Skip to main content

Release Notes v1.70

23KE release notes and upgrade guide​

Related upstream release notes / changelogs​

Update provider-gcp to 1.29.1

[gardener-extension-provider-gcp]

🐛 Bug Fixes​

Update cert-management to 0.10.5

[cert-management]

🏃 Others​

Update external-dns-management to 0.15.3

[external-dns-management]

✨ New Features​

🏃 Others​

Update networking-calico to 1.33.0

[gardener-extension-networking-calico]

🏃 Others​

Update networking-cilium to 1.24.0

[gardener-extension-networking-cilium]

🏃 Others​

Update shoot-cert-service to 1.32.0

[gardener-extension-shoot-cert-service]

🏃 Others​

[cert-management]

🏃 Others​

Update gardener-controlplane to 1.70.0

[gardener]

⚠️ Breaking Changes​

  • [USER] Gardener sets minDomains for shoot system components to the number of zones configured in the system component worker pool(s). (gardener/gardener#7826, @timuthy)
    • ⚠️ It is strongly recommended to place at least one worker node per availability zone for system component workers in order to ensure hitch-free rolling updates and scheduling of pods. You may need to adjust the maximum: <number-of-zones> values of your system component worker pool(s).
    • This configuration only takes effect for clusters which enabled feature gate MinDomainsInPodTopologySpread (enabled by default as of Kubernetes v1.27).
  • [USER] The spec.secretBindingName, .spec.networking, .spec.networking.type, spec.maintenance.autoUpdate.machineImageVersion fields in the Shoot API are now made optional to prepare for the introduction of workerless Shoots feature. Please see https://github.com/gardener/gardener/issues/7635 for more details. (gardener/gardener#7828, @shafeeqes)
  • [OPERATOR] The promoted or deprecated feature gates ManagedIstio and ReversedVPN have been removed. Remove these feature gates before updating to this version of Gardener. (gardener/gardener#7830, @rfranzke)
  • [DEVELOPER] The gardener.cloud/timestamp annotation is now formatted as time.RFC3339Nano. (gardener/gardener#7796, @dimityrmirchev)

✨ New Features​

  • [USER] It is now possible to specify custom linux kernel settings per worker pool for Shoots via .spec.provider.workers[].sysctls, which may override Gardener default values. (gardener/gardener#7825, @ScheererJ)
  • [USER] Secrets/ConfigMaps referenced in .spec.resources of Shoots are now protected with a finalizer to ensure they do not disappear from the system as long as they are still referenced somewhere. (gardener/gardener#7850, @rfranzke)
  • [OPERATOR] gardener-operator now deploys Istio components into the garden runtime cluster. (gardener/gardener#7817, @timuthy)
  • [OPERATOR] The highavailabilityconfig webhook configures topology spread constraints with minDomains=<number-of- zones>. This configuration only takes effect for clusters which enabled feature gate MinDomainsInPodTopologySpread (default as of Kubernetes v1.27). Please note, this configuration will require at least one worker node per registered availability zone so that Kubernetes can spread the respective seed, shoot and control-plane pods across zones. (gardener/gardener#7826, @timuthy)
  • [OPERATOR] Gardener now supports seed clusters with Kubernetes versions up to v1.26. (gardener/gardener#7831, @shafeeqes)
  • [OPERATOR] Annotations in seed.spec.settings.loadBalancerServices.annotations are now applied to the Nginx-Ingress load balancer service in the seed cluster. (gardener/gardener#7835, @timuthy)
  • [OPERATOR] The gardener-operator does now also manage kube-state-metrics. (gardener/gardener#7836, @rfranzke)
  • [DEVELOPER] The local deployment of Gardener is extended so that it is now possible to create a second single zone HA Seed. This Seed can be used to test the control plane migration scenario for HA Shoots. Additionally, make targets were added to trigger the control plane migration integration test with HA Shoots: test-e2e-local-migration-ha-single-zone to test the migration locally, and ci-e2e-kind-migration-ha-single-zone mainly intended to be used in Gardener prow jobs. (gardener/gardener#7742, @plkokanov)

🐛 Bug Fixes​

  • [OPERATOR] Prevent nil pointer exceptions on shoot deletion in gardenlet when seed namespace is gone. (gardener/gardener#7827, @oliver-goetz)
  • [OPERATOR] gardener-apiserver: The kubelet version constraint validation is now fixed to also cover the Shoot K8s version update. Previously it was possible to update the Shoot K8s version to a new minor version when the Shoot has a worker pool with machine image version which kubeletVersionConstraint does not match the new K8s version. (gardener/gardener#7853, @ialidzhikov)

📖 Documentation​

🏃 Others​

  • [OPERATOR] Suppress the event-logger nest filter's warnings in the fluent-bit. (gardener/gardener#7832, @vlvasilev)
  • [OPERATOR] Fixed an issue that would cause the gardenlet to run into CrashLoopBackoff when following the docs/development/getting_started_locally.md#remote-local-setup guide. (gardener/gardener#7841, @plkokanov)
  • [OPERATOR] When Seed's spec.settings.ownerChecks.enabled=false gardenlet is now able to delete the owner DNSRecord for a Shoot stuck in deletion where the kube-apiserver Deployment is missing but the Infrastructure is present and cannot be deleted for some reason (infrastructure dependency, invalid credentials). (gardener/gardener#7842, @ialidzhikov)
  • [OPERATOR] The Istio Ingress-Gateway deployment was refined to speed up seed bootstrapping times. (gardener/gardener#7844, @timuthy)
  • [OPERATOR] Change log mount path of node-problem-detector from /var/log to /var/log/journal. (gardener/gardener#7860, @AleksandarSavchev)
  • [OPERATOR] Gardener now deploys the cluster-autoscaler earlier in the shoot reconciliation flow without checking if the worker pools are ready. (gardener/gardener#7774, @rishabh-11)
  • [DEVELOPER] Update local-setup to kind@v0.18.0. (gardener/gardener#7831, @shafeeqes)
  • [DEVELOPER] Deactivate leader election, health and readiness checks when running make *-debug. (gardener/gardener#7847, @oliver-goetz)
  • [DEVELOPER] Improves testing flakiness of logging testmachinery test by making the loki init-container reliable. (gardener/gardener#7848, @nickytd)
  • [DEVELOPER] Go version is updated to 1.20.4. (gardener/gardener#7862, @shafeeqes)
  • [DEVELOPER] The register-kind2-env and tear-down-kind2-env will no longer try to deploy and delete the seed-local Secret. This fixes an issue where tear-down-kind2-env would hang as it deletes and then waits for the seed-local Secret to be deleted which can not happen as long as the local Seed which uses it still exists. (gardener/gardener#7742, @plkokanov)
  • [DEVELOPER] Introduced a new field called machineDeploymentsLastUpdateTime in the Worker status to keep track of the time when the status of the Worker resource was last updated with the latest machine deployments. (gardener/gardener#7774, @rishabh-11)

[hvpa-controller]

✨ New Features​

  • [OPERATOR] HVPA supports k8s versions >= 1.25 by switching to k8s.io/autoscaling/v2 when necessary for all API calls. (gardener/hvpa-controller#121, @voelzmo)
  • [OPERATOR] Added a LeaderElectionID to the controller options, allowing to run multiple instances of HVPA with leader election when --leader-elect=true is passed as commandline arg (gardener/hvpa-controller#122, @voelzmo)

🏃 Others​

Docker Images​

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.70.0 apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.70.0 controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.70.0 scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.70.0 operator: eu.gcr.io/gardener-project/gardener/operator:v1.70.0 gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.70.0 resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.70.0

Update gardener-controlplane to 1.70.0

[gardener]

⚠️ Breaking Changes​

  • [USER] Gardener sets minDomains for shoot system components to the number of zones configured in the system component worker pool(s). (gardener/gardener#7826, @timuthy)
    • ⚠️ It is strongly recommended to place at least one worker node per availability zone for system component workers in order to ensure hitch-free rolling updates and scheduling of pods. You may need to adjust the maximum: <number-of-zones> values of your system component worker pool(s).
    • This configuration only takes effect for clusters which enabled feature gate MinDomainsInPodTopologySpread (enabled by default as of Kubernetes v1.27).
  • [USER] The spec.secretBindingName, .spec.networking, .spec.networking.type, spec.maintenance.autoUpdate.machineImageVersion fields in the Shoot API are now made optional to prepare for the introduction of workerless Shoots feature. Please see https://github.com/gardener/gardener/issues/7635 for more details. (gardener/gardener#7828, @shafeeqes)
  • [OPERATOR] The promoted or deprecated feature gates ManagedIstio and ReversedVPN have been removed. Remove these feature gates before updating to this version of Gardener. (gardener/gardener#7830, @rfranzke)
  • [DEVELOPER] The gardener.cloud/timestamp annotation is now formatted as time.RFC3339Nano. (gardener/gardener#7796, @dimityrmirchev)

✨ New Features​

  • [USER] It is now possible to specify custom linux kernel settings per worker pool for Shoots via .spec.provider.workers[].sysctls, which may override Gardener default values. (gardener/gardener#7825, @ScheererJ)
  • [USER] Secrets/ConfigMaps referenced in .spec.resources of Shoots are now protected with a finalizer to ensure they do not disappear from the system as long as they are still referenced somewhere. (gardener/gardener#7850, @rfranzke)
  • [OPERATOR] gardener-operator now deploys Istio components into the garden runtime cluster. (gardener/gardener#7817, @timuthy)
  • [OPERATOR] The highavailabilityconfig webhook configures topology spread constraints with minDomains=<number-of- zones>. This configuration only takes effect for clusters which enabled feature gate MinDomainsInPodTopologySpread (default as of Kubernetes v1.27). Please note, this configuration will require at least one worker node per registered availability zone so that Kubernetes can spread the respective seed, shoot and control-plane pods across zones. (gardener/gardener#7826, @timuthy)
  • [OPERATOR] Gardener now supports seed clusters with Kubernetes versions up to v1.26. (gardener/gardener#7831, @shafeeqes)
  • [OPERATOR] Annotations in seed.spec.settings.loadBalancerServices.annotations are now applied to the Nginx-Ingress load balancer service in the seed cluster. (gardener/gardener#7835, @timuthy)
  • [OPERATOR] The gardener-operator does now also manage kube-state-metrics. (gardener/gardener#7836, @rfranzke)
  • [DEVELOPER] The local deployment of Gardener is extended so that it is now possible to create a second single zone HA Seed. This Seed can be used to test the control plane migration scenario for HA Shoots. Additionally, make targets were added to trigger the control plane migration integration test with HA Shoots: test-e2e-local-migration-ha-single-zone to test the migration locally, and ci-e2e-kind-migration-ha-single-zone mainly intended to be used in Gardener prow jobs. (gardener/gardener#7742, @plkokanov)

🐛 Bug Fixes​

  • [OPERATOR] Prevent nil pointer exceptions on shoot deletion in gardenlet when seed namespace is gone. (gardener/gardener#7827, @oliver-goetz)
  • [OPERATOR] gardener-apiserver: The kubelet version constraint validation is now fixed to also cover the Shoot K8s version update. Previously it was possible to update the Shoot K8s version to a new minor version when the Shoot has a worker pool with machine image version which kubeletVersionConstraint does not match the new K8s version. (gardener/gardener#7853, @ialidzhikov)

📖 Documentation​

🏃 Others​

  • [OPERATOR] Suppress the event-logger nest filter's warnings in the fluent-bit. (gardener/gardener#7832, @vlvasilev)
  • [OPERATOR] Fixed an issue that would cause the gardenlet to run into CrashLoopBackoff when following the docs/development/getting_started_locally.md#remote-local-setup guide. (gardener/gardener#7841, @plkokanov)
  • [OPERATOR] When Seed's spec.settings.ownerChecks.enabled=false gardenlet is now able to delete the owner DNSRecord for a Shoot stuck in deletion where the kube-apiserver Deployment is missing but the Infrastructure is present and cannot be deleted for some reason (infrastructure dependency, invalid credentials). (gardener/gardener#7842, @ialidzhikov)
  • [OPERATOR] The Istio Ingress-Gateway deployment was refined to speed up seed bootstrapping times. (gardener/gardener#7844, @timuthy)
  • [OPERATOR] Change log mount path of node-problem-detector from /var/log to /var/log/journal. (gardener/gardener#7860, @AleksandarSavchev)
  • [OPERATOR] Gardener now deploys the cluster-autoscaler earlier in the shoot reconciliation flow without checking if the worker pools are ready. (gardener/gardener#7774, @rishabh-11)
  • [DEVELOPER] Update local-setup to kind@v0.18.0. (gardener/gardener#7831, @shafeeqes)
  • [DEVELOPER] Deactivate leader election, health and readiness checks when running make *-debug. (gardener/gardener#7847, @oliver-goetz)
  • [DEVELOPER] Improves testing flakiness of logging testmachinery test by making the loki init-container reliable. (gardener/gardener#7848, @nickytd)
  • [DEVELOPER] Go version is updated to 1.20.4. (gardener/gardener#7862, @shafeeqes)
  • [DEVELOPER] The register-kind2-env and tear-down-kind2-env will no longer try to deploy and delete the seed-local Secret. This fixes an issue where tear-down-kind2-env would hang as it deletes and then waits for the seed-local Secret to be deleted which can not happen as long as the local Seed which uses it still exists. (gardener/gardener#7742, @plkokanov)
  • [DEVELOPER] Introduced a new field called machineDeploymentsLastUpdateTime in the Worker status to keep track of the time when the status of the Worker resource was last updated with the latest machine deployments. (gardener/gardener#7774, @rishabh-11)

[hvpa-controller]

✨ New Features​

  • [OPERATOR] HVPA supports k8s versions >= 1.25 by switching to k8s.io/autoscaling/v2 when necessary for all API calls. (gardener/hvpa-controller#121, @voelzmo)
  • [OPERATOR] Added a LeaderElectionID to the controller options, allowing to run multiple instances of HVPA with leader election when --leader-elect=true is passed as commandline arg (gardener/hvpa-controller#122, @voelzmo)

🏃 Others​

Docker Images​

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.70.0 apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.70.0 controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.70.0 scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.70.0 operator: eu.gcr.io/gardener-project/gardener/operator:v1.70.0 gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.70.0 resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.70.0

Update gardenlet to 1.70.0

[gardener]

⚠️ Breaking Changes​

  • [USER] Gardener sets minDomains for shoot system components to the number of zones configured in the system component worker pool(s). (gardener/gardener#7826, @timuthy)
    • ⚠️ It is strongly recommended to place at least one worker node per availability zone for system component workers in order to ensure hitch-free rolling updates and scheduling of pods. You may need to adjust the maximum: <number-of-zones> values of your system component worker pool(s).
    • This configuration only takes effect for clusters which enabled feature gate MinDomainsInPodTopologySpread (enabled by default as of Kubernetes v1.27).
  • [USER] The spec.secretBindingName, .spec.networking, .spec.networking.type, spec.maintenance.autoUpdate.machineImageVersion fields in the Shoot API are now made optional to prepare for the introduction of workerless Shoots feature. Please see https://github.com/gardener/gardener/issues/7635 for more details. (gardener/gardener#7828, @shafeeqes)
  • [OPERATOR] The promoted or deprecated feature gates ManagedIstio and ReversedVPN have been removed. Remove these feature gates before updating to this version of Gardener. (gardener/gardener#7830, @rfranzke)
  • [DEVELOPER] The gardener.cloud/timestamp annotation is now formatted as time.RFC3339Nano. (gardener/gardener#7796, @dimityrmirchev)

✨ New Features​

  • [USER] It is now possible to specify custom linux kernel settings per worker pool for Shoots via .spec.provider.workers[].sysctls, which may override Gardener default values. (gardener/gardener#7825, @ScheererJ)
  • [USER] Secrets/ConfigMaps referenced in .spec.resources of Shoots are now protected with a finalizer to ensure they do not disappear from the system as long as they are still referenced somewhere. (gardener/gardener#7850, @rfranzke)
  • [OPERATOR] gardener-operator now deploys Istio components into the garden runtime cluster. (gardener/gardener#7817, @timuthy)
  • [OPERATOR] The highavailabilityconfig webhook configures topology spread constraints with minDomains=<number-of- zones>. This configuration only takes effect for clusters which enabled feature gate MinDomainsInPodTopologySpread (default as of Kubernetes v1.27). Please note, this configuration will require at least one worker node per registered availability zone so that Kubernetes can spread the respective seed, shoot and control-plane pods across zones. (gardener/gardener#7826, @timuthy)
  • [OPERATOR] Gardener now supports seed clusters with Kubernetes versions up to v1.26. (gardener/gardener#7831, @shafeeqes)
  • [OPERATOR] Annotations in seed.spec.settings.loadBalancerServices.annotations are now applied to the Nginx-Ingress load balancer service in the seed cluster. (gardener/gardener#7835, @timuthy)
  • [OPERATOR] The gardener-operator does now also manage kube-state-metrics. (gardener/gardener#7836, @rfranzke)
  • [DEVELOPER] The local deployment of Gardener is extended so that it is now possible to create a second single zone HA Seed. This Seed can be used to test the control plane migration scenario for HA Shoots. Additionally, make targets were added to trigger the control plane migration integration test with HA Shoots: test-e2e-local-migration-ha-single-zone to test the migration locally, and ci-e2e-kind-migration-ha-single-zone mainly intended to be used in Gardener prow jobs. (gardener/gardener#7742, @plkokanov)

🐛 Bug Fixes​

  • [OPERATOR] Prevent nil pointer exceptions on shoot deletion in gardenlet when seed namespace is gone. (gardener/gardener#7827, @oliver-goetz)
  • [OPERATOR] gardener-apiserver: The kubelet version constraint validation is now fixed to also cover the Shoot K8s version update. Previously it was possible to update the Shoot K8s version to a new minor version when the Shoot has a worker pool with machine image version which kubeletVersionConstraint does not match the new K8s version. (gardener/gardener#7853, @ialidzhikov)

📖 Documentation​

🏃 Others​

  • [OPERATOR] Suppress the event-logger nest filter's warnings in the fluent-bit. (gardener/gardener#7832, @vlvasilev)
  • [OPERATOR] Fixed an issue that would cause the gardenlet to run into CrashLoopBackoff when following the docs/development/getting_started_locally.md#remote-local-setup guide. (gardener/gardener#7841, @plkokanov)
  • [OPERATOR] When Seed's spec.settings.ownerChecks.enabled=false gardenlet is now able to delete the owner DNSRecord for a Shoot stuck in deletion where the kube-apiserver Deployment is missing but the Infrastructure is present and cannot be deleted for some reason (infrastructure dependency, invalid credentials). (gardener/gardener#7842, @ialidzhikov)
  • [OPERATOR] The Istio Ingress-Gateway deployment was refined to speed up seed bootstrapping times. (gardener/gardener#7844, @timuthy)
  • [OPERATOR] Change log mount path of node-problem-detector from /var/log to /var/log/journal. (gardener/gardener#7860, @AleksandarSavchev)
  • [OPERATOR] Gardener now deploys the cluster-autoscaler earlier in the shoot reconciliation flow without checking if the worker pools are ready. (gardener/gardener#7774, @rishabh-11)
  • [DEVELOPER] Update local-setup to kind@v0.18.0. (gardener/gardener#7831, @shafeeqes)
  • [DEVELOPER] Deactivate leader election, health and readiness checks when running make *-debug. (gardener/gardener#7847, @oliver-goetz)
  • [DEVELOPER] Improves testing flakiness of logging testmachinery test by making the loki init-container reliable. (gardener/gardener#7848, @nickytd)
  • [DEVELOPER] Go version is updated to 1.20.4. (gardener/gardener#7862, @shafeeqes)
  • [DEVELOPER] The register-kind2-env and tear-down-kind2-env will no longer try to deploy and delete the seed-local Secret. This fixes an issue where tear-down-kind2-env would hang as it deletes and then waits for the seed-local Secret to be deleted which can not happen as long as the local Seed which uses it still exists. (gardener/gardener#7742, @plkokanov)
  • [DEVELOPER] Introduced a new field called machineDeploymentsLastUpdateTime in the Worker status to keep track of the time when the status of the Worker resource was last updated with the latest machine deployments. (gardener/gardener#7774, @rishabh-11)

[hvpa-controller]

✨ New Features​

  • [OPERATOR] HVPA supports k8s versions >= 1.25 by switching to k8s.io/autoscaling/v2 when necessary for all API calls. (gardener/hvpa-controller#121, @voelzmo)
  • [OPERATOR] Added a LeaderElectionID to the controller options, allowing to run multiple instances of HVPA with leader election when --leader-elect=true is passed as commandline arg (gardener/hvpa-controller#122, @voelzmo)

🏃 Others​

Docker Images​

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.70.0 apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.70.0 controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.70.0 scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.70.0 operator: eu.gcr.io/gardener-project/gardener/operator:v1.70.0 gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.70.0 resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.70.0

Update shoot-dns-service to 1.33.0

[gardener-extension-shoot-dns-service]

⚠️ Breaking Changes​

🐛 Bug Fixes​

🏃 Others​

[external-dns-management]

✨ New Features​

🏃 Others​

Update provider-aws to 1.43.1