[gardener]

✨ New Features

• [USER] NodeLocalDNS can now be enabled via the shoot specification, nodes are rolled in case NodeLocalDNS is switched. Each node gets an additional label indicating the state of NodeLocalDNS at this node. (gardener/gardener#6057, @ScheererJ)
• [USER] When annotating shoots with gardener.cloud/operation or maintenance.gardener.cloud/operation apiserver now validates if the respective operations are supported. (gardener/gardener#6070, @oliver-goetz)
• [OPERATOR] A full snapshot of etcd-main is now triggered after all Secret were encrypted with the new key after ETCD encryption key rotation. (gardener/gardener#6064, @rfranzke)
• [OPERATOR] Introduce feature gate HAControlPlanes in alpha state for gardenlet and gardener-scheduler. ⚠️ This comes with a change to the certs used, which will cause a restart of the etcds. (gardener/gardener#5741, @shreyas-s-rao)

🐛 Bug Fixes

• [USER] A bug has been fixed which could have caused orphaned ServiceAccount token Secrets after the rotation of the signing key. (gardener/gardener#6063, @rfranzke)
• [USER] A bug has been fixed which might cause ServiceAccounts to still reference old static token Secrets after the rotation of the ServiceAccount signing key. (gardener/gardener#6078, @rfranzke)
• [USER] A bug has been fixed which could allow the gardenlet performing rotation of certificate authorities or ServiceAccount signing keys even if the respective feature gates were disabled. (gardener/gardener#6079, @rfranzke)
• [OPERATOR] Fixed a bug with the gardener.cloud/operation: renew-kubeconfig annotation for ManagedSeed resources, which caused the corresponding gardenlet to break when the annotation was set. (gardener/gardener#6069, @Diaphteiros)
• [OPERATOR] A bug was fixed which caused current, accidental resource limit values for the loki container of the loki component, to be established as fixed limits, in place of the correct absolute limit value. (gardener/gardener#6100, @andrerun)
• [OPERATOR] A bug has been fixed which can cause the gardener-resource-manager deployment in the shoot namespaces to mount a ServiceAccount token secret from a different namespace. (gardener/gardener#6109, @rfranzke)
• [DEVELOPER] A bug has been fixed which prevented extension controllers to register shoot webhooks only (w/o any seed webhooks). (gardener/gardener#6086, @DockToFuture)
• [DEVELOPER] Fix a bug causing nil pointer exceptions when configuring the webhook server for local development (gardener/gardener#6087, @kon-angelo)
• [DEPENDENCY] The generic Worker actuator now scales up machine-controller-manager Deployment when Shoot is hibernating (or waking up) and machine-controller-manager Deployment is already scaled down by external actor (dependency-watchdog). (gardener/gardener#6054, @unmarshall)

📖 Documentation

• [OPERATOR] Logging usage documentation is updated. (gardener/gardener#6055, @vlvasilev)

🏃 Others

• [USER] The version of the nginx-ingress-controller addon has been bumped to 1.2.1 for shoots and seeds >= 1.22. (gardener/gardener#6115, @timebertt)
• [OPERATOR] making blackbox-exporter on shoots highly-available, to prevent false positive alerts during rollouts of blackbox-exporter, apiserver-proxy and worker nodes (gardener/gardener#6025, @bd3lage)
• [OPERATOR] Combine systemd services logs in one Loki stream except docker, containerd, kubelet, and kernel. (gardener/gardener#6055, @vlvasilev)
• [OPERATOR] Update coredns to v1.9.3. (gardener/gardener#6071, @ScheererJ)
• [OPERATOR] Gardener landscape administrators are now provided with serviceaccountmanager permissions, i.e. they can manage service accounts and issue tokens for them. (gardener/gardener#6093, @vpnachev)
• [OPERATOR] If you use multi-zonal seed clusters (those labelled with seed.gardener.cloud/multi-zonal), then the Gardener Scheduler will only consider them for multi-zonal shoot clusters. Normal or single-zonal shoot clusters will not be scheduled there. (gardener/gardener#6105, @timuthy)
• [OPERATOR] Node local dns components will stay in the cluster until after the node roll out of a node local dns switch and be cleaned up in the next reconcile. (gardener/gardener#6107, @ScheererJ)
• [OPERATOR] Increased the VPA Recommender log level to v=3. (gardener/gardener#6108, @voelzmo)
• [OPERATOR] Upgrade grafana to 7.5.16 (gardener/gardener#6119, @wyb1)
• [OPERATOR] Fix the "Target" variable of the vpa-recommendations dashboard (gardener/gardener#6129, @istvanballok)

[etcd-backup-restore]

🐛 Bug Fixes

• [OPERATOR] Throw Fatal error to avoid edge case potential deadlocks. (gardener/etcd-backup-restore#471, @ishan16696)

🏃 Others

• [OPERATOR] Introducing a timeout timeoutToOpenBoltDB to open boltDB within a given time, so backup-restore won't have to wait for ever. (gardener/etcd-backup-restore#480, @ishan16696)
• [OPERATOR] When the owner check fails, etcd-backup-restore will restart the etcd process right before attempting to take a final snapshot, if the owner check was previously successful. (gardener/etcd-backup-restore#478, @plkokanov)
• [OPERATOR] Fixed retrieval of credentials during copy operation for backups stored in Swift snapstore. (gardener/etcd-backup-restore#476, @plkokanov)
• [OPERATOR] ETCD won't restart from the PVC if it is wrongly mounted to the pod (gardener/etcd-backup-restore#468, @abdasgupta)
• [OPERATOR] OCS S3 Snapstore now supports supplying access information via a mounted secret. (gardener/etcd-backup-restore#465, @Wieneo)

📰 Noteworthy

• [OPERATOR] Multi-node etcd bootstrapping is now supported. This is an alpha feature intended for initial use and evaluation. Please do not enable this feature for your productive workloads (gardener/etcd-backup-restore#419, @abdasgupta)
  • Multi-node etcd restoration from backup buckets is not supported
  • Intended to work only with etcd-druid v0.9.x and beyond
  • Intended to work only with etcd-custom-image v3.4.13-bootstrap-4 and beyond
• [OPERATOR] An initial-cluster field is now expected in the ETCD config (gardener/etcd-backup-restore#482, @abdasgupta)

[etcd-custom-image]

🏃 Others

• [OPERATOR] The base image of etcd has been set to Alpine 3.15.4. (gardener/etcd-custom-image#18, @timuthy)

[etcd-druid]

⚠️ Breaking Changes

• [OPERATOR] If Spec.Replicas in ETCD CR is greater than 0 and a even number, then no statefulset for ETCD nodes will be created and so the ETCD cluster won't be setup by Druid (gardener/etcd-druid#314, @abdasgupta)
• [OPERATOR] Introduced separate TLS config for client and peer communication with ETCD cluster. The previous Etcd resource field spec.etcd.tls is now deprecated and removed. (gardener/etcd-druid#314, @abdasgupta)

✨ New Features

• [USER] Add SchedulingConstraints field to Etcd spec. The currently supported constraints are Affinity and TopologySpreadConstraints. (gardener/etcd-druid#329, @shreyas-s-rao)

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed which prevented the ServiceAccount's automountServiceAccountToken field from being reconciled. (gardener/etcd-druid#316, @rfranzke)
• [OPERATOR] A bug has been fixed that deleted member lease objects in all namespaces. With this release member lease renewals are enabled again. (gardener/etcd-druid#353, @timuthy)

📖 Documentation

• [DEPENDENCY] Paths transformations in .docforge/manifest.yaml for simplification (gardener/etcd-druid#302, @Kostov6)

🏃 Others

• [OPERATOR] Deployed configmap programmatically as component instead of chart (gardener/etcd-druid#314, @abdasgupta)
  • configmap configures ETCD config based on the number of nodes in cluster. Number of nodes in cluster is derived from spec.Replicas of ETCD CR
• [OPERATOR] Fixed a bug where druid did not copy etcd labels to configmap (gardener/etcd-druid#343, @aaronfern)
• [OPERATOR] Do not re-used resource limits from an existing etcd stateful set. This will cause a RESTART(!) of the etcd pod for existing clusters that currently have a resource limit set for the etcd stateful-set, but whose etcd resource does not specify a resource limit. (gardener/etcd-druid#342, @danielfoehrKn)
• [OPERATOR] ETCd backups can now be successfully copied between OCS buckets. (gardener/etcd-druid#330, @Wieneo)

[hvpa-controller]

🏃 Others

• [USER] Fix an issue where the HVPA would set Requests higher than Limits if ControlledValues: RequestsOnly is set (gardener/hvpa-controller#99, @voelzmo)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.49.0
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.49.0
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.49.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.49.0
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.49.0
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.49.0
seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.49.0