v1.143.0

Compare Source

[github.com/gardener/gardener:v1.143.0]

⚠️ Breaking Changes

• [OPERATOR] gardener-operator's ValidatingWebhookConfiguration no longer accepts invalid values for the Garden's .spec.virtualCluster.kubernetes.kubeAPIServer.eventTTL field even for existing Garden resources with already invalid values. Invalid values are values outside of the range [0, 24h]. The gardener-operator webhook caps the eventTTL to 24h for already persisted Gardens with a value exceeding the allowed maximum. by @​ialidzhikov [#​14707]
• [OPERATOR] The GA-ed and unconditionally enabled NewWorkerPoolHash feature gate is removed. If you have references to this feature gate, clean them up before upgrading to this version of Gardener. by @​ialidzhikov [#​14800]
• [OPERATOR] ⚠️ The secrets in the gardener-system-shoot-issuer namespace containing shoot's OIDC discovery documents will stop to be labeled with authentication.gardener.cloud/public-keys=serviceaccount after Gardener v1.145.0 is released. Clients relying on this label must migrate to discovery.gardener.cloud/public=serviceaccount before that. For backward compatibility, it is advised to support both labels for some time. by @​vpnachev [#​14670]
• [OPERATOR] gardener-apiserver no longer accepts invalid values for ManagedSeedSet's .spec.shootTemplate.spec.kubernetes.kubeAPIServer.eventTTL field even for existing ManagedSeedSet resources with already invalid values. Invalid values are values outside of the range [0, 24h]. gardener-apiserver caps the eventTTL to 24h for already persisted ManagedSeedSets with a value exceeding the allowed maximum. by @​ialidzhikov [#​14707]
• [OPERATOR] The deprecated gardenClusterCACert field was removed from the GardenletConfiguration. The CA is now always automatically set by Gardener. by @​timuthy [#​14803]
• [USER] gardener-apiserver no longer accepts invalid values for the Shoot's .spec.kubernetes.kubeAPIServer.eventTTL field even for existing Shoot resources with already invalid values. Invalid values are values outside of the range [0, 24h]. gardener-apiserver caps the eventTTL to 24h for already persisted Shoots with a value exceeding the allowed maximum. by @​ialidzhikov [#​14707]
• [DEPENDENCY] In Gardener v1.142.0 the hack/push-helm.sh script was moved to dev-setup/push-helm.sh. It is now moved to back from dev-setup/push-helm.sh to hack/push-helm.sh to allow reuse from the extensions as before. by @​ialidzhikov [#​14838]

📰 Noteworthy

• [OPERATOR] Garden status now contains the AdvertisedAddresses of the virtual garden kube-apiserver by @​hown3d [#​14831]
• [USER] The release binary artifact names have changed to include an archive suffix, which is removed from the contained binary. by @​LucaBernstein [#​14814]
• [DEVELOPER] e2e tests are now running with Kubernetes v1.35. by @​timuthy [#​14766]

✨ New Features

• [USER] A new Kubelet option SingleProcessOOMKill was added to the Shoot API. Users can use this field to configure single process termination in case it ran out of memory. By default, all processes in the same cgroup are killed when an OOM occurs. by @​timuthy [#​14866]

🐛 Bug Fixes

• [OPERATOR] Fixed intermittent gRPC "server closed the stream without sending trailers" errors for shoot-node log collection by setting useClientProtocol: true on the otel-collector DestinationRule to ensure HTTP/2 is used for upstream connections. by @​rrhubenov [#​14730]
• [OPERATOR] A bug causing the gardener-resource-manager to panic whenever a VirtualService update event is processed and the Http/Tls/Tcp spec fields need element-by-element comparison is now fixed. by @​shafeeqes [#​14888]
• [OPERATOR] Skip unusable machine types in search for suitable bastion host image by @​matthias-horne [#​14813]
• [OPERATOR] A bug has been fixed where the SystemComponentsRunning was showing and error for self-hosted shoots on unmanaged infrastructure. by @​tobschli [#​14804]
• [OPERATOR] Fixed unreachability of gardener-discovery server if a custom URL is configured by @​crigertg [#​14815]
• [OPERATOR] The gardener-resource-manager deployment procedure was hardened. In rare situations, the procedure became stuck indefinitely after the seed's CA rotation. by @​timuthy [#​14765]
• [USER] Fix an issue where shoot node logging is broken when the valitail and opentelemetry-collector systemd units start before their auth-token file is written to disk. The units now wait for the token file to exist before starting, ensuring logs and telemetry from worker nodes are reliably shipped by @​iypetrov [#​14905]
• [USER] Fixed a bug where Shoot deletion could get permanently stuck if triggered while Shoot creation was still in progress. The delete flow incorrectly created a new ControlPlane extension resource that could never be reconciled due to missing shoot access secrets. by @​acumino [#​14706]
• [DEVELOPER] make generate no longer skips CRD regeneration when only a transitively-referenced type changed; CI runs manifest generation in sequential mode to catch any remaining drift. by @​shafeeqes [#​14894]

🏃 Others

• [OPERATOR] Add alpha.control-plane.shoot.gardener.cloud/vpn-auto-mtu annotation to enable automatic MTU configuration for VPN connections. When set to true, the OPENVPN_AUTO_MTU flag is propagated to all VPN components (seed server, shoot client, kube-apiserver sidecars).` by @​axel7born [#​14768]
• [OPERATOR] The images of the registry caches used in the dev setups are now updated to distribution/distribution@v3.1.1. by @​dimitar-kostadinov [#​14791]
• [OPERATOR] The gardener-node-init now performs a connectivity check to the kube-apiserver and fatal errors of the gardener-node-agent are forwarded to the machine console. This should improve the visibility when bootstrapping of machines fail. by @​vknabel [#​14760]
• [OPERATOR] Gardener observability components are accessible even if web browsers try to coalesce connections. by @​ScheererJ [#​14867]
• [OPERATOR] DestinationRules, VirtualServices & Services are now exported to the Istio Ingress namespaces where they are used only. by @​oliver-goetz [#​14842]
• [OPERATOR] The secrets reconciler in the gardener-controller-manager no longer copies secrets with labels gardener.cloud/role:{helm-pull-secret, oci-ca-bundle} from garden namespace to the seed namespaces in the virtual cluster. Gardenlet can already access this secret if the secret is referred in a ControllerDeployment and the seed has a ControllerInstallation referring this deployment. by @​shafeeqes [#​14419]
• [OPERATOR] Plutono's prometheus-longterm datasource now correctly targets the Cortex query frontend (port 81) instead of Prometheus's local API (port 80), fixing timed-out longterm queries. by @​rickardsjp [#​14873]
• [OPERATOR] The provider-local now implements the SelfHostedShootExposure extension. by @​cerealsnow [#​14723]
• [OPERATOR] Federation short-circuit from aggregate to garden Prometheus when both instances run on the runtime cluster has been adapted for Istio virtual services. by @​vicwicker [#​14868]
• [OPERATOR] The opentelemetry-operator and prometheus-operator deployed by Gardener now have the required RBAC for Events in the events.k8s.io API group. by @​plkokanov [#​14808]
• [OPERATOR] Disable IPIP encapsulation for IPv6 IP pools for local setup. by @​axel7born [#​14790]
• [OPERATOR] Memory usage and garbage collection metrics are exposed for cluster-autoscaler. by @​takoverflow [#​14764]
• [DEVELOPER] remote setup: Garden VPA is disabled by default to avoid two VPA deployments to act on the same cluster causing endless eviction loops. by @​ialidzhikov [#​14680]
• [DEVELOPER] The SetLoggerSuffix implementations in the extension healthcheck package now emit provider and extension as independent structured log fields instead of embedding them in the logger name. by @​AnantKumar17 [#​14752]
• [DEPENDENCY] The following dependencies have been updated:
  • open-telemetry/opentelemetry-operator from v0.145.0 to v0.150.0. Release Notes by @​gardener-ci-robot [#​14263]
• [DEPENDENCY] The following dependencies have been updated:
  • europe-docker.pkg.dev/gardener-project/releases/gardener/fluent-bit-plugin from v1.4.0 to v1.5.0. by @​iypetrov [#​14787]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/ingress-default-backend from 0.25.0 to 0.26.0. Release Notes by @​gardener-ci-robot [#​14828]
• [DEPENDENCY] The following dependencies have been updated:
  • gcr.io/istio-release/pilot from 1.29.2 to 1.29.3.
  • gcr.io/istio-release/proxyv2 from 1.29.2 to 1.29.3.
  • istio.io/api from v1.29.2 to v1.29.3. by @​gardener-ci-robot [#​14859]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/autoscaler from v1.34.1 to v1.34.2. Release Notes by @​gardener-ci-robot [#​14851]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/dashboard from 1.84.0 to 1.84.1. Release Notes by @​gardener-ci-robot [#​14759]
• [DEPENDENCY] The gardener/autoscaler image for Shoots with Kubernetes version 1.35 has been updated to v1.35.0. Release Notes by @​timuthy [#​14857]
• [DEPENDENCY] The following dependencies have been updated:
  • credativ/vali from v2.2.32 to v2.2.33. Release Notes by @​gardener-ci-robot [#​14843]
• [DEPENDENCY] The following dependencies have been updated:
  • credativ/plutono from v7.5.47 to v7.5.48. Release Notes by @​gardener-ci-robot [#​14845]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/kiwigrid/k8s-sidecar from 2.7.1 to 2.7.3. by @​gardener-ci-robot [#​14811]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/dashboard from 1.83.11 to 1.84.0. Release Notes by @​gardener-ci-robot [#​14683]

application/spdx+json

• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:5dde901e0ff7bd63c13eda1243a584e3dd946d9a0dfeb0259799b33f6d799eb5
• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:f1e475ed15b1e10b5a25851635847095fb1c248a2e55a6423b3fb8f670731c0e
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:c293a293e778432bcf115af8f135c78b55e34e90e6259ed0fe55e39aa9497c1e
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:d8b6055487dca31e827e29ab21bcd003926359453118545c5926cb93158903d3
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:392f8eba1b194ab63d294967522087022dec8ceacdfbfeb39c794edfaebc7e7a
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:4018034f952908789c15a61d1f8fb78ddcecc28ac550bf5efc17f5dd14f48458
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:e3e812dc935cf468eb2967a7d350f10bc7d26727703f90fb0307753bea7450a9
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:fe8679f370392b3f43feea219439b1ffa299fefd864f9d98c3bee260f8769b76
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:52dd456f2695a04337df1c5a9037f3b0d6dce523e146f43d645a19301a82358b
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:ad2641181f056eba9f140755211ca78d076fb832fc17335b65d9e64c8f9a5046
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:0a385a6354b242e8f8da4c606b9987afcf5228a3d142d5d6e5fc66ebc8953989
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:abea47497cd65b22a8128e4dc6114d61164baf92e2fb9086753d13af312b02a7
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:a0a1baa82955db596b04bbb693bf5c9b66b2233948a3d7004c81389d08590aef
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:bfbe9909794318f49c6e28b520e515977a3a594d3f982fc1b80c5bf495867d53
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:41e7302b9583a4ce8a0f72426f157612500be0754132939a2a601319e495c269
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:a5428183d1a68bb881b443773ad22cfd610cfb2db2a9d86ae6ac38f6402900dc
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:8eb293e3f0570fb84424943fed6674a2ed682f99eaa7ee69eb73ac9dd4f952c0
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:ef29b8c580d8499e7f2ca6580b859fa090640d03359cad558ff524cb2a1d0fa6

Helm Charts

• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.143.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.143.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.143.0

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.143.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.143.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.143.0
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.143.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.143.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.143.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.143.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.143.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.143.0

v1.142.3

Compare Source

[github.com/gardener/gardener:v1.142.3]

🐛 Bug Fixes

• [USER] Fix an issue where shoot node logging is broken when the valitail and opentelemetry-collector systemd units start before their auth-token file is written to disk. The units now wait for the token file to exist before starting, ensuring logs and telemetry from worker nodes are reliably shipped by @​iypetrov [#​14902]

application/spdx+json

• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:7467d1267b97d5fc383e68b29cccc52858f4655ff465511c80efae90786fb2de
• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:b6b5b46852a514bfc3cc91d385d54785e9e9a5f90783fb602a93a643cc7b433d
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:acac5b71d77c2f6c58202f903e5739be5de13bf714937885b0fa4a1b9ffbb8fc
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:d35fd217874755be96e577dfb54d0b7594e1fa34a61752e7ea1f0e83330380b5
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:57b816366d315548c75657c3ae98ae28c94a6ec3e4fdb81f98eccc706b278396
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:cbcc326f14a2a6d6c54f72d8595e2b3a9f8bd997525d4a99eb7884681532d504
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:70e0ffa1c580fa7efe7d9c2488205416cf74b52bd76747d07e91de601a648198
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:a1bc88de1b39f35a0be28596638bb142678f86029aa3eeb38c98970f20fa3080
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:6b0cc54036542458a1b570898b7f2a017d12e7d36852e79eb902101c393e031a
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:c27d727d2b9326a715b2d188a6df1333bf79476add58d7ee550b6afac5b443db
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:065e475b1abb90f4f773181f2d7c2d869d047278b4a65a7a2eed580e27030924
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:1429ffedb63f5f05b6fa02f21c6b97e6a47a5defea71e875ff1e5d07f6800b54
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:763162d58313828431f22c9952782640807a22da4426508fe61eb7fbb5e0909a
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:8985b1aca2624fbdba67d2fe27b4dc74c467b41a69fb884d7513118241aaff08
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:18dcb5262591871aacd61d1cd7b254d7a35293c6221f975a567f1cf3f4724613
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:c7794be3f764d43b6e9c7eee35abc15ae433ca0d82319a1052ef255095e3f035
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:5553f6e2784c3080fe585977efc4cb1f24f8aba74df534c0fd2266cec9318715
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:fb5ffbc8d849bd7726ce7b7a28181d777e02b2651476db79c2291e6302e5004a

Helm Charts

• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.142.3
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.142.3
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.142.3

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.142.3
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.142.3
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.142.3
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.142.3
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.142.3
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.142.3
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.142.3
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.142.3
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.142.3

v1.142.2

Compare Source

[github.com/gardener/gardener:v1.142.2]

🐛 Bug Fixes

• [OPERATOR] A bug causing the gardener-resource-manager to panic whenever a VirtualService update event is processed and the Http/Tls/Tcp spec fields need element-by-element comparison is now fixed. by @​shafeeqes [#​14889]
• [OPERATOR] Fixed unreachability of gardener-discovery server if a custom URL is configured by @​crigertg [#​14863]

🏃 Others

• [OPERATOR] Gardener observability components are accessible even if web browsers try to coalesce connections. by @​ScheererJ [#​14876]

application/spdx+json

• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:3538f42b31ecf80f0409dc730591eb06b48a1518dfb50b5db86bbc31fe4ed20c
• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:bb0dbe0fd9e8112b8f9e9b8d8833455f0bb1d16cbb0312bcbde6903e34339edd
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:327641404f2226ccd742d8d7b655ce9c29a0faa3129f39a11ac195bef5007869
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:c15ecf3d1b52e6595aa08326dc91b503dd831fcbe25aa4715bb9c03b004282ce
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:87f65bc612826d5b35b503af3bc57334a431778e6527794a3a5f2904269388f2
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:8f7031d757f329861e7cde4fbb75a8b177b5259ad26810fe5077acede1dee341
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:05597a34e06dec98acee0ac592ceb5e20436e990044c05fb6965fc578109b515
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:306be2a501e9e99c90bde7b61a33b1fc6d3cc3e49d849e988c865ccb6768cc16
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:b24f70501edb52837b3f117235aa35371e6f6e53e84f138f662332c39701e0fc
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:ffbbfac19d03967e3ac8567edfb65e3b0e640f6ea0d47a313f0a5eac02c2fb2e
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:0dcc41a3c834feb302132b321e77dc76f5a8d2eb21a70fae7f88deb0b2203a71
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:1183956252d1c5b9336667dfba04f21122fdf98e4aff0758c3b626900217e6c8
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:157256182d932888e5b66f591d19fb9c030e017bc4fb1cb2b3cc8da4257d374e
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:cf5105b4b7746d662605f837ad9013ac04e05153ff9093674f1a5fa823dace1a
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:5c872657c116b75483f55cf319d4842bf41ac9b268da2ff76c32f7e25d9589af
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:63d0cc8d2ed33668cae70a0ef51c586067cfea2cbdfda19959e85644160e7082
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:cbe2e53392a9f68dfecb8b369ecf2635b1efdb1d698a63aa46febbb8f7cf59c0
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:ddaffaa66668d0e8e99ade494acb438d17aea8e4ee7a5ae342e6e59dd10efcc4

Helm Charts

• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.142.2
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.142.2
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.142.2

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.142.2
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.142.2
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.142.2
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.142.2
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.142.2
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.142.2
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.142.2
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.142.2
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.142.2

v1.142.1

Compare Source

[github.com/gardener/gardener:v1.142.1]

🐛 Bug Fixes

• [OPERATOR] Fixed intermittent gRPC "server closed the stream without sending trailers" errors for shoot-node log collection by setting useClientProtocol: true on the otel-collector DestinationRule to ensure HTTP/2 is used for upstream connections. by @​rrhubenov [#​14825]

🏃 Others

• [OPERATOR] Add alpha.control-plane.shoot.gardener.cloud/vpn-auto-mtu annotation to enable automatic MTU configuration for VPN connections. When set to true, the OPENVPN_AUTO_MTU flag is propagated to all VPN components (seed server, shoot client, kube-apiserver sidecars).` by @​axel7born [#​14820]

application/spdx+json

• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:ab6b2d5c9c7c96cd3477aa712a7fd7040d9924326ae67502a781555b58756a58
• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:e74e9e097f0e82403001f022bafde5fc53024bd96e57cb753f298bf9525ee719
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:119fc43f2d41594a7b187d8fc9c34f35e9a300dcf3fd0bb3d84a37073aa2601d
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:2d89fdade8180e2e549e379622d4f9f92e7bd472c137da632f084d3fa09c8f52
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:619c52099bb2cac58a98ed83777fbc60ccbff1145de9666a11f739936ee73986
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:fa8e7e6f2a809043a60ad2ef8f2704b719ea9568967a476dae748e22983a87d4
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:78a8d65941f19917db854c3fa2549226ff0d95cd23a2f3a52c8862bc877cbb5c
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:bd298818ee00e32282b2396f997c834b6cd790f62c24e4a1556c81d15a0db8bf
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:52ecb6970208fa92d1205f9943052ed81d4f6a4a19ea068beb80af1463953dfd
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:f3ead75e94d5deeffca4eb2cfd7cfadaac85b41cd41f47366d53236a0b7cbe46
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:4f6b864f30da2e7393c6cf159989782d22e1280c13ddbd2425074af4b3d171cb
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:cddda157e0035df47271aab6a4d813d999d0a80e4a8c828b0b16231f7395de54
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:47dcd125810ac525b5cbfe7f5e9a589127a053a4a131b1482ff2fad9d0c7d887
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:7aacd7749289d0f1f8615ca6a1e98df951fcf2c3a2ad9a0a68c972c4e5e2c666
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:15b3d89a6e24fd845a56668fbd9e6586e7f63c355bb55a2f4142e5d7aa6edcd9
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:925bf49fc008847591fbcf96bac7f69dcc3fcba1a064671bc14450393b628f19
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:c915f83a4ff85a2836bf9d0949dd6ba904e77053e32897d6aa18dec1e325c5d1
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:e5f74d2b73fd7d3044b507f080418e1bd1692e05fe2e22bc687bde5fb89da2d1

Helm Charts

• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.142.1
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.142.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.142.1

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.142.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.142.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.142.1
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.142.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.142.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.142.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.142.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.142.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.142.1

v1.142.0

Compare Source

[github.com/gardener/gardener:v1.142.0]

⚠️ Breaking Changes

• [OPERATOR] With the discontinued support of Kubernetes 1.31, the API group settings.gardener.cloud was completely removed from the Gardener API.
  Earlier, this API group contained the resources OpenIDConnectPreset and ClusterOpenIDConnectPreset which have been unsupported since Kubernetes 1.32.
  Please make sure to clean up all OpenIDConnectPreset and ClusterOpenIDConnectPreset objects and automations before upgrading to this version. by @​timuthy [#​14615]
• [OPERATOR] ⚠️ Gardener does no longer support Garden, Seed, or Shoot clusters with Kubernetes version 1.31. Make sure to upgrade all existing clusters before upgrading to this Gardener version. by @​timuthy [#​14615]
• [USER] The deprecated gardener/controlplane Helm chart has been removed. Use gardener-operator to deploy Gardener instead. by @​rfranzke [#​14614]
• [DEVELOPER] The make operator-seed-{up,dev,down} targets have been renamed to make gardener-{up,dev,down}. make kind-{up,down} is now an alias for make kind-single-node-{up,down}. All local development scenarios that were previously based on the legacy gardener/controlplane Helm chart are now based on gardener-operator. by @​rfranzke [#​14614]
• [DEVELOPER] In case you're using the remote development setup, the kubeconfig of the remote cluster you're using as seed is no longer expected in /dev-setup/remote/kubeconfigs/kubeconfig but in dev-setup/kubeconfigs/remote/kubeconfig. by @​rfranzke [#​14614]
• [DEVELOPER] ./hack/usage/generate-admin-kubeconfig-local.sh has been merged into ./hack/usage/generate-kubeconfig.sh. Use ./hack/usage/generate-kubeconfig.sh --help to learn about the usage. by @​rfranzke [#​14614]

📰 Noteworthy

• [OPERATOR] DisableNginxIngressInGarden allows to disable nginx-ingress in a Garden runtime cluster managed by gardener-operator. by @​ScheererJ [#​14636]
• [OPERATOR] DisableNginxIngressInSeed allows to disable nginx-ingress in Seed clusters. by @​ScheererJ [#​14636]
• [OPERATOR] DisableNginxIngressInShoot allows to disable nginx-ingress for Shoot clusters:
  • If set for gardener-apiserver, it disallows creation of new Shoot clusters with the nginx-ingress addon enabled and it prevents existing shoot clusters from enabling it. Shoot cluster, which already have the addon enabled, are left as is.
  • If set for gardener-controller-manager, it disables the nginx-ingress addon for all Shoot clusters during their next maintenance period. by @​ScheererJ [#​14636]
• [OPERATOR] The propagateCAFromKubeAPIServerSNI field was added to the GardenerDashboardConfig API. When the kube-apiserver SNI endpoint uses a private/custom CA, set this field to true to include the CA certificate in the dashboard's apiServerCaData. This makes the behavior introduced in #​14217 opt-in, preserving transparent CA rotation for publicly trusted certificates. by @​petersutter [#​14637]
• [OPERATOR] The gardener-operator now deploys an extensionsv1alpha1.BackupEntry alongside the BackupBucket when etcd backup is configured (when BackupEntryForGarden feature gate is enabled), aligning the garden controller with the same extension contract that shoot clusters use for backup credential management. by @​rfranzke [#​14628]
• [OPERATOR] When backup is configured in the Garden resource, the gardener-operator now requires a BackupEntry controller registration in the operator.gardener.cloud/v1alpha1.Extension resource of the backup provider when the new BackupEntryForGarden feature gate is enabled. If the Extension object for the provider does not yet include BackupEntry in .spec.resources, it must be added before upgrading gardener-operator. All provider extensions should also enable their BackupEntry controllers when running in the garden runtime cluster. by @​rfranzke [#​14628]
• [DEVELOPER] The local gardenadm development setup for the unmanaged infrastructure scenario now uses GinD (Gardener-in-Docker) instead of KinD. Refer to the updated documentation for details. by @​rfranzke [#​14700]

✨ New Features

• [USER] The Shoot API now supports configuring cluster-autoscaler's maxBinpackingTime flag for specifying a longer duration to be spent on binpacking for scale-up. by @​takoverflow [#​14698]
• [DEVELOPER] ManagedResources that use the resources.gardener.cloud/delete-on-invalid-update annotation can now also specify the deletion propagation with the annotation resources.gardener.cloud/deletion-propagation-on-invalid-update by @​maboehm [#​14642]

🐛 Bug Fixes

• [OPERATOR] An issue causing the guestbook TM test to fail against IPv6 Shoot clusters in now fixed. by @​plkokanov [#​14701]
• [OPERATOR] The secret used for the kube-rbac-proxy for the opentelemetry-collector is now deployed for all shoot clusters, independent of whether node logging is enabled or not. by @​iypetrov [#​14428]
• [OPERATOR] A bug has been fixed where the EveryNodeReadyCondition was showing and error for self-hosted shoots on unmanaged infrastructure. by @​tobschli [#​14665]
• [OPERATOR] The systemdunitcheck controller now correctly treats systemd units that are in a failed state but explicitly disabled as healthy. by @​cerealsnow [#​14733]
• [OPERATOR] Errors during resource deletion caused by missing CRDs are now ignored by @​matthias-horne [#​14645]
• [USER] Rotating the etcd encryption key tolerates unavailable APIServices. by @​robinschneider [#​14679]
• [DEPENDENCY] The reconcileSeedWebhookConfig function now correctly reconciles both MutatingWebhookConfiguration and ValidatingWebhookConfiguration for extensions that register both mutating and validating admission webhooks. Previously, only the first configuration was reconciled due to a premature return in the loop. by @​Roncossek [#​14664]

🏃 Others

• [OPERATOR] Add resourceId for image istio-basic-auth-server to fix overwrite image lookup by @​MartinWeindel [#​14716]
• [OPERATOR] Certain best-practice Envoy settings for HTTP2 protocol options have been applied to istio-ingressgateways. by @​oliver-goetz [#​14678]
• [OPERATOR] The images of the registry caches used in the dev setups are now updated to distribution/distribution@v3.1.0. by @​dimitar-kostadinov [#​14718]
• [OPERATOR] The Prometheus health check rule evaluation interval has been reduced from 60s to 5s for faster detection of health check state changes. by @​vicwicker [#​14662]
• [OPERATOR] The garden Prometheus maximum metric retention has been increased to 30 days. by @​vicwicker [#​14657]
• [DEVELOPER] The TM tests no longer rely on the nginx-ingress addon for any Kubernetes release. by @​ScheererJ [#​14643]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/ext-authz-server from v0.2.0 to v0.3.0. Release Notes by @​gardener-ci-robot [#​14725]
• [DEPENDENCY] The following dependencies have been updated:
  • registry.k8s.io/coredns/coredns from v1.14.2 to v1.14.3. by @​gardener-ci-robot [#​14724]
• [DEPENDENCY] The following dependencies have been updated:
  • envoyproxy/envoy from distroless-v1.37.2 to v1.38.0. Release Notes by @​gardener-ci-robot [#​14674]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/cortexproject/cortex from v1.20.1 to v1.21.0. by @​gardener-ci-robot [#​14695]
• [DEPENDENCY] The following dependencies have been updated:
  • registry.k8s.io/dns/k8s-dns-node-cache from 1.26.7 to 1.26.8. by @​gardener-ci-robot [#​14659]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/prometheus/alertmanager from v0.32.0 to v0.32.1. by @​gardener-ci-robot [#​14732]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/kiwigrid/k8s-sidecar from 2.6.0 to 2.7.1. by @​gardener-ci-robot [#​14699]
• [DEPENDENCY] The following dependencies have been updated:
  • quay.io/brancz/kube-rbac-proxy from v0.21.2 to v0.22.0. by @​gardener-ci-robot [#​14703]
• [DEPENDENCY] The following dependencies have been updated:
  • gardener/dashboard from 1.83.11 to 1.84.1. Release Notes by @​marc1404 [#​14771]

application/spdx+json

• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:1eb5d65be651660ff2e4dd3012315ab4f8feac3b94af8e321f833e0848ab69c4
• admission-controller-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller@sha256:f926858481411ed15cc1a31be14b214e764f882163c764e23def1c1fe1d9daf6
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:0e02ebedbe9ed6a34dc99736a6e41b45ad5b730f564b1eaa848d5f156e11e311
• apiserver-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver@sha256:1815b4550cbd1f2c6c4b7d50ac6e092e3ad3e6f207de9666ad889243bb0988f8
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:7234f2705acad476e26c663eb8d589770e7f77108eeeb28fa33a38c07908c0f3
• controller-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager@sha256:f5a956378f5fba34b51ca828e0f1c448b11a9e27f65633ec73874d695231689c
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:3b7c03096e6f8de1fee49ec62a17849aeae261b67751871da0dc635764d689b5
• gardenadm-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm@sha256:fc7085b785212951f63bfaa63bbea9d019cdc7f66735c2fc2dcec753f01bb70a
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:34f283da125518e68415117b86c926ed5b103ec88a4c82c2602399172dc5d70a
• gardenlet-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet@sha256:d7f1c555d75bc17c1a3c3fc6c6034fd9e934396a455d8e4df2c03021f4921438
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:5c26ac6437adcfcd20aeab1a233d29d774980fc4d8f1801ffde480fb4a893635
• node-agent-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent@sha256:7b518fb710dc7cc187784d621fe5deb7e5d3032623233768232596b5a575db0f
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:13c624f9dfbf1b6b146f314b8da20b5edde93a4c4c14ddbb0d4424555e04f138
• operator-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/operator@sha256:22549456a978c9ff74e6b79252abb655e3926b36c0bfdc8714c127f412c800f1
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:9769cc9338182588139cb6a6d3c39ad79f9a0a27a3bc447c3b1c0292b1968391
• resource-manager-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager@sha256:a8745e5d63dc898d042ccbad0947cc617e5624bf1165bb8bf90744dcbcd91471
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:0a6ec2623516f5c20d688b379c0ee075ed81deff5509abb600569182fd5c9add
• scheduler-spdx-ref: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler@sha256:57694de6715aae8751988b140957adff88db9b020f01cecac1f0cf42b5ad27c5

Helm Charts

• gardenlet: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/gardenlet:v1.142.0
• operator: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/operator:v1.142.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/resource-manager:v1.142.0

Container (OCI) Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.142.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.142.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.142.0
• gardenadm: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenadm:v1.142.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.142.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.142.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.142.0
• resource-manager: `europe-docker.pkg.dev/gardener-project/re

✂ Note

PR body was truncated to here.