Merge Requests integrated in this release

488 merge requests were integrated in this repo between the fork of release-1.7 branch and 1.8.0.

These notes don't account for the MRs merged in secondary repos.

Kubernetes

• Use short DNS name for various service to improve DNS resolution efficiency !7261 ~"type::bug" (issues: #3611 Use short names as much as possible to reach internal services)
  
• Remove kube-system namespace definition from namespace-defs !8481 ~"type::cleanup"
  
• Upgrade openSUSE LeapMicro to version 6.2 !6798
  
• improve tools/check-sylva-units-k8s-versions.py for case where OS images for a given flavor don't all use the same k8s version !8559 ~"area:CI"
  
• update k8s: 1.35.6+rke2r1, 1.34.9+rke2r1, 1.33.13+rke2r1 + related calico, ingress-nginx, multus, coredns upgrades !8433
  
• add support of k8s 1.36 !8393 ~"area:operating-systems" (issues: #4227 add support of k8s 1.36 in sylva)
  
• remove support of k8s 1.33 !8754
  
• Pin k8s version for canonical !8898 ~"ck8s"
  
• fix os_images_info_job_registry_filter_regex !8989 ~"area:operating-systems" ~"type::bug"
  
• Use short in-cluster FQDN for internal OpenBao workload_team_defs.vault_settings.endpoint !9072 ~"security::credentials"
  
• Update k8s gateway repo url !9149 ~"oci"
  
• Exclude kube-system namespace pods from VAP/restrict-node-selection !9255 ~"area:security"
  
• kubeadm: increase Etcd election-timeout/heartbeat-interval (align with RKE2) !9091 ~"CI::infra" ~"area:CI" ~"kubeadm"
  
• update k8s patch versions - 1.36, 1.35, 1.34 for kubeadm, rke2, ck8s !8939 ~"ck8s" ~"kubeadm" ~"rke2"
  
• update k8s patch versions for rke2, kubeadm, ck8s - 1.34, 1.35, 1.36 and add multus-crd !9358 ~"ck8s" ~"kubeadm" ~"rke2"
  
• Revert "update k8s patch versions for rke2, kubeadm, ck8s - 1.34, 1.35, 1.36 and add multus-crd" !9468
  
• update k8s patch versions for rke2, kubeadm, ck8s - 1.34, 1.35, 1.36 and add multus-crd (reapply) !9482
  

Sylva-units framework

• Update sylva-units-operator to v1.4.5 ~"renovate" !8683 !8935 !9224 !9426
  
• Update dependency fluxcd/flux2 to v2.9.5 ~"renovate" !8533 !8869 !8915 !9044
  
• Update misc-controllers-suite to v1.4.3 !9424 ~"renovate"
  
• Flux: let kustomize-controller use a serviceAccount for cluster healthChecks to clear cache between retries !8388
  
• Flux: Also use serviceAccount for cluster-ready healthChecks to clear cache between retries !8443
  
• reduce flux Helm controller memory request !8200
  
• Add upgrade job to run flux migrate for stale SSA managedFields across Flux CRs !7487 (issues: #4329 remaining traces of old Flux CRDs (OCIRepo v1beta2, example))
  
• properly handle inexisting fields in healthCheckExprs !8463
  
• Update define-source script: do not override source branch if already provided !8510
  
• Enable Rancher auditLog sidecar when audit_log.level is set !8520 (issues: #4356 Rancher Audit Logs can't be enabled - auditLog.enabled missing from rancher HelmRelease values)
  
• minor: Fix healthCheckExprs for rancher-roles-management !8522
  
• remove sylvactl_timing_hints from mgmt_cluster_state_values._internal !8557 ~"type::cleanup"
  
• Trigger additional reconciliation when one-shot units are active !7965 ~"area:CI" (issues: #4062 leverage SylvaUnitsRelease additional reconciliation to clear one-shot unit Kustomizations)
  
• sylva-units: fix '(raw)', avoid breaking on second sylva-units iteration !8704 ~"type::bug"
  
• bootstrap: install sylva-toolbox into an empty directory !8808
  
• sylva-units: ensure proper interpretation ordering around is_ha !8399
  
• improve how ensure_toolbox replaces the ./bin directory !8870
  
• Rename the helm template one-shot-unit-enabled test value to show expectancy !8403 ~"docs::values"
  
• sylvactl/CI: use recent change in how data on narrow-timeout units is reported !8984 ~"area:CI"
  
• workload-cluster: robustness improvement for dummy units !8581
  
• Extract sylva-release-info workload clusters ConfigMap in a dedicated unit !9027
  
• keep is_upgrade stable across additional reconciliations !8619
  
• sylva-units: don't require 'get-helm-version' named template to interpret the whole unit definition, 'helm_chart_versions' is sufficient !9206
  
• Rename and revisit _internal.sylva_namespaces computation and tests !8357
  
• Standardize the way proxies are referred to in values !7218 ~"type::bug" (issues: #3780 changing proxies in mgmt cluster triggers a rolling update in workload clusters)
  
• Enable kustomization reconciler controller in management cluster !9236
  
• Revert "Enable kustomization reconciler controller in management cluster" !9334
  
• Add drift detection ignore rules for crossplane external-name annotations !8328 ~"area:security" ~"security::user-and-role-management" (issues: #4241 keycloak-user-management: need a drift correction ignore rule for externalName annotation)
  
• Fix management-cluster-flux dependencies on the csi unit !7660 ~"area:storage" (issues: #3907 timeout on Kustomization/management-cluster-flux)
  
• Add StorageClass name to Flux PVC name to trigger recreation on upgrade !9389 ~"area:storage"
  
• Re-enable kustomization reconciler controller in management cluster !9340
  
• Remove namespace defs !9410 ~"type::cleanup"
  
• Exclude keys from units to keep sylva-units-values secret smaller !9397
  

Cluster API

• Update dependency kubernetes-sigs/cluster-api-provider-openstack to v0.14.8 ~"renovate" ~"capo" !8506 !8945 !9045
  
• Update Sylva Helm chart sylva-capi-cluster to v0.15.22 ~"renovate" !8489 !8660 !8670 !8697 !8746 !9007 !9136 !9256 !9545
  
• Update dependency canonical/cluster-api-k8s to v0.6.2 !9342 ~"ck8s" ~"renovate"
  
• adjust cluster-reachable sylvactl timeout !8445
  
• Update metal3 !8507 ~"capm3" ~"renovate"
  
• Bump CAPI API versions for remaining objects !8476 ~"type::cleanup"
  
• Add cluster-* healthCheckExpr !7220 ~"type::tech-debt" (issues: #4347 cluster and cluster-ready units go Ready before any node exists)
  
• fix rke2-capd deployments stuck on the cluster unit !8656 ~"rke2"
  
• Revert upgrade of sylva-capi-cluster to 0.15.5 !8696
  
• Disable SerializeImagePull via kubelet_config_file_options !8687 ~"kubeadm"
  
• Wait for last node to be fully drained/deleted before reporting ready !8583 (issues: #4269 have cluster-machines-ready wait for last node to be drained/deleted)
  
• don't make immutable the 'cluster' definition of non-HA clusters !8679
  
• Update metal3 !8766 ~"capm3" ~"renovate"
  
• add generic CAPI information to sylva-units-status and sylva-release-info ConfigMaps !9005 ~"area:workload-cluster"
  
• Update metal3 !9092 ~"capm3" ~"renovate"
  
• Introduce trust-manager as an additional unit and use Metal3 chart values instead of postRenderers !8537 ~"capm3" ~"type::tech-debt"
  
• Fix assisted-installer dependencies !9135 ~"okd"
  
• OKD on CAPO !7518 ~"capo" ~"okd"
  
• CAPO: Duplicate security group rules for ipv6 !9388 ~"area:networking" ~"capo" ~"type::tech-debt"
  

Workload cluster

• Update Sylva Helm chart workload-team-defs to v0.8.5 ~"gitops" ~"renovate" !8569 !8764 !9144
  
• Update Helm chart kunai to v3.8.1 ~"kunai" ~"renovate" !8690 !8912 !9156 !9199
  
• Update workload-cluster-operator to v0.14.6 ~"renovate" !8763 !9494 !9542
  
• Ensure the OpenBao resources land in vault ns even in Workload Cluster !8428 ~"area:security" ~"security"
  
• include Kubernetes current and target version in sylva-units-status ConfigMap !8478
  
• CI: workload cluster gitops workflow, tests required Keycloak and Vault resources !8090 ~"area:CI"
  
• Ensure the prerequisite units are enabled automatically in Workload Cluster when openbao is !8498
  
• Fix Kunai SSO in case of upgrade !8540 ~"kunai"
  
• Derive WC node helm chart registry from registry_mirrors, decoupled from sylva_base_oci_registry !8544 (issues: #4381 Decouple workload-cluster node helm chart OCI registry from sylva_base_oci_registry)
  
• add generic CAPI information to sylva-units-status and sylva-release-info ConfigMaps !9005 ~"area:capi"
  
• Make kunai-secrets depend explicitly on vault-secrets !8925 ~"kunai" (issues: #4501 kunai-secrets failure due to missing vault-secrets dependency)
  
• Simplify how workload-team-defs reacts to a workload-teams-repo configmap change !9477
  
• Add a CI test tool for the GitOps managed workload cluster deployment flow !9103 ~"area:CI"
  

Backup and Restore

• Update rancher-backup to v109.0.5+up10.0.5 !6142 ~"rancher" ~"renovate"
  
• rancher backup: split ns creation into a separate unit and define missing dependency !8364 ~"rancher" (issues: #4280 rancher backup: missing dependency & unit split)
  
• Allow backup encryption !6219 ~"area:security" ~"backup" ~"security" ~"security::backup-restore" (issues: #2328 Allow client-side encryption of the backups)
  
• add s3url and checksumAlgorithm for velero backupstorageLocation !8542 ~"velero" (issues: #4368 missing s3Url and checksumAlgorithm value in backupstoragelocation for velero)
  
• add minio-operator for wkld cluster !8924
  
• Remove bitnami kubectl image override for Velero !9189
  
• optimise backup scripts and write backup-common.sh !8685 ~"type::enhancement" (issues: #3846 optimize backup-restore scripts)
  
• Enable Encryption for recurring rancher backups !9181 ~"area:security" (issues: #4418 enable encryption for reccurring rancher backups)
  
• enable encryption for velero !9233 ~"area:security" ~"velero" (issues: #4659 enable encryption in velero)
  
• Add healthcheck for backupStorageLocation in velero !9320 ~"area:CI"
  
• Add random suffix for chainsaw velero resources !9315
  

Networking

• Update ghcr.io/kube-vip/kube-vip container to v1.2.3 !8025 ~"kubeadm" ~"renovate"
  
• Update sriov to v1.6.5+up1.6.0 !8916 ~"renovate"
  
• Update Helm chart goldpinger to v1.1.3 !9324 ~"renovate"
  
• Create metallb-system namespace using new metallb-init unit !8078 ~"type::cleanup"
  
• Add dual-stack support for rke2 !7761 (issues: #4020 Add dual-stack (IPv4 + IPv6) support for RKE2 Sylva clusters)
  
• Deploys kubemacpool to allocate MAC addresses to VirtualMachines from a random cluster-local OUI !8601 ~"kubevirt" (issues: #4253 Integrate KubeMacPool as a Sylva unit to enable stable MAC addresses for KubeVirt VMs using bridge CNI)
  
• increase kovn timeout !8895
  
• OKD: add required security context constraints for Sriov !7975 ~"area:security" ~"okd"
  
• Ease the way to enable MetalLB as secondary LB controller !8141 ~"kubeadm" (issues: #4139 metallb: allow use with kubeadm (ignore enabled_conditions if metallb values are provided))
  
• Fix kube-ovn RAFT election !7970 ~"type::bug"
  
• Migrate from ingress-nginx to traefik !8872 ~"type::tech-debt"
  
• Add support for nftables Multinetwork Policy (part of k8s Network Plumbing Work Group) for Multus net-attach-def !7982 ~"type::feature" (issues: #2234 Add support for nftables MultiNetworkPolicy (part of k8s Network Plumbing Work Group) for Multus net-attach-def)
  
• Add ipv6 vip support !8841 ~"type::feature"
  
• Improve test skip logic when multi-networkpolicy-nftables unit is disabled !9240 (issues: #4682 multi-networkpolicy-nftables test are not skipped even when unit is disabled)
  
• Increase multus-rke2-whereabouts-reconciler memory resources !9275 (issues: #4696 Pod multus-rke2-whereabouts-reconciler fails in loop with OOM)
  
• Convert nmstate operator test !9077 ~"CI::functional-tests" ~"area:CI"
  
• CAPO: Duplicate security group rules for ipv6 !9388 ~"area:capi" ~"capo" ~"type::tech-debt"
  
• change condition on multus to check if any *.conf or .*conflist already exists !9431 (issues: #4771 Improve workaround applied for bug: Multus secondary interface missing on pods after node rolling update)
  

OpenStack ~capo

• Update dependency kubernetes-sigs/cluster-api-provider-openstack to v0.14.8 ~"area:capi" ~"renovate" !8506 !8945 !9045
  
• Update heat-operator to v0.5.2 ~"renovate" !8525 !9379
  
• Update dependency k-orc/openstack-resource-controller to v2.6.0 !8356 ~"renovate"
  
• Update Sylva Helm chart sync-openstack-images to v0.9.4 ~"renovate" !8762 !8903 !8974
  
• Update sylva-elements/container-images/openstack-client container to v0.1.8 ~"renovate" !8771 !8905 !8936
  
• Update Helm chart openstack-cinder-csi to v2.36.5 ~"renovate" !8840 !9230
  
• Update Helm chart ceph-csi-rbd to v3.17.1 !6570 ~"area:storage" ~"renovate"
  
• Add VolumeSnapshotClass for Cinder CSI and chainsaw testing !8371 ~"area:storage" (issues: #3104 VolumeSnapshotClass to be added for cinder csi)
  
• OKD on CAPO !7518 ~"area:capi" ~"okd"
  
• CAPO: Duplicate security group rules for ipv6 !9388 ~"area:capi" ~"area:networking" ~"type::tech-debt"
  

Baremetal ~capm3

• Update Helm chart metal3 to v0.15.2 ~"renovate" !8477 !8998
  
• Update sylva-elements/container-images/libvirt-metal to v0.4.3 !8314 ~"renovate"
  
• Update Sylva Helm chart os-image-server to v2.8.1 !8971 ~"renovate"
  
• improve sylvactl timeout for cluster-bmh (baremetal inspection) !8423 (issues: #4307 sylvactl timeout for baremetal inspection is too short)
  
• metal3: inject oci_registry_extra_ca_certs in ipa-downloader for IPA image OCI artifact download (fix air-gapped use-case) !8086 ~"type::bug"
  
• Update metal3 !8507 ~"area:capi" ~"renovate"
  
• Update metal3 !8766 ~"area:capi" ~"renovate"
  
• Increase capm3-virt workload node vCPUs from 4 to 8 !8970 ~"area:CI" (issues: #4467 upgrade from 1.6 to 1.7: longhorn-ready unit times out because the new instance manager pod cannot be scheduled due to insufficient cpu)
  
• unset DOCKER_HOST if SKIP_DOCKER_SERVICE is true !8868 ~"area:CI"
  
• Update metal3 !9092 ~"area:capi" ~"renovate"
  
• Introduce trust-manager as an additional unit and use Metal3 chart values instead of postRenderers !8537 ~"area:capi" ~"type::tech-debt"
  
• Increase ironic PVC size !9141
  
• Increase management-cluster nodes memory capacity for capm3 CI deployments !9420 ~"area:CI"
  

Monitoring

• Update Helm chart prometheus-snmp-exporter to v9.18.0 ~"renovate" !8434 !8490 !8838 !8938 !9271
  
• Update rancher-monitoring to v110.0.2+up80.9.1-rancher.22 ~"rancher" ~"renovate" !8480 !8835 !9100 !9451
  
• Update Sylva Helm chart sylva-dashboards to v1.0.1 ~"renovate" !8563 !9222
  
• Update thanos to v0.42.4 ~"renovate" !8495 !8705
  
• Update Helm chart prometheus-pushgateway to v3.9.0 ~"renovate" !8723 !8917 !9450
  
• Update Sylva Helm chart sylva-thanos-rules to v0.5.4 ~"renovate" !8740 !9177 !9273 !9541
  
• Update Sylva Helm chart sylva-prometheus-rules to v0.4.1 !9076 ~"renovate"
  
• Update Helm chart alertmanager-snmp-notifier to v2.2.0 !9089 ~"renovate"
  
• Enable Prometheus HA !8089 ~"type::tech-debt"
  
• Skip reload on grafana dashboard sidecar !8847
  
• Refactor sylva-dashboards implementation !8084
  
• Metrics server for kubeadm deployments !4540 ~"kubeadm" (issues: #2399 metrics-server for bootstrap CABPK Kubeadm)
  
• Replace deprecated helm_repo_url for Kepler !9040 ~"kepler"
  
• rustfs-monitoring tenant to replace minio-monitoring tenant (Thanos) and cleanup of minio-monitoring !9016 (issues: #4620 use rustfs for monitoring stack (Thanos))
  
• use XFS for rustfs monitoring !9387 (issues: #4729 use XFS for the rustfs monitoring instance)
  
• Switch to rustfs for logging stack (Loki) !9184
  

Logging

• Update ghcr.io/grafana/helm-charts/loki container to v7.1.0 !8541 ~"renovate"
  
• Update github.com/kube-logging/logging-operator to v6.8.0 ~"renovate" !8150 !8833
  
• Update Sylva Helm chart sylva-logging-flows to v0.4.1 !8761 ~"renovate"
  
• Modify fluentd pods number and enable buffer persistency !7291 (issues: #3454 Consider add HA and persistence on logging fluentd)
  
• Fix logs being dropped !8530
  
• Change Loki Helm repository to grafana-community !8655
  
• updated optional Prometheus alert for loki !8926
  
• fix: loki-init failure when using an external S3 backend by adding loki-dummy unit with privilege-namespace !8995
  
• loki: remove useless container image override for kubectl bitnamilegacy !9170
  
• Clean up and fix Loki values overrides after transitioning to grafana-community chart !9201 ~"type::bug"
  

Storage

• Update Helm chart ceph-csi-rbd to v3.17.1 !6570 ~"capo" ~"renovate"
  
• Create longhorn-system namespace using new longhorn-init unit !8360 ~"type::cleanup"
  
• increase sylvactl timeout for ceph-rbd-csi unit !8586 ~"ceph-csi"
  
• Use Ceph CSIs for real-bmh deployments !8661 ~"area:CI" (issues: #3697 Add ceph-csi-rbd in storage_class_unit_map)
  
• Upgrade CephFS CSI from v3.14 to v3.17 with immutable CSIDriver handling !8855 ~"ceph-csi" (issues: #4502 Support CephFS CSI v3.17 upgrade with immutable CSIDriver field)
  
• Add RustFS operator !8703
  
• renovate: support longhorg/longhorn-crd on multiple versions !9030 ~"renovate" ~"renovate::configuration" (issues: #4557 renovate: need to cover longhorn)
  
• remove Longhorn 1.10 !9029
  
• Store Longhorn Encryption Secrets in Vault with pushSecrets for mgmt cluster !8654 ~"area:security" (issues: #3403 store the longhorn encrypted secret keys in vault)
  
• Add VolumeSnapshotClass for Cinder CSI and chainsaw testing !8371 ~"capo" (issues: #3104 VolumeSnapshotClass to be added for cinder csi)
  
• Auto enable trident only when parameters are defined !8503
  
• Handle VolumeSnapshot controller through Flux on RKE2/CABPR clusters !8101 ~"rke2" (issues: #4105 handle lifecylcle of volume snapshot controller with flux on RKE2)
  
• Use single-replica-storageclass for flux source controller only when longhorn is the default CSI !8686 ~"type::bug" (issues: #4413 Flux source-controller uses single-replica-storageclass sc even when longhorn is not the main CSI)
  
• Use relocated images of minio !9330
  
• add XFS StorageClasses !9285 (issues: #4700 Create an xfs storageclass)
  
• add missing dependency on traefik for rusfts-operator unit !9377 ~"rustfs"
  
• Fix management-cluster-flux dependencies on the csi unit !7660 ~"area:units-framework" (issues: #3907 timeout on Kustomization/management-cluster-flux)
  
• Add StorageClass name to Flux PVC name to trigger recreation on upgrade !9389 ~"area:units-framework"
  
• XFS storage classes, allow per-provisioner settings !9371
  
• Create ceph-csi-cephfs namespace using a new ceph-csi-cephfs-init unit !9363 ~"type::cleanup"
  
• Fix snapshot CRD recreation during RKE2 upgrade !9313 (issues: #4752 undesired removal of volumesnapshot CRDs)
  

Security

• Update crossplane-contrib/provider-keycloak container to v2.24.0 !8554 ~"renovate"
  
• Update Helm chart kyverno to v3.9.1 ~"kyverno" ~"renovate" !8611 !9041 !9274
  
• Update registry-1.docker.io/cloudpirates/keycloak container to v0.21.39 ~"renovate" !8324 !8710 !8897 !9032
  
• Remove hashicorp-vault from KUSTOMIZATIONS_PRUNE_FALSE list once we transition from vault to openbao !8145 (issues: #4071 Remove hashicorp-vault from KUSTOMIZATIONS_PRUNE_FALSE list once we transition from vault to openbao in 1.7.0)
  
• stop having crossplane-provider-keycloak-init unit depend on keycloak !8378
  
• increase NeuVector limits and requests to avoid OOMKilled !8315 ~"area:CI" ~"neuvector" ~"type::bug" (issues: #4234 increase NeuVector limits and requests to avoid OOMKilled)
  
• fix bug in sbom-operator unit !8396
  
• sbom-operator: let sbom-operator-init unit be automatically enabled !8467 (issues: #4339 regression: sbom-operator can't be deployed in workload clusters)
  
• Ensure the OpenBao resources land in vault ns even in Workload Cluster !8428 ~"area:workload-cluster"
  
• Reduce CVE for postgresql deployed by CNPG-operator !8532 ~"CNPG" ~"harbor" ~"keycloak" (issues: #4252 Vulnerabilities in postgresql)
  
• tools/get_image_refs.py: normalize the images found on nodes and in helm releases !8579
  
• tools/get_image_refs.py: remove the leading slash from an image reference before normalization !8613 ~"tooling"
  
• harbor: avoid use of hardcoded admin password when harbor is deployed in workload context !8662 ~"harbor" (issues: #4406 Harbor Login Test Is Failing (workload cluster))
  
• Allow backup encryption !6219 ~"area:backup-restore" ~"backup" (issues: #2328 Allow client-side encryption of the backups)
  
• Make get_image_refs.py retrieve the OCI artifacts needed by a workload cluster !7853 ~"oci"
  
• documentation: fix Keycloak app version !8725 ~"keycloak"
  
• Use In-built support for PodDisruptionBudget in CNPG cluster of Keycloak in a way that it is not enabled in Non-HA deployments (default is enabled) !8749 ~"CNPG" ~"keycloak" (issues: #4040 Use In-built support for PodDisruptionBudget in CNPG cluster of Keycloak)
  
• Remove unnecessary crossplane-provider-keycloak-init Secrets !8775
  
• Convert firewall test into pytest !8810 ~"CI::functional-tests" ~"area:CI"
  
• Deploy ClusterSecretStore for reading vault ns Secret/vault-ca and fix secret !8729
  
• Fix NeuVector SSO in upgrade scenario !8658 (issues: #4401 Neuvector SSO test failed on upgrade scenario ( from release-1.6))
  
• Use healthCheckExprs on random secrets !8880
  
• Fix bootstrap CA race that leaves Vault serving an unverifiable TLS cert !8909
  
• add keycloak-user-groups repo unit for Keycloak user/groups GitOps management !6766 (issues: #3400 Manage Keycloak users/groups in Git (GitOps))
  
• tools/get_image_refs.py: support for HelmReleases relying on ExternalArtifacts !8877 ~"oci" (issues: #4491 tools/get_image_refs.py: regression on Rancher chart source artifact identification)
  
• OKD: add required security context constraints for Sriov !7975 ~"Networking" ~"area:networking" ~"okd" ~"sriov"
  
• Fix external OpenBao code path !8620
  
• Add healthCheckExprs for vault-config-operator CRs units !9061
  
• Revert MR#9061 on healthCheckExprs for vault-config-operator CRs units !9083
  
• fix: keycloak-idp kustomization.yaml (external Keycloak IDP) !9085 ~"keycloak" ~"type::bug"
  
• Have workload-team-defs (its JWTOIDCAuthEngineRole CRs) depend on vault-oidc !9081
  
• Implement separate roles for neuvector-readers and federation-wide fedReader group !8695 (issues: #4425 Implement separate roles for neuvector-readers and federation-wide fedReader group)
  
• Store Longhorn Encryption Secrets in Vault with pushSecrets for mgmt cluster !8654 ~"area:storage" (issues: #3403 store the longhorn encrypted secret keys in vault)
  
• Increase memory limits and requests for Kyverno reportsController !9218
  
• [CRA] Create SECURITY.md !9179
  
• add rancher-roles-management-repo unit for gitops !8853
  
• add unit to build a configmap from existing keycloak ressources !7134
  
• Pass vault_settings.oidc.allowedRedirectURIs to w-t-d only when internal OpenBao is configured for OIDC !9062
  
• Exclude kube-system namespace pods from VAP/restrict-node-selection !9255 ~"area:kubernetes-core"
  
• get_image_refs links additional images found in a helm releases to a unit !8702 ~"area:CI" (issues: #4386 get_image_refs doesn't link additional images found in a helm release to a unit)
  
• Enable Encryption for recurring rancher backups !9181 ~"area:backup-restore" (issues: #4418 enable encryption for reccurring rancher backups)
  
• use ci-deployment-values 0.6.30 (fix "'users_groups_repo' not allowed" on 1.7-to-main pipelines) !9291 ~"gitops"
  
• enable encryption for velero !9233 ~"area:backup-restore" ~"velero" (issues: #4659 enable encryption in velero)
  
• CI: Keycloak/GitOps, add distinct check for realm and client roles !9268 ~"area:CI" ~"type::bug"
  
• Add support for external OpenBao/Vault namespace !9217
  
• Add healthCheckExprs for vault-config-operator CRs units !9267
  
• GitOps: Add proxy via secret in gitrepos !8941 ~"gitops"
  
• Fix and run chainsaw restricted-fields test !9260 ~"area:CI"
  
• Add CI support for external OpenBao namespace testing !8367
  
• Enable audit logs for Openbao !9221 (issues: #4618 add audit logs to openbao)
  
• Add drift detection ignore rules for crossplane external-name annotations !8328 ~"area:units-framework" (issues: #4241 keycloak-user-management: need a drift correction ignore rule for externalName annotation)
  
• fix(security): bump OpenBao to 2.6.3 !9384
  

RKE2

• Update rancher-compliance to v110.2.0+up1.5.3 ~"rancher" ~"renovate" !8836 !9101 !9452
  
• minor: Use latest rke2-in-docker image tag in values !8431
  
• fix rke2-capd deployments stuck on the cluster unit !8656 ~"area:capi" ~"capd"
  
• Bump ci-deployment-values and sylva-capi-cluster (OS users) !8832 (issues: #4461 sylva-units HelmRelease install fails: schema validation error on cluster.rke2.additionalUserData.config)
  
• Handle VolumeSnapshot controller through Flux on RKE2/CABPR clusters !8101 ~"area:storage" (issues: #4105 handle lifecylcle of volume snapshot controller with flux on RKE2)
  
• feat: expose cluster.helm_oci_auth for private RKE2 bootstrap chart registries - 4345 !9272 ~"oci"
  
• update k8s patch versions - 1.36, 1.35, 1.34 for kubeadm, rke2, ck8s !8939 ~"area:kubernetes-core" ~"ck8s" ~"k8s-upgrade" ~"kubeadm"
  
• update k8s patch versions for rke2, kubeadm, ck8s - 1.34, 1.35, 1.36 and add multus-crd !9358 ~"area:kubernetes-core" ~"ck8s" ~"k8s-upgrade" ~"kubeadm"
  

Kubeadm

• Update ghcr.io/kube-vip/kube-vip container to v1.2.3 !8025 ~"area:networking" ~"renovate"
  
• Disable SerializeImagePull via kubelet_config_file_options !8687 ~"area:capi"
  
• Ease the way to enable MetalLB as secondary LB controller !8141 ~"area:networking" (issues: #4139 metallb: allow use with kubeadm (ignore enabled_conditions if metallb values are provided))
  
• Metrics server for kubeadm deployments !4540 ~"area:observability" ~"monitoring" (issues: #2399 metrics-server for bootstrap CABPK Kubeadm)
  
• kubeadm: increase Etcd election-timeout/heartbeat-interval (align with RKE2) !9091 ~"CI::infra" ~"area:CI" ~"area:kubernetes-core"
  
• update k8s patch versions - 1.36, 1.35, 1.34 for kubeadm, rke2, ck8s !8939 ~"area:kubernetes-core" ~"ck8s" ~"k8s-upgrade" ~"rke2"
  
• update k8s patch versions for rke2, kubeadm, ck8s - 1.34, 1.35, 1.36 and add multus-crd !9358 ~"area:kubernetes-core" ~"ck8s" ~"k8s-upgrade" ~"rke2"
  

Rancher

• Update Helm chart rancher-turtles to v0.27.2 ~"renovate" !8424 !9082 !9439
  
• Update rancher-backup to v109.0.5+up10.0.5 !6142 ~"area:backup-restore" ~"renovate"
  
• Update rancher-monitoring to v110.0.2+up80.9.1-rancher.22 ~"monitoring" ~"renovate" ~"area:observability" !8480 !8835 !9100 !9451
  
• Update rancher-compliance to v110.2.0+up1.5.3 ~"renovate" ~"rke2" !8475 !8836 !9101 !9452
  
• Update rancher/shell container to v0.8.2 ~"renovate" !8465 !8819 !9445
  
• Update github.com/rancher/local-path-provisioner to v0.0.37 !8748 ~"renovate"
  
• Update Helm chart rancher to v2.15.2 !9456 ~"renovate"
  
• rancher backup: split ns creation into a separate unit and define missing dependency !8364 ~"area:backup-restore" (issues: #4280 rancher backup: missing dependency & unit split)
  
• rancher unit: don't depend on keycloak-oidc-external-secrets !8429 ~"security::user-and-role-management"
  
• upgrade rancher to 2.14.3 !8405
  
• Move Rancher namespaces creation to rancher-namespaces unit !8523 ~"type::cleanup"
  
• Disable fleet components (helmops/gitjob) !7883
  
• Remove cluster-creator related components !8617 ~"type::cleanup"
  
• Fix Rancher UI becoming unresponsive, caused by the chainsaw test CRD churn !8739 ~"area:CI"
  
• add Renovate config for updating the Rancher versions !8780 ~"area:CI" ~"renovate::configuration"
  
• add support of Rancher 2.15.1 and Rancher charts 110.x.x !8752 (issues: #4229 add support of rancher 2.15.x and rancher charts 110.x.x)
  
• bump Rancher Renovate condition to keep charts in sync with Rancher version !8531 ~"area:CI" ~"renovate::configuration" (issues: #4230 update renovate conf for rancher charts as per 110.x.x)
  
• Create cattle-system namespace in workload clusters via a dedicated unit !9364 ~"type::cleanup"
  
• Rancher: disable fleet-agent !9367
  

OKD/OpenShift

• Update github.com/stolostron/mce-operator-helm-xks to v2.17.20260608 !8843 ~"renovate"
  
• Add kyverno-migrate-resources to kyverno-scc users !8735
  
• Remove user and group from chainsaw tests !8821 ~"area:CI"
  
• OKD: add required security context constraints for Sriov !7975 ~"Networking" ~"area:networking" ~"area:security" ~"sriov"
  
• Fix assisted-installer dependencies !9135 ~"area:capi"
  
• OKD on CAPO !7518 ~"area:capi" ~"capo"
  
• Exclude OKD bootstrap namespaces from the py test checking sylva.org/sylva-managed label !9277 ~"area:CI"
  
• Fix OKD workload cluster circular dependency !9460
  
• Make the same units disabled in all OKD deployment options !9289
  
• Grant nonroot-v2 SCC to kubevirt SAs on OKD (cabpoa) !8918 ~"kubevirt"
  

Harbor

• Update harbor-configuration-operator to v1.8.66 !8501 ~"renovate"
  
• Update Helm chart harbor to v1.19.2 !8867 ~"renovate"
  
• harbor-oidc and kunai-oidc need to depend on keycloak-base-resources (need sylva Realm) !8375 ~"security::user-and-role-management"
  
• Reduce CVE for postgresql deployed by CNPG-operator !8532 ~"CNPG" ~"area:security" ~"keycloak" (issues: #4252 Vulnerabilities in postgresql)
  
• harbor: avoid use of hardcoded admin password when harbor is deployed in workload context !8662 ~"area:security" (issues: #4406 Harbor Login Test Is Failing (workload cluster))
  
• harbor, fix admin authentication !8673 (issues: #4416 harbor: admin authentication broken)
  
• let harbor-init depend on eso-secret-stores unit !8914
  

Other

• Force flux UI pod recreation on upgrades from previous releases !8415
  
• prevent namespace defined outside of namespace-defs unit to be pruned by Flux !8457
  
• CNPG postgres image: don't use a floating tag (fix pinning) !8588 ~"CNPG" (issues: #4395 need to pin CNPG postgres container image)
  
• Improve HealthCheckExprs to units producing CNPG clusters !8103 ~"CNPG" (issues: #4142 improve healthCheckExprs for CNPG Clusters)
  
• Add the medik8s operator !8047 ~"type::feature"
  
• Add init dependencies for kepler and trivy !9355 ~"kepler" ~"trivy" (issues: #4742 Missing init dependencies for kepler and trivy-operator)
  
• Kepler: clean up the chart 0.6 DaemonSet prior to the upgrade to 0.11 !9369 ~"kepler"
  
• Increase grafana mem/cpu in mgmt cluster !9491
  
• [release-1.8] upgrade sylva-toolbox to v0.10.12 (fix) !9579
  

Other dependency upgrades

• Update pre-commit hook sylva-projects/sylva-elements/ci-tooling/sylva-test-framework to v1.1.13 !8407 !8441 !8459 !8777 !8794 !9115 !9161 !9258 !9300
  
• Update sylva-elements/container-images/ci-image/ci-playwright-image container to v1.9.0 !8408
  
• Update pre-commit hook astral-sh/ruff-pre-commit to v0.15.22 !8430 !8482 !8513 !8610 !8708
  
• Update sylva-elements/container-images/helm-toolbox container to v1.2.4 !8262 !8904
  
• Update docker.io/library/busybox container to v1.38.0 !8131
  
• Update sylva-elements/ci-tooling/ci-deployment-values to v0.6.24 !8436 !8566 !8976
  
• Update ci-image to v1.10.1 !8460
  
• Update docker.io/nginx container to v1.31.5 !8500 !8709 !8890 !9039
  
• Update Helm chart cert-manager to v1.21.2 !8512 !8590 !8842 !9292
  
• Update container-images/sylva-toolbox container to v1.10.10 !8479 !8575 !9200 !9453
  
• Update pre-commit hook crate-ci/typos to v1.50.3 !8536 !8871 !9127 !9147 !9185 !9345 !9498
  
• Update kube-job to v1.7.3 !8545 !8932
  
• Update dependency sylva-projects/sylva-elements/ci-tooling/ci-templates to v1.1.5 !8561 !8931 !9008
  
• Update Helm chart policy-reporter to v3.10.0 !8578 !8807 !9047
  
• Update Helm chart k8s-ephemeral-storage-metrics to v1.21.0 !8587
  
• Update ghcr.io/openbao/openbao container to v2.6.2 !8534 !8883
  
• Update sylva-toolbox & ci-image to v1.10.4 !8665 !8721 !8789
  
• Update sylva-elements/container-images/oci-tools container to v0.5.1 !8669
  
• Update Helm chart cloudnative-pg to v0.29.0 !8527 ~"CNPG"
  
• Update Helm chart jiralert to v1.9.0 !8485
  
• Update registry.gitlab.com/python-gitlab/python-gitlab container to v8 !8691
  
• Update Helm chart external-secrets to v2.10.0 !8043 !8920 !9046
  
• Update dependency python_gitlab to v8.5.0 !8822 ~"automerge"
  
• Update Helm chart cdi to v0.7.0 !4123 ~"kubevirt"
  
• Update github.com/czerwonk/junos_exporter to v0.16.2 !8860
  
• Update pre-commit hook packaging to v26.3 !8884
  
• Update pre-commit hook oras to v0.2.43 !8919
  
• Update Helm chart crossplane to v2.4.0 !5993
  
• Update dependency k8snetworkplumbingwg/kubemacpool to v0.52.0 !9097
  
• Update dependency sylva-projects/sylva-elements/ci-tooling/ci-components/scheduled-pipeline-report to v1.1.1 !9234 !9336
  
• Update Helm chart sylva-library to v0.10.2 !9246
  
• Update Helm chart hpe-csi-driver to v3.3.0 !8317
  

Documentation

• Add logging, and output artifact section in README !8850 ~"CI::functional-tests" ~"area:CI"
  
• fix units-description.md, k8s-gateway !9392
  

Cleanups

• Create metallb-system namespace using new metallb-init unit !8078 ~"area:networking"
  
• Enable Prometheus HA !8089 ~"area:observability" ~"monitoring"
  
• Create longhorn-system namespace using new longhorn-init unit !8360 ~"area:storage"
  
• Remove kube-system namespace definition from namespace-defs !8481 ~"area:kubernetes-core"
  
• Move workload-cluster cattle-fleet-system namespace patching out of namespace-defs !8515
  
• Bump CAPI API versions for remaining objects !8476 ~"area:capi"
  
• remove sylvactl_timing_hints from mgmt_cluster_state_values._internal !8557 ~"area:units-framework"
  
• Add cluster-* healthCheckExpr !7220 ~"area:capi" (issues: #4347 cluster and cluster-ready units go Ready before any node exists)
  
• Move Rancher namespaces creation to rancher-namespaces unit !8523 ~"rancher"
  
• Remove keycloak-realm-operator unit !8353
  
• Remove cluster-creator related components !8617 ~"rancher"
  
• Remove markdown scheduled report generation !8753 ~"area:CI"
  
• Introduce trust-manager as an additional unit and use Metal3 chart values instead of postRenderers !8537 ~"area:capi" ~"capm3"
  
• Cleanup unused Kyverno PolicyException for Neuvector !9124
  
• typo "as it"/"as-is" !9166 ~"area:CI"
  
• Remove fixtures from Sylva core as they are now handled by sylva-test-framework !9158 ~"area:CI"
  
• harbor: cleanups after transitioning DB to CNPG in Sylva 1.7 !8573 ~"CNPG"
  
• Remove legacy check on bitnami images !9157 ~"area:CI"
  
• Migrate from ingress-nginx to traefik !8872 ~"area:networking"
  
• Cleanup unused KIND_CLUSTER_K8S_VERSION variable !9223
  
• Cleanup nmstate option !9048 ~"area:CI"
  
• Create cattle-monitoring-system namespace via a monitoring-namespace dedicated unit !7983
  
• Remove main-pipeline-report.yml !9317 ~"area:CI"
  
• Create neuvector namespace via a neuvector-namespace dedicated unit !8096
  
• Move harbor namespaces creation to dedicated units !8547
  
• Create cattle-system namespace in workload clusters via a dedicated unit !9364 ~"rancher"
  
• CAPO: Duplicate security group rules for ipv6 !9388 ~"area:capi" ~"area:networking" ~"capo"
  
• Create ceph-csi-cephfs namespace using a new ceph-csi-cephfs-init unit !9363 ~"area:storage"
  
• Remove namespace defs !9410 ~"area:units-framework"
  
• Cleanup redundant yaml linter !9473 ~"area:CI"
  

CI

• Prepare CI release 1.7 !8259
  
• deps-project-tool.py: changes for 1.7 fork, in particular change naming of deps repo release branches, now "release-u.v-sylva-x.y" !8251
  
• use ci-deployment-values with revisited "ha" option !8398 (issues: #4278 CI: on capo, inconsistency between #replicas on MR pipelines compared to scheduled pipelines)
  
• use fresh tags from sylva-elements repos after fork of release-1.7 !8391
  
• Show warning when crust-gather artifacts are unavailable !8341 (issues: #4223 CI console displays crust-gather command even if no crust-gather artifact is available)
  
• Change downstream pipeline strategy from depend to mirror !8440
  
• Bump sylva test framework !8400
  
• increase NeuVector limits and requests to avoid OOMKilled !8315 ~"area:security" ~"neuvector" ~"type::bug" (issues: #4234 increase NeuVector limits and requests to avoid OOMKilled)
  
• Add the ability to exclude values on scheduled report !8466
  
• Add a direct link to test_report in scheduled pipeline reports !8474
  
• CI: improvements on scheduled pipeline report !8494
  
• Add a test to ensure that no CRDs were recreated during an upgrade !8487
  
• CI: workload cluster gitops workflow, tests required Keycloak and Vault resources !8090 ~"area:workload-cluster"
  
• Move test_vault under test_units folder !8469
  
• Add missing pipelines in scheduled report !8516 (issues: #4354 CI: scheduled pipeline report misleading when deployment did not run)
  
• Update test_longhorn.py to use kr8s instead of plain k8s lib !8471
  
• Update test_detect_rolling_updates.py to use kr8s instead of plain k8s lib !8470
  
• Trigger additional reconciliation when one-shot units are active !7965 ~"area:units-framework" (issues: #4062 leverage SylvaUnitsRelease additional reconciliation to clear one-shot unit Kustomizations)
  
• improve tools/check-sylva-units-k8s-versions.py for case where OS images for a given flavor don't all use the same k8s version !8559 ~"area:kubernetes-core"
  
• Improve playwright tests on failure !8555
  
• CI, virt-leaseweb: use new configuration for increased sylvactl timeout factor !8604
  
• CI, helm-schema-validation.sh: Add -fsS so it returns a non-zero exit code on failure while keeping the output clean !8339 (issues: #4273 jsonschema can get crash during failure of curl creating empty file)
  
• Fix Rancher UI becoming unresponsive, caused by the chainsaw test CRD churn !8739 ~"rancher"
  
• Add the ability to run some pytest tests even when the related deployment/upgrade jobs failed !8517
  
• Convert mgmt cluster hurl tests into pytests !8342
  
• Remove markdown scheduled report generation !8753 ~"type::cleanup"
  
• add exception for k8s secret in mgmt-leak-report !8760 (issues: #4445 leaks_check_report script failed on UTF8 decode)
  
• Convert cert-manager tests into pytest !8456
  
• Create a tooling to check if some commit are not covered by a tag in sylva-elements/*** repos !7320 (issues: #1424 Create a tooling to check if some commit are not covered by a tag in sylva-elements/*** repos)
  
• Use Ceph CSIs for real-bmh deployments !8661 ~"area:storage" (issues: #3697 Add ceph-csi-rbd in storage_class_unit_map)
  
• Convert workload hurl login test into pytest !8759
  
• Bump OKD version to 4.22 !8787 ~"okd"
  
• Bring visibility on Junit reports in scheduled pipeline reports !8781
  
• Fix rules for check-cluster-deploy-jobs-before-delete job !8798
  
• Display tests in failure analysis tabs of scheduled report UI !8797
  
• Fix rules for sylva tests framework jobs !8785
  
• Convert firewall test into pytest !8810 ~"area:security"
  
• Remove user and group from chainsaw tests !8821 ~"okd"
  
• Convert compliance scan test into pytest !8812
  
• Handle 404 when a pod owner is garbage-collected mid-run !8851 ~"type::enhancement"
  
• Improve detect-unplanned-node-rolling-updates CI test !8724
  
• minor: prevent crust-gather from hanging indefinitely !8837
  
• fix chainsaw test chainsaw-config ConfigMap collision !8893 (issues: #4504 CI: collision of chainsaw test Job ConfigMaps between different tests)
  
• Add logging, and output artifact section in README !8850 ~"area:documentation"
  
• Adapt push helm artifacts rules !8942 ~"oci"
  
• Increase capm3-virt workload node vCPUs from 4 to 8 !8970 ~"capm3" (issues: #4467 upgrade from 1.6 to 1.7: longhorn-ready unit times out because the new instance manager pod cannot be scheduled due to insufficient cpu)
  
• report runner-wait failures as Infra Unavailable in the scheduled report !8975
  
• Integrate chainsaw in pytest !8511
  
• Convert monitoring alert test in pytest tests !8784
  
• Convert kyverno tests jobs in pytest !8852
  
• Convert identify drift detection !8813
  
• Convert wkld-no-sso-kubeconfig into pytest !8999
  
• Add entrypoint for sylvatest framework !8988
  
• Fix kube-score failures by keeping kubectl stderr out of cluster dump YAML !8987
  
• unset DOCKER_HOST if SKIP_DOCKER_SERVICE is true !8868 ~"capm3"
  
• sylvactl/CI: use recent change in how data on narrow-timeout units is reported !8984 ~"area:units-framework"
  
• Convert 2 step upgrade job into pytest !9002
  
• test-framework: Use --infra-provider and --bootstrap-provider options !9057
  
• Collect JWTOIDCAuthEngineRole vault-config-operator CR during debug-on-exit !9058 ~"security::credentials"
  
• Update get_image_refs !9055 ~"oci" ~"security::supply-chain" (issues: #4567 Improve get_image_refs, #3264 tools/get_image_refs.py: need to cover all OCIRepositories)
  
• Set internal OpenBao env var VAULT_LOG_LEVEL to debug for CI and dev deployments !9080 ~"security::credentials"
  
• Move fixtures from sylva-core to sylva-test-framework !9096
  
• introduce _internal.sylva_branch !9114 (issues: #4527 provide sylva-core branch information)
  
• CI: let get_folder_from_ref support dev 0.0.0- tags on release branches !9139
  
• typo "as it"/"as-is" !9166 ~"type::cleanup"
  
• CI: don't let change_git_revision modify GIT_REVISION !9159 (issues: #4624 CI: deploy job, regression around change_git_revision due to sylva_branch evolution)
  
• Remove fixtures from Sylva core as they are now handled by sylva-test-framework !9158 ~"type::cleanup"
  
• Revert "Use verify mode for building helm artifact when unit description change" !9178
  
• fix typo in check-sylva-units-k8s-versions.py !9180 (issues: #4638 Fix typo in check-sylva-units-k8s-versions.py)
  
• Remove legacy check on bitnami images !9157 ~"type::cleanup"
  
• Add backup Renovate predefined pipeline !9148
  
• [NFS-Ganesha] [CI] Test RWX functionalilty of NFS Ganesha !8911 ~"area:storage"
  
• Fix pre-commit issue in the CI related to bitnami helm images !9202
  
• CI job to check internal sylva_branch values !9140
  
• Disable cache for deployment jobs !9193
  
• Keycloak legacy cleanup inventory !9134 ~"security::user-and-role-management"
  
• Provide a fixture to retrieve the sylva branch used to deploy a cluster !9152
  
• Improve the way we discover chainsaw jobs !9197
  
• Use schedule pipeline report component !9190
  
• Make get_image_refs.py work with any workload cluster kubeconfig !8902 ~"security::supply-chain" (issues: #4380 Make get_image_refs.py work with any workload cluster kubeconfig)
  
• Cleanup nmstate option !9048 ~"type::cleanup"
  
• kubeadm: increase Etcd election-timeout/heartbeat-interval (align with RKE2) !9091 ~"area:kubernetes-core" ~"kubeadm"
  
• get_image_refs links additional images found in a helm releases to a unit !8702 ~"area:security" ~"security::supply-chain" (issues: #4386 get_image_refs doesn't link additional images found in a helm release to a unit)
  
• add backup pipelines in scheduled nightly pipelines !9174 (issues: #4519 enable velero in scheduled pipelines)
  
• add chainsaw tests for velero !8861 ~"area:backup-restore" ~"velero" (issues: #4438 add CI testing for velero)
  
• CI: fix mgmt-check-keycloak-cm for environments that use a proxy !9287 ~"security::user-and-role-management"
  
• Change scope of skip_based_on_upstream_status fixture !9293
  
• CI: Keycloak/GitOps, add distinct check for realm and client roles !9268 ~"area:security" ~"security::user-and-role-management" ~"type::bug"
  
• CI: Ignore test namespaces in sylva-managed tests !9276
  
• Exclude OKD bootstrap namespaces from the py test checking sylva.org/sylva-managed label !9277 ~"okd"
  
• Use specific directory for non-api resources dumps in debug archive !7175
  
• Add healthcheck for backupStorageLocation in velero !9320 ~"area:backup-restore"
  
• Convert nmstate operator test !9077 ~"area:networking"
  
• Introduce external OpenBao (serving HTTP) ephemeral infrastructure CI option !8616
  
• Remove main-pipeline-report.yml !9317 ~"type::cleanup"
  
• Introduce external OpenBao (serving HTTPS) ephemeral infrastructure CI option !8692
  
• Fix and run chainsaw restricted-fields test !9260 ~"area:security"
  
• Use cached node ips on upgrade when API unavailable !9351
  
• CI: let test_no_crd_recreation accept removal of Minio operator CRDs !9401
  
• move sylva-units Helm schema validation to pre-commit !9403
  
• Sylva-toolbox-version stored in a configmap !9117 ~"security::supply-chain" (issues: #4585 improve how get_image_refs.py finds kind node image and sylva-toolbox version)
  
• Cleanup redundant yaml linter !9473 ~"type::cleanup"
  
• Increase management-cluster nodes memory capacity for capm3 CI deployments !9420 ~"capm3"
  
• Use new components instead of legacy Gitlab templates !9481
  
• Fix pre-commit job !9487
  
• Add a CI test tool for the GitOps managed workload cluster deployment flow !9103 ~"area:workload-cluster"
  
• [release-1.8] set sylva_branch to release-1.8 !9560
  
• Remove leaseweb from scheduled pipeline of release-1.8 !9569
  

Internal tooling

• add Renovate config for updating the Rancher versions !8780 ~"area:CI" ~"rancher"
  
• Keep tracking SYLVA_CI_VALUES_REVISION in deployment-base for releases branches !8946 ~"area:CI"
  
• Use a clearer name than "core" for the neuvector helm chart in Renovate MRs !8955 ~"area:CI"
  
• renovate: support longhorg/longhorn-crd on multiple versions !9030 ~"area:storage" ~"longhorn" ~"renovate" (issues: #4557 renovate: need to cover longhorn)
  
• Add a pre-commit hook to properly format json !9049 ~"area:CI"
  
• bump Rancher Renovate condition to keep charts in sync with Rancher version !8531 ~"area:CI" ~"rancher" (issues: #4230 update renovate conf for rancher charts as per 110.x.x)
  
• Track kubemacpool image with renovate !9095 ~"area:CI"
  
• Track nvidia-gpu-operator driver version with Renovate !8993 ~"area:CI"
  
• disable renovate for release-1.3 !9311 ~"area:CI"
  
• Add registry host for full name external OpenBao container image to fix Renovate lookup !9394 ~"area:CI" ~"security::credentials"
  
• Fix Renovate so it detects new Rancher versions again !9411 ~"area:CI"
  
• Update renovate configuration for release-1.8 !9537 ~"area:CI"
  

Contributors

46 people contributed.

Abhishek Bandarupalle, Advit Pandey, Akshay Yadav, Alain Thioliere, Alexandre Seitz, Alin H, Andra-Simona Delicostea, Andrew Kiselev, Arnaud Bouts, Aurélien Sollaud, Bogdan Antohe, Bogdan Nicolae, Bogdan-Adrian Burciu, Cristian Manda, Cristina Isaroiu, Daniel Anton, Dragos Gerea, Eric Zhou, Francois Eleouet, Francois Klieber, François-Régis Menguy, Gwenael Lambrouin, Ionut Spanu, Jianzhu Zhang, Jonas Arndt, Jonathan Gayvallet, Loic Nicolle, Lupescu Daniel, Manik Bindlish, Mihai Zaharia, Mohan Sharma, Médéric De Verdilhac, Nitin Sharma, Pierrick Seite, Pradeep Kumar, Priya Goyal, Ravindra Tanwar, Remi Le Trocquer, Sakshi Choudhary, Samuel Bartel, Sara Walia, Shreya Gupta, Teodora Pirvan, Thomas Morin, Tiberiu Mihai, Vladimir Braquet