Release 2.6.1 (2024 Q3)

• Kubernetes version: 1.29.1
• This release is no longer supported. See release policy.

Available versions for transition #

Update notes #

When updating from version 2.6.1 to 2.7.0 and higher, perform the following steps.

For the management cluster #

1. Start the management cluster update.
2. Connect to the management cluster from the console.
3. Edit the ShturvalServiceConfig custom resources in the ops.shturval.tech group:
   • shturval-update;
   • shturval-update-crds.
4. In the spec.version block, set the value to 2.7.0.

For the client cluster #

1. Start the client cluster update.
2. Go to the Custom resources page in the Administration section.
3. In the ShturvalServiceConfig group, find:
   • shturval-update;
   • shturval-update-crds.
4. In the spec.version block, set the value to 2.7.0.

Infrastructure #

• Added Snapshot Controller to Ceph RBD and Ceph FS charts.
• Added support for RED OS 8.
• Updated version of kube-rbac-proxy to 0.15.0.
• Updated Cilium version to 1.14.13.
• Updated AlertManager configuration check for stable operation when invalid data is detected. It is not possible to apply AlertManager changes if the configuration is invalid.
• Added automatic configuration of LoadBalancer for the Basic Dynamix provider.
• Changed the namespace on the kube-system to install an operator for working with SRIOV interfaces (shturval-sriov) and additional networks (NetworkAttachmentDefinitions, SriovNetwork, SriovNetworkNodePolicy). The choice of namespace is not available; additional networks and the operator are automatically installed in the kube-system namespace.
• Processing of Shturval v2 provider hosts has been accelerated.

Bug fixes #

• Fixed an error in updating the update service, identified in version 2.6.0.
• Fixed display of the rule in the network policy editor.
• Fixed a bug in applying NTP configuration using the NCI resource.
• Fixed a bug in creating Linux users using the NCI resource.
• Fixed display of ControlPlane node data for Shturval v2 provider
• Fixed receiving Event for namespace and cluster resources.
• Fixed an error in creating a client cluster with Ubuntu 22.04 OS.
• Fixed an error in processing Shturval v2 hosts after deleting a client cluster.
• Fixed detection of connection settings and fields during automatic configuration of integration with LDAP.
• Fixed generation of the root trusted certificate.
• Fixed an error in setting the node configuration when re-creating a node.
• Restored display of the selection method for deleting CronJob and Job.
• Fixed display of notification rule types.
• Fixed authorization in the module for graphical display of metrics (Grafana).
• Fixed counting resources (Pods) and displaying reports on triggering security policies (Kyverno) in the GUI.
• Fixed a bug in assigning roles in OpenSearch.
• Fixed an error installing packages on Alt Linux OS.
• Restored the ability to specify a relative path to a certificate (using ~).
• Fixed an error when sending Kube Audit logs to OpenSearch.
• Fixed a bug in switching ConfigMaps editing modes.
• Fixed error adding label/annotate in Secret in “Uneditable” editing mode.
• Fixed missing URL in the specification of the graphical metrics display module.
• Fixed a bug with character input restrictions for user and group names when assigning a role.
• Fixed an error in terminating a work session (logout) in Opensearch without terminating the work session in the Shturval platform GUI.
• Fixed an error in counting the number of Pods for each security policy (Kyverno).
• Fixed an error in the ability to assign access rights (Namespace-admin) to users in the ingress namespace.
• fixed error when changing Service with an empty IP address.
• Fixed error updating ConfigMaps argocd-rbac-cm when assigning/removing access rights to a user.
• Fixed handling of node cleanup in the Node Configuration Management (STD) module.
• Fixed a bug in displaying the ability to go to Argo CD when there is no service.
• Fixed shturvald (STD) cyclic restart error when creating a directory in /etc/containerd/certs.d/ manually. In such cases, nodes in clusters will no longer receive the “SchedulingDisabled” status.
• Fixed a bug with the ability to create a node configuration (NCI) from the console without specifying the file and the path to the file.
• Fixed a bug where adding hosts in the Shturval v2 provider in the platform GUI was unavailable.
• Fixed OS handling by node configuration management module (STD). Adding a file/directory using the NCI resource in the cluster is successful.
• Fixed access errors for users/groups with the roles sec-platform-admin, dev-debugger, ops-certificate-issuer, sec-security-report.
• Fixed the template for specifying the path to the certificate in the platform GUI. Adding a certificate using an NCI resource is available with or without the HTTPS protocol.
• Fixed a bug with a self-signed certificate when reinstalling a management cluster.

Security #

• System service vulnerabilities found in version 2.6.0 have been fixed.
• Added the ability to manage repositories in Argo CD for users with the role of namespace admin (namespace-admin).
• A mechanism is now available to check the integrity of the initial node configuration file (/etc/std/nci.json).
• Fixed a vulnerability using a weak random number generator in the initial deployment module (STC).

Interface changes #

• Improved ability to specify namespaces, namespaces and non-namespace important resources in backup.
• Added additional validation for host IP addresses in the Shturval v2 provider.
• Roles have been installed for Worker nodes in the management cluster.
• The approach to determining permissions for infrastructure providers has been improved.
• A restriction has been placed on the request to delete a cluster with suspended infrastructure reconciliation.
• Added default values for KubeadmControlPlane and MachineDeployment resources:
  • nodeDeletionTimeout: 10m0s
  • nodeDrainTimeout: 10m0s
  • nodeVolumeDetachTimeout: 5m0s
• Added the ability to use special characters and Cyrillic for groupname and username.
• The interface for displaying the status of services with the ClusterIP or LoadBalancer type has been updated.
• Added detailed Kubernetes/ETCD Cluster Health dashboard to Grafana.
• Updated NCI resource Kubelet configuration interface. Added the ability to specify the value “Not selected”; setting default field values is excluded (the values have been moved to tooltips).
• Updated interface of the network policy editor in client clusters. Added selection of namespaces from the list, enabled DNS proxy by default when traffic to Kubernetes DNS is allowed.
• The interface of the Egress tab on the namespace page has been improved: an information notification has been added when specifying the name of the network interface.
• Updated cluster interface: added cluster deletion blocking and information message in case of suspension of cluster infrastructure reconciliation.
• The interface of the Certificates block in NCI has been updated: hints and restrictions have been added on the choice of how to enter certificate data for adding.
• The interface of the page for viewing installed services has been updated: labels and annotations of services have been placed on separate tabs.
• Added the ability to manage the availability of providers (vSphere, oVirt, Shturval V2, Basic Dynamix, OpenStack) in the platform GUI. When the provider service is installed and enabled, provider templates can be managed in the GUI.