:19 +0200 Subject: [PATCH 26/55] Fix typo Co-authored-by: Andreas Sommer --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index c4301f835..5bd43fd8c 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -11,7 +11,7 @@ Following our work on changing the CNI of the Giant Swarm Workload Clusters towa > **WARNING:** The Cilium AWS ENI mode can be *ONLY* enabled while upgrading from `18.4.2` to `19.1.0` release. From that point forward the Workload Clusters will be running in Cilium AWS ENI mode and cannot be switched back to our default Cilium that comes with `19.0.0`. Both the Cilium and Cilium AWS ENI mode will receive the same level of support going forward. -Feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` set on the Cluster CR while on `18.4.2` release prior to `19.1.0` upgrade. When the upgrade is triggered, the undelying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with kube-proxy. +Feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` set on the Cluster CR while on `18.4.2` release prior to `19.1.0` upgrade. When the upgrade is triggered, the underlying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with kube-proxy. ## Kyverno by default From 20b644f274945db62160d9a60a4ae381a9e475f4 Mon Sep 17 00:00:00 2001 From: Lorenzo Date: Wed, 6 Sep 2023 11:49:37 +0200 Subject: [PATCH 27/55] Update aws/v19.1.0/README.md Co-authored-by: Andreas Sommer --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 5bd43fd8c..d879365f1 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -21,7 +21,7 @@ This is the release preparing for the migration away from Pod Security Policies ## AWSMachineDeployment CR's annotation to change the Flatcar Release Version -This feature allows customer to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows to set `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or a higher. We have added this feautre to accomodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. +This feature allows customers to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows setting `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or a higher version. We have added this feature to accommodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run the Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. Please read the detailed description of the designed behaviour of the annotation: - when setting the annotation the TCNP Stack for the specific node pool is rolled and replaces the OS image From f1531732599e35da743c86000491682cd2bd13a9 Mon Sep 17 00:00:00 2001 From: Lorenzo Date: Wed, 6 Sep 2023 11:50:06 +0200 Subject: [PATCH 28/55] Update aws/v19.1.0/README.md Co-authored-by: Andreas Sommer --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index d879365f1..73715d50c 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -24,7 +24,7 @@ This is the release preparing for the migration away from Pod Security Policies This feature allows customers to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows setting `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or a higher version. We have added this feature to accommodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run the Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. Please read the detailed description of the designed behaviour of the annotation: -- when setting the annotation the TCNP Stack for the specific node pool is rolled and replaces the OS image +- when setting the annotation, the TCNP CloudFormation Stack for the specific node pool is rolled and replaces the OS image - when removing the annotation the node pool is updated and switches back to the default OS image which is coming from the AWS release - when upgrading the cluster to a new AWS release, the node pool uses the specific flatcar release from the annotation as long as you don't change by either setting it to a higher version or removing the annotation. From c0536d599b2477956e99ba727abae25d1b92a059 Mon Sep 17 00:00:00 2001 From: Lorenzo Date: Wed, 6 Sep 2023 11:50:15 +0200 Subject: [PATCH 29/55] Update aws/v19.1.0/README.md Co-authored-by: Andreas Sommer --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 73715d50c..a65a026d6 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -25,7 +25,7 @@ This feature allows customers to set an annotation on AWSMachineDeployment CR's Please read the detailed description of the designed behaviour of the annotation: - when setting the annotation, the TCNP CloudFormation Stack for the specific node pool is rolled and replaces the OS image -- when removing the annotation the node pool is updated and switches back to the default OS image which is coming from the AWS release +- when removing the annotation, the node pool is updated and switches back to the default OS image which is coming from the AWS release - when upgrading the cluster to a new AWS release, the node pool uses the specific flatcar release from the annotation as long as you don't change by either setting it to a higher version or removing the annotation. From 01a10bbae7e6a786e8ed35cbaaa8e9f8185828d3 Mon Sep 17 00:00:00 2001 From: Lorenzo Date: Wed, 6 Sep 2023 11:50:29 +0200 Subject: [PATCH 30/55] Update aws/v19.1.0/announcement.md Co-authored-by: Marco Ebert --- aws/v19.1.0/announcement.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/announcement.md b/aws/v19.1.0/announcement.md index 16f2908e4..cacc7502a 100644 --- a/aws/v19.1.0/announcement.md +++ b/aws/v19.1.0/announcement.md @@ -1 +1 @@ -**Workload cluster release v19.1.0 for AWS is available**. This is a maintainance featuring latest Kubernetes versions and component upgrades. The new GS version is a preparation for the migrating away from Pod Security Policies(PSP) in favor of Pod Security Standards(PSS) in Kubernetes 1.25. We have also added two new feautres, the Cilium AWS ENI mode and new annotation for NodePools OS upgrades. Further details can be found in the [release notes](https://docs.giantswarm.io/changes/workload-cluster-releases-azure/releases/aws-v19.1.0/). +**Workload cluster release v19.1.0 for AWS is available**. This is a maintenance release featuring latest Kubernetes versions and component upgrades. The new GS version is a preparation for the migrating away from Pod Security Policies(PSP) in favor of Pod Security Standards(PSS) in Kubernetes 1.25. We have also added two new feautres, the Cilium AWS ENI mode and new annotation for NodePools OS upgrades. Further details can be found in the [release notes](https://docs.giantswarm.io/changes/workload-cluster-releases-azure/releases/aws-v19.1.0/). From e506b51e565dc7989749e142bae2cbf2402dc31f Mon Sep 17 00:00:00 2001 From: Lorenzo Date: Wed, 6 Sep 2023 11:51:04 +0200 Subject: [PATCH 31/55] Update aws/v19.1.0/README.md Co-authored-by: Andreas Sommer --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index a65a026d6..efb66c9e5 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -23,7 +23,7 @@ This is the release preparing for the migration away from Pod Security Policies This feature allows customers to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows setting `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or a higher version. We have added this feature to accommodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run the Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. -Please read the detailed description of the designed behaviour of the annotation: +The annotation behaves as follows: - when setting the annotation, the TCNP CloudFormation Stack for the specific node pool is rolled and replaces the OS image - when removing the annotation, the node pool is updated and switches back to the default OS image which is coming from the AWS release - when upgrading the cluster to a new AWS release, the node pool uses the specific flatcar release from the annotation as long as you don't change by either setting it to a higher version or removing the annotation. From ba260a04516f595f7ba9e9cdeb133a804849860a Mon Sep 17 00:00:00 2001 From: Lorenzo Date: Sat, 9 Sep 2023 14:02:39 +0200 Subject: [PATCH 32/55] Update aws/v19.1.0/README.md Co-authored-by: Marco Ebert --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index efb66c9e5..4bbe382c8 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -15,7 +15,7 @@ Feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` s ## Kyverno by default -This is the release preparing for the migration away from Pod Security Policies (PSP) in favor of Pod Security Standards (PSS) in Kubernetes 1.25. Our `security-bundle` is now installed by default, and will deploy `kyverno` and `restricted` level PSS policies in `audit` mode. These resources are provided in order to allow time to create exceptions for workloads which need them before the policies are changed to `enforce` in a future release. For more information about PSS please read our official [documentation](https://docs.giantswarm.io/advanced/security-policy-enforcement/). Please also take a look at the `kyverno` [documentation](https://docs.giantswarm.io/platform-overview/security/platform-security/#kyverno) to utilize fully its potential. +This release prepares for the migration away from Pod Security Policies (PSP) in favor of Pod Security Standards (PSS) in Kubernetes 1.25. Our `security-bundle` is now installed by default, and will deploy `kyverno` and `restricted` level PSS policies in `audit` mode. These resources are provided in order to allow time to create exceptions for workloads which need them before the policies are changed to `enforce` in a future release. For more information about PSS please read our official [documentation](https://docs.giantswarm.io/advanced/security-policy-enforcement/). Please also take a look at the `kyverno` [documentation](https://docs.giantswarm.io/platform-overview/security/platform-security/#kyverno) to fully utilize its potential. > **WARNING:** If you are already running `kyverno` as Giant Swarm Managed App, the installation of `security-bundle` will fail. However the already existing `kyverno` deployment and its configuration can be adopted by the bundle after the upgrade is finished. Please talk to your Account Engineer if you have any questions. From 819fb59bc361f81b793747482aa16db4aa12defe Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 11 Sep 2023 08:24:12 +0200 Subject: [PATCH 33/55] bump components on 19.1.0 --- aws/v19.1.0/README.md | 152 +++++---------- aws/v19.1.0/announcement.md | 1 - aws/v19.1.0/release.diff | 373 +++++++++++++++++++----------------- aws/v19.1.0/release.yaml | 25 +-- 4 files changed, 260 insertions(+), 291 deletions(-) delete mode 100644 aws/v19.1.0/announcement.md diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 4bbe382c8..816e2aac9 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -1,56 +1,10 @@ # :zap: Giant Swarm Release v19.1.0 for AWS :zap: -This is a maintenance release featuring latest 1.24 Kubernetes versions as well as components upgrades. This release also introduces new features which are described in next sections. - -***IAM Permissions Requirements*** -The minimal requirement for the IAM permissions is [Version 3.3.0](https://github.com/giantswarm/giantswarm-aws-account-prerequisites/blob/master/CHANGELOG.md#330---2023-05-11) of [giantswarm-aws-account-prerequisites](https://github.com/giantswarm/giantswarm-aws-account-prerequisites/) repository. - -## Cilium AWS ENI mode - -Following our work on changing the CNI of the Giant Swarm Workload Clusters towards Cilium, we have added a possibility to migrate to the Cilium AWS ENI mode instead of plain Cilium setup. - -> **WARNING:** The Cilium AWS ENI mode can be *ONLY* enabled while upgrading from `18.4.2` to `19.1.0` release. From that point forward the Workload Clusters will be running in Cilium AWS ENI mode and cannot be switched back to our default Cilium that comes with `19.0.0`. Both the Cilium and Cilium AWS ENI mode will receive the same level of support going forward. - -Feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` set on the Cluster CR while on `18.4.2` release prior to `19.1.0` upgrade. When the upgrade is triggered, the underlying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with kube-proxy. - -## Kyverno by default - -This release prepares for the migration away from Pod Security Policies (PSP) in favor of Pod Security Standards (PSS) in Kubernetes 1.25. Our `security-bundle` is now installed by default, and will deploy `kyverno` and `restricted` level PSS policies in `audit` mode. These resources are provided in order to allow time to create exceptions for workloads which need them before the policies are changed to `enforce` in a future release. For more information about PSS please read our official [documentation](https://docs.giantswarm.io/advanced/security-policy-enforcement/). Please also take a look at the `kyverno` [documentation](https://docs.giantswarm.io/platform-overview/security/platform-security/#kyverno) to fully utilize its potential. - -> **WARNING:** If you are already running `kyverno` as Giant Swarm Managed App, the installation of `security-bundle` will fail. However the already existing `kyverno` deployment and its configuration can be adopted by the bundle after the upgrade is finished. Please talk to your Account Engineer if you have any questions. - -## AWSMachineDeployment CR's annotation to change the Flatcar Release Version - -This feature allows customers to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows setting `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or a higher version. We have added this feature to accommodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run the Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. - -The annotation behaves as follows: -- when setting the annotation, the TCNP CloudFormation Stack for the specific node pool is rolled and replaces the OS image -- when removing the annotation, the node pool is updated and switches back to the default OS image which is coming from the AWS release -- when upgrading the cluster to a new AWS release, the node pool uses the specific flatcar release from the annotation as long as you don't change by either setting it to a higher version or removing the annotation. - +<< Add description here >> ## Change details -### app-operator [6.8.0](https://github.com/giantswarm/app-operator/releases/tag/v6.8.0) - -#### Added - -- Add Service Monitor by default to make it compliant with the latest monitoring improvements - - - -### aws-operator [14.21.0](https://github.com/giantswarm/aws-operator/releases/tag/v14.21.0) - -#### Added -- Allow newer flatcar releases for node pools as provided by AWS release. -- Add sigs.k8s.io/cluster-api-provider-aws/role tag to all subnets as preparation for migration to CAPI. - -#### Changed -- Unmanage interfaces for CNI eth[1-9] on workers eth[2-9] on masters -- [cilium eni mode] Only run aws-node, calico and kube-proxy on old nodes during migration to cilium. - - ### cert-operator [3.2.1](https://github.com/giantswarm/cert-operator/releases/tag/v3.2.1) #### Fixed @@ -65,7 +19,8 @@ The annotation behaves as follows: - Consider new control-plane label. #### Changed - Propagate `global.podSecurityStandards.enforced` value set to `true` for PSS migration -- Rename function for better readability. +- Rename function for better readbility. + ### etcd [3.5.9](https://github.com/etcd-io/etcd/releases/tag/v3.5.9) @@ -77,41 +32,48 @@ The annotation behaves as follows: -### kubernetes [1.24.15](https://github.com/kubernetes/kubernetes/releases/tag/v1.24.15) +### kubernetes [1.24.17](https://github.com/kubernetes/kubernetes/releases/tag/v1.24.17) #### Feature -- Kubernetes 1.24.x is now built with Go 1.19.10 ([#118557](https://github.com/kubernetes/kubernetes/pull/118557), [@puerco](https://github.com/puerco)) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Node, Release, Storage and Testing] +- Kubernetes is now built with Go 1.20.7 ([#119837](https://github.com/kubernetes/kubernetes/pull/119837), [@jeremyrickard](https://github.com/jeremyrickard)) [SIG Apps, Cloud Provider, Node, Release, Storage and Testing] #### Bug or Regression -- Fixes a bug at kube-apiserver start where APIService objects for custom resources could be deleted and recreated. ([#118104](https://github.com/kubernetes/kubernetes/pull/118104), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Testing] -- If `kubeadm reset` finds no etcd member ID for the peer it removes during the `remove-etcd-member` phase, it continues immediately to other phases, instead of retrying the phase for up to 3 minutes before continuing. ([#118192](https://github.com/kubernetes/kubernetes/pull/118192), [@dlipovetsky](https://github.com/dlipovetsky)) [SIG Cluster Lifecycle] -- Kubeadm: fix a bug where the static pod changes detection logic is inconsistent with kubelet ([#118069](https://github.com/kubernetes/kubernetes/pull/118069), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] +- Fixed a bug where clusters that use KMS v1 with skewed API servers on versions v1.24 and v1.25 would see internal errors when attempting to read encrypted data via the v1.24 API servers. ([#119387](https://github.com/kubernetes/kubernetes/pull/119387), [@enj](https://github.com/enj)) [SIG API Machinery and Auth] #### Dependencies #### Added -- github.com/a8m/tree: [10a5fd5](https://github.com/a8m/tree/tree/10a5fd5) -- github.com/dougm/pretty: [2ee9d74](https://github.com/dougm/pretty/tree/2ee9d74) -- github.com/rasky/go-xdr: [4930550](https://github.com/rasky/go-xdr/tree/4930550) -- github.com/vmware/vmw-guestinfo: [25eff15](https://github.com/vmware/vmw-guestinfo/tree/25eff15) +_Nothing has changed._ #### Changed -- github.com/google/uuid: [v1.1.2 → v1.3.0](https://github.com/google/uuid/compare/v1.1.2...v1.3.0) -- github.com/kr/pretty: [v0.2.1 → v0.3.0](https://github.com/kr/pretty/compare/v0.2.1...v0.3.0) -- github.com/rogpeppe/go-internal: [v1.3.0 → v1.6.1](https://github.com/rogpeppe/go-internal/compare/v1.3.0...v1.6.1) -- github.com/vmware/govmomi: [v0.20.3 → v0.30.0](https://github.com/vmware/govmomi/compare/v0.20.3...v0.30.0) +_Nothing has changed._ #### Removed _Nothing has changed._ -### cert-exporter [2.6.0](https://github.com/giantswarm/cert-exporter/releases/tag/v2.6.0) +### app-operator [6.8.0](https://github.com/giantswarm/app-operator/releases/tag/v6.8.0) -#### Changed -- Remove the Exist toleration from deployment. This allows the pod to be rescheduled on a drained node sometimes causing the drain of a node to fail and require a manual fix +#### Added +- Add Service Monitor by default to make it complain with the latest monitoring improvements -### coredns [1.18.1](https://github.com/giantswarm/coredns-app/releases/tag/v1.18.1) +### aws-operator [14.21.0](https://github.com/giantswarm/aws-operator/releases/tag/v14.21.0) -#### Fixed -- Remove `fallthrough` for reverse zones from kubernetes plugin. + + + +### cert-manager [3.3.0](https://github.com/giantswarm/cert-manager-app/releases/tag/v3.3.0) + +⚠️ Attention: Major release [3.0.0](#300---2023-07-26) contains breaking changes in user values! Please make yourself familiar with its changelog! ⚠️ +#### Added +- Add NetworkPolicies for controller and cainjector. ([#354](https://github.com/giantswarm/cert-manager-app/pull/354)) + + + +### cilium [0.12.0](https://github.com/giantswarm/cilium-app/releases/tag/v0.12.0) + +#### Added +- Support creating `CiliumNetworkPolicy` manifests that allow egress requests to DNS and proxy hosts +#### Changed +- Add missing conditional for PSP rendering of default-policies installer job @@ -123,34 +85,18 @@ _Nothing has changed._ -### vertical-pod-autoscaler [4.0.0](https://github.com/giantswarm/vertical-pod-autoscaler-app/releases/tag/v4.0.0) +### node-exporter [1.17.1](https://github.com/giantswarm/node-exporter-app/releases/tag/v1.17.1) #### Changed -WARNING: this version requires Cilium to run because of the dependency on the CiliumNetworkPolicy CRD -- Upgrade dependency chart to 9.2.0. -- Adjusted the resource and limits to accomodate larger clusters by default -- Adjusted the admission controller to give it more QPS against the API -- Adjusted the updater to give it more QPS against the API -- Adjusted the recommender to give it - - more QPS against the API - - doubling the memory in case of an OOMKilled event - - Using the 95% percentile for the calculation of the CPU usage: should allow to scale up more precisely to account for spikes in CPU consumption of the workload - - Adjusted the resource and limits to accomodate larger clusters by default - - Calculating recommendations only for workloads which do have a VPA custom resource, instead of all workloads - - Removed standard network policies to decrease maintenance burden - - Fixed Cilium Network Policy to allow CRD jobs execution - - Added Cilium Network Policy weight for an early execution - - Disabled VPA for the updater pod otherwise it keeps on getting re-scheduled because the memory consumption varies a lot between reconsiling resources and idle - - Disabled VPA for the recommender pod otherwise it keeps on getting re-scheduled because the memory consumption varies a lot between reconsiling resources and idle +- fix apparmor annotation -### observability-bundle [0.7.3](https://github.com/giantswarm/observability-bundle/releases/tag/v0.7.3) +### observability-bundle [0.8.0](https://github.com/giantswarm/observability-bundle/releases/tag/v0.8.0) #### Changed -- Add extra config for `prometheus-operator-app` to be able to enable cilium. -#### Changed -- Upgrade `prometheus-operator-app` and `prometheus-operator-crd` to 5.1.0. +- Upgrade `prometheus-agent` to 0.6.0. +- Upgrade `prometheus-operator-app` and `prometheus-operator-crd` to 6.0.0. @@ -169,11 +115,8 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### cilium [0.11.1](https://github.com/giantswarm/cilium-app/releases/tag/v0.11.1) +### cert-exporter [2.6.0](https://github.com/giantswarm/cert-exporter/releases/tag/v2.6.0) -#### Changed -- Create custom CNI config depending on provider to allow bigger customization. -- Bump all manifests to upstream version 1.13.6. @@ -192,10 +135,25 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### node-exporter [1.16.1](https://github.com/giantswarm/node-exporter-app/releases/tag/v1.16.1) +### vertical-pod-autoscaler [4.0.0](https://github.com/giantswarm/vertical-pod-autoscaler-app/releases/tag/v4.0.0) #### Changed -- Enable service monitor. +WARNING: this version requires Cilium to run because of the dependency on the CiliumNetworkPolicy CRD +- Upgrade dependency chart to 9.2.0. +- Adjusted the resource and limits to accomodate larger clusters by default +- Adjusted the admission controller to give it more QPS against the API +- Adjusted the updater to give it more QPS against the API +- Adjusted the recommender to give it + - more QPS against the API + - doubling the memory in case of an OOMKilled event + - Using the 95% percentile for the calculation of the CPU usage: should allow to scale up more precisely to account for spikes in CPU consumption of the workload + - Adjusted the resource and limits to accomodate larger clusters by default + - Calculating recommendations only for workloads which do have a VPA custom resource, instead of all workloads + - Removed standard network policies to decrease maintenance burden + - Fixed Cilium Network Policy to allow CRD jobs execution + - Added Cilium Network Policy weight for an early execution + - Disabled VPA for the updater pod otherwise it keeps on getting re-scheduled because the memory consumption varies a lot between reconsiling resources and idle + - Disabled VPA for the recommender pod otherwise it keeps on getting re-scheduled because the memory consumption varies a lot between reconsiling resources and idle @@ -205,10 +163,4 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci - Add Max memory (default 500Mi) for VPA. -### security-bundle [0.16.2](https://github.com/giantswarm/security-bundle/releases/tag/v0.16.2) - -#### Changed -- Update to `kyverno` (app) version 0.14.7, introducing exception mechanisms for `chart-operator` and restricting wildcards for Kinds. -- Disabled the default apps `falco`, `trivy`, `trivy-operator` and `starboard-exporter`. This apps can be manually enabled. - diff --git a/aws/v19.1.0/announcement.md b/aws/v19.1.0/announcement.md deleted file mode 100644 index cacc7502a..000000000 --- a/aws/v19.1.0/announcement.md +++ /dev/null @@ -1 +0,0 @@ -**Workload cluster release v19.1.0 for AWS is available**. This is a maintenance release featuring latest Kubernetes versions and component upgrades. The new GS version is a preparation for the migrating away from Pod Security Policies(PSP) in favor of Pod Security Standards(PSS) in Kubernetes 1.25. We have also added two new feautres, the Cilium AWS ENI mode and new annotation for NodePools OS upgrades. Further details can be found in the [release notes](https://docs.giantswarm.io/changes/workload-cluster-releases-azure/releases/aws-v19.1.0/). diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index d19425f7e..648266968 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -1,179 +1,194 @@ -# Generated with: # Generated with: -# /home/whites/workspace/devctl/devctl release create --overwr | # devctl release create --name 19.1.0 --base 19.0.1 --provider -apiVersion: release.giantswarm.io/v1alpha1 apiVersion: release.giantswarm.io/v1alpha1 -kind: Release kind: Release -metadata: metadata: - annotations: annotations: - giantswarm.io/docs: https://docs.giantswarm.io/reference/c giantswarm.io/docs: https://docs.giantswarm.io/reference/c - creationTimestamp: null creationTimestamp: null - name: v19.0.1 | name: v19.1.0 -spec: spec: - apps: apps: - - componentVersion: 1.24.1 - componentVersion: 1.24.1 - > dependsOn: - > - vertical-pod-autoscaler-crd - name: aws-cloud-controller-manager name: aws-cloud-controller-manager - version: 1.24.1-gs9 version: 1.24.1-gs9 - > - componentVersion: 1.21.0 - dependsOn: dependsOn: - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - - componentVersion: 1.15.0 < - name: aws-ebs-csi-driver name: aws-ebs-csi-driver - version: 2.21.1 | version: 2.25.0 - dependsOn: | - dependsOn: - - vertical-pod-autoscaler-crd < - - name: cert-exporter < - version: 2.5.1 < - dependsOn: < - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - > name: cert-exporter - > version: 2.6.0 - - componentVersion: 1.8.2 - componentVersion: 1.8.2 - name: cert-manager < - version: 2.24.1 < - dependsOn: dependsOn: - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - > name: cert-manager - > version: 2.24.1 - - name: chart-operator - name: chart-operator - version: 2.35.0 version: 2.35.0 - - componentVersion: 1.13.0 | - dependsOn: - > - aws-cloud-controller-manager - name: cilium name: cilium - version: 0.11.0 | version: 0.11.1 - > - componentVersion: 1.24.3 - dependsOn: dependsOn: - - aws-cloud-controller-manager - aws-cloud-controller-manager - - componentVersion: 1.24.0 < - name: cluster-autoscaler < - version: 1.24.0-gs3 < - dependsOn: < - - aws-cloud-controller-manager < - - cilium - cilium - - coredns - coredns - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - > name: cluster-autoscaler - > version: 1.24.3 - - componentVersion: 1.9.3 - componentVersion: 1.9.3 - name: coredns < - version: 1.18.0 < - dependsOn: dependsOn: - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - > name: coredns - > version: 1.18.1 - - componentVersion: 0.11.0 - componentVersion: 0.11.0 - name: external-dns < - version: 2.37.1 < - dependsOn: dependsOn: - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - > name: external-dns - > version: 2.39.0 - - componentVersion: 0.6.1 - componentVersion: 0.6.1 - name: metrics-server < - version: 2.2.0 < - dependsOn: dependsOn: - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - - name: net-exporter | name: metrics-server - version: 1.15.0 | version: 2.2.0 - dependsOn: | - dependsOn: - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - - componentVersion: 1.3.1 | name: net-exporter - name: node-exporter | version: 1.17.0 - version: 1.16.0 | - dependsOn: - dependsOn: < - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - - componentVersion: 0.14.0 | name: node-exporter - name: vertical-pod-autoscaler | version: 1.16.1 - version: 3.5.4 | - dependsOn: - dependsOn: < - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - > name: vertical-pod-autoscaler - > version: 4.0.0 - - name: vertical-pod-autoscaler-crd - name: vertical-pod-autoscaler-crd - version: 2.0.1 version: 2.0.1 - - name: etcd-kubernetes-resources-count-exporter | - dependsOn: - version: 1.2.0 < - dependsOn: < - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - - name: observability-bundle | name: etcd-kubernetes-resources-count-exporter - version: 0.5.1 | version: 1.4.0 - dependsOn: | - dependsOn: - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - name: k8s-dns-node-cache-app | name: observability-bundle - version: 2.4.0 | version: 0.7.3 - dependsOn: | - dependsOn: - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - prometheus-operator-crd - prometheus-operator-crd - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - - name: prometheus-blackbox-exporter | name: k8s-dns-node-cache-app - version: 0.3.2 | version: 2.4.0 - dependsOn: | - dependsOn: - - aws-cloud-controller-manager - aws-cloud-controller-manager - - cilium - cilium - - coredns - coredns - - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - - name: cilium-servicemonitors | name: prometheus-blackbox-exporter - version: 0.1.1 | version: 0.3.2 - dependsOn: | - dependsOn: - - prometheus-operator-crd - prometheus-operator-crd - - name: irsa-servicemonitors | name: cilium-servicemonitors - version: 0.0.1 | version: 0.1.2 - dependsOn: | - dependsOn: - - prometheus-operator-crd - prometheus-operator-crd - > name: irsa-servicemonitors - > version: 0.0.1 - components: components: - - name: app-operator - name: app-operator - version: 6.7.0 | version: 6.8.0 - - name: aws-operator - name: aws-operator - releaseOperatorDeploy: true < - version: 14.17.1 < - reference: 14.17.1-patch3 reference: 14.17.1-patch3 - > releaseOperatorDeploy: true - > version: 14.21.0 - - name: cert-operator - name: cert-operator - releaseOperatorDeploy: true releaseOperatorDeploy: true - version: 3.0.1 | version: 3.2.1 - - name: cluster-operator - name: cluster-operator - releaseOperatorDeploy: true < - version: 5.6.1 < - reference: 5.6.1-patch1 reference: 5.6.1-patch1 - > releaseOperatorDeploy: true - > version: 5.8.0 - - name: containerlinux - name: containerlinux - version: 3510.2.0 version: 3510.2.0 - - name: etcd - name: etcd - version: 3.5.7 | version: 3.5.9 - - name: kubernetes - name: kubernetes - version: 1.24.13 | version: 1.24.15 - date: "2023-08-02T09:59:41Z" | date: "2023-09-01T13:32:54Z" - state: active state: active -status: status: - inUse: false inUse: false - ready: false ready: false +# Generated with: # Generated with: +# /home/whites/workspace/devctl/devctl release create --overwri | # /home/whites/workspace/devctl/devctl release create --provide +apiVersion: release.giantswarm.io/v1alpha1 apiVersion: release.giantswarm.io/v1alpha1 +kind: Release kind: Release +metadata: metadata: + annotations: annotations: + giantswarm.io/docs: https://docs.giantswarm.io/reference/cp giantswarm.io/docs: https://docs.giantswarm.io/reference/cp + creationTimestamp: null creationTimestamp: null + name: v19.0.1 | name: v19.1.0 +spec: spec: + apps: apps: + - componentVersion: 1.24.1 - componentVersion: 1.24.1 + > dependsOn: + > - vertical-pod-autoscaler-crd + name: aws-cloud-controller-manager name: aws-cloud-controller-manager + version: 1.24.1-gs9 version: 1.24.1-gs9 + > - componentVersion: 1.21.0 + dependsOn: dependsOn: + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - componentVersion: 1.15.0 < + name: aws-ebs-csi-driver name: aws-ebs-csi-driver + version: 2.21.1 | version: 2.25.0 + dependsOn: | - dependsOn: + - vertical-pod-autoscaler-crd < + - name: cert-exporter < + version: 2.5.1 < + dependsOn: < + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - componentVersion: 1.8.2 | name: cert-exporter + name: cert-manager | version: 2.6.0 + version: 2.24.1 | - componentVersion: 1.12.3 + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: cert-manager + > version: 3.3.0 + - name: chart-operator - name: chart-operator + version: 2.35.0 version: 2.35.0 + - componentVersion: 1.13.0 | - componentVersion: 1.13.6 + name: cilium < + version: 0.11.0 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - componentVersion: 1.24.0 | name: cilium + name: cluster-autoscaler | version: 0.12.0 + version: 1.24.0-gs3 | - componentVersion: 1.24.3 + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: cluster-autoscaler + > version: 1.24.3 + - componentVersion: 1.9.3 - componentVersion: 1.9.3 + name: coredns < + version: 1.18.1 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + > name: coredns + > version: 1.18.1 + - componentVersion: 0.11.0 - componentVersion: 0.11.0 + name: external-dns < + version: 2.37.1 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: external-dns + > version: 2.39.0 + - componentVersion: 0.6.1 - componentVersion: 0.6.1 + name: metrics-server < + version: 2.2.0 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - name: net-exporter | name: metrics-server + version: 1.15.0 | version: 2.2.0 + dependsOn: | - dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: net-exporter + > version: 1.17.0 + - componentVersion: 1.3.1 - componentVersion: 1.3.1 + name: node-exporter < + version: 1.16.0 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: node-exporter + > version: 1.17.1 + - componentVersion: 0.14.0 - componentVersion: 0.14.0 + name: vertical-pod-autoscaler < + version: 3.5.4 < + dependsOn: dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: vertical-pod-autoscaler + > version: 4.0.0 + - name: vertical-pod-autoscaler-crd - name: vertical-pod-autoscaler-crd + version: 2.0.1 version: 2.0.1 + - name: etcd-kubernetes-resources-count-exporter | - dependsOn: + version: 1.2.0 < + dependsOn: < + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - name: observability-bundle | name: etcd-kubernetes-resources-count-exporter + version: 0.5.1 | version: 1.4.0 + dependsOn: | - dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - name: k8s-dns-node-cache-app | name: observability-bundle + version: 2.4.0 | version: 0.8.0 + dependsOn: | - dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - prometheus-operator-crd - prometheus-operator-crd + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - name: prometheus-blackbox-exporter | name: k8s-dns-node-cache-app + version: 0.3.2 | version: 2.4.0 + dependsOn: | - dependsOn: + - aws-cloud-controller-manager - aws-cloud-controller-manager + - cilium - cilium + - coredns - coredns + - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + - name: cilium-servicemonitors | name: prometheus-blackbox-exporter + version: 0.1.1 | version: 0.3.2 + dependsOn: | - dependsOn: + - prometheus-operator-crd - prometheus-operator-crd + - name: irsa-servicemonitors | name: cilium-servicemonitors + version: 0.0.1 | version: 0.1.2 + dependsOn: | - dependsOn: + - prometheus-operator-crd - prometheus-operator-crd + > name: irsa-servicemonitors + > version: 0.0.1 + > - dependsOn: + > - aws-cloud-controller-manager + > - cilium + > - coredns + > - vertical-pod-autoscaler-crd + > name: security-bundle + > version: 0.16.2 + > catalog: giantswarm + > - dependsOn: + > - aws-cloud-controller-manager + > - cilium + > - coredns + > - vertical-pod-autoscaler-crd + > name: k8s-audit-metrics + > version: 0.6.1 + components: components: + - name: app-operator - name: app-operator + version: 6.7.0 | version: 6.8.0 + - name: aws-operator - name: aws-operator + releaseOperatorDeploy: true < + version: 14.17.1 < + reference: 14.17.1-patch3 reference: 14.17.1-patch3 + > releaseOperatorDeploy: true + > version: 14.21.0 + - name: cert-operator - name: cert-operator + releaseOperatorDeploy: true releaseOperatorDeploy: true + version: 3.0.1 | version: 3.2.1 + - name: cluster-operator - name: cluster-operator + releaseOperatorDeploy: true < + version: 5.6.1 < + reference: 5.6.1-patch1 reference: 5.6.1-patch1 + > releaseOperatorDeploy: true + > version: 5.8.0 + - name: containerlinux - name: containerlinux + version: 3510.2.0 version: 3510.2.0 + - name: etcd - name: etcd + version: 3.5.7 | version: 3.5.9 + - name: kubernetes - name: kubernetes + version: 1.24.13 | version: 1.24.17 + date: "2023-08-02T09:59:41Z" | date: "2023-09-11T06:19:34Z" + state: active state: active +status: status: + inUse: false inUse: false + ready: false ready: false diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 4d3436144..f5bb80b3d 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -1,5 +1,5 @@ # Generated with: -# devctl release create --name 19.1.0 --base 19.0.1 --provider aws --overwrite --app cert-manager@2.24.1 --app cilium@0.11.1 --app observability-bundle@0.7.3 --app vertical-pod-autoscaler@3.5.3 --app node-exporter@1.16.1 --component kubernetes@1.24.15 --component aws-operator@14.21.0 --component cluster-operator@5.8.0 --app vertical-pod-autoscaler@4.0.0 +# /home/whites/workspace/devctl/devctl release create --provider aws --base 19.0.1 --name 19.1.0 --component kubernetes@1.24.17 --component containerlinux@3510.2.0 --overwrite apiVersion: release.giantswarm.io/v1alpha1 kind: Release metadata: @@ -26,20 +26,21 @@ spec: - vertical-pod-autoscaler-crd name: cert-exporter version: 2.6.0 - - componentVersion: 1.8.2 + - componentVersion: 1.12.3 dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: cert-manager - version: 2.24.1 + version: 3.3.0 - name: chart-operator version: 2.35.0 - - dependsOn: + - componentVersion: 1.13.6 + dependsOn: - aws-cloud-controller-manager name: cilium - version: 0.11.1 + version: 0.12.0 - componentVersion: 1.24.3 dependsOn: - aws-cloud-controller-manager @@ -77,14 +78,16 @@ spec: - vertical-pod-autoscaler-crd name: net-exporter version: 1.17.0 - - dependsOn: + - componentVersion: 1.3.1 + dependsOn: - aws-cloud-controller-manager - cilium - coredns - vertical-pod-autoscaler-crd name: node-exporter - version: 1.16.1 - - dependsOn: + version: 1.17.1 + - componentVersion: 0.14.0 + dependsOn: - aws-cloud-controller-manager - cilium - coredns @@ -102,7 +105,7 @@ spec: - cilium - coredns name: observability-bundle - version: 0.7.3 + version: 0.8.0 - dependsOn: - aws-cloud-controller-manager - cilium @@ -160,8 +163,8 @@ spec: - name: etcd version: 3.5.9 - name: kubernetes - version: 1.24.15 - date: "2023-09-01T13:32:54Z" + version: 1.24.17 + date: "2023-09-11T06:19:34Z" state: active status: inUse: false From 41883eb669554188950e607fb32c29c5fc97d9d5 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 11 Sep 2023 08:29:51 +0200 Subject: [PATCH 34/55] bump components on 19.1.0 --- aws/v19.1.0/README.md | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 816e2aac9..77fc4ef27 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -1,6 +1,32 @@ # :zap: Giant Swarm Release v19.1.0 for AWS :zap: -<< Add description here >> +This is a maintenance release featuring latest 1.24 Kubernetes versions as well as components upgrades. This release also introduces new features which are described in next sections. + +***IAM Permissions Requirements*** +The minimal requirement for the IAM permissions is [Version 3.3.0](https://github.com/giantswarm/giantswarm-aws-account-prerequisites/blob/master/CHANGELOG.md#330---2023-05-11) of [giantswarm-aws-account-prerequisites](https://github.com/giantswarm/giantswarm-aws-account-prerequisites/) repository. + +## Cilium AWS ENI mode + +Following our work on changing the CNI of the Giant Swarm Workload Clusters towards Cilium, we have added a possibility to migrate to the Cilium AWS ENI mode instead of plain Cilium setup. + +> **WARNING:** The Cilium AWS ENI mode can be *ONLY* enabled while upgrading from `18.4.2` to `19.1.0` release. From that point forward the Workload Clusters will be running in Cilium AWS ENI mode and cannot be switched back to our default Cilium that comes with `19.0.0`. Both the Cilium and Cilium AWS ENI mode will receive the same level of support going forward. + +Feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` set on the Cluster CR while on `18.4.2` release prior to `19.1.0` upgrade. When the upgrade is triggered, the underlying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with kube-proxy. + +## Kyverno by default + +This release prepares for the migration away from Pod Security Policies (PSP) in favor of Pod Security Standards (PSS) in Kubernetes 1.25. Our `security-bundle` is now installed by default, and will deploy `kyverno` and `restricted` level PSS policies in `audit` mode. These resources are provided in order to allow time to create exceptions for workloads which need them before the policies are changed to `enforce` in a future release. For more information about PSS please read our official [documentation](https://docs.giantswarm.io/advanced/security-policy-enforcement/). Please also take a look at the `kyverno` [documentation](https://docs.giantswarm.io/platform-overview/security/platform-security/#kyverno) to fully utilize its potential. + +> **WARNING:** If you are already running `kyverno` as Giant Swarm Managed App, the installation of `security-bundle` will fail. However the already existing `kyverno` deployment and its configuration can be adopted by the bundle after the upgrade is finished. Please talk to your Account Engineer if you have any questions. + +## AWSMachineDeployment CR's annotation to change the Flatcar Release Version + +This feature allows customers to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows setting `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or a higher version. We have added this feature to accommodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run the Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. + +The annotation behaves as follows: +- when setting the annotation, the TCNP CloudFormation Stack for the specific node pool is rolled and replaces the OS image +- when removing the annotation, the node pool is updated and switches back to the default OS image which is coming from the AWS release +- when upgrading the cluster to a new AWS release, the node pool uses the specific flatcar release from the annotation as long as you don't change by either setting it to a higher version or removing the annotation. ## Change details From 127ee4f1aa70113a7519e0f72d75cc88829a033b Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 11 Sep 2023 10:05:50 +0200 Subject: [PATCH 35/55] fix release --- aws/v19.1.0/release.diff | 16 ++++++---------- aws/v19.1.0/release.yaml | 2 -- 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 648266968..073a8ce41 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -167,20 +167,16 @@ spec: spec: - name: app-operator - name: app-operator version: 6.7.0 | version: 6.8.0 - name: aws-operator - name: aws-operator - releaseOperatorDeploy: true < - version: 14.17.1 < - reference: 14.17.1-patch3 reference: 14.17.1-patch3 - > releaseOperatorDeploy: true - > version: 14.21.0 + releaseOperatorDeploy: true releaseOperatorDeploy: true + version: 14.17.1 | version: 14.21.0 + reference: 14.17.1-patch3 < - name: cert-operator - name: cert-operator releaseOperatorDeploy: true releaseOperatorDeploy: true version: 3.0.1 | version: 3.2.1 - name: cluster-operator - name: cluster-operator - releaseOperatorDeploy: true < - version: 5.6.1 < - reference: 5.6.1-patch1 reference: 5.6.1-patch1 - > releaseOperatorDeploy: true - > version: 5.8.0 + releaseOperatorDeploy: true releaseOperatorDeploy: true + version: 5.6.1 | version: 5.8.0 + reference: 5.6.1-patch1 < - name: containerlinux - name: containerlinux version: 3510.2.0 version: 3510.2.0 - name: etcd - name: etcd diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index f5bb80b3d..4b6f04eaa 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -148,14 +148,12 @@ spec: - name: app-operator version: 6.8.0 - name: aws-operator - reference: 14.17.1-patch3 releaseOperatorDeploy: true version: 14.21.0 - name: cert-operator releaseOperatorDeploy: true version: 3.2.1 - name: cluster-operator - reference: 5.6.1-patch1 releaseOperatorDeploy: true version: 5.8.0 - name: containerlinux From a80a886d8273e7e6a1e5b2a1bec6391dff6b7ef5 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 11 Sep 2023 10:31:28 +0200 Subject: [PATCH 36/55] add announcement --- aws/v19.1.0/announcement.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 aws/v19.1.0/announcement.md diff --git a/aws/v19.1.0/announcement.md b/aws/v19.1.0/announcement.md new file mode 100644 index 000000000..cacc7502a --- /dev/null +++ b/aws/v19.1.0/announcement.md @@ -0,0 +1 @@ +**Workload cluster release v19.1.0 for AWS is available**. This is a maintenance release featuring latest Kubernetes versions and component upgrades. The new GS version is a preparation for the migrating away from Pod Security Policies(PSP) in favor of Pod Security Standards(PSS) in Kubernetes 1.25. We have also added two new feautres, the Cilium AWS ENI mode and new annotation for NodePools OS upgrades. Further details can be found in the [release notes](https://docs.giantswarm.io/changes/workload-cluster-releases-azure/releases/aws-v19.1.0/). From 11cee39a65f98cd0615dfc7361030d0fa1f94149 Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 11 Sep 2023 11:18:51 +0200 Subject: [PATCH 37/55] Update README.md --- aws/v19.1.0/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 77fc4ef27..c2272b607 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -11,7 +11,7 @@ Following our work on changing the CNI of the Giant Swarm Workload Clusters towa > **WARNING:** The Cilium AWS ENI mode can be *ONLY* enabled while upgrading from `18.4.2` to `19.1.0` release. From that point forward the Workload Clusters will be running in Cilium AWS ENI mode and cannot be switched back to our default Cilium that comes with `19.0.0`. Both the Cilium and Cilium AWS ENI mode will receive the same level of support going forward. -Feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` set on the Cluster CR while on `18.4.2` release prior to `19.1.0` upgrade. When the upgrade is triggered, the underlying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with kube-proxy. +This feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` set on the Cluster CR while on `18.4.2` release prior to `19.1.0` upgrade. When the upgrade is triggered, the underlying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with `kube-proxy`. ## Kyverno by default @@ -21,7 +21,7 @@ This release prepares for the migration away from Pod Security Policies (PSP) in ## AWSMachineDeployment CR's annotation to change the Flatcar Release Version -This feature allows customers to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows setting `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or a higher version. We have added this feature to accommodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run the Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. +This feature allows customers to set an annotation on AWSMachineDeployment CR's to change the Flatcar Release Version. For now it only allows setting `alpha.giantswarm.io/flatcar-release-version: "3689.0.0"` or higher version. We have added this feature to accommodate the issues with Cilium CNI high CPU usage on small clusters. This feature is solely to enable customers to run the Flatcar `alpha` channel which consists of the `kernel 6` version that fixes the issue, while waiting for a `stable` Flatcar release. The annotation behaves as follows: - when setting the annotation, the TCNP CloudFormation Stack for the specific node pool is rolled and replaces the OS image From b970990e0a92794f87e9d7e8dc8bc357fb6db5ab Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 11 Sep 2023 11:20:09 +0200 Subject: [PATCH 38/55] Update announcement.md --- aws/v19.1.0/announcement.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/announcement.md b/aws/v19.1.0/announcement.md index cacc7502a..3d3f25b2d 100644 --- a/aws/v19.1.0/announcement.md +++ b/aws/v19.1.0/announcement.md @@ -1 +1 @@ -**Workload cluster release v19.1.0 for AWS is available**. This is a maintenance release featuring latest Kubernetes versions and component upgrades. The new GS version is a preparation for the migrating away from Pod Security Policies(PSP) in favor of Pod Security Standards(PSS) in Kubernetes 1.25. We have also added two new feautres, the Cilium AWS ENI mode and new annotation for NodePools OS upgrades. Further details can be found in the [release notes](https://docs.giantswarm.io/changes/workload-cluster-releases-azure/releases/aws-v19.1.0/). +**Workload cluster release v19.1.0 for AWS is available**. This is a maintenance release featuring latest Kubernetes versions and component upgrades. The new GS version is a preparation for the migration away from Pod Security Policies (PSP) in favor of Pod Security Standards(PSS) in Kubernetes 1.25. We have also added two new feautres: the Cilium AWS ENI mode and new annotation for NodePools OS upgrades. Further details can be found in the [release notes](https://docs.giantswarm.io/changes/workload-cluster-releases-azure/releases/aws-v19.1.0/). From ec47c1e11e0d2c1f14d1046ff5879be9f2b9e67a Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 11 Sep 2023 12:54:50 +0200 Subject: [PATCH 39/55] Update aws/v19.1.0/README.md Co-authored-by: Fernando Ripoll --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index c2272b607..39764b385 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -88,7 +88,7 @@ _Nothing has changed._ ### cert-manager [3.3.0](https://github.com/giantswarm/cert-manager-app/releases/tag/v3.3.0) -⚠️ Attention: Major release [3.0.0](#300---2023-07-26) contains breaking changes in user values! Please make yourself familiar with its changelog! ⚠️ +⚠️ Attention: Major release [3.0.0](#300---2023-07-26) contains breaking changes in user values! Please make sure you [read about the upgrade instructions](https://github.com/giantswarm/cert-manager-app/blob/main/docs/upgrading.md)! ⚠️ #### Added - Add NetworkPolicies for controller and cainjector. ([#354](https://github.com/giantswarm/cert-manager-app/pull/354)) From dc7d2026052ff62822fb59834413102933522fd9 Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 11 Sep 2023 13:45:07 +0200 Subject: [PATCH 40/55] Update aws/v19.1.0/README.md Co-authored-by: Cedric Kaufmann <60580186+ced0ps@users.noreply.github.com> --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 39764b385..014c42730 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -9,7 +9,7 @@ The minimal requirement for the IAM permissions is [Version 3.3.0](https://githu Following our work on changing the CNI of the Giant Swarm Workload Clusters towards Cilium, we have added a possibility to migrate to the Cilium AWS ENI mode instead of plain Cilium setup. -> **WARNING:** The Cilium AWS ENI mode can be *ONLY* enabled while upgrading from `18.4.2` to `19.1.0` release. From that point forward the Workload Clusters will be running in Cilium AWS ENI mode and cannot be switched back to our default Cilium that comes with `19.0.0`. Both the Cilium and Cilium AWS ENI mode will receive the same level of support going forward. +> **WARNING:** The Cilium AWS ENI mode can *ONLY* be enabled while upgrading from `18.4.2` to `19.1.0` release. From that point forward the Workload Clusters will be running in Cilium AWS ENI mode and cannot be switched back to our default Cilium that comes with `19.0.0`. Both the Cilium and Cilium AWS ENI mode will receive the same level of support going forward. This feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` set on the Cluster CR while on `18.4.2` release prior to `19.1.0` upgrade. When the upgrade is triggered, the underlying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with `kube-proxy`. From ab2599b01eb8676a655b88109697a808613d996d Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Mon, 11 Sep 2023 13:50:13 +0200 Subject: [PATCH 41/55] Update aws/v19.1.0/README.md Co-authored-by: Cedric Kaufmann <60580186+ced0ps@users.noreply.github.com> --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 014c42730..879913e1a 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -11,7 +11,7 @@ Following our work on changing the CNI of the Giant Swarm Workload Clusters towa > **WARNING:** The Cilium AWS ENI mode can *ONLY* be enabled while upgrading from `18.4.2` to `19.1.0` release. From that point forward the Workload Clusters will be running in Cilium AWS ENI mode and cannot be switched back to our default Cilium that comes with `19.0.0`. Both the Cilium and Cilium AWS ENI mode will receive the same level of support going forward. -This feature can be enabled via an annotation `cilium.giantswarm.io/ipam-mode: eni` set on the Cluster CR while on `18.4.2` release prior to `19.1.0` upgrade. When the upgrade is triggered, the underlying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with `kube-proxy`. +This feature can be enabled via the annotation `cilium.giantswarm.io/ipam-mode: eni`, set on the Cluster CR, while on `18.4.2` release and prior to `19.1.0` upgrade. When the upgrade is triggered, the underlying infrastructure will choose to continue with the [Cilium AWS ENI mode](https://docs.cilium.io/en/latest/network/concepts/ipam/eni/). This is meant for the users that do not want to migrate any of the underlying network infrastructure that has been linked with the Giant Swarm Workload Clusters. The network setup after the upgrade will be the same as while running `aws-cni` with `kube-proxy`. ## Kyverno by default From 387d9c00ea6ca06cb567282d67a7783df4551081 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 11 Sep 2023 16:23:22 +0200 Subject: [PATCH 42/55] bump flatcar and aws operator --- aws/v19.1.0/README.md | 108 +++++++++++++++++++++++---------------- aws/v19.1.0/release.diff | 23 ++------- aws/v19.1.0/release.yaml | 10 ++-- 3 files changed, 74 insertions(+), 67 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 879913e1a..be105c9b4 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -31,24 +31,6 @@ The annotation behaves as follows: ## Change details -### cert-operator [3.2.1](https://github.com/giantswarm/cert-operator/releases/tag/v3.2.1) - -#### Fixed -- Fix rule names of PolicyException. - - - -### cluster-operator [5.8.0](https://github.com/giantswarm/cluster-operator/releases/tag/v5.8.0) - -#### Added -- Add ENI mode for Cilium on AWS. -- Consider new control-plane label. -#### Changed -- Propagate `global.podSecurityStandards.enforced` value set to `true` for PSS migration -- Rename function for better readbility. - - - ### etcd [3.5.9](https://github.com/etcd-io/etcd/releases/tag/v3.5.9) #### etcd server @@ -81,33 +63,55 @@ _Nothing has changed._ -### aws-operator [14.21.0](https://github.com/giantswarm/aws-operator/releases/tag/v14.21.0) +### aws-operator [14.22.0](https://github.com/giantswarm/aws-operator/releases/tag/v14.22.0) +#### Changed +- Get AMI data from helm value rather than from hardcoded string in the code. -### cert-manager [3.3.0](https://github.com/giantswarm/cert-manager-app/releases/tag/v3.3.0) ⚠️ Attention: Major release [3.0.0](#300---2023-07-26) contains breaking changes in user values! Please make sure you [read about the upgrade instructions](https://github.com/giantswarm/cert-manager-app/blob/main/docs/upgrading.md)! ⚠️ #### Added - Add NetworkPolicies for controller and cainjector. ([#354](https://github.com/giantswarm/cert-manager-app/pull/354)) +#### Fixed +- Fix rule names of PolicyException. -### cilium [0.12.0](https://github.com/giantswarm/cilium-app/releases/tag/v0.12.0) + +### cluster-operator [5.8.0](https://github.com/giantswarm/cluster-operator/releases/tag/v5.8.0) #### Added -- Support creating `CiliumNetworkPolicy` manifests that allow egress requests to DNS and proxy hosts +- Add ENI mode for Cilium on AWS. +- Consider new control-plane label. #### Changed -- Add missing conditional for PSP rendering of default-policies installer job +- Propagate `global.podSecurityStandards.enforced` value set to `true` for PSS migration +- Rename function for better readbility. -### external-dns [2.39.0](https://github.com/giantswarm/external-dns-app/releases/tag/v2.39.0) +### containerlinux [3510.2.7](https://www.flatcar-linux.org/releases/#release-3510.2.7) + + _Changes since **Stable 3510.2.6**_ + + #### Security fixes: + + - Linux ([CVE-2022-40982](https://nvd.nist.gov/vuln/detail/CVE-2022-40982), [CVE-2022-41804](https://nvd.nist.gov/vuln/detail/CVE-2022-41804), [CVE-2023-1206](https://nvd.nist.gov/vuln/detail/CVE-2023-1206), [CVE-2023-20569](https://nvd.nist.gov/vuln/detail/CVE-2023-20569), [CVE-2023-4004](https://nvd.nist.gov/vuln/detail/CVE-2023-4004), [CVE-2023-4147](https://nvd.nist.gov/vuln/detail/CVE-2023-4147), [CVE-2023-20569](https://nvd.nist.gov/vuln/detail/CVE-2023-20569), [CVE-2023-23908](https://nvd.nist.gov/vuln/detail/CVE-2023-23908)) + + #### Bug fixes: + + - Fixed the restart of Systemd services when the main process is being killed by a SIGHUP signal ([flatcar#1157](https://github.com/flatcar/Flatcar/issues/1157)) + + #### Updates: + + - Linux ([5.15.125](https://lwn.net/Articles/940801) (includes [5.15.124](https://lwn.net/Articles/940339), [5.15.123](https://lwn.net/Articles/939424))) + + +### net-exporter [1.17.0](https://github.com/giantswarm/net-exporter/releases/tag/v1.17.0) #### Changed -- Replace monitoring labels with ServiceMonitor ([#296](https://github.com/giantswarm/external-dns-app/pull/296)). -- Update ATS to 0.4.1 and python deps ([#297](https://github.com/giantswarm/external-dns-app/pull/297)). +- Add security context values to make chart comply to PodSecurityStandard restricted profile. @@ -118,11 +122,10 @@ _Nothing has changed._ -### observability-bundle [0.8.0](https://github.com/giantswarm/observability-bundle/releases/tag/v0.8.0) +### etcd-kubernetes-resources-count-exporter [1.4.0](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter/releases/tag/v1.4.0) #### Changed -- Upgrade `prometheus-agent` to 0.6.0. -- Upgrade `prometheus-operator-app` and `prometheus-operator-crd` to 6.0.0. +- Add Max memory (default 500Mi) for VPA. @@ -134,30 +137,25 @@ _Nothing has changed._ -### aws-ebs-csi-driver [2.25.0](https://github.com/giantswarm/aws-ebs-csi-driver-app/releases/tag/v2.25.0) - -#### Changed -- Updated ebs-csi-driver to `v1.21.0` and updated sidecar images. - - - ### cert-exporter [2.6.0](https://github.com/giantswarm/cert-exporter/releases/tag/v2.6.0) -### cluster-autoscaler [1.24.3](https://github.com/giantswarm/cluster-autoscaler-app/releases/tag/v1.24.3) +### cilium [0.12.0](https://github.com/giantswarm/cilium-app/releases/tag/v0.12.0) +#### Added +- Support creating `CiliumNetworkPolicy` manifests that allow egress requests to DNS and proxy hosts #### Changed -- Change ScaleDownUtilizationThreshold default from 0.5 to 0.7 -- Update cluster-autoscaler to version `1.24.3`. +- Add missing conditional for PSP rendering of default-policies installer job -### net-exporter [1.17.0](https://github.com/giantswarm/net-exporter/releases/tag/v1.17.0) +### external-dns [2.39.0](https://github.com/giantswarm/external-dns-app/releases/tag/v2.39.0) #### Changed -- Add security context values to make chart comply to PodSecurityStandard restricted profile. +- Replace monitoring labels with ServiceMonitor ([#296](https://github.com/giantswarm/external-dns-app/pull/296)). +- Update ATS to 0.4.1 and python deps ([#297](https://github.com/giantswarm/external-dns-app/pull/297)). @@ -183,10 +181,34 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### etcd-kubernetes-resources-count-exporter [1.4.0](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter/releases/tag/v1.4.0) +### observability-bundle [0.8.0](https://github.com/giantswarm/observability-bundle/releases/tag/v0.8.0) #### Changed -- Add Max memory (default 500Mi) for VPA. +- Upgrade `prometheus-agent` to 0.6.0. +- Upgrade `prometheus-operator-app` and `prometheus-operator-crd` to 6.0.0. + + + +### aws-ebs-csi-driver [2.25.0](https://github.com/giantswarm/aws-ebs-csi-driver-app/releases/tag/v2.25.0) + +#### Changed +- Updated ebs-csi-driver to `v1.21.0` and updated sidecar images. + + + +### cert-manager [3.3.0](https://github.com/giantswarm/cert-manager-app/releases/tag/v3.3.0) + +⚠️ Attention: Major release [3.0.0](#300---2023-07-26) contains breaking changes in user values! Please make yourself familiar with its changelog! ⚠️ +#### Added +- Add NetworkPolicies for controller and cainjector. ([#354](https://github.com/giantswarm/cert-manager-app/pull/354)) + + + +### cluster-autoscaler [1.24.3](https://github.com/giantswarm/cluster-autoscaler-app/releases/tag/v1.24.3) + +#### Changed +- Change ScaleDownUtilizationThreshold default from 0.5 to 0.7 +- Update cluster-autoscaler to version `1.24.3`. diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 073a8ce41..fad3e4329 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -6,7 +6,7 @@ metadata: metadata: annotations: annotations: giantswarm.io/docs: https://docs.giantswarm.io/reference/cp giantswarm.io/docs: https://docs.giantswarm.io/reference/cp creationTimestamp: null creationTimestamp: null - name: v19.0.1 | name: v19.1.0 + name: v19.0.1 | name: v19.1.0-whites spec: spec: apps: apps: - componentVersion: 1.24.1 - componentVersion: 1.24.1 @@ -148,27 +148,12 @@ spec: spec: - prometheus-operator-crd - prometheus-operator-crd > name: irsa-servicemonitors > version: 0.0.1 - > - dependsOn: - > - aws-cloud-controller-manager - > - cilium - > - coredns - > - vertical-pod-autoscaler-crd - > name: security-bundle - > version: 0.16.2 - > catalog: giantswarm - > - dependsOn: - > - aws-cloud-controller-manager - > - cilium - > - coredns - > - vertical-pod-autoscaler-crd - > name: k8s-audit-metrics - > version: 0.6.1 components: components: - name: app-operator - name: app-operator version: 6.7.0 | version: 6.8.0 - name: aws-operator - name: aws-operator releaseOperatorDeploy: true releaseOperatorDeploy: true - version: 14.17.1 | version: 14.21.0 + version: 14.17.1 | version: 14.22.0 reference: 14.17.1-patch3 < - name: cert-operator - name: cert-operator releaseOperatorDeploy: true releaseOperatorDeploy: true @@ -178,12 +163,12 @@ spec: spec: version: 5.6.1 | version: 5.8.0 reference: 5.6.1-patch1 < - name: containerlinux - name: containerlinux - version: 3510.2.0 version: 3510.2.0 + version: 3510.2.0 | version: 3510.2.7 - name: etcd - name: etcd version: 3.5.7 | version: 3.5.9 - name: kubernetes - name: kubernetes version: 1.24.13 | version: 1.24.17 - date: "2023-08-02T09:59:41Z" | date: "2023-09-11T06:19:34Z" + date: "2023-08-02T09:59:41Z" | date: "2023-09-11T09:45:05Z" state: active state: active status: status: inUse: false inUse: false diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 4b6f04eaa..72cddc07b 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -1,12 +1,12 @@ # Generated with: -# /home/whites/workspace/devctl/devctl release create --provider aws --base 19.0.1 --name 19.1.0 --component kubernetes@1.24.17 --component containerlinux@3510.2.0 --overwrite +# /home/whites/workspace/devctl/devctl release create --provider aws --base 19.0.1 --name 19.1.0 --component kubernetes@1.24.17 --component containerlinux@3510.2.7 --overwrite apiVersion: release.giantswarm.io/v1alpha1 kind: Release metadata: annotations: giantswarm.io/docs: https://docs.giantswarm.io/reference/cp-k8s-api/releases.release.giantswarm.io/ creationTimestamp: null - name: v19.1.0 + name: v19.1.0-whites spec: apps: - componentVersion: 1.24.1 @@ -149,7 +149,7 @@ spec: version: 6.8.0 - name: aws-operator releaseOperatorDeploy: true - version: 14.21.0 + version: 14.22.0 - name: cert-operator releaseOperatorDeploy: true version: 3.2.1 @@ -157,12 +157,12 @@ spec: releaseOperatorDeploy: true version: 5.8.0 - name: containerlinux - version: 3510.2.0 + version: 3510.2.7 - name: etcd version: 3.5.9 - name: kubernetes version: 1.24.17 - date: "2023-09-11T06:19:34Z" + date: "2023-09-11T09:45:05Z" state: active status: inUse: false From 0fa49a37bf612042f9852b3c645db1c8dfd0ff37 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Mon, 11 Sep 2023 16:27:32 +0200 Subject: [PATCH 43/55] bump flatcar and aws operator --- aws/v19.1.0/release.diff | 17 ++++++++++++++++- aws/v19.1.0/release.yaml | 2 +- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index fad3e4329..e16603789 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -6,7 +6,7 @@ metadata: metadata: annotations: annotations: giantswarm.io/docs: https://docs.giantswarm.io/reference/cp giantswarm.io/docs: https://docs.giantswarm.io/reference/cp creationTimestamp: null creationTimestamp: null - name: v19.0.1 | name: v19.1.0-whites + name: v19.0.1 | name: v19.1.0 spec: spec: apps: apps: - componentVersion: 1.24.1 - componentVersion: 1.24.1 @@ -148,6 +148,21 @@ spec: spec: - prometheus-operator-crd - prometheus-operator-crd > name: irsa-servicemonitors > version: 0.0.1 + > - dependsOn: + > - aws-cloud-controller-manager + > - cilium + > - coredns + > - vertical-pod-autoscaler-crd + > name: security-bundle + > version: 0.16.2 + > catalog: giantswarm + > - dependsOn: + > - aws-cloud-controller-manager + > - cilium + > - coredns + > - vertical-pod-autoscaler-crd + > name: k8s-audit-metrics + > version: 0.6.1 components: components: - name: app-operator - name: app-operator version: 6.7.0 | version: 6.8.0 diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 72cddc07b..f77fd6ffc 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -6,7 +6,7 @@ metadata: annotations: giantswarm.io/docs: https://docs.giantswarm.io/reference/cp-k8s-api/releases.release.giantswarm.io/ creationTimestamp: null - name: v19.1.0-whites + name: v19.1.0 spec: apps: - componentVersion: 1.24.1 From 91a0ba07e604d9f931c853c90e15b833b2e47e8c Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Wed, 13 Sep 2023 08:25:43 +0200 Subject: [PATCH 44/55] bump observability bundle --- aws/v19.1.0/README.md | 58 +++++++++++++++++++++++++++++++++------- aws/v19.1.0/release.diff | 4 +-- aws/v19.1.0/release.yaml | 6 ++--- 3 files changed, 54 insertions(+), 14 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index be105c9b4..1784958a3 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -181,11 +181,19 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### observability-bundle [0.8.0](https://github.com/giantswarm/observability-bundle/releases/tag/v0.8.0) +### observability-bundle [0.8.1](https://github.com/giantswarm/observability-bundle/releases/tag/v0.8.1) + +- Upgrade `prometheus-agent` to 0.6.2. + - Upgrade `prometheus` to 2.47.0. +- Upgrade `prometheus-operator-app` and `prometheus-operator-crd` to 6.1.0. + + + +### cilium-servicemonitors [0.1.2](https://github.com/giantswarm/cilium-servicemonitors-app/releases/tag/v0.1.2) #### Changed -- Upgrade `prometheus-agent` to 0.6.0. -- Upgrade `prometheus-operator-app` and `prometheus-operator-crd` to 6.0.0. +- Drop metrics with high cardinality. +- Increase scrape interval to 60s. @@ -196,19 +204,51 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### cert-manager [3.3.0](https://github.com/giantswarm/cert-manager-app/releases/tag/v3.3.0) +### cluster-autoscaler [1.24.3](https://github.com/giantswarm/cluster-autoscaler-app/releases/tag/v1.24.3) + +#### Changed +- Change ScaleDownUtilizationThreshold default from 0.5 to 0.7 +- Update cluster-autoscaler to version `1.24.3`. + + + +### cilium [0.12.0](https://github.com/giantswarm/cilium-app/releases/tag/v0.12.0) -⚠️ Attention: Major release [3.0.0](#300---2023-07-26) contains breaking changes in user values! Please make yourself familiar with its changelog! ⚠️ #### Added -- Add NetworkPolicies for controller and cainjector. ([#354](https://github.com/giantswarm/cert-manager-app/pull/354)) +- Support creating `CiliumNetworkPolicy` manifests that allow egress requests to DNS and proxy hosts +#### Changed +- Add missing conditional for PSP rendering of default-policies installer job -### cluster-autoscaler [1.24.3](https://github.com/giantswarm/cluster-autoscaler-app/releases/tag/v1.24.3) +### external-dns [2.39.0](https://github.com/giantswarm/external-dns-app/releases/tag/v2.39.0) #### Changed -- Change ScaleDownUtilizationThreshold default from 0.5 to 0.7 -- Update cluster-autoscaler to version `1.24.3`. +- Replace monitoring labels with ServiceMonitor ([#296](https://github.com/giantswarm/external-dns-app/pull/296)). +- Update ATS to 0.4.1 and python deps ([#297](https://github.com/giantswarm/external-dns-app/pull/297)). + + + +### etcd-kubernetes-resources-count-exporter [1.4.0](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter/releases/tag/v1.4.0) + +#### Changed +- Add Max memory (default 500Mi) for VPA. + + + +### cert-exporter [2.6.0](https://github.com/giantswarm/cert-exporter/releases/tag/v2.6.0) + +### Changed + +- Remove the `Exist` toleration from deployment. This allows the pod to be rescheduled on a drained node sometimes causing the drain of a node to fail and require a manual fix + + + +### cert-manager [3.3.0](https://github.com/giantswarm/cert-manager-app/releases/tag/v3.3.0) + +⚠️ Attention: Major release [3.0.0](#300---2023-07-26) contains breaking changes in user values! Please make yourself familiar with its changelog! ⚠️ +#### Added +- Add NetworkPolicies for controller and cainjector. ([#354](https://github.com/giantswarm/cert-manager-app/pull/354)) diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index e16603789..cee10236a 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -124,7 +124,7 @@ spec: spec: - cilium - cilium - coredns - coredns - name: k8s-dns-node-cache-app | name: observability-bundle - version: 2.4.0 | version: 0.8.0 + version: 2.4.0 | version: 0.8.1 dependsOn: | - dependsOn: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium @@ -183,7 +183,7 @@ spec: spec: version: 3.5.7 | version: 3.5.9 - name: kubernetes - name: kubernetes version: 1.24.13 | version: 1.24.17 - date: "2023-08-02T09:59:41Z" | date: "2023-09-11T09:45:05Z" + date: "2023-08-02T09:59:41Z" | date: "2023-09-13T06:20:40Z" state: active state: active status: status: inUse: false inUse: false diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index f77fd6ffc..338faa157 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -1,5 +1,5 @@ # Generated with: -# /home/whites/workspace/devctl/devctl release create --provider aws --base 19.0.1 --name 19.1.0 --component kubernetes@1.24.17 --component containerlinux@3510.2.7 --overwrite +# /home/whites/workspace/devctl/devctl release create --provider aws --base 19.0.1 --name 19.1.0 --component kubernetes@1.24.17 --component containerlinux@3510.2.7 --app security-bundle@0.16.2 --app k8s-audit-metrics@0.6.1 --overwrite apiVersion: release.giantswarm.io/v1alpha1 kind: Release metadata: @@ -105,7 +105,7 @@ spec: - cilium - coredns name: observability-bundle - version: 0.8.0 + version: 0.8.1 - dependsOn: - aws-cloud-controller-manager - cilium @@ -162,7 +162,7 @@ spec: version: 3.5.9 - name: kubernetes version: 1.24.17 - date: "2023-09-11T09:45:05Z" + date: "2023-09-13T06:20:40Z" state: active status: inUse: false From 473b1a59881cc7d0f2fbc5b27c1bb5a7840fd629 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Wed, 13 Sep 2023 08:30:12 +0200 Subject: [PATCH 45/55] bump security bundle --- aws/v19.1.0/README.md | 14 ++++++++++++++ aws/v19.1.0/release.diff | 2 +- aws/v19.1.0/release.yaml | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 1784958a3..1ed1ba3ca 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -251,4 +251,18 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci - Add NetworkPolicies for controller and cainjector. ([#354](https://github.com/giantswarm/cert-manager-app/pull/354)) +### security-bundle [0.17.0](https://github.com/giantswarm/security-bundle/releases/tag/v0.17.0) +#### Added + +- Update to kyverno (app) upstream version 1.10.2. Note: This update includes breaking changes in the values structure, please check the migration docs before upgrading. +- Update to trivy (app) version 0.8.3. +- Update to falco (app) version 0.6.5. + + + +### k8s-audit-metrics [0.6.1](https://github.com/giantswarm/k8s-audit-metrics/releases/tag/v0.6.1) + +#### Changed + +- Push to default app catalog. diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index cee10236a..98a5580ad 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -154,7 +154,7 @@ spec: spec: > - coredns > - vertical-pod-autoscaler-crd > name: security-bundle - > version: 0.16.2 + > version: 0.17.0 > catalog: giantswarm > - dependsOn: > - aws-cloud-controller-manager diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 338faa157..592489fa2 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -1,5 +1,5 @@ # Generated with: -# /home/whites/workspace/devctl/devctl release create --provider aws --base 19.0.1 --name 19.1.0 --component kubernetes@1.24.17 --component containerlinux@3510.2.7 --app security-bundle@0.16.2 --app k8s-audit-metrics@0.6.1 --overwrite +# /home/whites/workspace/devctl/devctl release create --provider aws --base 19.0.1 --name 19.1.0 --component kubernetes@1.24.17 --component containerlinux@3510.2.7 --app security-bundle@0.17.0 --app k8s-audit-metrics@0.6.1 --overwrite apiVersion: release.giantswarm.io/v1alpha1 kind: Release metadata: @@ -135,7 +135,7 @@ spec: - coredns - vertical-pod-autoscaler-crd name: security-bundle - version: 0.16.2 + version: 0.17.0 catalog: giantswarm - dependsOn: - aws-cloud-controller-manager From d7e36bb1efc52ba3990cdae6b7f87bda1f3b581a Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Wed, 13 Sep 2023 10:28:13 +0200 Subject: [PATCH 46/55] improve dependencies --- aws/v19.1.0/release.diff | 5 +++++ aws/v19.1.0/release.yaml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 98a5580ad..433ab0444 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -81,6 +81,7 @@ spec: spec: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns + > - prometheus-operator-crd - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - name: net-exporter | name: metrics-server version: 1.15.0 | version: 2.2.0 @@ -88,6 +89,7 @@ spec: spec: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns + > - prometheus-operator-crd - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd > name: net-exporter > version: 1.17.0 @@ -98,6 +100,7 @@ spec: spec: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns + > - prometheus-operator-crd - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd > name: node-exporter > version: 1.17.1 @@ -108,6 +111,7 @@ spec: spec: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns + > - prometheus-operator-crd - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd > name: vertical-pod-autoscaler > version: 4.0.0 @@ -137,6 +141,7 @@ spec: spec: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns + > - prometheus-operator-crd - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - name: cilium-servicemonitors | name: prometheus-blackbox-exporter version: 0.1.1 | version: 0.3.2 diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 592489fa2..d459c1980 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -68,6 +68,7 @@ spec: - aws-cloud-controller-manager - cilium - coredns + - prometheus-operator-crd - vertical-pod-autoscaler-crd name: metrics-server version: 2.2.0 @@ -75,6 +76,7 @@ spec: - aws-cloud-controller-manager - cilium - coredns + - prometheus-operator-crd - vertical-pod-autoscaler-crd name: net-exporter version: 1.17.0 @@ -83,6 +85,7 @@ spec: - aws-cloud-controller-manager - cilium - coredns + - prometheus-operator-crd - vertical-pod-autoscaler-crd name: node-exporter version: 1.17.1 @@ -91,6 +94,7 @@ spec: - aws-cloud-controller-manager - cilium - coredns + - prometheus-operator-crd - vertical-pod-autoscaler-crd name: vertical-pod-autoscaler version: 4.0.0 @@ -118,6 +122,7 @@ spec: - aws-cloud-controller-manager - cilium - coredns + - prometheus-operator-crd - vertical-pod-autoscaler-crd name: prometheus-blackbox-exporter version: 0.3.2 From ad915cba5f5f189e4926a43fb781ea6538f91f89 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Wed, 13 Sep 2023 14:14:27 +0200 Subject: [PATCH 47/55] bump observability bundle --- aws/v19.1.0/README.md | 6 ++---- aws/v19.1.0/release.diff | 2 +- aws/v19.1.0/release.yaml | 2 +- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 1ed1ba3ca..ff5587d23 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -181,11 +181,9 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### observability-bundle [0.8.1](https://github.com/giantswarm/observability-bundle/releases/tag/v0.8.1) +### observability-bundle [0.8.2](https://github.com/giantswarm/observability-bundle/releases/tag/v0.8.) -- Upgrade `prometheus-agent` to 0.6.2. - - Upgrade `prometheus` to 2.47.0. -- Upgrade `prometheus-operator-app` and `prometheus-operator-crd` to 6.1.0. +- Upgrade promtail to 1.4.0. diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 433ab0444..29e78f9d1 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -128,7 +128,7 @@ spec: spec: - cilium - cilium - coredns - coredns - name: k8s-dns-node-cache-app | name: observability-bundle - version: 2.4.0 | version: 0.8.1 + version: 2.4.0 | version: 0.8.2 dependsOn: | - dependsOn: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index d459c1980..16a56aabd 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -109,7 +109,7 @@ spec: - cilium - coredns name: observability-bundle - version: 0.8.1 + version: 0.8.2 - dependsOn: - aws-cloud-controller-manager - cilium From 9e7c2086546f147c98c967bc2cb661a948df7bf7 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Wed, 13 Sep 2023 16:14:29 +0200 Subject: [PATCH 48/55] bump k8s-audit-metrics --- aws/v19.1.0/README.md | 5 +++-- aws/v19.1.0/release.diff | 2 +- aws/v19.1.0/release.yaml | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index ff5587d23..7825a5ebb 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -259,8 +259,9 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### k8s-audit-metrics [0.6.1](https://github.com/giantswarm/k8s-audit-metrics/releases/tag/v0.6.1) +### k8s-audit-metrics [0.7.0](https://github.com/giantswarm/k8s-audit-metrics/releases/tag/v0.7.0) #### Changed -- Push to default app catalog. +- Switched to kube-system namespace by default +- Added Cilium Network Policy to scrape /metrics on port 8000 diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index 29e78f9d1..fd93a2a28 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -167,7 +167,7 @@ spec: spec: > - coredns > - vertical-pod-autoscaler-crd > name: k8s-audit-metrics - > version: 0.6.1 + > version: 0.7.0 components: components: - name: app-operator - name: app-operator version: 6.7.0 | version: 6.8.0 diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 16a56aabd..4e8793249 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -148,7 +148,7 @@ spec: - coredns - vertical-pod-autoscaler-crd name: k8s-audit-metrics - version: 0.6.1 + version: 0.7.0 components: - name: app-operator version: 6.8.0 From 7db7c3ccb713972eece73b7fa723302b92153b7f Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Thu, 14 Sep 2023 09:07:35 +0200 Subject: [PATCH 49/55] fix dependencies --- aws/v19.1.0/release.diff | 15 +++++++++------ aws/v19.1.0/release.yaml | 3 +++ 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index fd93a2a28..e4dc41c69 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -71,6 +71,7 @@ spec: spec: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns + > - prometheus-operator-crd - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd > name: external-dns > version: 2.39.0 @@ -146,17 +147,18 @@ spec: spec: - name: cilium-servicemonitors | name: prometheus-blackbox-exporter version: 0.1.1 | version: 0.3.2 dependsOn: | - dependsOn: + > - prometheus-operator-crd + > name: cilium-servicemonitors + > version: 0.1.2 + > - dependsOn: - prometheus-operator-crd - prometheus-operator-crd - - name: irsa-servicemonitors | name: cilium-servicemonitors - version: 0.0.1 | version: 0.1.2 + - name: irsa-servicemonitors | name: irsa-servicemonitors + version: 0.0.1 version: 0.0.1 dependsOn: | - dependsOn: - - prometheus-operator-crd - prometheus-operator-crd - > name: irsa-servicemonitors - > version: 0.0.1 - > - dependsOn: > - aws-cloud-controller-manager > - cilium > - coredns + - prometheus-operator-crd - prometheus-operator-crd > - vertical-pod-autoscaler-crd > name: security-bundle > version: 0.17.0 @@ -165,6 +167,7 @@ spec: spec: > - aws-cloud-controller-manager > - cilium > - coredns + > - kyverno > - vertical-pod-autoscaler-crd > name: k8s-audit-metrics > version: 0.7.0 diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 4e8793249..345e66e4f 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -60,6 +60,7 @@ spec: - aws-cloud-controller-manager - cilium - coredns + - prometheus-operator-crd - vertical-pod-autoscaler-crd name: external-dns version: 2.39.0 @@ -138,6 +139,7 @@ spec: - aws-cloud-controller-manager - cilium - coredns + - prometheus-operator-crd - vertical-pod-autoscaler-crd name: security-bundle version: 0.17.0 @@ -146,6 +148,7 @@ spec: - aws-cloud-controller-manager - cilium - coredns + - kyverno - vertical-pod-autoscaler-crd name: k8s-audit-metrics version: 0.7.0 From e319261feca1fe391f77971ccbebbb61882d7054 Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Thu, 14 Sep 2023 14:19:57 +0200 Subject: [PATCH 50/55] Update README.md --- aws/v19.1.0/README.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 7825a5ebb..86ef6902c 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -71,15 +71,6 @@ _Nothing has changed._ -⚠️ Attention: Major release [3.0.0](#300---2023-07-26) contains breaking changes in user values! Please make sure you [read about the upgrade instructions](https://github.com/giantswarm/cert-manager-app/blob/main/docs/upgrading.md)! ⚠️ -#### Added -- Add NetworkPolicies for controller and cainjector. ([#354](https://github.com/giantswarm/cert-manager-app/pull/354)) - -#### Fixed -- Fix rule names of PolicyException. - - - ### cluster-operator [5.8.0](https://github.com/giantswarm/cluster-operator/releases/tag/v5.8.0) #### Added From 2bda80472bd669ce378cb3f2d1dadad5dd642a2f Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Thu, 14 Sep 2023 14:22:43 +0200 Subject: [PATCH 51/55] Update README.md updated aws-op release notes --- aws/v19.1.0/README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 86ef6902c..814209c63 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -65,11 +65,17 @@ _Nothing has changed._ ### aws-operator [14.22.0](https://github.com/giantswarm/aws-operator/releases/tag/v14.22.0) -#### Changed +#### Added +- Allow newer flatcar releases for node pools as provided by AWS release. +- Add sigs.k8s.io/cluster-api-provider-aws/role tag to all subnets as preparation for migration to CAPI. +#### Changed - Get AMI data from helm value rather than from hardcoded string in the code. +- Unmanage interfaces for CNI eth[1-9] on workers eth[2-9] on masters +- *cilium eni mode* - Only run aws-node, calico and kube-proxy on old nodes during migration to cilium. + ### cluster-operator [5.8.0](https://github.com/giantswarm/cluster-operator/releases/tag/v5.8.0) From bcc84830c22cbc0d92acbd4389480b561218dbfe Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Thu, 14 Sep 2023 15:10:23 +0200 Subject: [PATCH 52/55] Update aws/v19.1.0/README.md Co-authored-by: Joel Whittaker-Smith --- aws/v19.1.0/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 814209c63..f6c88c298 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -178,7 +178,7 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### observability-bundle [0.8.2](https://github.com/giantswarm/observability-bundle/releases/tag/v0.8.) +### observability-bundle [0.8.2](https://github.com/giantswarm/observability-bundle/releases/tag/v0.8.2) - Upgrade promtail to 1.4.0. From 2b070eb83fdfe8e7fc73e6488322dcffd0e13bf3 Mon Sep 17 00:00:00 2001 From: Pau Date: Fri, 15 Sep 2023 10:12:44 +0200 Subject: [PATCH 53/55] Revert cert-manager app --- aws/requests.yaml | 2 +- aws/v19.1.0/README.md | 8 -------- aws/v19.1.0/release.diff | 13 ++++++------- aws/v19.1.0/release.yaml | 2 +- 4 files changed, 8 insertions(+), 17 deletions(-) diff --git a/aws/requests.yaml b/aws/requests.yaml index 8d65992a7..78937e4bc 100644 --- a/aws/requests.yaml +++ b/aws/requests.yaml @@ -8,7 +8,7 @@ releases: - name: app-operator version: ">= 6.6.3" - name: cert-manager - version: ">= 2.24.1" + version: ">= 2.24.1 < 3.0.0" - name: cilium-servicemonitors version: ">= 0.1.2" - name: aws-ebs-csi-driver diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index f6c88c298..3e05647a5 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -238,14 +238,6 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci - Remove the `Exist` toleration from deployment. This allows the pod to be rescheduled on a drained node sometimes causing the drain of a node to fail and require a manual fix - -### cert-manager [3.3.0](https://github.com/giantswarm/cert-manager-app/releases/tag/v3.3.0) - -⚠️ Attention: Major release [3.0.0](#300---2023-07-26) contains breaking changes in user values! Please make yourself familiar with its changelog! ⚠️ -#### Added -- Add NetworkPolicies for controller and cainjector. ([#354](https://github.com/giantswarm/cert-manager-app/pull/354)) - - ### security-bundle [0.17.0](https://github.com/giantswarm/security-bundle/releases/tag/v0.17.0) #### Added diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index e4dc41c69..f8274fa63 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -21,24 +21,23 @@ spec: spec: name: aws-ebs-csi-driver name: aws-ebs-csi-driver version: 2.21.1 | version: 2.25.0 dependsOn: | - dependsOn: - - vertical-pod-autoscaler-crd < + - vertical-pod-autoscaler-crd - name: cert-exporter < - version: 2.5.1 < + version: 2.5.1 | version: 2.6.0 + | - componentVersion: 1.12.3 dependsOn: < - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - - componentVersion: 1.8.2 | name: cert-exporter - name: cert-manager | version: 2.6.0 - version: 2.24.1 | - componentVersion: 1.12.3 + - componentVersion: 1.8.2 < + name: cert-manager < + version: 2.24.1 < dependsOn: dependsOn: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - > name: cert-manager - > version: 3.3.0 - name: chart-operator - name: chart-operator version: 2.35.0 version: 2.35.0 - componentVersion: 1.13.0 | - componentVersion: 1.13.6 diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index 345e66e4f..fb6906a42 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -33,7 +33,7 @@ spec: - coredns - vertical-pod-autoscaler-crd name: cert-manager - version: 3.3.0 + version: 2.24.1 - name: chart-operator version: 2.35.0 - componentVersion: 1.13.6 From dcd55f7158e717a472bf5005665b910404b66ed0 Mon Sep 17 00:00:00 2001 From: Christian Bianchi Date: Wed, 20 Sep 2023 08:29:17 +0200 Subject: [PATCH 54/55] bump stuff --- aws/v19.1.0/README.md | 13 +++++++++---- aws/v19.1.0/release.diff | 19 ++++++++++--------- aws/v19.1.0/release.yaml | 6 +++--- 3 files changed, 22 insertions(+), 16 deletions(-) diff --git a/aws/v19.1.0/README.md b/aws/v19.1.0/README.md index 3e05647a5..16914c74b 100644 --- a/aws/v19.1.0/README.md +++ b/aws/v19.1.0/README.md @@ -119,11 +119,11 @@ _Nothing has changed._ -### etcd-kubernetes-resources-count-exporter [1.4.0](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter/releases/tag/v1.4.0) +### etcd-kubernetes-resources-count-exporter [1.5.0](https://github.com/giantswarm/etcd-kubernetes-resources-count-exporter/releases/tag/v1.5.0) #### Changed - Add Max memory (default 500Mi) for VPA. - +- Set `priorityClassName` to the deployment to mitigate scheduling issues. ### cilium-servicemonitors [0.1.2](https://github.com/giantswarm/cilium-servicemonitors-app/releases/tag/v0.1.2) @@ -156,11 +156,12 @@ _Nothing has changed._ -### vertical-pod-autoscaler [4.0.0](https://github.com/giantswarm/vertical-pod-autoscaler-app/releases/tag/v4.0.0) +### vertical-pod-autoscaler [4.2.0](https://github.com/giantswarm/vertical-pod-autoscaler-app/releases/tag/v4.2.0) #### Changed WARNING: this version requires Cilium to run because of the dependency on the CiliumNetworkPolicy CRD - Upgrade dependency chart to 9.2.0. +- In order to facilitate the migration from aws-cni to cilium we need to keep the standard network policies in place so that VPA can communicate with the k8s API while the clusters are being upgraded. - Adjusted the resource and limits to accomodate larger clusters by default - Adjusted the admission controller to give it more QPS against the API - Adjusted the updater to give it more QPS against the API @@ -248,7 +249,11 @@ WARNING: this version requires Cilium to run because of the dependency on the Ci -### k8s-audit-metrics [0.7.0](https://github.com/giantswarm/k8s-audit-metrics/releases/tag/v0.7.0) +### k8s-audit-metrics [0.7.1](https://github.com/giantswarm/k8s-audit-metrics/releases/tag/v0.7.1) + +#### + +- Removed /metrics checks in cilium network policy. #### Changed diff --git a/aws/v19.1.0/release.diff b/aws/v19.1.0/release.diff index f8274fa63..33c9de619 100644 --- a/aws/v19.1.0/release.diff +++ b/aws/v19.1.0/release.diff @@ -21,23 +21,24 @@ spec: spec: name: aws-ebs-csi-driver name: aws-ebs-csi-driver version: 2.21.1 | version: 2.25.0 dependsOn: | - dependsOn: - - vertical-pod-autoscaler-crd + - vertical-pod-autoscaler-crd < - name: cert-exporter < - version: 2.5.1 | version: 2.6.0 - | - componentVersion: 1.12.3 + version: 2.5.1 < dependsOn: < - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - - componentVersion: 1.8.2 < - name: cert-manager < - version: 2.24.1 < + - componentVersion: 1.8.2 | name: cert-exporter + name: cert-manager | version: 2.6.0 + version: 2.24.1 | - componentVersion: 1.12.3 dependsOn: dependsOn: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium - coredns - coredns - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd + > name: cert-manager + > version: 2.24.1 - name: chart-operator - name: chart-operator version: 2.35.0 version: 2.35.0 - componentVersion: 1.13.0 | - componentVersion: 1.13.6 @@ -114,7 +115,7 @@ spec: spec: > - prometheus-operator-crd - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd > name: vertical-pod-autoscaler - > version: 4.0.0 + > version: 4.2.0 - name: vertical-pod-autoscaler-crd - name: vertical-pod-autoscaler-crd version: 2.0.1 version: 2.0.1 - name: etcd-kubernetes-resources-count-exporter | - dependsOn: @@ -122,7 +123,7 @@ spec: spec: dependsOn: < - vertical-pod-autoscaler-crd - vertical-pod-autoscaler-crd - name: observability-bundle | name: etcd-kubernetes-resources-count-exporter - version: 0.5.1 | version: 1.4.0 + version: 0.5.1 | version: 1.5.0 dependsOn: | - dependsOn: - aws-cloud-controller-manager - aws-cloud-controller-manager - cilium - cilium @@ -169,7 +170,7 @@ spec: spec: > - kyverno > - vertical-pod-autoscaler-crd > name: k8s-audit-metrics - > version: 0.7.0 + > version: 0.7.1 components: components: - name: app-operator - name: app-operator version: 6.7.0 | version: 6.8.0 diff --git a/aws/v19.1.0/release.yaml b/aws/v19.1.0/release.yaml index fb6906a42..9786ae5e4 100644 --- a/aws/v19.1.0/release.yaml +++ b/aws/v19.1.0/release.yaml @@ -98,13 +98,13 @@ spec: - prometheus-operator-crd - vertical-pod-autoscaler-crd name: vertical-pod-autoscaler - version: 4.0.0 + version: 4.2.0 - name: vertical-pod-autoscaler-crd version: 2.0.1 - dependsOn: - vertical-pod-autoscaler-crd name: etcd-kubernetes-resources-count-exporter - version: 1.4.0 + version: 1.5.0 - dependsOn: - aws-cloud-controller-manager - cilium @@ -151,7 +151,7 @@ spec: - kyverno - vertical-pod-autoscaler-crd name: k8s-audit-metrics - version: 0.7.0 + version: 0.7.1 components: - name: app-operator version: 6.8.0 From 3e569167560e69e319787b9575e0d141d40823d1 Mon Sep 17 00:00:00 2001 From: Tobiasz Kukawka Date: Wed, 20 Sep 2023 10:58:57 +0200 Subject: [PATCH 55/55] Update announcement.md --- aws/v19.1.0/announcement.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aws/v19.1.0/announcement.md b/aws/v19.1.0/announcement.md index 3d3f25b2d..90382004f 100644 --- a/aws/v19.1.0/announcement.md +++ b/aws/v19.1.0/announcement.md @@ -1 +1 @@ -**Workload cluster release v19.1.0 for AWS is available**. This is a maintenance release featuring latest Kubernetes versions and component upgrades. The new GS version is a preparation for the migration away from Pod Security Policies (PSP) in favor of Pod Security Standards(PSS) in Kubernetes 1.25. We have also added two new feautres: the Cilium AWS ENI mode and new annotation for NodePools OS upgrades. Further details can be found in the [release notes](https://docs.giantswarm.io/changes/workload-cluster-releases-azure/releases/aws-v19.1.0/). +**Workload cluster release v19.1.0 for AWS is available**. This is a maintenance release featuring latest Kubernetes versions and component upgrades. The new GS version is a preparation for the migration away from Pod Security Policies (PSP) in favor of Pod Security Standards (PSS) in Kubernetes 1.25. We have also added two new feautres: the Cilium AWS ENI mode and new annotation for NodePools OS upgrades. Further details can be found in the [release notes](https://docs.giantswarm.io/changes/workload-cluster-releases-azure/releases/aws-v19.1.0/).