Release 2.7.0 (2024 Q3)

• Kubernetes version: 1.29.4 – 1.29.6
• This release is no longer supported. See release policy.

Available versions for transition #

¹ When updating from version 2.6.0 to 2.7.0 and higher, perform the following steps.

For the management cluster

1. Start the management cluster update.
2. Connect to the management cluster from the console.
3. Edit the ShturvalServiceConfig custom resources in the ops.shturval.tech group:
   • shturval-update;
   • shturval-update-crds.
4. In the spec.version block, set the value to 2.7.0.

For the client cluster

1. Start the client cluster update.
2. Go to the Custom resources page in the Administration section.
3. In the ShturvalServiceConfig group, find:
   • shturval-update;
   • shturval-update-crds.
4. In the spec.version block, set the value to 2.7.0.

Infrastructure #

• Updated versions of components: Argo CD, ArgoRollouts, OpenStack, CertManager, CNI Cilium, Grafana, KubeVIP, Nginx, NodeLocalDNS, Prometheus, Whereabouts (SR-IOV), VictoriaMetrics, vSphere, Velero, RawFileProvisioner (updated images: csi-provisioner, csi-node-driver-registrar, csi-resizer) KubeBench, Trivy, Containerd.
• Added a utility for rolling out and updating the mirror in the Nexus (including the customer’s Nexus). For more details, see the instructions for installation in closed and conditionally closed loops.
• Added the ability to protect nodes from automatic actions with nodes (drain, reboot). Protection management is available to the platform administrator and is performed from the console. More details on the page How ​​to protect nodes from automatic restart.
• Added HealthChecks (health checks) of installed services to the management cluster and client clusters.
• Updated AlertManager configuration check for stable operation when invalid data is detected. It is not possible to apply AlertManager changes if the configuration is invalid.
• Support for the internal platform provider Shturval Manual has been discontinued. A mechanism is now available to block the ability to update to 2.7.0 and higher if there is a deployed cluster with the Shturval Manual provider.
• Updated list of critical services for cluster operation. Now, for the operation of virtual IP address management services, external connection management (Ingress) and authentication service (authn), space scheduling in the cluster is guaranteed. Critical services cannot be disabled or removed. Critical service pods cannot be preempted when load balancing occurs across nodes.
• Processing of Shturval v2 provider hosts has been accelerated.
• Support for the operating system RED OS 8 is now available.
• Added management of pools of IP addresses and the ability to assign addresses of a pool of API providers to a cluster server and Ingress when deploying a cluster with vSphere, oVirt, Shturval V2 providers.
• Added the ability to manage the configuration of Cluster API Machine, KubeadmControlPlane, InfraMachineTemplate, MachineHealthCheck from the GUI. The interface is available on the Node Management page.
• Updated the way to configure Master nodes when creating a cluster. The cluster availability type setting (single (single-node), ha (highly available)) has been replaced with setting the number of Master nodes increased.

Security #

• Added the ability to authenticate a user via kubectl without using the platform GUI.
• Added management of configuration of access rights sets by the platform administrator for the management cluster, client clusters and namespaces.
• Added search for users and user groups in the directory (AD) when assigning access rights to users/groups. Directory searching is possible when LDAP integration is successfully configured. The search interface for groups and users is available on the Assigning access rights pages in the management cluster and client clusters.
• Added management of groups of Worker nodes of clusters.

Interface changes #

• Added an interface for viewing and changing HPA YAML manifests in Deployment, network policies.
• Updated interface of the network policy editor in client clusters. Added selection of namespaces from the list, enabled DNS proxy by default when traffic to Kubernetes DNS is allowed.
• Added interfaces for managing backup and recovery, custom resources in the namespaces of the management cluster and client clusters.
• Added the ability to manage namespace and non-namespace resources in the backup and restore interface.
• The cluster interface has been updated: the names of the “Services and Repositories” section and pages.
• You can install the Seccomp profile in the namespace Loads of client clusters and the management cluster is now available.
• The interface of the page for viewing installed services has been updated: labels and annotations of services have been moved to separate tabs, viewing configuration parameters (values) of services has been added.
• The interface of the Certificates block in NCI has been updated: hints and restrictions have been added on the choice of how to enter certificate data for adding.
• The interface of the Egress tab on the namespace page has been improved: an information notification has been added when specifying the name of the network interface.
• Updated cluster interface: added cluster deletion blocking and information message in case of suspension of cluster infrastructure reconciliation.
• An interface is now available for managing groups of Worker nodes (Default, Infra and custom) when creating a cluster with vSphere, oVirt, Basic Dynamix, OpenStack, Shturval v2 providers.
• Added product marketplace interface. The Marketplace is available in the “Services and Repositories” section.
• The management cluster interface has been moved to the Clusters section. Additionally, management is implemented in the cluster:
  • receiving events and security events (audit logs);
  • security policy management (Kyverno);
  • ability to scan cluster configuration (KubeBench);
  • the ability to scan container images for vulnerabilities (Trivy);
  • management of custom resources;
  • network policy management.
• Added the ability to manage user interface settings. The functionality is available on the User Settings page.
• Improved display of reports on triggered security policies in namespaces and namespace Loads.

Bug fixes #

• Fixed handling of node cleanup in the Node Configuration Management (STD) module.
• Fixed automatic redirection after the end of the session. Passing re-authorization redirects to the page where the session was interrupted.
• Added information to the logs of the authentication service (authn) when user authentication is unsuccessful.
• Added validation of entered data for host IP addresses when configuring the Shturval v2 provider from the console.
• Fixed shturvald (STD) cyclic restart error when creating a directory in /etc/containerd/certs.d/ manually. In such cases, nodes in clusters will no longer receive the “SchedulingDisabled” status.
• Fixed errors in displaying the reconciliation and deletion buttons on the cluster dashboard when there is no information in the description block.
• Fixed an error in receiving security events when going to the “Security Events” page in the GUI of client clusters.
• Fixed a bug in displaying the ability to go to Argo CD when there is no service.
• Fixed an issue where access rights were incorrectly assigned to users when selecting the “Cluster-admin-restricted” role.
• Fixed an error in obtaining namespace objects when switching between cluster namespaces.
• Fixed inability to check the format of YAML object manifests in the GUI after returning a valid structure.
• Fixed missing URL in the specification of the graphical metrics display module.
• Fixed an error in displaying external URL data in the Ingresses interface of the namespace.
• Editing the pod selector in Deployment in the GUI is prohibited.
• Fixed LDAP connection error with TLS connection security check.
• Fixed error in checking connection settings in automatic mode.
• Fixed data display error on Control Plane nodes in a cluster with the Shturval v2 provider after updating the cluster.
• Fixed an error in receiving Events for namespace resources.

Known Limitations:

• Creating client clusters is only available with the Platform-admin access set.
• There may be problems accessing the Scan Results page.
• The Kubelet section has been removed from the node configuration interface. Will be returned to the interface from release 2.7.1.