v1.5.3
Important Registry Change Information
For the next series of KubeOne and KKP patch releases, image references will move from k8s.gcr.io
to registry.k8s.io
. This will be done to keep up with the latest upstream changes. Please ensure that any mirrors you use are able to host registry.k8s.io
and/or that firewall rules are going to allow access to registry.k8s.io
to pull images before applying the next KubeOne patch releases. This is not included in this patch release but just a notification of future changes.
Important Security Information
Kubernetes releases prior to 1.25.4, 1.24.8, 1.23.14, and 1.22.16 are affected by two Medium CVEs in kube-apiserver: CVE-2022-3162 (Unauthorized read of Custom Resources) and CVE-2022-3294 (Node address isn't always verified when proxying). We strongly recommend upgrading to 1.25.4, 1.24.8, 1.23.14, or 1.22.16 as soon as possible.
Changelog since v1.5.2
Changes by Kind
API Change
.cloudProvider.csiConfig
is now a mandatory field for vSphere clusters using the external cloud provider (.cloudProvider.external: true
)..cloudProvider.csiConfig
can be specified even if the in-tree provider is used, but the provided CSIConfig is ignored in such cases (a warning about this is printed) (#2447, @kubermatic-bot)
Feature
- Add
allow_insecure
variable (defaultfalse
) to Terraform configs for vSphere. The value of this variable is propagated to the MachineDeployment template inoutput.tf
(#2449, @xmudrii) - Add a new addon parameter called
HubbleIPv6
(true
/false
, default:true
) for Cilium CNI used to enable/disable Hubble UI listening on an IPv6 interface (#2451, @kubermatic-bot) - Update OpenStack CCM and CSI to v1.24.5 and v1.22.2 (#2445, @xmudrii)
- Update etcd to 3.5.5 or use the version provided by kubeadm if it's newer (#2443, @kubermatic-bot)
Other (Cleanup or Flake)
- Expose machine-controller metrics port (8080/TCP), so Prometheus ServiceMonitor can be used for scraping (#2439, @kubermatic-bot)
- Make volume size for worker nodes configurable in Terraform configs for AWS (50 GB by default) (#2450, @xmudrii)
Chore
- Rename
generate-internal-groups
Make target toupdate-codegen
(#2450, @xmudrii) - KubeOne is now built using Go 1.19.3 (#2462, @xmudrii)
- The
kubeone-e2e
image is moved from Docker Hub to Quay (quay.io/kubermatic/kubeone-e2e
) (#2464, @xmudrii)
Checksums
SHA256 checksums can be found in the kubeone_1.5.3_checksums.txt
file.