Skip to main content
Version: 1.35.0

SIGHUP Distribution Release v1.35.0

Welcome to SD release v1.35.0.

The distribution is maintained with ❤️ by the team SIGHUP by ReeVo.

This version adds support for Kubernetes 1.35, updates all core modules, and introduces support for the new Immutable kind in alpha status.

The new Immutable kind allows to create SD Clusters on top of bare-metal or virtual-machines using Flatcar Container Linux as operating system. The OS installatoin and nodes life-cycle is managed by furyctl.

Installer Updates​

  • on-premises 📦 installer: v1.35.5
    • Installs Kubernetes version 1.35.5, adds support for Kubernetes v1.34.8 and v1.33.12.
    • Updates etcd, containerd and runc.
  • eks 📦 installer: v3.5.0
    • Verified compatibility with Kubernetes 1.35.
  • immutable 📦 installer: v1.35.5
    • Verified compatibility with Kubernetes 1.35.

Module updates 📦​

  • aws 📦 provider module: v5.3.0
    • Bumps cluster-autoscaler to v1.35.0, aws-load-balancer-controller to v3.4.0 and aws-node-termination-handler to v1.25.6.
  • auth 📦 core module: v0.7.0
    • Bumps Dex to v2.45.1, Gangplank to v1.2.1 and Pomerium to v0.32.7.
  • dr 📦 core module: v3.4.0
    • Bumps Velero to v1.18.1 and Velero plugins to v1.14.1 (AWS, Microsoft Azure and GCP).
    • Updates MinIO image to the Chainguard fork.
  • ingress 📦 core module: v5.1.0
    • Bumps cert-manager to v1.20.2, ExternalDNS to v0.21.0 and HAProxy to v3.2.8.
    • Updates NGINX images to the Chainguard fork v1.15.5.
  • logging 📦 core module: v5.4.0
    • Bumps OpenSearch to v3.7.0, OpenSearch Dashboard to v3.7.0, Logging operator to v6.5.1 and Loki to v3.7.2.
    • Updates MinIO image to the Chainguard fork.
    • Enables OpenSearch Dashboards Explore.
    • Adds access-log-exporter sidecar to the gateway for NGINX metrics.
    • Requires module-ingress >= v5.0.0 due to updated ingress-nginx log regex expecting the $host field.
  • monitoring 📦 core module: v4.2.0
    • Bumps AlertManager to v0.31.1, Blackbox exporter to v0.28.0, Grafana to v12.4.1, Kubernetes RBAC proxy to v0.21.0, Kubernetes state metrics to v2.18.0, Node exporter to v1.10.2, Prometheus operator to v0.89.0, Prometheus operated to v3.10.0, x509 exporter to v4.1.0 and Mimir to v3.0.4.
    • Updates MinIO image to the Chainguard fork.
    • Enables Grafana Drilldown dashboard.
    • Fixes some broken dashboard metrics, x509-exporter certificate watch paths and Grafana alerts.
  • networking 📦 core module: v4.0.0
    • Bumps Cilium to v1.18.11 and Tigera to v1.40.13.
    • Enables Whisker observability UI.
  • policy 📦 core module: v1.17.0
    • Bumps Gatekeeper to v3.22.2, Gatekeeper Policy Manager to v1.1.1 and Kyverno to v1.18.1.
  • tracing 📦 core module: v1.5.0
    • Bumps tempo-distributed to v2.10.5.
    • Updates MinIO image to the Chainguard fork.

New features 🌟​

  • [#504] Add Whisker Network Observability UI tool for clusters using Tigera Calico as CNI.
  • [#513] Introduce new Immutable kind in alpha status, based on Flatcar Container Linux. This new kind allows to create kubernetes clusters from scracth provisioning fresh (baremetal or virtual) machines with Flatcar Container Linux, gaining immutability and security benefits for your kubernetes clusters.
  • [#519] Allow overriding the pomerium auth ingress through spec.distribution.modules.auth.overrides.ingresses.pomerium.
  • [#527] The distribution is now a data-only repository: it no longer ships the generated Go types. It provides the public JSON schemas, defaults, templates, rules and kfd.yaml. furyctl now owns its config types (see furyctl#674), so integrators that previously imported the generated Go library should migrate accordingly.
  • [#530] Add support for a per-host dnsZone override in furyctl.yaml for masters, etcd, nodes, and loadBalancers host entries. When set on a host, the local value takes precedence over the global spec.kubernetes.dnsZone when computing kubernetes_hostname and etcd_initial_cluster. This makes it possible to assign different FQDNs to hosts in different DNS zones.
  • [#539] Pin ansible (with its python + uv build toolchain and the galaxy collections) under tools.common in kfd.yaml, so furyctl installs a self-contained, versioned Ansible via the bundled mise for the OnPremises and Immutable kinds instead of requiring it on the host. Optional and backward compatible: distributions without the block keep using the host Ansible.
  • [#543] New customResources distribution field: add a new customResources field under the distribution phase configuration that allows the deployment of custom resources together with the distribution phase. This allows to solve some cyclic dependencies that could arise using Kustomize Plugins (like the storage). Plugins remain the preferred way to deploy additional resources.

Bug Fixes 🐛​

  • [#515] Don't try to delete Kyverno Policies when CRDs are not present: the distribution pre-apply script tried to delete the default Kyverno policies even when the CRDs were not present in the cluster. Now the script checks for the CRDs before attempting to delete them.
  • [#532] Fix worker nodes not receiving custom registry in OnPremises clusters: kubernetes_image_registry was placed under master.vars instead of all.vars in the generated hosts.yaml, causing worker nodes to fall back to the default registry.sighup.io/fury/on-premises registry for the pause container (sandbox_image).
  • [#537] Fix PrometheusOperatorRejectedResources false positive: Deploy the AlertmanagerConfigs included with the monitoring module only when URLs are set for the webhooks they use, otherwise a PrometheusOperatorRejectedResources alert would be triggered because of missing Secrets causing alert noise.
  • [#549] Fix Gatekeeper Policy Manager NetworkPolicy blocking ingress traffic when auth provider is not SSO.

Breaking changes 💔​

  • [#505] Support NFTables mode for kube-proxy in on-premises clusters. Now the boolean kubeProxy.enabled field is removed and replaced by the kubeProxy.type enum (ipvs, nftables, none). Migrate existing configurations as follows: enabled: false becomes type: none; enabled: true (or the field omitted) becomes type: ipvs, which is also the default when type is omitted.
  • [#519] For the EKSCluster and KFDDistribution kinds, spec.distribution.modules.auth.overrides.ingresses now only accepts the gangplank, dex and pomerium keys. Previously any key was accepted; configurations using other keys will now fail schema validation.
  • cgroup v1 support removed in Kubernetes 1.35: the kubelet will refuse to start on nodes using cgroup v1. Most modern Linux distributions already use cgroup v2 by default. Before upgrading, verify your nodes are on cgroup v2 by running stat -fc %T /sys/fs/cgroup/ , the output must be cgroup2fs. See the Kubernetes 1.35 release blog for more details.

Upgrade procedure​

Check the upgrade docs for the steps to upgrade the SIGHUP Distribution from one version to the next using furyctl.