HNC v0.4 goal is to stabilize HNC's UX. From now on, we will not make backwards-incompatible changes to the v1alpha1 API; we will either maintain compatibility or introduce a new API version after a suitable deprecation period.

To install this release on your cluster, run the following commands:

HNC_VERSION=v0.4.0
kubectl apply -f https://github.com/kubernetes-sigs/multi-tenancy/releases/download/hnc-${HNC_VERSION}/hnc-manager.yaml

To install the kubectl plugin on your workstation, switch to any directory in your PATH (e.g. ~/bin) and run the following commands:

HNC_VERSION=v0.4.0
curl -L https://github.com/kubernetes-sigs/multi-tenancy/releases/download/hnc-${HNC_VERSION}/kubectl-hns -o ./kubectl-hns
chmod +x ./kubectl-hns

# Ensure the plugin is working
kubectl hns
# The help text should be displayed

For more instructions, see the user guide.

Changelog

A complete list of changes since HNC v0.3 is available here.

Since HNC v0.4.0 rc2

None

Since HNC v0.4.0 rc1

Fixed:

• Allow HNC to work without Stackdriver (#770)

Since HNC v0.3

Key new/changed features in this release include:

• The user interface for creating subnamespaces has changed - rather than creating a HierarchicalNamespace object, you now create a SubnamespaceAnchor object. Otherwise, the UX is identical (issue #704 plus doc updates)
• HNC no longer requires cert-manager to run (#653)
• The CritCycle condition is now applied to all namespaces involved in a cycle, not just one randomly-selected one (#666)
• Tree labels are updated even in the presence of critical conditions (#660)
• Namespace conditions are now available as a metric (#736)

Known issues

These issues are being (or have been) fixed in HNC v0.5, but are considered to be sufficiently rare or low-impact that we are not currently planning on backporting them to HNC v0.4. Please contact aludwin@google.com if you are affected by these changes and require a backport.

• The object validators are not all set up correctly and do not respond to changes in HNCConfiguration. That is, if you overwrite or delete an object managed by HNC, it may appear to succeed, but HNC will immediately overwrite it (#761)
• If a RoleBinding is quickly deleted and recreated with a new Role, HNC may fail to update it (#798)
• If you manage to create a subnamespace anchor to an existing namespace (by bypassing the webhook, or due to an extremely unlucky race condition), and if that subnamespace has allowCascadingDelete set (which is not the default), then you can delete that namespace (#797).