get-openstack-images: don't block on images in queued state that we don't own #2518 ~"capo"

Compute default value of calico autodetection in sylva-capi-cluster rather than sylva-core #2649 ~"bug-reproducibility::always" ~"capo" ~"rke2" ~"type::bug"

Inject oci_registry_extra_ca_certs into get-openstack-images job #2312 ~"capo"

Increase default openstack flavor for management cluster #2689 ~"capo"

fixed: get-openstack-image condition to enable tls check based on provided certificate #2728 ~"capo"

Use v1beta1 apiVersion for CAPO resources #2758 ~"capo"

Verify image signature when getting OS images information #2332 ~"capm3" ~"capo" ~"security" ~"security::supply-chain"

revert cloud-public-endpoint refactoring #3179 ~"CI-breakage" ~"capo"

fix capo CI proxy issue #3310 ~"CI::configuration" ~"capo"

CAPD

• capd: fix kindest/node images #3098 ~"CI-breakage" ~"capd"
  

CAPM3

• Update dependency metal3-io/cluster-api-provider-metal3 to v1.8.2

  • Update dependency metal3-io/cluster-api-provider-metal3 to v1.7.1 #2610 ~"capm3" ~"renovate"

  • Update dependency metal3-io/cluster-api-provider-metal3 to v1.7.2 #2847 ~"capm3" ~"renovate"

  • Update dependency metal3-io/cluster-api-provider-metal3 to v1.8.1 #2827 ~"capm3" ~"renovate"

  • Update dependency metal3-io/cluster-api-provider-metal3 to v1.8.2 #2958 ~"capm3" ~"ci-feature::test-upgrade-from-1.1.1" ~"renovate"
    

Update dependency https://gitlab.com/sylva-projects/sylva-elements/container-images/libvirt-metal.git to v0.1.17 #2756 ~"capm3" ~"renovate"

Remove bonded configuration for libvirt-metal in upgrades from 1.1.1 #2819 ~"CI-breakage" ~"capm3" ~"ci-feature::test-upgrade-from-1.1.1"

Longhorn disks config enhancements and Longhorn Disk Schema validation #2410 ~"capm3" ~"ci-feature::test-upgrade-from-1.1.1" ~"longhorn"

delete metal3 deployments after pivot #2948 ~"CI-breakage" ~"capm3"

revert the upgrade of capm3 to 1.8.x #2950 ~"CI-breakage" ~"capm3" ~"ci-feature::test-upgrade-from-1.1.1"

Force interface naming in Metal3 IPA #3057 ~"capm3" ~"ci-feature::test-rolling-update"

Add OKD CAPI provider and assisted installer #2654 ~"capm3" ~"okd"

Use & test new bmh interface-mappings scheme #3077 ~"capm3" ~"ci-feature::test-rolling-update"

ensure baremetal server disks cleanup (kyverno policy to patch BaremetalHosts automatedCleaningMode) #3073 ~"capm3" ~"ci-feature::test-upgrade-from-1.1.1"

Delete metal3MachineTemplates on mgmtCluster after pivot #3270 ~"capm3" ~"ci-feature::mgmt-rolling-update"

CAPV

• Update dependency kubernetes-sigs/vsphere-csi-driver to v3.3.1 #2615 ~"capv" ~"renovate"
  

• Update dependency kubernetes-sigs/cluster-api-provider-vsphere to v1.11.3

  • Update dependency kubernetes-sigs/cluster-api-provider-vsphere to v1.10.2 #2625 ~"capv" ~"renovate"

  • Update dependency kubernetes-sigs/cluster-api-provider-vsphere to v1.11.0 #2719 ~"capv" ~"renovate"

  • Update dependency kubernetes-sigs/cluster-api-provider-vsphere to v1.11.1 #2965 ~"capv" ~"renovate"

  • Update dependency kubernetes-sigs/cluster-api-provider-vsphere to v1.11.2 #3133 ~"capv" ~"renovate"

  • Update dependency kubernetes-sigs/cluster-api-provider-vsphere to v1.11.3 #3279 ~"capv" ~"dependencies::patch" ~"renovate"
    

Fix vsphere-cpi patch #2676 ~"capv"

Cleanup vsphere-cpi #2683 ~"capv" ~"type::cleanup"

Use vsphere-cpi 1.29.0 when k8s_version>=v1.29 #3127 ~"capv"

Refactor vsphere-cpi dependencies #2931 ~"capv" ~"type::enhancement"

Patch vsphere CSI and CPI image registry to use registry.k8s.io #3172 ~"capv"

Features

• Adding kubevirt manager unit #2578 ~"kubevirt" ~"type::feature"
  
• Add Kepler unit #2395 ~"monitoring" ~"type::feature"
  
• RWX enabled PVCs for with NFS Ganesha provisioner #2589 ~"type::feature"
  

Bug Fixes

• Increase ingress-nginx large-client-header-buffers to address HTTP 400 error in workload cluster cattle-cluster-agent #2662 ~"type::bug"
  
• Fix is_ha internal value #2658 ~"type::bug"
  
• Generalize the use of merge-append for unit defaults and templates #2451 ~"type::bug"
  
• Align fluentd chunk size with loki client_max_body_size configuration #2725 ~"type::bug"
  
• Dummy unit generate no resource #2911 ~"cluster-lifecycle" ~"type::bug"
  
• HOTFIX: < char was breaking mdx compiler generating documentation #3264 ~"docs" ~"docs::fix" ~"type::bug"
  
• Fix sylva unit status when workload cluster created by gitops #3329 ~"cluster-lifecycle" ~"type::bug"
  

Documentation

• Update documentation about os-image workload cluster update #2566 ~"docs"
  
• migration on portal #2598 ~"docs" ~"docs::migration"
  
• docs folder final review #2622 ~"docs"
  
• remove non-essential Orange internal references #3013 ~"docs"
  
• Sylva-units chart README was missing a png #3251 ~"docs"
  
• fix forbidden char in unit_description #3325 ~"docs" ~"docs::fix"
  

Monitoring & logging

• Update Helm release prometheus-pushgateway to v2.15.0

  • Update Helm release prometheus-pushgateway to v2.14.0 #2560 ~"monitoring" ~"renovate"

  • Update Helm release prometheus-pushgateway to v2.15.0 #3024 ~"monitoring" ~"renovate"
    

Update rancher-logging to v103.1.2+up4.4.0 (patch) #2736 ~"logging" ~"renovate"

Update Thanos Ruler Alertmanager endpoints #2516 ~"monitoring"

Thanos: enable dedupliction to avoid overlapping blocks #2612 ~"monitoring"

Update Grafana default datasource for management zone #2507 ~"monitoring"

Update memory limits for thanos #2682 ~"monitoring"

Add anti-affinity to alertmanager #2724 ~"monitoring"

Update MinIO configuration #2748 ~"monitoring"

Add anti-affinity to MinIO #2723 ~"logging" ~"monitoring"

Avoid integer 0 for rancher charts value, evaluated to false #2808 ~"CI-breakage" ~"monitoring"

Change minio anti-affinity rule #2825 ~"CI-breakage" ~"logging" ~"monitoring"

Add minio-monitoring-tenant unit healtchCheck for StatefulSet/monitoring-pool-monitoring #2826 ~"CI-breakage" ~"monitoring"

Only enable thanos-credentials-secret if thanos unit is enabled #2947 ~"monitoring"

align Minio units on v5.0.16 (non-OCI was stuck on v5.0.13) #2973 ~"logging" ~"monitoring" ~"renovate"

align Loki on v3.1 (non-OCI was stuck on v2.9) #2972 ~"logging" ~"renovate"

add config for loki compactor #2835 ~"logging"

Redefine minio tenants #2928 ~"ci-feature::test-rolling-update" ~"logging" ~"monitoring"

loki: limit number of labels for logs #2763 ~"logging" ~"type::bug"

Use dedicated service for grafana ingress #2890 ~"logging" ~"monitoring"

Modify the cri parser to store the message in the log field #3010 ~"ci-feature::test-upgrade-from-1.1.1" ~"logging"

Drop helmrelease_spec.chart.spec.chart for minio-logging unit #3070 ~"logging" ~"type::cleanup"

Improve monitoring conditionals for Grafana dashboards and Prometheus rules #2998 ~"monitoring"

Add lenovo_xcc snmp module #3097 ~"monitoring"

Bump tags for Lenovo hardware SNMP monitoring #3146 ~"monitoring"

Add Kyverno monitoring #2962 ~"monitoring"

Standardize serviceMonitor conditionals (kepler, longhorn, gitea) #3210 ~"monitoring"

Disable analytics in loki #3241 ~"logging"

Fixes to enable FluxCD drift detection for monitoring #3204 ~"monitoring"

Storage

• Update longhorn to v103.3.1+up1.6.2 (minor) #2216 ~"longhorn" ~"renovate"
  
• Update Longhorn charts to 1.6.3 #3110 ~"ci-feature::test-upgrade-from-1.1.1" ~"longhorn"
  
• Longhorn 104.1.0+up1.6.2 with 1.6.3 images #3026 ~"ci-feature::test-upgrade-from-1.1.1" ~"longhorn"
  
• Move longhorn-crd chart to 104.x version #3041 ~"longhorn"
  
• Change longhorn-instance-manager-cleanup job ns in workload cluster #3124 ~"longhorn"
  
• Manage the Longhorn engines upgrade #3154 ~"ci-feature::test-upgrade-from-1.1.1" ~"cluster-lifecycle" ~"longhorn"
  
• Install engine image cleanup policy after longhorn #3259 ~"longhorn"
  

Security

• Update Helm release vault-config-operator to v0.8.29 #2575 ~"renovate" ~"security"
  

• Update Helm release trivy-operator to v0.23.3 #2209 ~"renovate" ~"security"
  

• Update Helm release kyverno to v3.2.7

  • Update Helm release kyverno to v3.2.5 #2204 ~"renovate" ~"security"

  • Update Helm release kyverno to v3.2.7 #2997 ~"renovate" ~"security"
    

Update dependency https://github.com/bank-vaults/vault-operator.git to v1.22.3 #2981 ~"renovate" ~"security"

Neuvector fix: Use v2beta1 apiVersion policyexception #2648 ~"security" ~"type::bug"

add kubeaudit as additionnal logging sources (RKE2) #2021 ~"monitoring" ~"rke2" ~"security"

Use per-namespace credentials for loki and thanos #1725 ~"monitoring" ~"security" ~"security::logging"

Resolve "PolicyException using the wrong policy name" #2851 ~"security" ~"security::runtime-security"

Refactor Helm Chart OCI Artifacts Generation and Sign Kustomize-Units in OCI Registry #1969 ~"security"

Implement a Kyverno policy to check container images signatures in a cluster #828 ~"ops" ~"security" ~"security::supply-chain"

let the disable-automountserviceaccounttoken Kyverno policy apply on existing ns/SAs #3086 ~"security"

Create RoleTemplates for common resources (CRDs, network policies, multus) #2230 ~"security" ~"security::user-and-role-management"

move some credentials to helm_secret_values/kustomization_substitute_secrets #3116 ~"security"

update secret name in kubevirt-manager-certificate #3280 ~"security" ~"type::bug"

CI

• Update dependency renovate-bot/renovate-runner to v19.10.1

  • Update dependency renovate-bot/renovate-runner to v17.286.1 #2629 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v17.288.5 #2652 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18 #2672 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.7.0 #2695 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.16.4 #2731 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.25.3 #2762 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.31.1 #2801 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.40.1 #2853 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.47.0 #2908 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.57.2 #2952 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.64.1 #3001 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.72.1 #3044 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.79.1 #3091 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.85.4 #3151 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.89.2 #3205 ~"CI" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.96.5 #3232 ~"CI" ~"dependencies::minor" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v18.96.7 #3272 ~"CI" ~"dependencies::patch" ~"renovate"

  • Update dependency renovate-bot/renovate-runner to v19 #3273 ~"CI" ~"dependencies::major"

  • Update dependency renovate-bot/renovate-runner to v19.10.1 #3311 ~"CI" ~"dependencies::minor" ~"renovate"
    

Update registry.gitlab.com/gitlab-org/cli Docker tag to v1.45.0 #2631 ~"CI" ~"renovate"

Update python Docker tag to v3.9.20 #2861 ~"CI" ~"CI::linter" ~"renovate"

Update Ci values revision to fix proxies configuration used for capo deployment #3074 ~"CI" ~"CI-breakage" ~"CI::configuration" ~"capo"

Update renovate configuration to track kube-job image used by sylva-units delete hook #2975 ~"CI" ~"renovate::configuration"

Factorize capm3-virt environment values #2515 ~"CI" ~"capm3" ~"type::cleanup"

Fix login tests for kubeadm-capm3-virt #2620 ~"CI" ~"CI-breakage" ~"CI-bugs"

Fix request in neuvector login test #2647 ~"CI"

Revert of "Revert Enabling kubevirt and dependent units in capm3 libvirt-metal CI" #2363 ~"CI"

Cleanup unit report script #2675 ~"CI" ~"type::cleanup"

Relates-to: Fix the secretName used by os-image-info certs #2674 ~"CI" ~"CI-breakage" ~"type::bug"

[CI] Test baremetal management cluster deployment with 2 DNS #2618 ~"CI" ~"capm3" ~"capm3"

Check thanos alerts in CI #2168 ~"CI" ~"Test" ~"monitoring"

Allow to test upgrade from 1.1.1 in MR pipelines via ci-feature::test-upgrade-from-1.1.1 #2690 ~"CI" ~"ci-feature::test-upgrade-from-1.1.1"

Switch to hardened image for rke2 deployments #1918 ~"CI" ~"OperatingSystem"

Add cert-manager and PKI in workload clusters #2665 ~"CI" ~"Test" ~"security::certificates"

add in CI check for secret leak in the logs #2465 ~"CI" ~"Test" ~"security" ~"security::CI"

Add release-notes gitlab CI template #2717 ~"CI"

Move all CAPO CI jobs to Rocket (except capo-fip) #2651 ~"CI" ~"capo"

Have libvirt-metal use bonded vlan as primary interface #2153 ~"CI" ~"capm3"

sylva-units: include management.values.yaml in k8s 1.27/1.28 test values #2771 ~"CI"

add capm3-virt-misc to ci #2746 ~"CI" ~"capm3"

debug-on-exit.sh: dump PodDisruptionBudgets and Endpoints, don't dump pod list on console #2783 ~"CI"

Reuse code in login script #2790 ~"CI" ~"type::cleanup"

Move capo-fip job to Rocket #2788 ~"CI" ~"capo"

stop pointing to ci-deployment-values main, reference a tag instead #2803 ~"CI"

CI: dump_machine_logs.sh, show more info on errors when failing to connect to miniserve #2780 ~"CI"

Fix kubeadm-capd gitlab runner flavor (fix kyverno issue) #2807 ~"CI" ~"CI-breakage" ~"kubeadm"

debug-on-exit.sh: dump API resources list #2810 ~"CI"

Minor fix for scheduled capo cleanup #2818 ~"CI"

CI: add CRDs to debug-on-exit #2836 ~"CI"

fix CI job for leak-report #2738 ~"CI" ~"CI-breakage" ~"CI-bugs"

Add pylama python linter in CI #2123 ~"CI" ~"CI::linter"

re-allow leak-report job to fail #2840 ~"CI-bugs"

Fix broken scheduled report #2869 ~"CI"

Add info on CI labels in MR templates #2874 ~"CI" ~"CI::configuration" ~"docs"

Add libvirt-metal pods logs to debug-on-exit for workload clusters #2879 ~"CI" ~"capm3"

Improve Kyverno PolicyReport CI Job to make it fail if relevant #2891 ~"CI" ~"CI-bugs"

Makes deployment pipeline more modular #2876 ~"CI"

Remove Falcon cleanup from the CI #2894 ~"CI" ~"CI::infra" ~"capo" ~"type::cleanup"

Use a warning icon for job allowed to failed in scheduled pipelines reports #2896 ~"CI" ~"CI::tooling"

Use runner-aas template in capm3 pipeline definition #2895 ~"CI" ~"type::cleanup"

Scheduled report and openstack cleanup don't need publish jobs #2900 ~"CI"

Pin the version of python-gitlab used in the scheduled report pipeline #2902 ~"CI" ~"CI-bugs"

[Rework CI] part1 - minor changes #2899 ~"CI"

debug-on-exit: add more capm3 and metallb resources #2924 ~"CI"

Avoid redundant renovate with 2 MRs on kustomize-units/capd/kustomization.yaml #2921 ~"CI" ~"renovate::configuration"

add 'shared notes' wiki link to scheduled pipelines reports #2946 ~"CI" ~"CI::tooling"

Track gitlab-ci include with renovate for all CI files #2956 ~"CI" ~"renovate::configuration"

CI: rename ci-feature::test-rolling-upgrade into ci-feature::test-rolling-update #2954 ~"CI" ~"CI::configuration"

Use 1.1.1 branch with ci-tweaks for upgrade tests #2955 ~"CI" ~"CI::configuration" ~"ci-feature::test-upgrade-from-1.1.1"

Exit earlier in error if OCI artifacts doesn't exist #2969 ~"CI" ~"CI-bugs"

Implement shellcheck #1272 ~"CI" ~"CI::linter"

delete-workload-cluster job: provide information on Namespace status/conditions on failed deletion #2932 ~"CI" ~"ci-feature::mgmt-rolling-update"

CI: silence failures of the leak-report job #2977 ~"CI"

Fix harbor/grafana on upgrade #2980 ~"CI" ~"ci-feature::test-upgrade-from-1.1.1"

Change scheduled & upgrade rules to include capm3-misc pipeline #2984 ~"CI" ~"CI::configuration"

Have a CI label to test rolling update of management cluster in MR #2844 ~"CI" ~"ci-feature::mgmt-rolling-update"

Use CI values relative to specific versions into directories #2960 ~"CI" ~"CI::configuration" ~"ci-feature::test-upgrade-from-1.1.1"

Fix CI config for mgmt rolling upgrade #3011 ~"CI" ~"CI-bugs" ~"ci-feature::mgmt-rolling-update"

introduce k8s-1.29 version #2749 ~"CI" ~"CI::configuration" ~"ci-feature::test-upgrade-from-1.1.1"

Serve 1.28 image for workload cluster #3022 ~"CI" ~"CI-bugs" ~"CI::configuration" ~"ci-feature::test-rolling-update"

Update runner-aas template #3012 ~"CI" ~"CI::configuration"

Only start pylama and shellcheck linters when needed & fix interruptible linters #3029 ~"CI" ~"CI::linter"

Collect crust-gather during debug on exit #2982 ~"CI"

send crustgather output to dedicated file #3034 ~"CI" ~"CI-bugs"

[Rework CI] part2 - Use meaningful deployment job names with emoji 😋 #2906 ~"CI" ~"CI::configuration" ~"ci-feature::test-upgrade-from-1.1.1"

Align nightly schedule with current behavior #3040 ~"CI" ~"CI::configuration"

Rename scenario 'migration' to 'sylva-upgrade' #3046 ~"CI" ~"CI::configuration" ~"ci-feature::test-upgrade-from-1.1.1"

Change node os emoji - replace 🎸 by 🐧 #3050 ~"CI"

Adapt linter rules for cross repo pipelines #3048 ~"CI" ~"CI::linter"

Fix rules for cross repo pipelines #3047 ~"CI" ~"CI-breakage" ~"CI-bugs"

Bump CI Values to 0.4.5 #3052 ~"CI" ~"CI::configuration" ~"ci-feature::test-upgrade-from-1.1.1"

Fix grafana login #3061 ~"CI" ~"CI::functional-tests" ~"monitoring"

Fix ci-feature::test-upgrade-from-1.1.1 configuration in MR #3063 ~"CI" ~"CI-breakage" ~"CI-bugs" ~"ci-feature::test-upgrade-from-1.1.1"

Revisit deployment rules for renovate MRs #3049 ~"CI" ~"CI::configuration" ~"renovate" ~"renovate::configuration"

add logging related units to capm3 misc CI #3045 ~"CI" ~"CI::configuration"

Ignore create-runner-wait job in report #3083 ~"CI" ~"CI::tooling"

Integrate capm3 kubeadm suse in CI #3087 ~"CI" ~"CI::configuration"

Decouple login test for rancher #3027 ~"CI" ~"CI-bugs" ~"CI::functional-tests" ~"ci-feature::mgmt-rolling-update"

Fail if we can't download artifacts via API #3100 ~"CI"

Upload values file in artifacts #3102 ~"CI" ~"CI-bugs"

Handle API pagination to retrieve artifacts #3107 ~"CI" ~"CI-breakage" ~"CI-bugs"

use ci-deployment-values tag 0.4.10 #3119 ~"CI" ~"CI-breakage"

Bump CI deployment values to 0.4.11 #3130 ~"CI" ~"CI-breakage" ~"CI::configuration"

use CEL for the prevent-mgmt-cluster-delete Kyverno policies #3078 ~"CI" ~"CI::functional-tests"

Bump CI values to include capo misc simplification #3142 ~"CI" ~"CI::configuration" ~"capo"

Improve scheduled pipeline report #3148 ~"CI" ~"CI::tooling"

add capm3-kubeadm to 1.1.1-to-main daily scheduled pipelines #3113 ~"CI" ~"CI::configuration"

pin pylama version and add renovate entry for it #3156 ~"CI"

Fix deployment-failure:cleanup job. #3185 ~"CI" ~"CI-breakage" ~"CI-bugs" ~"capo"

Prevent silent failure of scheduled cleanup & fix cleanup for API with authentication #3186 ~"CI" ~"CI-bugs"

Only start helm & kustomize linters when needed #3196 ~"CI"

fix implementation of delay-capo-ci-cleanup-on-failure #3199 ~"CI" ~"CI-bugs" ~"capo"

Fix a typo in CAPO scheduled cleanup #3200 ~"CI" ~"CI-bugs"

Fix after_script / missing node logs #3167 ~"CI" ~"CI-bugs"

delay scheduled CAPO CI cleanup based on update time #3201 ~"CI" ~"capo"

Switch capo nighty upgrade deployments to oci and add some oci variants for capm3-virt #3197 ~"CI" ~"CI::configuration"

Remove preview exception in CI #3175 ~"CI"

Add screenshots when sso-test fail to help debugging #3138 ~"CI" ~"CI::functional-tests"

Apply specific files for capm3 sylva upgrade scenario #3223 ~"CI" ~"ci-feature::test-upgrade-from-1.1.1"

Reorganize CI files #3215 ~"CI" ~"CI::configuration"

Rename deployment jobs ☁capm3-virt to ☁capm3 #3158 ~"CI"

Job ID added as prefix to artifact name when downloaded #3194 ~"CI"

CI timeout increase (and other improvements) #3285 ~"CI"

CI use the same naming convention for all tests #3211 ~"CI" ~"type::cleanup"

fix debug-on-exit remote_command #3316 ~"CI-bugs"

Cleanups

• Use kustomize component for shared-workload-clusters-settings #2514 ~"type::cleanup"
  
• remove inherit from kustomization-deployed-on-mgmt-cluster for cluster-reachable unit #2567 ~"type::cleanup"
  
• Cleanup Loki unit values #2524 ~"type::cleanup"
  
• make keycloak external secrets conditioned components #2426 ~"type::cleanup"
  
• Use kyverno chart new value resourceFiltersExclude to avoid dumping large resourceFilters contents #2646 ~"type::cleanup"
  
• cleanup: 'capi' unit, no need to set EXP_CLUSTER_RESOURCE_SET #2742 ~"type::cleanup"
  
• simplify kube-job design / cleanup get-openstack-images #2523 ~"type::cleanup"
  
• refactor cluster-garbage-collector using kube-cronjob #2776 ~"type::cleanup"
  
• prevent having both 'repo' and 'helmrelease_spec.chart.spec.version' set for a unit #2970 ~"type::cleanup"
  
• prevent having both 'repo' and 'helmrelease_spec.chart.spec.version' set for a unit #3072 ~"type::tech-debt"
  
• Revert workaround related to RKE2 cisnetworkpolicy Node finalizer #3088 ~"ci-feature::test-upgrade-from-1.1.1" ~"rke2" ~"type::cleanup"
  
• Remove cluster_public_endpoint from values #2881 ~"ci-feature::test-upgrade-from-1.1.1" ~"type::cleanup"
  

Other

• Update renovate regex to handle sylva-core source_templates exception #2816 ~"renovate::configuration"
  
• Update SRIOV chart repo from 'charts.rancher.io' to 'suse-edge.github.io' #2473
  
• Update Rancher helm repo to get stable releases #2968
  
• Update CAPI to v1.8.3, CAPBPR RKE2 bootstrap provider to 0.7.1 #2961 ~"ci-feature::test-upgrade-from-1.1.1"
  
• enforce harbor-init dependency in mgmnt values file #2628
  
• apply scripts: fail quickly on any sylva-units error #2550 ~"type::enhancement"
  
• Calico: add healthcheck on operator.tigera.io/v1/sylva-system/default Installation #2569 ~"cluster-lifecycle"
  
• Provide HA values for capm3-virt as component #2630
  
• Disable calico-ready in management cluster #2667
  
• renovate: use addLabels instead of labels #2685 ~"renovate::configuration"
  
• Revert upgrade of Flux resources apiVersions ("Replace deprecated flux apiVersion") #2680
  
• use CEL prerecondition for patch-bond-policy Kyverno policy #2144
  
• Align sylva-units delete timeout with delete hook job activeDeadline #2679
  
• Avoid retries during helmreleases installations and upgrades #2469
  
• Set calico-ready dependency during management cluster upgrade #2671
  
• Kubevirt manager expose endpoints to access gui #2617
  
• fix: gitea update strategy #2707
  
• Use different GitRepository of sylva-core for kustomize-units and sylva-units #2694 ~"CI-breakage" ~"ci-feature::test-upgrade-from-1.1.1"
  
• Grant Kyverno backend permission to update namespaces and use "updatepsa" verb with Rancher #2544
  
• allow upgrades from previous releases using existing_source #2730 ~"CI-breakage" ~"ci-feature::test-upgrade-from-1.1.1"
  
• allow leak-report job to fail #2734
  
• increase SYLVA_UNITS_RECONCILE_TIMEOUT #2754 ~"ci-feature::test-upgrade-from-1.1.1"
  
• Introduce descheduler #2287
  
• upgrade Kubernetes to patch versions 1.28.12, 1.27.16, 1.26.15 #2712 ~"ci-feature::test-upgrade-from-1.1.1" ~"kubeadm" ~"rke2"
  
• Fix ingress-nginx version computation for k8s 1.27 #2761 ~"CI-breakage"
  
• get-openstack-images/os-images-info: fix JOB_CHECKSUM ensure interpretation before hashing #2768 ~"ci-feature::test-upgrade-from-1.1.1"
  
• Fix the computation of sylva_base_oci_registry #2792
  
• Kyverno in base-deps #2183
  
• Let Flux manage Calico and MetalLB #2255 ~"ci-feature::test-upgrade-from-1.1.1" ~"cluster-lifecycle" ~"rke2"
  
• Revert "Merge branch 'renovate/https-github.com-minio-operator.git-5.0.x' into 'main'" #2799
  
• sylva-units: don't use 'lookup' to determine sylva-core GitRepo spec #2794
  
• Rollback calico Helm release name and ns alignment for kubeadm #2815 ~"CI-breakage" ~"ci-feature::test-upgrade-from-1.1.1" ~"kubeadm"
  
• Provide DHCP-less option with manual IPA networking config #2520
  
• remove harbor-postgres-primary PodDisruptionBudget #2784 ~"CI-breakage"
  
• Kyverno policy to cleanup nodes re-created during machine deprovisionning #2767 ~"ci-feature::test-rolling-update"
  
• cluster-creator-login.sh: always assign user to globalrole even when user exists #2714
  
• Revert "Let Flux manage Calico and MetalLB" #2822 ~"CI-breakage" ~"ci-feature::test-upgrade-from-1.1.1"
  
• workload-cluster: fix namespaces of the GitRepository used by cattle-agent-xxx Kustomization #2837
  
• adjust kustomizations to not define caBundle in CRD manifests #2838 ~"CI-breakage"
  
• descheduler: fix RemovePodsHavingTooManyRestarts #2759
  
• cis profile updated for k8s 1.29 #2855
  
• RKE2: test delayed etcd membership pruning #2845 ~"ci-feature::test-rolling-update" ~"rke2"
  
• bootstrap: cluster-reachable should always depend on cluster unit #2857
  
• fix path on vault admin policy for policies management #2829
  
• provide sane default value for cluster_domain of workload clusters #2811
  
• Add minio tenants to debug-on-exit #2878
  
• Remove support of k8s version 1.26 #2865
  
• move apiVersion (for healthcheck) to sylva-library #1999
  
• Exclude chart.lock in sylva-units oci artifact check #2897 ~"CI-breakage"
  
• Add postUpgradeCommands in renovate configuration for sylva library updates #2910 ~"renovate::configuration"
  
• Update renovate configuration for sylva-library update #2918 ~"renovate::configuration"
  
• add rancher-init enabled conditions #2920
  
• Interpret values only once #2922 ~"type::enhancement"
  
• Enable coredns unit in workload cluster #2781
  
• suspend thanos-compactor during cluster rolling update #2949 ~"ci-feature::mgmt-rolling-update"
  
• renovate: allow use of Rancher 104.x chart #2988 ~"renovate::configuration"
  
• revert of sylva-units schema change breaking OCI deployments #2995 ~"CI-breakage"
  
• bootstrap: don't do 'helm dependency update' #2987
  
• Set sylvaCA for ssl verification #2884
  
• sylva-units: introduce _internal.state.is_upgrade, alternative to .Release.IsUpgrade #3025 ~"ci-feature::test-upgrade-from-1.1.1"
  
• tools/serve-crustgather-artifact.sh: fail early (e.g. if bad archive) #3062
  
• have unit-enabled test fail on non-existing unit #3064
  
• Fix/pdb unhealthy pod eviction policy #2864 ~"ci-feature::mgmt-rolling-update" ~"cluster-lifecycle"
  
• Call capm3NetworkValidation #3018
  
• fix how imageReferences is injected in checkimages clusterPolicy #3085 ~"CI-breakage"
  
• upgrade kubernetes patch versions to 1.29.9, 1.28.14 and (rke2) 1.27.16+rke2r2 #3038 ~"ci-feature::test-upgrade-from-1.1.1" ~"update"
  
• Configuration Options for Flux Controllers: Concurrent Reconciles, Feature Gates, and Log Level #2996
  
• Adding Kubevirt CDI addon #2696 ~"kubevirt"
  
• Make more use of CEL preconditions in Kyverno ClusterPolicies #2774
  
• support source_template..spec.ref.branch for dev workflows #3122
  
• Align memory requirements for HA node configs #3123
  
• Limit patch updates frequency to every 2 weeks for some packages #3135 ~"renovate::configuration"
  
• setup the newer policy preventing mgmt cluster deletion before upgrading 'cluster' unit #3145 ~"ci-feature::test-upgrade-from-1.1.1" ~"cluster-lifecycle" ~"update"
  
• Fix missing namespace on new workload clusters #3166 ~"CI-breakage"
  
• Always enable kyverno policy preventing cluster deletion (remove cabpoa particular case) #3173 ~"CI-breakage"
  
• revert sylva-capi-cluster to 0.2.44 #3170 ~"CI-breakage"
  
• Kyverno policy to handle new interface-mappings scheme in BareMetalHost #3171
  
• Add a option to serve crustgather in backgroud and start a sub-shell to interact with it #3094
  
• Rename kubvirt test VMs to fix upgrades from 1.1.1 #3160 ~"CI-breakage" ~"bug-reproducibility::always" ~"ci-feature::test-upgrade-from-1.1.1" ~"kubevirt"
  
• Restrict ingress-nginx to use the default metallb ippool #3132 ~"ci-feature::test-upgrade-from-1.1.1"
  
• Fix minio-cleanup-pre-upgrade enabled conditions #3060 ~"ci-feature::test-upgrade-from-1.1.1"
  
• Need for helmrelease retries in bootstrap cluster #3188
  
• Decrease fluentd chunks size #3213
  
• Remove capm3 interface_mappings values for upgrades from 1.1.1 #3203 ~"ci-feature::test-upgrade-from-1.1.1"
  
• Revert https://gitlab.com/sylva-projects/sylva-core/-/merge_requests/2975 #3222 ~"renovate::configuration"
  
• add Kyverno policy to prevent recreation of RKE2 HelmCharts for Calico and MetalLB #3234 ~"cluster-lifecycle" ~"rke2"
  
• Automatically enabling the kubevirt-manager when kubevirt unit is enabled #3071 ~"kubevirt"
  
• use API server CEL matchCondition for the Kyverno policy preventing the use of default namespace #3240
  
• Check if any circular dependency in units configuration #3079
  
• workload clusters: fix generation of sylva-units-status configmap #3244
  
• [823] Add a unit to deploy workload-team-defs Helm chart #1897 ~"cluster-lifecycle"
  
• workload clusters: fix _internal.is_upgrade #3245
  
• Ensure that multus CRDs are updated #3238 ~"ci-feature::test-upgrade-from-1.1.1"
  
• Vault & gitops - Add workload cluster team roles and policies #3246
  
• add Kyverno policy to remove kubernetes-vip Service #3187 ~"ci-feature::test-upgrade-from-1.1.1"
  
• Add a unit to test nfs-ganesha RWX PVs #3177 ~"type::enhancement"
  
• unbreak OCI builds by adding to .helmignore: img, units-description.md, values.schema.yaml #3265 ~"CI-breakage" ~"oci"
  
• Let Flux handle Metallb LCM and associated resources #3101 ~"ci-feature::test-upgrade-from-1.1.1"
  
• Update sylva-toolbox & ci-image (patch) #3269 ~"dependencies::patch"
  
• Reduce kyverno load #3239
  
• fix premature exit of 'sylvactl watch' on transient HelmRelease errors #3278 ~"ci-feature::test-upgrade-from-1.1.1"
  
• Migrate openshift assisted installer version to ocm-2.12 #3231
  
• get back to a rancher-cis-benchmark compatible with rancher 2.9 #3281
  
• add policy to fix RKE2 HelmChart for core components to avoid their uninstallation #3271 ~"rke2"
  
• remove bootstrap cluster only if pivot is ready #3288
  
• have root-dependency job remove leftover root-dependency- resources #3282
  
• GitOps: Enable passing secret from Vault for workload clusters #2859
  
• fix metallb-resources-annotations Kyverno policy #3292
  
• (merge artifact) #3293 ~"ci-feature::mgmt-rolling-update"
  
• let sylva-units-status capture the fact that the upgrade from 1.1.1 is done #3334
  

Other dependency upgrades

• Update docker Docker tag to v27.3.1

  • Update docker Docker tag to v27 #2505 ~"renovate"

  • Update docker Docker tag to v27.1.1 #2633 ~"renovate"

  • Update docker Docker tag to v27.1.2 #2716 ~"renovate"

  • Update docker Docker tag to v27.2.1 #2787 ~"renovate"

  • Update docker Docker tag to v27.3.1 #2944 ~"renovate"
    

Update sylva-projects/sylva-elements/container-images/ci-image Docker tag to v1.0.38 #2613 ~"renovate"

Update dependency rancher-sandbox/cluster-api-provider-rke2 to v0.5.0 #2611 ~"renovate" ~"rke2"

Update Helm release ceph-csi-cephfs to v3.11.0 #2202 ~"renovate"

Update dependency kubernetes-sigs/cluster-api to v1.7.4 #2609 ~"renovate"

Update dependency https://gitlab.com/sylva-projects/sylva-elements/helm-charts/capo-contrail-bgpaas.git to v1.0.4 #2745 ~"renovate"

Update dependency rancher/cluster-api-provider-rke2 to v0.6.0 #2782 ~"ci-feature::test-upgrade-from-1.1.1" ~"renovate" ~"rke2"

Update sylva-units-operator to v0.1.3 (patch) #2839 ~"cluster-lifecycle" ~"renovate"

Update registry.gitlab.com/gitlab-org/cli Docker tag to v1.46.1 #2830 ~"renovate"

Update Helm release rke2-multus to v4.1.001 #2868 ~"renovate" ~"rke2"

Update sriov to v1.3.0 (minor) #2914 ~"renovate"

Update bitnami/configmap-reload Docker tag to v0.14.0 #2993 ~"renovate"

Update registry.gitlab.com/sylva-projects/sylva-elements/container-images/oci-tools Docker tag to v0.0.14 #3129 ~"renovate"

Update oci-tools Docker tag to v0.0.14 #3226 ~"dependencies::patch" ~"renovate"

Update dependency https://gitlab.com/sylva-projects/sylva-elements/helm-charts/sriov-resources.git to v0.0.4 #3192 ~"renovate"

Update sylva-toolbox & ci-image (patch) #2700 ~"renovate"

Update sylva-toolbox & ci-image (patch) #2769 ~"renovate"

Update sylva-toolbox & ci-image (patch) #3002 ~"ci-investigation-needed" ~"renovate"

Update sylva-toolbox & ci-image (patch) #3125 ~"ci-feature::mgmt-rolling-update" ~"dependencies::patch" ~"renovate"

Contributors

Thomas Morin, Remi Le Trocquer, Alexandre Seitz, Francois Eleouet, francois klieber, Bogdan-Adrian Burciu, Pierrick Seite, Sakshi Choudhary, Jonathan GAYVALLET, Jianzhu Zhang, Federico Cicchiello, manik bindlish, Mohan Sharma, Chris Wheeler, Zaharia Mihai, Antoine Monlong, vladimir braquet, Advit Pandey, Alin H, Yiping Chen, Alain Thioliere, Bogdan Antohe, Ishita Mittal, Aurélien Sollaud, Samuel Bartel, François-Régis Menguy, Loic Nicolle, emmanuel wyckens, Médéric de Verdilhac, Claudine Le Mercier, Alex Ghita, Daniel Anton, Akshay yadav, Arnaud Bouts, sakshi gupta, Benjamin Le Diguerher, Cristian Manda, Marc Bailly, Mathieu Rohon, Ionut Spanu, Dragos Gerea, Priya Goyal