Skip to content

CHANGELOG.md

Latest commit

 

History

History
345 lines (261 loc) · 14.9 KB

CHANGELOG.md

File metadata and controls

345 lines (261 loc) · 14.9 KB

CHANGELOG

Release 2.5.1

Breaking changes

  • Solutions product information format has changed, there is a new manifest.yaml file to describe the whole Solution instead of the product.txt and config.yaml (#2422). Solution archives working on previous versions of MetalK8s will no longer be compatible and will need to be regenerated. See Solutions documentation for details about the new format.

Enhancements

  • #2590 - Bump Kubernetes version to 1.16.10 (PR #2597)

  • #2423 - Bump nginx-ingress-controller version to 0.30.0 (PR #2446)

  • #2429 - Bump Dex version to 2.23.0 (PR #2437)

  • #2430 - Bump prometheus-operator version to 8.13.0 (PR #2557)

  • #2431 - Bump Prometheus-adapter version to 0.6.0 (PR #2441)

  • #2488 - Update default CSC value during upgrade/downgrade (PR #2513)

  • #2493 - Use async call for disk.dump during Volume provisioning (PR #2571)

  • Add support for CustomResourceDefinition apiextensions.k8s.io/v1 in metalk8s_kubernetes Salt module (PR #2583)

Bug fixes

  • #2434 - Wait for a single Salt Master container during Bootstrap (PR #2435)

  • #2526 - Add 'groups' scope when requesting an id_token from Dex in the UI (PR #2529)

  • #2443 - Improve error handling for Salt jobs in the UI (PR #2475)

  • #2495 - Fix monitoring page to display all alerts in the UI (PR #2503)

  • #2569 - Restart Dex Pod automatically upon CSC Dex configuration changes (PR #2573)

  • #2533 - Use dedicated kubeconfig for Salt master (PR #2534)

Release 2.5.0

Breaking changes

  • Basic authentication has been deprecated in favour of OpenID Connect (OIDC) with Dex being deployed as a local Identity Provider, used by Kubernetes API and Grafana.

    This implies:

    • The existing users defined for Kubernetes API Basic Auth in (/etc/kubernetes/htpasswd) and for the Grafana admin will become unusable
    • A default admin user will be created in Dex, with the new credentials admin@metalk8s.invalid:password which can be used to access the MetalK8s UI and Grafana
    • Procedures to edit and add new users can now be found here

  • A new framework for persisting Cluster and Services Configurations (CSC) has been added to ensure configurations set by administrators are not lost during upgrade or downgrade and can be found here.

    • User-provided configuration is now stored in ConfigMaps, and MetalK8s tooling will honor the values provided when deploying its services:

      • Dex uses metalk8s-auth/metalk8s-dex-config
      • Grafana uses metalk8s-monitoring/metalk8s-grafana-config
      • Prometheus uses metalk8s-monitoring/metalk8s-prometheus-config
      • Alertmanager uses metalk8s-monitoring/metalk8s-alertmanager-config

    • Documentation for changing and applying configuration values is found here.

      Note that any configuration applied on other Kubernetes objects (e.g. a configuration Secret that Alertmanager uses, or the Deployment of Grafana) will be lost upon upgrade, and admins should make sure to prepare the relevant ConfigMaps from their existing configuration before upgrading to this version.

  • The MetalK8s UI has been re-branded with lots of changes to the Login screens and Navbar to offer a smoother experience.

Features Added

  • Upgrade Calico to 3.12.0 (PR #2253)

  • #2007 - Deploy Dex in a MetalK8s cluster from stable Helm Charts (PR #2025)

  • #2015 - Configure MetalK8s UI to require authentication through Dex (OIDC) (PR #2042)

  • #2016 - Brand the Dex GUI to match MetalK8s UI specifications (PR #2062)

  • #2072 - Remove support for Kubernetes API server basic authentication (PR #2119)

  • #2078 - Store Dex authentication access_token in the browser localStorage (PR #2088)

  • #2255 - Template and store replicas count for Prometheus, Grafana & Alertmanager as service configurations (PR #2258)

  • #2261 - Template and store Dex backend settings as service configurations (PR #2274)

  • #2262 - Template and store Alertmanager Secret as a service configuration (PR #2289)

  • #2328 - Bump K8S version to 1.16.8 (PR #2363)

  • Enable OIDC based authentication for Grafana service (PR #2378)

Documentation

  • #2351 - Update documentation with default credentials for Metalk8s UI and Grafana UI (PR #2377)

  • #2264 - Add documentation on the list of Cluster and Service configurations (PR #2291)

Release 2.4.5 (in development)

Release 2.4.4

Features added

  • #2561 - install kubectl on all master nodes (PR #2562)

Security fixes

  • Due to critical vulnerabilities ( CVE-2020-11652 and CVE-2020-11651) with CVSS score of 10.0 affecting all Salt master versions inferior to 3000.2, this release ships with all Saltstack updated to 3000.3. Users, especially those who expose the Salt master to the Internet must therefore upgrade immediately.

    #650 - Upgrade Salt master to version 3000.3 (PR #2549)

  • Due to an access control vulnerability CVE-2020-13379 with CVSS score of 5.3 that was discovered affecting Grafana versions from 3.0.1 through 7.0.1, this release ships with a Grafana version updated to 6.7.4. For more, see here

    #2600 - Upgrade Grafana to 6.7.4 (PR #2605)

  • A potential risk for privilege escalation in SaltAPI described here was fixed in this release.

    #2634 - Prevent impersonation in SaltAPI (PR #2642)

    #1528 and #2084 - Tighten storage-operator permissions against Salt (PR #2635)

Enhancements

  • #2589 - Bump Kubernetes version to 1.15.12 (PR #2595)

  • #2029 - Bump python-kubernetes client to v11 (PR #2554)

  • Make etcd expansions more resilient (PR #2147)

  • #2585 - Add state to cleanup PrometheusRule CRs after upgrade/downgrade (PR #2594)

  • #2533 - Use dedicated kubeconfig for Salt master (PR #2534)

Bug fixes

  • #2444 - Fix flaky SLS rendering when missing a pillar key (PR #2445)

  • #2524 - Fix salt-minion upgrade and downgrade (PR #2525)

  • #2551 Fix downgrade pre-check regarding the saltenv version (PR #2552)

  • #2592 - Fix invalid custom object listing in metalk8s_kubernetes Salt module (PR #2593)

  • Fix apiserver-proxy to no longer proxy to non-master nodes (PR #2555)

  • #2530 - Make cluster upgrade more robust to Pod disruption constraints (PR #2531)

  • #2028 - Improve the resilience of node deployment (PR #2147)

  • Fix various issues in the bootstrap restore script (PR #2061)

Release 2.4.3

Features added

  • #1993 - Add Solutions management, CLI tooling to deploy Solutions (complex Kubernetes applications) (PR #2279)

Enhancements

  • Add label_selector in MetalK8s custom kubernetes salt module for listing kubernetes objects (PR #2236)

  • #2328 - Bump K8S version to 1.15.11 (PR #2362)

  • Salt grains cache is now enabled (PR #2417

Bug fixes

  • #2334 - Add and install yum-utils package required for cluster expansion (PR #2343)

  • #2245 - Rephrase volume status from Available to Ready (PR #2248)

  • #2409 - Deletion on pending volumes (PR #2410)

Release 2.4.2

Breaking changes

  • If apiServer.host is configured in BootstrapConfiguration, this is no longer used (and must no longer be defined).
  • If apiServer.keepalived is configured in BootstrapConfiguration, this is no longer used, and Keepalived is no longer deployed at all.
  • Generated admin.conf KubeConfig files point to the control-plane IP of the host on which they are generated. You can override this when using them using kubectls -s/--server argument to point to another address.

Features added

  • #1891 - Allow adding labels to Volumes from the UI (PRs #1979 and #2066)

  • #2049 - Deploy prometheus-adapter to implement the metrics.k8s.io API, to support kubectl top and other consumers of this API (PR #2057)

  • #2103 - Add a host-local nginx on every node to provide highly-available and load-balanced access to kube-apiserver (PR #2106)

  • #2052 - Handle configuration of an HTTP proxy for containerd (PRs #2071 and #2201)

  • #2149 - Provide access to the product documentation from the UI (PR #2176)

Bug fixes

Release 2.4.1

Features added

  • #1891 - Allow adding labels to Volumes from the UI (PR #1979) Note: this only sets labels on the Volume object, not the created PV. Fixed in 2.4.2

Bug fixes

  • #1970 - Ensure yum history, repositories and RPM databases are properly closed after a transaction (PR #1971)