knative/serving v0.24.0

Knative Serving v0.24.0

on GitHub

Changes by Kind

🚨 Breaking or Notable

1. Renaming of some net-* components

Related issue: knative/networking#448

As part of our efforts to GA/1.0 we've standardized on the naming of our networking plugins that are installed along side Serving. If you're managing your Knative deployment manually with kubectl this will require a two-phase upgrade process. Please see the below sections:

Upgrade of net-http01 to v0.24.0

# Apply the new release
$ kubectl apply -f net-http01.yaml

# Once the deployment is ready delete the old resources
$ kubectl delete deployment http01-controller -n knative-serving
$ kubectl delete service challenger -n knative-serving

Upgrade of net-certmanager to v0.24.0

# Apply the new release
$ kubectl apply -f net-certmanager.yaml

# Once the deployment is ready apply the same file but 
# prune the old resources
$ kubectl apply -f net-certmanager.yaml \
  --prune -l networking.knative.dev/certificate-provider=cert-manager

Upgrade net-istio to v0.24.0

# Apply the new release
$ kubectl apply -f net-istio.yaml

# Once the deployment is ready apply the same file but 
# prune the old resources
$ kubectl apply -f net-istio.yaml \
  --prune -l networking.knative.dev/ingress-provider=istio

Upgrade of net-contour to v0.24.0

# Apply the new release
$ kubectl apply -f net-contour.yaml

# Once the deployment is ready apply the same file but 
# prune the old resources
$ kubectl apply -f net-contour.yaml \
  --prune -l networking.knative.dev/ingress-provider=contour

Upgrade of net-kourier to v0.24.0

At this point we've defered the renaming to net-kourier until the next release. We're looking to ensure there is no traffic disruption as part of the upgrade. Thus upgrading to v0.24.0 requires no special instructions.

Upgrade of namespace certificate controller to v0.24.0

# Apply the new release
$ kubectl apply -f serving-nscert.yaml

# Once the deployment is ready apply the same file but 
# prune the old resources
$ kubectl apply -f serving-nscert.yaml \
  --prune -l networking.knative.dev/wildcard-certificate-provider=nscert

2. Kubernetes 1.19 is now required

As part of our Kubernetes Minimum Version Principle we now have a hard requirement on Kubernetes Version 1.19.

3. Webhook/Controller RBAC changes

The recommended way to delete a Knative installation is to run kubectl delete -f serving-core.yaml and other release YAMLs you may have applied. There's been a misconception that deleting the knative-serving namespace will perform a similar cleanup but this does not remove cluster scoped resources. In prior releases the cluster state would have prevented the reinstall of Knative Serving. We've addressed this problem but it will require some RBAC permissions on namespaces & finalizers.

Please see the relevant issues & PRs:

• Original issue: knative/pkg#2044
• Workaround: (knative/pkg#2098, @novahe)
• knative-serving-core cluster role has requires permission for namespaces/finalizers. (#11517, @nak3)

4. DomainMapping feature is now BETA

This means it is built in to the main serving-core yaml by default. It is still possible to opt out of the feature by setting replica count of the domainmapping-controller to zero.

As part of this transition the default value for autocreateClusterDomainClaims in the config-network config map has been changed to false meaning cluster-wide permissions are required to delegate the ability to create particular DomainMappings to namespaces.Single tenant clusters may wish to allow arbitrary users to create Domain Mappings by changing this value back to true. (#11573, @julz)

💫 New Features & Changes

• Allow dropping capabilities from a container's security context (#11344, @psschwei)
• Domainmapping can now specify a tls secret to be used as the https certificate (#11250, @shinigambit)
• Provides a feature gate that, when enabled, allows adding capabilities from a container's security context (#11410, @psschwei)
• defaultExternalScheme can now be used to default routes to surface a URL scheme of your choice rather than the default "http". (#11480, @markusthoemmes)
• Optimized generated routes to minimize Envoy configuration size (net-istio#632, @howardjohn)
• Rename Contonr's ClusterRole and ClusterRoleBinding to differ from existing contour installation (net-contour#500, @izabelacg)
• Add a new ConfigMap config-kourier, with the initial enable-service-access-logging setting (net-kourier#523, @markusthoemmes)

🐞 Bug Fixes

• Fixed a bug where traffic would briefly be routed 'wrong', leading to errors due to exceeded queues in deployments with a large activator count and a low service pod count. (#11375, @markusthoemmes)
• Traffic status in Route is updated whenever traffic configuration was wrong. (#11477, @nak3)
• Validates, consistently with other configmaps, that the _example section of the features configmap is not accidentally modified. (#11391, @julz)

Dependencies Changes