Skip to main content
Version: 1.34.3

SIGHUP Distribution Release v1.34.3

Welcome to SD release v1.34.3.

The distribution is maintained with ❤️ by the team SIGHUP by ReeVo.

This patch release backports the v1.36.0 module updates, features and fixes to the v1.34 line, while keeping Kubernetes 1.34 as the supported minor version. It targets Kubernetes v1.34.12 on-premises (bumped from 1.34.8 in v1.34.2) and continues to support EKS 1.34.

The utilities core module (Headlamp) and the Immutable kind introduced in the v1.35 and v1.36 lines are not part of this release.

Note that this release includes Breaking Changes.

Installer Updates​

Module updates 📦​

  • aws 📦 provider module: v5.4.0
    • Bumps cluster-autoscaler to v1.36.1 and aws-load-balancer-controller to v3.5.0.
  • auth 📦 core module: v0.8.0
    • Bumps Gangplank to v1.3.0 and Pomerium to v0.33.1.
  • dr 📦 core module: v3.5.0
    • Bumps Velero to v1.18.2, Velero plugins to v1.14.2 (AWS, Microsoft Azure and GCP) and snapshot-controller to v8.6.0.
    • Updates the MinIO image.
  • ingress 📦 core module: v5.2.0
    • Bumps cert-manager to v1.21.2, HAProxy to v3.2.15 and NGINX (Chainguard fork) to v1.15.10.
    • Renames the HAProxy Ingress alerts with the HaproxyIngress prefix, and removes HaproxyBackendLatencyCritical, HaproxyBackendNoAliveServers and HaproxyHighHttp4xxErrorRateBackend.
  • logging 📦 core module: v5.5.0
    • Bumps OpenSearch to v3.8.0, OpenSearch Dashboards to v3.8.0, Logging operator to v6.8.0, Fluent Bit to v5.1.0 and Loki to v3.7.7.
    • Updates the MinIO image and adds MinIO alerts.
    • Routes the ingress-haproxy, forecastle and external-dns namespaces to the infra output.
  • monitoring 📦 core module: v4.3.0
    • Bumps AlertManager to v0.33.0, Grafana to v13.0.2, Kubernetes RBAC proxy to v0.22.0, Kubernetes state metrics to v2.19.0, Node exporter to v1.11.1, Prometheus operator to v0.92.0, Prometheus operated to v3.12.0, x509 exporter to v4.2.0 and Mimir to v3.2.0.
    • Updates the MinIO image.
    • Adds new control plane, MinIO and x509-exporter alerts. Some Mimir alerts change name with the upstream rules of Mimir v3.2.0.
    • The distribution also bumps the Prometheus image of the prometheusAgent monitoring type to v3.12.0.
  • networking 📦 core module: v4.1.0
    • Bumps Cilium to v1.19.8 and Tigera operator to v1.42.6 (Calico v3.32.2).
    • With Calico on OnPremises and KFDDistribution, deploys the Calico API Server, which Whisker, Goldmane and Tiers need since Calico v3.32.
  • policy 📦 core module: v1.18.0
    • Bumps Gatekeeper to v3.23.1, Gatekeeper Policy Manager to v2.1.0 and Kyverno to v1.19.1.
  • tracing 📦 core module: v1.6.0
    • Bumps tempo-distributed to v2.10.8.
    • Updates the MinIO image and adds MinIO alerts.

New features 🌟​

  • [#575] OnPremises: add support for the new furyctl renew kubeconfigs command. It renews the kubeconfig file of the admin and the kubeconfig files of the users in spec.kubernetes.advanced.users.names. Then it downloads them to the working directory. A user that you add to the configuration file gets a kubeconfig file. It is not necessary to apply the kubernetes phase.

Bug Fixes 🐛​

  • [#577] OnPremises: makes the admin.conf fetch in fetch-admin-conf-playbook.yaml pick the right master, and stops the playbook from failing on purpose to signal "cluster doesn't exist".
  • [#607] DR module: fix velero triggering immediate backups after every furyctl apply.
  • [#597] OnPremises: the API server now uses the OIDC groups prefix from the configuration file. Before this release, the installer ignored spec.kubernetes.advanced.oidc.group_prefix and always used oidc:. The new field is groups_prefix, the same name as claimMappings.groups.prefix in the API server AuthenticationConfiguration. group_prefix is deprecated, but it still works when groups_prefix is not set. Refer to the Breaking Changes section.
  • [#589] All kinds: the schema now validates the storageSize fields of Prometheus, OpenSearch and MinIO as Kubernetes quantities, for example 10Gi. A value like 10GB now fails when furyctl validates the configuration, and not during the apply. The retentionSize field of Prometheus does not change, because it uses Prometheus units like 120GB.

Breaking changes 💔​

  • [#597] OnPremises: if you set spec.kubernetes.advanced.oidc.group_prefix to a value that is not oidc:, the OIDC group names change when you apply. Before this release, the API server always used oidc:, so your RoleBinding and ClusterRoleBinding objects probably use oidc:. Update these bindings to the prefix that you set before you apply, or the users of these groups lose access. If you did not set the field, or you set it to oidc:, nothing changes.
  • Tracing: Tempo no longer supports the OpenCensus receiver.

Known issues ⚠️​

  • OnPremises with Cilium: Cilium 1.18 and 1.19 have a bug (cilium/cilium#44891). When the upgrade replaces a Cilium pod that is not Ready, the hubble-relay pod on that node can stay not Ready, and furyctl apply waits on deployment/hubble-relay.

    Before you upgrade, make sure that all the Cilium pods are Ready:

    kubectl -n kube-system rollout status ds/cilium

    If the fault occurs, drain the node of the hubble-relay pod, reboot it, then uncordon it. A restart of the Cilium pod does not clear the fault.

Upgrade procedure​

Check the upgrade docs for the steps to upgrade the SIGHUP Distribution from one version to the next using furyctl.