v2.25.1

Changes by Kind

Deprecation / Removal

• Deprecating support for Centos7 and Weave ; they are not tested anymore (#11428, @k8s-infra-cherrypick-robot)
• Remove Debian 10 support. (#11429, @k8s-infra-cherrypick-robot)ra-cherrypick-robot)

Feature

• Default to Kubernetes v1.29.10 (#11666, @enneitex)
• Add hashes for Kubernetes v1.29.9 (#11599, @robertvolkmann), Add hashes for Kubernetes v1.29.7 (#11408, @mzaian), Add hashes for Kubernetes v1.29.6 (#11355, @tico88612)
• Default to etcd v3.5.16 (#11576, @janosbabik)
• [ingress-nginx] upgrade controller to version 1.11.2 (#11464, @k8s-infra-cherrypick-robot)
• Allow to run kubespray with an empty kube_node group, to provision only the control plane (#11249, @k8s-infra-cherrypick-robot)
• CentOS 7 yum repo baseurl update (#11365, @k8s-infra-cherrypick-robot)
• Check CentOS-Base.repo exists for CentOS 7 (#11438, @k8s-infra-cherrypick-robot)
• User has a possibility to fix nodePort of ingress-nginx service with property in addons.yaml (#11339, @k8s-infra-cherrypick-robot)

Applications

• [helm] Upgrade to v3.14.4 (#11599, @robertvolkmann)

Network

• [calico] Update default calico to v3.27.4
  [calico] Fix high cpu load due to XDP program in iptables (#11476, @mzaian)

Container-Managers

• [containerd] Default to v1.7.22
  [nerdctl] Upgrade to 1.7.7
  [runc] Upgrade to v1.1.14 (#11576, @janosbabik)

Bug or Regression

• Always copy cert generation script to first etcd to pick up fixes on existing clusters (#11616, @k8s-infra-cherrypick-robot)
• Ingress-nginx-controller admission service is automatically created when ingress_nginx_webhook_enabled: true (#11332, @k8s-infra-cherrypick-robot)
• Fix: cannot stop & remove all cri containers via remove_node.yml (#11638, @k8s-infra-cherrypick-robot)