Users by setting nodeSelector in platform settings can enforce all platform apps to be deployed to a given node pool.
The OTEL log collector and Prometheus node exporter are still deployed to all worker nodes to preserve the observability of the whole cluster. Internal secrets are generate with ESO Password generator. Besides that a number of core apps were updated.
Core application changes
| App Name | Old Version | New Version | Notes |
|---|---|---|---|
| argocd | 9.7.1 | 10.9.1 | Updated |
| cert-manager | v1.21.1 | v1.21.2 | Updated |
| external-secrets | 2.9.0 | 2.10.0 | Updated |
| gitea | 12.6.0 | 12.7.0 | Updated |
| istio-base | 1.30.3 | 1.30.4 | Updated |
| istio-cni | 1.30.3 | 1.30.4 | Updated |
| istio-gateway | 1.30.3 | 1.30.4 | Updated |
| istiod | 1.30.3 | 1.30.4 | Updated |
| keycloak | 7.2.3 | 7.3.1 | Updated |
| knative-operator | v1.23.0 | v1.23.1 | Updated |
| kserve | v0.19.0 | v0.20.0 | Updated |
| kserve-crd | v0.19.0 | v0.20.0 | Updated |
| kube-prometheus-stack | 88.6.1 | 90.2.0 | Updated |
| loki | 18.11.3 | 18.13.1 | Updated |
| metrics-server | 3.13.1 | 3.14.0 | Updated |
| otel-operator | 0.122.0 | 0.122.1 | Updated |
| policy-reporter | 3.9.1 | 3.10.0 | Updated |
| prometheus-blackbox-exporter | 11.17.2 | 11.18.0 | Updated |
| sealed-secrets | 2.19.3 | 2.20.0 | Updated |
| ztunnel | 1.30.3 | 1.30.4 | Updated |
Internal component release notes
https://github.com/linode/apl-api/releases/tag/v5.4.0
https://github.com/linode/apl-console/releases/tag/v5.3.0
What's Changed
- fix(oauth2-proxy): update cookie domains handling and set SameSite attribute to lax by @CasLubbers in #3595
- chore: remove release related packages by @CasLubbers in #3596
- chore(chart-deps): update kube-prometheus-stack to version 88.6.2 by @svcAPLBot in #3610
- docs: add ADRs for Dex as OIDC issuer and Keycloak migration path by @CasLubbers in #3542
- chore(chart-deps): update kube-prometheus-stack to version 88.6.3 by @svcAPLBot in #3619
- chore(chart-deps): update loki to version 18.12.1 by @svcAPLBot in #3625
- chore(chart-deps): update kube-prometheus-stack to version 88.6.5 by @svcAPLBot in #3622
- chore: clean up SOPS code by @merll in #3626
- chore(chart-deps): update metrics-server to version 3.14.0 by @svcAPLBot in #3561
- chore(chart-deps): update istio to version 1.30.4 by @svcAPLBot in #3601
- feat(chart): align chart/ and charts/apl-operator by @CasLubbers in #3570
- feat: add ClusterGenerator by @merll in #3628
- feat: add ValidatingAdmissionPolicy for team-specific hostname validation by @CasLubbers in #3598
- chore(chart-deps): update argocd to version 10.8.4 by @svcAPLBot in #3629
- chore(chart-deps): update kube-prometheus-stack to version 90.0.0 by @svcAPLBot in #3630
- chore: clean up processing of decrypted files by @merll in #3633
- chore(chart-deps): update knative-operator to version v1.23.1 by @svcAPLBot in #3613
- chore(chart-deps): update prometheus-blackbox-exporter to version 11.18.0 by @svcAPLBot in #3611
- chore(chart-deps): update policy-reporter to version 3.10.0 by @svcAPLBot in #3599
- feat: add loki network policy by @merll in #3632
- chore: [TOOLS][MINOR] update essential binaries by @merll in #3635
- chore(chart-deps): update gitea to version 12.7.0 by @svcAPLBot in #3503
- chore(chart-deps): update external-secrets to version 2.10.0 by @svcAPLBot in #3604
- refactor: replace generated platform secrets with eso generator by @merll in #3592
- chore: update base image tag by @merll in #3636
- chore(deps): bump json-schema-to-typescript from 15.0.4 to 16.0.0 by @dependabot[bot] in #3609
- chore(deps): bump the npm-dependencies group across 1 directory with 12 updates by @dependabot[bot] in #3627
- chore(chart-deps): update sealed-secrets to version 2.20.0 by @svcAPLBot in #3638
- chore(chart-deps): update argocd to version 10.9.0 by @svcAPLBot in #3641
- feat: add native nodeselector by @CasLubbers in #3639
- chore(chart-deps): update kube-prometheus-stack to version 90.2.0 by @svcAPLBot in #3646
- fix: recreate gitea deployments after upgrade by @merll in #3640
- fix(rbac): change ClusterRoleBinding to RoleBinding Tekton team listener by @CasLubbers in #3634
- fix: revert provide git credentials on first attempt (#3590)" by @j-zimnowoda in #3650
- chore(chart-deps): update cert-manager to version v1.21.2 by @svcAPLBot in #3642
- chore(chart-deps): update otel-operator to version 0.122.1 by @svcAPLBot in #3653
- chore(chart-deps): update argocd to version 10.9.1 by @svcAPLBot in #3651
- chore(chart-deps): update loki to version 18.13.1 by @svcAPLBot in #3652
- chore(chart-deps): update keycloak to version 7.3.1 by @svcAPLBot in #3612
- fix: only insert node selector when non-empty by @merll in #3657
- chore: move post-upgrade to following release by @merll in #3658
- fix: generate loki secret unconditionally by @merll in #3654
- ci: use explicit gh actions instead of relying on remote workflow definition by @j-zimnowoda in #3659
- fix: network policy label for otel collector by @merll in #3663
- fix: pause sync for preventing eso from overwriting secret finalizer by @merll in #3661
- chore(chart-deps): update kserve to version v0.20.0 by @svcAPLBot in #3497
- feat: add RBAC configuration and search namespace for Grafana in team settings by @CasLubbers in #3631
Full Changelog: v6.3.0...v6.4.0-rc.1