Changelog v1.76.10

Know before update

• Fixes recreation of all CloudEphemeral nodes on upgrade to 1.76.9. The MachineDeployment replica count was dropped and the MachineDeployment was scaled to zero.
• Values taken from Project.spec.parameters are now quoted where they are substituted into the shipped project templates, and a parameter that changes the structure of the rendered manifests rather than only their values is refused for any template, including custom ones. An administrator name may no longer contain control characters, and clusterLogDestinationName must be a Kubernetes object name or empty. Both are checked from the reconcile loop as well as at admission, so a project already carrying such a value goes into an error state on its next reconcile rather than at its next edit; the same holds for a custom template that turns a parameter into several objects or into YAML, which is refused when the project is created, edited, or reconciled with a change to apply. The module's admission policy now also matches CREATE, so objects labelled heritage: multitenancy-manager can only be created by the module itself.

• d8:manage:permission:module:multitenancy-manager:edit no longer grants write access to projecttemplates. A ProjectTemplate renders into a release applied by a ServiceAccount bound to cluster-admin, and its spec.resourcesTemplate is arbitrary, so authoring one is equivalent to holding cluster-admin and is not a module-level permission.

  Reading templates stays in d8:manage:permission:module:multitenancy-manager:view, and creating a Project on an existing template stays in the edit role. The legacy ClusterAdmin access level and the kubeadm:cluster-admins group keep the right. A subject that authored templates through the manager role has to be granted one of those instead.

Fixes

• [cloud-provider-vcd] Fixes an intermittent "network still in use" error during cluster deletion with the WithNAT placement strategy. #22328
• [istio] Restore Istiod pod anti-affinity for Istio 1.25 installations managed by the Sail Operator. #22168
• [multitenancy-manager] A project parameter can no longer inject objects into the rendered project manifests. #22286 Values taken from Project.spec.parameters are now quoted where they are substituted into the shipped project templates, and a parameter that changes the structure of the rendered manifests rather than only their values is refused for any template, including custom ones. An administrator name may no longer contain control characters, and clusterLogDestinationName must be a Kubernetes object name or empty. Both are checked from the reconcile loop as well as at admission, so a project already carrying such a value goes into an error state on its next reconcile rather than at its next edit; the same holds for a custom template that turns a parameter into several objects or into YAML, which is refused when the project is created, edited, or reconciled with a change to apply. The module's admission policy now also matches CREATE, so objects labelled heritage: multitenancy-manager can only be created by the module itself.

• [multitenancy-manager] The module manager role no longer grants authoring of project templates. #22330 d8:manage:permission:module:multitenancy-manager:edit no longer grants write access to projecttemplates. A ProjectTemplate renders into a release applied by a ServiceAccount bound to cluster-admin, and its spec.resourcesTemplate is arbitrary, so authoring one is equivalent to holding cluster-admin and is not a module-level permission.

  Reading templates stays in d8:manage:permission:module:multitenancy-manager:view, and creating a Project on an existing template stays in the edit role. The legacy ClusterAdmin access level and the kubeadm:cluster-admins group keep the right. A subject that authored templates through the manager role has to be granted one of those instead.

• [network-gateway] Fixed user and group in ConfigMap #22297 network-gateway pod's will be restarted

• [node-manager] MachineDeployment spec.replicas is no longer dropped on upgrade, so cloud nodes are not recreated. #22299 Fixes recreation of all CloudEphemeral nodes on upgrade to 1.76.9. The MachineDeployment replica count was dropped and the MachineDeployment was scaled to zero.

Chore

• [candi] update base images #22195
• [deckhouse] Removed the app short name from the Application resource. #22140

For more information, see the changelog and minor version release changes.