Changelog v1.76.15

Know before update

• A StaticInstance whose connectivity check fails now keeps its reservation for the whole bootstrap window instead of returning to the pool on every failed attempt, and the bootstrap (20 min) and cleanup (10 min) timeouts, which previously never fired, are now reachable.
  If nothing ever ran on the host, the bootstrap timeout returns the instance to the pool after 20 minutes as before.
  If the host was already bootstrapped in part, the instance returns only through MachineHealthCheck remediation (nodeStartupTimeoutSeconds: 1200) plus the cleanup timeout, so it becomes available again roughly 20 + 10 minutes after the failure, and remediation reboots the host as part of the cleanup.

Fixes

• [cert-manager] Restore the cert-manager and cainjector permissions that were lost against the upstream chart, including access to ListenerSet resources. #23077
• [chrony] Fixed the unit-detection condition in the disable-ntp-on-node.sh node step. #23035
• [cloud-provider-aws] fix GetCapacity not implemented error spam in logs #23132
• [cloud-provider-azure] Fix multimaster bootstrap by falling back to the d8-masters-kubernetes-data-device-path Secret when the master data device LUN is not provided via cloud-init. #23098
• [cloud-provider-azure] fix GetCapacity not implemented error spam in logs #23132
• [cloud-provider-dvp] fix GetCapacity not implemented error spam in logs #23132
• [cloud-provider-gcp] fix GetCapacity not implemented error spam in logs #23132
• [cloud-provider-vcd] Batch VM cache refresh on cache miss #23316
• [cloud-provider-yandex] fix "Address in use" failures when replacing nodes and when removing external IP addresses #23220
• [deckhouse-controller] Do not commit the package repository registry checksum when no application could be annotated, which left them all on stale registry settings. #23114
• [deckhouse-controller] Stop the module source registry fan-out from replaying and flooding the main queue with duplicate moduleRun tasks. #23114
• [deckhouse] In upmeter, the monitoring-and-autoscaling/alertmanager probe is disabled by default and is turned on with the new alertmanagerProbe.enabled setting. #23123
• [log-shipper] Fixed an invalid VRL script generated by the replaceValue transformation. #23051
  log-shipper
• [node-manager] Stop caps-controller-manager from rewriting StaticInstance objects in a hot loop when a connectivity check fails, which caused a sustained load on etcd. #23106
  A StaticInstance whose connectivity check fails now keeps its reservation for the whole bootstrap window instead of returning to the pool on every failed attempt, and the bootstrap (20 min) and cleanup (10 min) timeouts, which previously never fired, are now reachable.
  If nothing ever ran on the host, the bootstrap timeout returns the instance to the pool after 20 minutes as before.
  If the host was already bootstrapped in part, the instance returns only through MachineHealthCheck remediation (nodeStartupTimeoutSeconds: 1200) plus the cleanup timeout, so it becomes available again roughly 20 + 10 minutes after the failure, and remediation reboots the host as part of the cleanup.
• [user-authn] Render a valid Deployment for a DexAuthenticator whose resources limits are fractional or below the init container requests. #23181
  The self-signed-generator init container now carries the fixed 10m / 25Mi it was always
  meant to have, the same as the identical init container of user-api, instead of the sum of the
  main container limits. A DexAuthenticator that set large limits no longer gets that sum as burst:
  generating the self-signed certificate then takes 3 to 4 seconds instead of under a second. It
  happens once per pod start and needs no action.

Chore

• [ingress-nginx] Update nginx to 1.30.5. #23078
  All ingress-nginx controller pods will be restarted.