You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[OPERATOR] An issue causing the guestbook TM test to fail against IPv6 Shoot clusters in now fixed. by @plkokanov [#14705]
[DEPENDENCY] The reconcileSeedWebhookConfig function now correctly reconciles both MutatingWebhookConfiguration and ValidatingWebhookConfiguration for extensions that register both mutating and validating admission webhooks. Previously, only the first configuration was reconciled due to a premature return in the loop. by @Roncossek [#14688]
🏃 Others
[OPERATOR] Add resourceId for image istio-basic-auth-server to fix overwrite image lookup by @MartinWeindel [#14721]
[OPERATOR] Certain best-practice Envoy settings for HTTP2 protocol options have been applied to istio-ingressgateways. by @oliver-goetz [#14685]
[DEPENDENCY] The following dependencies have been updated:
[OPERATOR] The NewWorkerPoolHash feature gate has been promoted to GA and can no longer be disabled. by @timuthy [#14531]
[OPERATOR]⚠️ Gardener does no longer support Garden, Seed, or Shoot clusters with Kubernetes versions <= 1.30. Make sure to upgrade all existing clusters before upgrading to this Gardener version. by @timuthy [#14501]
[USER] Newly created Shoots now have a set period of 28d for etcd encryption key rotation. by @AleksandarSavchev [#14034]
[DEVELOPER]make gardenadm-up SCENARIO=connect now deploys the Gardener (gardener-operator and Garden resource) directly into the self-hosted shoot. Previously, it was deploying them next to the machine pods of the self-hosted shoot in the kind cluster. Use make gardenadm-up SCENARIO=connect-kind for the out-of-self-hosted-shoot deployment mode. by @rfranzke [#14387]
[DEPENDENCY] The obsolete Provider field was removed from the extensionswebhook.Webhook struct. The field can be removed without substitution. by @timuthy [#14460]
📰 Noteworthy
[OPERATOR] The gardener-resource-manager HA config webhook now uses ScheduleAnyway instead of DoNotSchedule for the hostname topology spread constraint when there is at most one node in the cluster. A new node-high-availability-config controller re-triggers the webhook when the node count crosses this threshold. by @rfranzke [#14595]
[OPERATOR] machine-controller-manager's RBAC permissions for the source cluster have been reduced to follow the principle of least privilege. by @dimityrmirchev [#14372]
[DEVELOPER] Added panic recovery to flow.Task to prevent a single task failure from crashing the entire controller. If you previously implemented custom panic recovery within your tasks, you can consider removing that custom panic recovery. by @dergeberl [#14606]
[DEVELOPER] The local setup now includes a cloud-controller-manager-local, which is deployed for kind clusters (in the kube-system namespace) and for shoot clusters (in the control plane namespace). The cloud-controller-manager implements Services of type LoadBalancer by creating dedicated Docker containers listening on external IPs (automatically added to the host's loopback interface on kind cluster creation). This replaces previous hacks for implementing load balancers in provider-local and supports load balancers in shoot clusters for the first time. by @timebertt [#14415]
[DEPENDENCY] Extension charts deployed on self-hosted shoot clusters may not receive .Values.gardener.seed when the shoot has not yet been promoted to a Seed. Charts should guard Seed-dependent values with {{ if .Values.gardener.seed }}. by @rfranzke [#14395]
[DEPENDENCY] A new helper function BuildExtensionTypeNamespaceSelector has been introduced. It builds proper namespaces selectors for extension webhooks, based on the extension type and class attributes. by @timuthy [#14460]
✨ New Features
[OPERATOR] Added spec.runtimeCluster.settings.loadBalancerServices.proxyProtocol.allowed and spec.runtimeCluster.settings.loadBalancerServices.externalTrafficPolicy to the Garden resource. When Allowed set to true, gardener-operator configures the Istio ingress gateway to terminate PROXY protocol, enabling preservation of the original client IP address for load balancers that use PROXY protocol. The explicit nature of the setting allows a seamless migration while enforcing a good security posture. ExternalTrafficPolicy allows configuring the Gateway either as Cluster (default) or Local, similar to the Seed. by @jamand [#14420]
[OPERATOR] The gardener-node-agent now monitors the health of systemd units declared in the OperatingSystemConfig and reports a SystemdUnitsReady condition on the Node. Unhealthy units are surfaced on the Shoot via the EveryNodeReady condition. by @rfranzke [#14496]
[USER] The Shoot spec field spec.kubernetes.kubeAPIServer.encryptionConfig.provider.type now supports the aesgcm and secretbox encryption provider types. The field is immutable. by @AleksandarSavchev [#14034]
[USER] The Garden spec fields spec.virtualCluster.kubernetes.kubeAPIServer.encryptionConfig.provider.typeand spec.virtualCluster.gardener.gardenerAPIServer.encryptionConfig.provider.type now support the aesgcm and secretbox encryption provider types. The fields are immutable. by @AleksandarSavchev [#14034]
🐛 Bug Fixes
[OPERATOR] The garbage collection logic now also deletes pods that are stuck due to preemption by the kubelet or scheduler. by @rfranzke [#14519]
[OPERATOR] The observability setup is deleted as late as possible so that, in case an error occurs during the deletion of any components, there is still enough information available to investigate the issue. by @iypetrov [#14475]
[OPERATOR] A bug was fixed where gardenadm init could fail due to a transient error while fetching the shoot-gardener-node-agent ManagedResource when the Kubernetes API server is temporarily unavailable due to static pod rollout. by @ialidzhikov [#14601]
[OPERATOR] A bug has been fixed that caused unintentional ShootState creations for Shoots running on managed seed clusters (those backed by ManagedSeed objects). The affected ShootState resources are automatically cleaned up by gardenlet during start-up. by @plkokanov [#14666]
[USER] Cluster-proportional autoscaling of coredns now works with Kubernetes >= 1.33 by @ScheererJ [#14638]
[DEPENDENCY] The golangci-lint makefile install recipe can be used in Gardener extensions again. by @timebertt [#14555]
🏃 Others
[OPERATOR] Gardener Discovery Server is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14587]
[OPERATOR] Alertmanager is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14575]
[OPERATOR] Vali is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14567]
[OPERATOR] OpenTelemetry Collector is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14585]
[OPERATOR] Use Info logging for admission denials instead of Error so that the full stack trace to every denial log entry does not get logged by @DockToFuture [#14561]
[OPERATOR] Apiserver-Proxy uses a dedicated network interface apiserver-proxy for its advertised IP address. Requests from nodes such as kubelet probes will use the proper IP as per the route table again. by @domdom82 [#14440]
[OPERATOR] Shoot advertised addresses are now configurable by extension components for Shoot VirtualService resources. by @ScheererJ [#14534]
[OPERATOR] During Shoot reconciliation MachineDeployments are now deployed in parallel. This should speed up the reconciliation of the Worker resource. by @plkokanov [#14220]
[OPERATOR] Resource limits have been removed for node-problem-detector by @domdom82 [#14450]
[OPERATOR] Prometheus is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14573]
[OPERATOR] Additional per nodegroup metrics can be exposed by cluster-autoscaler via the field .spec.kubernetes.clusterAutoscaler.emitPerNodeGroupMetrics in the Shoot API . by @aaronfern [#14557]
[OPERATOR] Gardener Dashboard is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14586]
[OPERATOR]Patch is now used to label all Machines with force-deletion: True instead of Update when the Shoot is being hibernated or deleted. Additionally, the function used to do this during the reconciliation of the Worker resource is now only executed once instead of for each MachineDeployment. by @plkokanov [#14220]
[OPERATOR] The gardenadm init flow now determines Pod network availability by checking the Node's NetworkUnavailable condition instead of the shoot-core-coredns ManagedResource health. This is a prerequisite improvement for the control plane Node restoration feature. by @ialidzhikov [#14523]
[OPERATOR] The following dependencies have been updated:
gardener/etcd-druid from v0.36.2 to v0.36.3. Release Notes
github.com/gardener/etcd-druid/api from v0.36.2 to v0.36.3. by @Shreyas-s14 [#14661]
[OPERATOR] cluster-autoscaler now supports a new expander least-nodes from v1.31 onwards by @aaronfern [#14558]
[OPERATOR] Plutono is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14142]
[USER] VPN-related dashboards now show a shared crosshair on all panels. by @domdom82 [#14576]
[DEVELOPER] The DinD version used in the remote local setup has been updated to v29. by @vicwicker [#14644]
[DEVELOPER]make seed-down and make garden-down cleanup additional resources by @matthias-horne [#14547]
[DEPENDENCY] The following dependencies have been updated:
[OPERATOR] An issue causing the guestbook TM test to fail against IPv6 Shoot clusters in now fixed. by @plkokanov [#14702]
[DEPENDENCY] The reconcileSeedWebhookConfig function now correctly reconciles both MutatingWebhookConfiguration and ValidatingWebhookConfiguration for extensions that register both mutating and validating admission webhooks. Previously, only the first configuration was reconciled due to a premature return in the loop. by @Roncossek [#14689]
🏃 Others
[OPERATOR] Certain best-practice Envoy settings for HTTP2 protocol options have been applied to istio-ingressgateways. by @oliver-goetz [#14684]
[OPERATOR] A bug has been fixed that caused unintentional ShootState creations for Shoots running on managed seed clusters (those backed by ManagedSeed objects). The affected ShootState resources are automatically cleaned up by gardenlet during start-up. by @tobschli [#14652]
[USER] Cluster-proportional autoscaling of coredns now works with Kubernetes >= 1.33 by @ScheererJ [#14650]
🏃 Others
[DEPENDENCY] The following dependencies have been updated:
[OPERATOR] The UseUnifiedHTTPProxyPort feature gate has been promoted to Beta and is enabled by default. If using the Gardener ACL Extension you need make sure that at least version v1.15.0 is installed and all Shoots are reconciled before the upgrade. by @jamand [#14422]
[DEVELOPER] The generate-admin-kubeconf.sh script has been renamed to generate-kubeconfig.sh. It now supports generating both admin (default) and viewer kubeconfigs. by @timuthy [#14464]
[DEVELOPER] The gardenadm machine pods have their state persisted in a unified PVC. Existing local gardenadm setups need to be recreated. To reset a local machine pod, delete both the pod and its corresponding PVC. by @LucaBernstein [#14359]
[DEVELOPER]GEN_CRD_API_REFERENCE_DOCS make command has been replaced with CRD_REF_DOCS. by @acumino [#14324]
[DEPENDENCY] The pkg/utils/time package is now removed. Use k8s.io/utils/clock.Clock instead. by @shafeeqes [#14515]
📰 Noteworthy
[OPERATOR] The SeedAuthorizer now enforces field/label selectors for gardenletlist/watch requests on ControllerInstallation, Bastion, Gardenlet, Seed, Shoot, and ManagedSeed resources, restricting each gardenlet to only observe resources belonging to its own seed. by @rfranzke [#14452]
[OPERATOR] The gardener-resource-manager's NetworkPolicy controller now only creates policies in namespaces that have pods with matching to-* labels, significantly reducing the number of NetworkPolicy objects on seeds. by @rfranzke [#14410]
[OPERATOR]RemoveVali FeatureGate has been introduced. When enabled, every Vali instance will be removed. This feature gate is available for both the gardenlet and the gardener-operator. by @rrhubenov [#14279]
[DEVELOPER] The sast and sast-report checks have been removed from verify and verify-extended make targets. Please call them explicitly when required. by @oliver-goetz [#14443]
✨ New Features
[OPERATOR] The Project API now has a .status.conditions field for allowing controllers to report conditions on Project objects. by @jamand [#14403]
[DEVELOPER] The local setup has been augmented to make the self-hosted shoot's API server directly accessible from the host machine without kubectl port-forward. A new unified hack/usage/generate-admin-kubeconfig-local.sh script supports generating kubeconfigs for both the virtual garden and the self-hosted shoot. by @rfranzke [#14370]
🐛 Bug Fixes
[OPERATOR] The formatting of event-logger logs when the OpenTelemetryCollector feature gate is enabled is now partially fixed. The event-logger logs are now properly structured with fields as attributes, but to make them searchable with the unpack feature a change in the fluent-bit output plugin is required. by @iypetrov [#14423]
[OPERATOR] The gardenlet reconciler in the gardener-operator now uses the virtual cluster client to fetch the pull secret and CA bundle secret. It was wrongly using the runtime cluster client earlier. by @shafeeqes [#14331]
[OPERATOR] Fix a bug where the shoot-care controller cannot reconcile shoots with spec.maintenance.confineSpecUpdateRollout=true and updated DNS credentials, i.e. shoot.spec.dns.providers[].credentialsRef, until the shoot is reconciled. by @vpnachev [#14397]
[USER] Fixed EveryNodeReady shoot condition incorrectly reporting NodeAgentUnhealthy for nodes not managed by MCM. by @acumino [#14509]
[DEVELOPER] Pull secrets in the remote setup are labeled correctly to be automatically propagated by @matthias-horne [#14502]
[DEPENDENCY] Extension shoot webhook configs are now always produced even when mergeShootWebhooksIntoSeedWebhooks is true, so that a self-hosted Shoot promoted to a Seed has the correct shoot webhooks registered. by @rfranzke [#14389]
🏃 Others
[OPERATOR] Fix KubePodNotReadyControlPlane alert to not trigger for pods in Completed state. by @adenitiu [#14404]
[OPERATOR] Create pull secret in garden namespace of virtual garden for remote setup. by @DockToFuture [#14449]
[OPERATOR] Introduce seed reconciliation alerts. by @adenitiu [#14441]
[OPERATOR] Enable notification flexibility of EtcdDbSizeLimitApproaching and EtcdDbSizeLimitCrossed alert for seeds by @adenitiu [#14384]
[OPERATOR] The following dependencies have been updated:
gardener/autoscaler from v1.34.0 to v1.34.1. Release Notes
gardener/autoscaler from v1.33.0 to v1.33.1. Release Notes
gardener/autoscaler from v1.32.2 to v1.32.3. Release Notes
gardener/autoscaler from v1.31.0 to v1.31.1. Release Notes
[OPERATOR] There is now maxConnectionDuration of 1 day for connections to kube-apiserver endpoints. Their maxConnections limit has been removed. by @oliver-goetz [#14463]
[DEVELOPER] The default shoot for test machinery tests was adjusted to work with Kubernetes 1.35. by @timuthy [#14439]
[DEVELOPER] In the remote setup Kyverno now always adds imagePullSecret for images in the remote registry. by @matthias-horne [#14478]
[DEPENDENCY] The following dependencies have been updated:
registry.k8s.io/autoscaling/vpa-admission-controller from 1.5.1 to 1.6.0.
registry.k8s.io/autoscaling/vpa-recommender from 1.5.1 to 1.6.0.
[OPERATOR] An issue causing the guestbook TM test to fail against IPv6 Shoot clusters in now fixed. by @plkokanov [#14715]
[DEPENDENCY] The reconcileSeedWebhookConfig function now correctly reconciles both MutatingWebhookConfiguration and ValidatingWebhookConfiguration for extensions that register both mutating and validating admission webhooks. Previously, only the first configuration was reconciled due to a premature return in the loop. by @Roncossek [#14687]
🏃 Others
[OPERATOR] Certain best-practice Envoy settings for HTTP2 protocol options have been applied to istio-ingressgateways. by @oliver-goetz [#14686]
This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign rfranzke for approval. For more information see the Code Review Process.
The full list of commands accepted by this bot can be found here.
Details
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
gardener-prowBot
added
cla: yes
Indicates the PR's author has signed the cla-assistant.io CLA.
size/XS
Denotes a PR that changes 0-9 lines, ignoring generated files.
labels
Mar 12, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 16, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Update module github.com/gardener/gardener to v1.138.0
Mar 16, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 17, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Update module github.com/gardener/gardener to v1.138.0
Mar 17, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 17, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Update module github.com/gardener/gardener to v1.138.0
Mar 17, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 18, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Update module github.com/gardener/gardener to v1.138.0
Mar 18, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 18, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 20, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Update module github.com/gardener/gardener to v1.138.0
Mar 20, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 21, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Update module github.com/gardener/gardener to v1.138.0
Mar 21, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 21, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Update module github.com/gardener/gardener to v1.138.0
Mar 21, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 21, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Update module github.com/gardener/gardener to v1.138.0
Mar 21, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Mar 23, 2026
gardener-ci-robot
changed the title
Update module github.com/gardener/gardener to v1.138.0 - autoclosed
Update module github.com/gardener/gardener to v1.138.0
Mar 23, 2026
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cla: yesIndicates the PR's author has signed the cla-assistant.io CLA.kind/enhancementEnhancement, improvement, extensionsize/XSDenotes a PR that changes 0-9 lines, ignoring generated files.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.132.5→v1.141.1Release Notes
gardener/gardener (github.com/gardener/gardener)
v1.141.1Compare Source
[github.com/gardener/gardener:v1.141.1]
🐛 Bug Fixes
[OPERATOR]An issue causing the guestbook TM test to fail against IPv6 Shoot clusters in now fixed. by @plkokanov [#14705][DEPENDENCY]ThereconcileSeedWebhookConfigfunction now correctly reconciles bothMutatingWebhookConfigurationandValidatingWebhookConfigurationfor extensions that register both mutating and validating admission webhooks. Previously, only the first configuration was reconciled due to a premature return in the loop. by @Roncossek [#14688]🏃 Others
[OPERATOR]AddresourceIdfor imageistio-basic-auth-serverto fix overwrite image lookup by @MartinWeindel [#14721][OPERATOR]Certain best-practice Envoy settings for HTTP2 protocol options have been applied toistio-ingressgateways. by @oliver-goetz [#14685][DEPENDENCY]The following dependencies have been updated:gardener/ext-authz-serverfromv0.2.0tov0.3.0. Release Notes by @ScheererJ [#14728]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:a533cff53ce26faae8d16ce777e42acfaec59f37b14e037f3df49897eb6e37a6europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:f9a88c4286072181ba44333dae0899fd7f04e6109deee7649b7ec4225d061c2eeurope-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:e4a314c878793de9230de8e578f4affde97f13669773b1038a1cedb542e3a46feurope-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:ec09bb23be84cdc04592a29db374e1107b91114c4420523bb8ad52a07777d2e2europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:2f4e2274461634f42f90fb5787cf2176d00079b0dcb1cbd6d6b06b5e8bfa3243europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:a20de14a51d7512cf7e4658a4e52a2c60dff17efbf2965ef20565a696619aa6aeurope-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:0723efdd00b677215935e8d86c5568c7c583afbecc130f1a281bd1da4ccacb67europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:e1ddbc08706eb9ac4af03811a12553cadeb00915f890883572ba7c267173473feurope-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:2904444a43a685fee5e601b621603114585857c6205d3d9286921a114110849ceurope-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:a592e08ced947cda1565a4bf3800785c2596880940542843787388baf0ad51eeeurope-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:63efdd9693ec670ba326fd4c3f70f88702aa41aaac69c268c83ab4a69820eea1europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:f61bcb10bfbd98c0a17d944d061357b78a59e09f79bc207db64203488bfb6ebdeurope-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:358db949d83420843f863158d5b97d6a7d2d6df8ed48e4ac4a442e883387c0d9europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:90d8da86f54ce63dd043285388d7acce0f9b3fb30f15e040ae4452f59d1d5b02europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:1c50c5a130190374ed9ddf8244e48585ef15fc4bed428817b7db101e8b14d747europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:9b1947be7ce2fe329591e02acb40960aadb1c41a88f9b8b9e10824ed5dd85787europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:0406036d984dcb000eb4a7af85a453ca7ec8a5cf7772c0cf7dfdbd6e576ba881europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:c5272548e8a05a13aeaf02d69bc1b10a57fd0e3de0ce44cf51433b43d00f964bHelm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.141.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.141.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.141.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.141.1Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.141.1europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.141.1europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.141.1europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.141.1europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.141.1europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.141.1europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.141.1europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.141.1europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.141.1v1.141.0Compare Source
[github.com/gardener/gardener:v1.141.0]
[OPERATOR]TheNewWorkerPoolHashfeature gate has been promoted to GA and can no longer be disabled. by @timuthy [#14531][OPERATOR][USER]Newly createdShoots now have a set period of28dfor etcd encryption key rotation. by @AleksandarSavchev [#14034][DEVELOPER]make gardenadm-up SCENARIO=connectnow deploys the Gardener (gardener-operatorandGardenresource) directly into the self-hosted shoot. Previously, it was deploying them next to the machine pods of the self-hosted shoot in the kind cluster. Usemake gardenadm-up SCENARIO=connect-kindfor the out-of-self-hosted-shoot deployment mode. by @rfranzke [#14387][DEPENDENCY]The obsoleteProviderfield was removed from theextensionswebhook.Webhookstruct. The field can be removed without substitution. by @timuthy [#14460]📰 Noteworthy
[OPERATOR]Thegardener-resource-managerHA config webhook now usesScheduleAnywayinstead ofDoNotSchedulefor the hostname topology spread constraint when there is at most one node in the cluster. A newnode-high-availability-configcontroller re-triggers the webhook when the node count crosses this threshold. by @rfranzke [#14595][OPERATOR]machine-controller-manager's RBAC permissions for the source cluster have been reduced to follow the principle of least privilege. by @dimityrmirchev [#14372][DEVELOPER]Added panic recovery toflow.Taskto prevent a single task failure from crashing the entire controller. If you previously implemented custom panic recovery within your tasks, you can consider removing that custom panic recovery. by @dergeberl [#14606][DEVELOPER]The local setup now includes acloud-controller-manager-local, which is deployed for kind clusters (in thekube-systemnamespace) and for shoot clusters (in the control plane namespace). The cloud-controller-manager implementsServicesof typeLoadBalancerby creating dedicated Docker containers listening on external IPs (automatically added to the host's loopback interface on kind cluster creation). This replaces previous hacks for implementing load balancers in provider-local and supports load balancers in shoot clusters for the first time. by @timebertt [#14415][DEPENDENCY]Extension charts deployed on self-hosted shoot clusters may not receive.Values.gardener.seedwhen the shoot has not yet been promoted to aSeed. Charts should guard Seed-dependent values with{{ if .Values.gardener.seed }}. by @rfranzke [#14395][DEPENDENCY]A new helper functionBuildExtensionTypeNamespaceSelectorhas been introduced. It builds proper namespaces selectors for extension webhooks, based on the extensiontypeandclassattributes. by @timuthy [#14460]✨ New Features
[OPERATOR]Addedspec.runtimeCluster.settings.loadBalancerServices.proxyProtocol.allowedandspec.runtimeCluster.settings.loadBalancerServices.externalTrafficPolicyto theGardenresource. When Allowed set totrue,gardener-operatorconfigures the Istio ingress gateway to terminate PROXY protocol, enabling preservation of the original client IP address for load balancers that use PROXY protocol. The explicit nature of the setting allows a seamless migration while enforcing a good security posture.ExternalTrafficPolicyallows configuring the Gateway either asCluster(default) orLocal, similar to the Seed. by @jamand [#14420][OPERATOR]Thegardener-node-agentnow monitors the health of systemd units declared in theOperatingSystemConfigand reports aSystemdUnitsReadycondition on theNode. Unhealthy units are surfaced on theShootvia theEveryNodeReadycondition. by @rfranzke [#14496][USER]TheShootspec fieldspec.kubernetes.kubeAPIServer.encryptionConfig.provider.typenow supports theaesgcmandsecretboxencryption provider types. The field is immutable. by @AleksandarSavchev [#14034][USER]TheGardenspec fieldsspec.virtualCluster.kubernetes.kubeAPIServer.encryptionConfig.provider.typeandspec.virtualCluster.gardener.gardenerAPIServer.encryptionConfig.provider.typenow support theaesgcmandsecretboxencryption provider types. The fields are immutable. by @AleksandarSavchev [#14034]🐛 Bug Fixes
[OPERATOR]The garbage collection logic now also deletes pods that are stuck due to preemption by the kubelet or scheduler. by @rfranzke [#14519][OPERATOR]The observability setup is deleted as late as possible so that, in case an error occurs during the deletion of any components, there is still enough information available to investigate the issue. by @iypetrov [#14475][OPERATOR]A bug was fixed wheregardenadm initcould fail due to a transient error while fetching theshoot-gardener-node-agentManagedResource when the Kubernetes API server is temporarily unavailable due to static pod rollout. by @ialidzhikov [#14601][OPERATOR]A bug has been fixed that caused unintentionalShootStatecreations forShoots running on managed seed clusters (those backed byManagedSeedobjects). The affectedShootStateresources are automatically cleaned up bygardenletduring start-up. by @plkokanov [#14666][USER]Cluster-proportional autoscaling of coredns now works with Kubernetes >= 1.33 by @ScheererJ [#14638][DEPENDENCY]Thegolangci-lintmakefile install recipe can be used in Gardener extensions again. by @timebertt [#14555]🏃 Others
[OPERATOR]Gardener Discovery Server is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14587][OPERATOR]Alertmanager is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14575][OPERATOR]Vali is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14567][OPERATOR]OpenTelemetry Collector is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14585][OPERATOR]UseInfologging for admission denials instead ofErrorso that the full stack trace to every denial log entry does not get logged by @DockToFuture [#14561][OPERATOR]Apiserver-Proxy uses a dedicated network interfaceapiserver-proxyfor its advertised IP address. Requests from nodes such as kubelet probes will use the proper IP as per the route table again. by @domdom82 [#14440][OPERATOR]Shoot advertised addresses are now configurable by extension components for Shoot VirtualService resources. by @ScheererJ [#14534][OPERATOR]DuringShootreconciliationMachineDeployments are now deployed in parallel. This should speed up the reconciliation of theWorkerresource. by @plkokanov [#14220][OPERATOR]Resource limits have been removed for node-problem-detector by @domdom82 [#14450][OPERATOR]Prometheus is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14573][OPERATOR]Additional per nodegroup metrics can be exposed bycluster-autoscalervia the field.spec.kubernetes.clusterAutoscaler.emitPerNodeGroupMetricsin theShootAPI . by @aaronfern [#14557][OPERATOR]Gardener Dashboard is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14586][OPERATOR]Patchis now used to label allMachines withforce-deletion: Trueinstead ofUpdatewhen theShootis being hibernated or deleted. Additionally, the function used to do this during the reconciliation of theWorkerresource is now only executed once instead of for eachMachineDeployment. by @plkokanov [#14220][OPERATOR]Thegardenadm initflow now determines Pod network availability by checking the Node'sNetworkUnavailablecondition instead of theshoot-core-corednsManagedResource health. This is a prerequisite improvement for the control plane Node restoration feature. by @ialidzhikov [#14523][OPERATOR]The following dependencies have been updated:gardener/etcd-druidfromv0.36.2tov0.36.3. Release Notesgithub.com/gardener/etcd-druid/apifromv0.36.2tov0.36.3. by @Shreyas-s14 [#14661][OPERATOR]cluster-autoscaler now supports a new expanderleast-nodesfrom v1.31 onwards by @aaronfern [#14558][OPERATOR]Plutono is now exposed directly via istio instead of nginx-ingress by @ScheererJ [#14142][USER]VPN-related dashboards now show a shared crosshair on all panels. by @domdom82 [#14576][DEVELOPER]The DinD version used in the remote local setup has been updated to v29. by @vicwicker [#14644][DEVELOPER]make seed-downandmake garden-downcleanup additional resources by @matthias-horne [#14547][DEPENDENCY]The following dependencies have been updated:quay.io/prometheus/node-exporterfromv1.10.2tov1.11.1. by @gardener-ci-robot [#14508][DEPENDENCY]The following dependencies have been updated:gcr.io/istio-release/pilotfrom1.29.1to1.29.2.gcr.io/istio-release/proxyv2from1.29.1to1.29.2.istio.io/apifromv1.29.1tov1.29.2. by @gardener-ci-robot [#14582][DEPENDENCY]Update kindest/node image to v1.35.1 (Kubernetes v1.35.1, containerd v2.2.1). by @LucaBernstein [#14421][DEPENDENCY]The following dependencies have been updated:credativ/valifromv2.2.31tov2.2.32. Release Notes by @gardener-ci-robot [#14611][DEPENDENCY]The following dependencies have been updated:quay.io/kiwigrid/k8s-sidecarfrom2.5.5to2.6.0. by @gardener-ci-robot [#14537][DEPENDENCY]The following dependencies have been updated:gardener/etcd-druidfromv0.36.1tov0.36.2. Release Notesgithub.com/gardener/etcd-druid/apifromv0.36.1tov0.36.2. by @gardener-ci-robot [#14579][DEPENDENCY]The following dependencies have been updated:credativ/plutonofromv7.5.46tov7.5.47. Release Notes by @gardener-ci-robot [#14613][DEPENDENCY]The following dependencies have been updated:gardener/gardener-discovery-serverfromv0.9.0tov0.10.0. Release Notes by @gardener-ci-robot [#14600][DEPENDENCY]The following dependencies have been updated:gardener/coredns-config-adapterfromv0.5.0tov0.6.0. Release Notes by @gardener-ci-robot [#14605][DEPENDENCY]The following dependencies have been updated:quay.io/prometheus/alertmanagerfromv0.31.1tov0.32.0. by @gardener-ci-robot [#14538][DEPENDENCY]The following dependencies have been updated:envoyproxy/envoyfromdistroless-v1.37.0tov1.37.2. Release Notes by @gardener-ci-robot [#14563]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:4c0764b6cbd79bea391de905c444e8901f3ef901c9cc601a5b8fcf66394aa40aeurope-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:a4bed35099c21fb59a719a718afc1f83040d4746a7dfaf81c4442e09725bf0abeurope-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:549aafc0b61b16d9e7d6fa1ab0bd95bd68f0d7dfac77989be541e9551f4dc726europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:b0675085cef3786d983b6a751cff7820b6dd896e55afccd99e07cefa2891f161europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:3757e8e04a1e555abbe832c72932211b4fb766ee8f3d6ded15c9acd6a14adde9europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:68bc182b3b1cbfcbbdb26bcb9b0ac5a182e0de0b1ae785c7f0fd9947e9653ccdeurope-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:558ae9de4cfffe41cce57e22bc8505c9f38d54e0fb8feea7b06754970b9090a3europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:ca399bfd9253860c2a8f5287aec8ecdd90b8b4fa96e8694dede72a05f0fbe263europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:47b8d427ac8f6deee19004e196c2a3396edd5010293bb1272abd7aaa2d385daeeurope-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:88953b01d223307b0ea3e05c8df24eeb1f08e5c1883b85be42b5e5da7a2f5af3europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:97bbf8d719ee9a6a441aee3ea1690bcb054eaf5ee23b3e98ee7ba580e5732a80europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:b40af8512c84cb32e56541716cba9036152e4393e9c810d0ea109d9e89f3abe7europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:b687d0080c773f8b51d7e7fe262bd38774cace83dc175bd59e86b38d4378fa89europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:de2bed5eedb5348fb5399b7ade0ec3569a247f75a6ea532b1365cab8c84cba59europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:127276658aff87d975ce690a0a862c0073d1c119028110d0a4dcb1a71e281c50europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:637b96ae9ddebe86ce4b36cb9a275b88a5dcd6cc7a7c1ac3993d7d93c0b89374europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:118cf6da60ad6930362891b741ab79a4d596a5fc8933c2cef7f8cb9fe75653f8europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:f9aa546df5d17ae6fe8510da46bb403de6d5a594febec773258cf79886257ec6Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.141.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.141.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.141.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.141.0Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.141.0europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.141.0europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.141.0europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.141.0europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.141.0europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.141.0europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.141.0europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.141.0europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.141.0v1.140.3Compare Source
[github.com/gardener/gardener:v1.140.3]
🐛 Bug Fixes
[OPERATOR]An issue causing the guestbook TM test to fail against IPv6 Shoot clusters in now fixed. by @plkokanov [#14702][DEPENDENCY]ThereconcileSeedWebhookConfigfunction now correctly reconciles bothMutatingWebhookConfigurationandValidatingWebhookConfigurationfor extensions that register both mutating and validating admission webhooks. Previously, only the first configuration was reconciled due to a premature return in the loop. by @Roncossek [#14689]🏃 Others
[OPERATOR]Certain best-practice Envoy settings for HTTP2 protocol options have been applied toistio-ingressgateways. by @oliver-goetz [#14684]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:1822e85f811978fb349b74680f28221c87f4fa2d04fe0762de218b332075e992europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:e716405933cb7b0c95dad7c8b11a124cb9b571c30895a4d2f84f9cd2771ba93eeurope-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:1ef36f5654df729eb00af9ab0810911e3e3421f6dedaebb5608a92e16e91f41eeurope-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:4e7a18d5e6bc47206fc791b49a86bc9771f6f66d7834e949f4fe9f067dd60e42europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:75206bf16fb2d8d00455cb980e841f21cb2cb9b1d6f6c65289868f0016aa0ff4europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:9e17e10e5233fe816fa941337079a5f0cf4971706e56b3ca41d53891f4298bc8europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:362e9f27c3ef430116f35bf61b9c978f357d19ff1adeb006dbb0806490d36804europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:4ea00980471d300bcfea2d9a14aa6e86fc7cb9576cac09d52654971e82bc13b1europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:86bcf0386b0c339a0cc6575d0a90fe35e90d2e9ed23def3cab61d0a34c920088europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:e7412d581e18a4abcd07de047e4b54d57a33a971bdb0c8ed0865bc75d4cbe95deurope-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:92cd70254d04d18c7344eb8ce7403bb55bf7daeac13aa3aab396584a83c1f2d2europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:d8c29267cee2c67ff2e2f763d0d30b2bb9da26b85785f62d7ee848b1be4167d4europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:4618dc33e7a7a6107a4a1a913a59227c9789bd5e0bb104fa386abc268e50e563europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:fb2981dbb5af259f7efed3fb486461e7390bc85a061da6c76bfcd0885a9daeaaeurope-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:1392b85a90c73abb2ffc3c5de671a7ff31caacd18b6386b6830cc709eb788e9eeurope-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:91be0a00364158cab7080cbd4f4d4c63f55e3efb518541af5ff6084606eab9b5europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:7ba50df1dc37cd310633090fca423084453a5f426e3066e2f075c047753e727ceurope-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:85cab24d82c6cac2806c8cf94cec16274c41df98f569c0926de5b8994b837d9cHelm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.140.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.140.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.140.3europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.140.3Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.140.3europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.140.3europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.140.3europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.140.3europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.140.3europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.140.3europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.140.3europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.140.3europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.140.3v1.140.2Compare Source
[github.com/gardener/gardener:v1.140.2]
🐛 Bug Fixes
[OPERATOR]A bug has been fixed that caused unintentionalShootStatecreations forShoots running on managed seed clusters (those backed byManagedSeedobjects). The affectedShootStateresources are automatically cleaned up bygardenletduring start-up. by @tobschli [#14652][USER]Cluster-proportional autoscaling of coredns now works with Kubernetes >= 1.33 by @ScheererJ [#14650]🏃 Others
[DEPENDENCY]The following dependencies have been updated:gardener/gardener-discovery-serverfromv0.9.0tov0.10.0. Release Notes by @gardener-ci-robot [#14609]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:8e632c165a58e3d73b7b8d91ba20c6c9c0d56eb2c77eb51ed8f68c53b7c119eceurope-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:b1bbf47c6050a0b0bd375b1caa6ed7676ab3f55c415ebf7d0b5ef6e474d6b3c0europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:3dbd103fd2bff6f557201f8c2089d835ab8690aa7c45fc2ab3ea9d246faa4d5ceurope-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:bba291fa54adf1fee863013d8e1853eb1b69e269957837619ccb44882293d79eeurope-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:197cc1f8adb17c6dedf2bff14cae41e2995101208b664ddea635e79410738d61europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:3f2d2108871940f6a8ad215cc221044fc27998f835ee4a4a5b486f7b0f14b080europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:666d9f776aa93a4aadc2abe094acfab8b042407255ee44f6f085e346741c3478europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:dfc8facb4841da0a19feea65952dbfc3306404ada2e595ef1ca322fd594db0c7europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:670478cf01ee601df03a77215e1c79fbda52181d4ec43c293b43cb2c4c468fafeurope-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:e69825509720518c2419a2b701e9a9433359a4a3d067176473557d2587a4b4f6europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:0ce0315f2f8b870e9518a63a6ef3ce1d7c3b8f4871a049a5f645c7b6f1f41bb7europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:38781d55c778f4b5432c5b8189b06780eebe2850085ea3268a9111ec328afba7europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:649244b2bebce7cd92c3b6db632a7e8c26a0e4a9f40670ca2ce7da7f205551f4europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:b55360921c2a8c84a1897a3d64c25dfbb3f0603d0c3d9d20c516a0a2c3b76e26europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:5155120ca1aac1ce9b752b1a629fcef61c246e1e74621e3c58aead8bdfd33baceurope-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:b547e944c7be9504bc0ec013beaaf507bb4794e22ceb9d925456d1eab8430849europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:44b1e433d7e7870a787774b2964657a4113ca758ac1e5a6444ea820f484ec038europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:fe309373e4bd99f3a1ae293fefce589cd8a4afe69269db261ce6c1fd2986f1e4Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.140.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.140.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.140.2europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.140.2Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.140.2europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.140.2europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.140.2europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.140.2europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.140.2europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.140.2europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.140.2europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.140.2europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.140.2v1.140.1Compare Source
[github.com/gardener/gardener:v1.140.1]
🐛 Bug Fixes
[DEPENDENCY]Thegolangci-lintmakefile install recipe can be used in Gardener extensions again. by @timebertt [#14564]🏃 Others
[DEPENDENCY]The following dependencies have been updated:gardener/etcd-druidfromv0.36.1tov0.36.2. Release Notesgithub.com/gardener/etcd-druid/apifromv0.36.1tov0.36.2. by @gardener-ci-robot [#14581]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.140.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.140.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.140.1europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.140.1Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.140.1europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.140.1europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.140.1europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.140.1europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.140.1europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.140.1europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.140.1europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.140.1europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.140.1v1.140.0Compare Source
[github.com/gardener/gardener:v1.140.0]
[OPERATOR]TheUseUnifiedHTTPProxyPortfeature gate has been promoted to Beta and is enabled by default. If using the Gardener ACL Extension you need make sure that at least versionv1.15.0is installed and allShootsare reconciled before the upgrade. by @jamand [#14422][DEVELOPER]Thegenerate-admin-kubeconf.shscript has been renamed togenerate-kubeconfig.sh. It now supports generating both admin (default) and viewer kubeconfigs. by @timuthy [#14464][DEVELOPER]Thegardenadmmachine pods have their state persisted in a unified PVC. Existing localgardenadmsetups need to be recreated. To reset a local machine pod, delete both the pod and its corresponding PVC. by @LucaBernstein [#14359][DEVELOPER]GEN_CRD_API_REFERENCE_DOCSmake command has been replaced withCRD_REF_DOCS. by @acumino [#14324][DEPENDENCY]Thepkg/utils/timepackage is now removed. Usek8s.io/utils/clock.Clockinstead. by @shafeeqes [#14515]📰 Noteworthy
[OPERATOR]TheSeedAuthorizernow enforces field/label selectors forgardenletlist/watchrequests onControllerInstallation,Bastion,Gardenlet,Seed,Shoot, andManagedSeedresources, restricting each gardenlet to only observe resources belonging to its own seed. by @rfranzke [#14452][OPERATOR]Thegardener-resource-manager'sNetworkPolicycontroller now only creates policies in namespaces that have pods with matchingto-*labels, significantly reducing the number ofNetworkPolicyobjects on seeds. by @rfranzke [#14410][OPERATOR]RemoveValiFeatureGate has been introduced. When enabled, everyValiinstance will be removed. This feature gate is available for both thegardenletand thegardener-operator. by @rrhubenov [#14279][DEVELOPER]Thesastandsast-reportchecks have been removed fromverifyandverify-extendedmake targets. Please call them explicitly when required. by @oliver-goetz [#14443]✨ New Features
[OPERATOR]TheProjectAPI now has a.status.conditionsfield for allowing controllers to report conditions onProjectobjects. by @jamand [#14403][DEVELOPER]The local setup has been augmented to make the self-hosted shoot's API server directly accessible from the host machine withoutkubectl port-forward. A new unifiedhack/usage/generate-admin-kubeconfig-local.shscript supports generating kubeconfigs for both the virtual garden and the self-hosted shoot. by @rfranzke [#14370]🐛 Bug Fixes
[OPERATOR]The formatting of event-logger logs when theOpenTelemetryCollectorfeature gate is enabled is now partially fixed. The event-logger logs are now properly structured with fields as attributes, but to make them searchable with theunpackfeature a change in the fluent-bit output plugin is required. by @iypetrov [#14423][OPERATOR]Thegardenletreconciler in thegardener-operatornow uses the virtual cluster client to fetch the pull secret and CA bundle secret. It was wrongly using the runtime cluster client earlier. by @shafeeqes [#14331][OPERATOR]Fix a bug where theshoot-carecontroller cannot reconcile shoots withspec.maintenance.confineSpecUpdateRollout=trueand updated DNS credentials, i.e.shoot.spec.dns.providers[].credentialsRef, until the shoot is reconciled. by @vpnachev [#14397][USER]FixedEveryNodeReadyshoot condition incorrectly reportingNodeAgentUnhealthyfor nodes not managed by MCM. by @acumino [#14509][DEVELOPER]Pull secrets in the remote setup are labeled correctly to be automatically propagated by @matthias-horne [#14502][DEPENDENCY]Extension shoot webhook configs are now always produced even whenmergeShootWebhooksIntoSeedWebhooksistrue, so that a self-hostedShootpromoted to aSeedhas the correct shoot webhooks registered. by @rfranzke [#14389]🏃 Others
[OPERATOR]FixKubePodNotReadyControlPlanealert to not trigger for pods inCompletedstate. by @adenitiu [#14404][OPERATOR]Create pull secret in garden namespace of virtual garden for remote setup. by @DockToFuture [#14449][OPERATOR]Introduce seed reconciliation alerts. by @adenitiu [#14441][OPERATOR]Enable notification flexibility ofEtcdDbSizeLimitApproachingandEtcdDbSizeLimitCrossedalert for seeds by @adenitiu [#14384][OPERATOR]The following dependencies have been updated:gardener/autoscalerfromv1.34.0tov1.34.1. Release Notesgardener/autoscalerfromv1.33.0tov1.33.1. Release Notesgardener/autoscalerfromv1.32.2tov1.32.3. Release Notesgardener/autoscalerfromv1.31.0tov1.31.1. Release Notesgardener/autoscalerfromv1.30.2tov1.30.3. Release Notes by @aaronfern [#14479][OPERATOR]There is nowmaxConnectionDurationof 1 day for connections to kube-apiserver endpoints. TheirmaxConnectionslimit has been removed. by @oliver-goetz [#14463][DEVELOPER]The default shoot for test machinery tests was adjusted to work with Kubernetes 1.35. by @timuthy [#14439][DEVELOPER]In the remote setup Kyverno now always adds imagePullSecret for images in the remote registry. by @matthias-horne [#14478][DEPENDENCY]The following dependencies have been updated:registry.k8s.io/autoscaling/vpa-admission-controllerfrom1.5.1to1.6.0.registry.k8s.io/autoscaling/vpa-recommenderfrom1.5.1to1.6.0.registry.k8s.io/autoscaling/vpa-updaterfrom1.5.1to1.6.0. by @gardener-ci-robot [#14036][DEPENDENCY]The following dependencies have been updated:gardener/machine-controller-managerfromv0.61.2tov0.61.3. Release Notesgithub.com/gardener/machine-controller-managerfromv0.61.2tov0.61.3. by @gardener-ci-robot [#14453][DEPENDENCY]Istio charts and images are updated to v1.29.1 by @axel7born [#14454][DEPENDENCY]The following dependencies have been updated:gardener/gardener-metrics-exporterfrom0.43.0to0.44.0. Release Notes by @gardener-ci-robot [#14486][DEPENDENCY]The following dependencies have been updated:quay.io/kiwigrid/k8s-sidecarfrom2.5.0to2.5.5. by @gardener-ci-robot [#14480][DEPENDENCY]The following dependencies have been updated:gardener/coredns-config-adapterfromv0.4.0tov0.5.0. Release Notes by @DockToFuture [#14490]Helm Charts
europe-docker.pkg.dev/gardener-project/releases/charts/gardener/controlplane:v1.140.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.140.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.140.0europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.140.0Container (OCI) Images
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.140.0europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.140.0europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.140.0europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.140.0europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.140.0europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.140.0europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.140.0europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.140.0europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.140.0v1.139.4Compare Source
[github.com/gardener/gardener:v1.139.4]
🐛 Bug Fixes
[OPERATOR]An issue causing the guestbook TM test to fail against IPv6 Shoot clusters in now fixed. by @plkokanov [#14715][DEPENDENCY]ThereconcileSeedWebhookConfigfunction now correctly reconciles bothMutatingWebhookConfigurationandValidatingWebhookConfigurationfor extensions that register both mutating and validating admission webhooks. Previously, only the first configuration was reconciled due to a premature return in the loop. by @Roncossek [#14687]🏃 Others
[OPERATOR]Certain best-practice Envoy settings for HTTP2 protocol options have been applied toistio-ingressgateways. by @oliver-goetz [#14686]application/spdx+json
europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:11734fcca9c46eca915bf337b80e638bc15297cc2e3377e7d3347b7ece7d8f0ceurope-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:7a2c70c395c4d158e005ea03aad441ce38e066cd92991c919eb3119c5568eaefeurope-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:0669836b0b7004c4e5052bdd64f66366226d83038007e514fb860d96e2c13bd7europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:39ba155f5152883751e3edd65091c4be36b9d1c0501f891476d399d9bae98f86europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:27445598326ac805d67cd2e4c41ced755e72567273544cec2342b70cd7f5026fConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Release note: