knative/serving knative-v1.12.0

v1.12.0

on GitHub

Changes since v1.11

🚨 Breaking or Notable

• Label the webhook service with "app: webhook" label (#14258, @JordanDeBeer)
• auto-tls is now named external-domain-tls (#14472, @ReToCode)
• internal-encryption is now named system-internal-tls (#14472, @ReToCode)
• cluster-local-domain-tls is introduced as a new alpha state flag to control TLS certificates for cluster-local domains (#14472, @ReToCode)
• Traffic from Ingress to Activator/QP uses TLS 1.3 when system-internal-tls is enabled. (#14074, @nak3)
• Validating webhook will now allow adding the NET_BIND_SERVICE or nil capabilities when secure pods defaults feature is enabled (#14445, @kauana)

💫 New Features & Changes

• Allow shareProcessNamespace to be set for a Knative Service (feature flag: kubernetes.podspec-shareprocessnamespace). Disabled by default. (#14454, @rhuss)
• Internal encryption verifies a new SAN kn-user-<ns>. (#14452, @nak3)
• ReadinessProbe with path contains a query string is supported now. (#14273, @nak3)
• Support gRPC probe. (#14134, @seongpyoHong)
• When system-internal-tls is enabled, queue-proxy mounts the certificate secret as projected-volume and automatically reloads the certificates on change. (#14189, @ReToCode)

🐞Bug Fixes

• Activator correctly propagates pod health when triggered by changes other than pod probes. (#14347, @arsenetar)
• Activator no longer cancels all probes when one fails (#14303, @arsenetar)
• Applied an upper bound to the statistics data read from the queue-proxy by the autoscaler. (#14523, @evankanderson)
• Certificate generation errors are bubbled up to its parent Route. (#14496, @gabo1208)
• Fix secure 'secure-pod-defaults' to work with restricted namespaces (#14363, @KauzClay)

Dependencies