Releases: gardener/gardener-extension-shoot-rsyslog-relp
Releases · gardener/gardener-extension-shoot-rsyslog-relp
v0.5.2
[gardener/gardener-extension-shoot-rsyslog-relp]
🐛 Bug Fixes
[OPERATOR]
Fixed an issue that caused the-a exit,always -F arch=b64 -S mount_setattr -F auid!=-1 -F key=privileged_special
audit rule to not get correctly applied. by @plkokanov [#151]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp-admission:v0.5.2
- gardener-extension-shoot-rsyslog-relp:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp:v0.5.2
v0.5.1
[gardener/gardener-extension-shoot-rsyslog-relp]
🏃 Others
[OPERATOR]
The memory of thersyslog.service
systemd unit is now limited via a drop-in config. The following configurations are used:MemoryMin=15M
,MemoryHigh=150M
,MemoryMax=300M
,MemorySwapMax=0
by @plkokanov [#139]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp-admission:v0.5.1
- gardener-extension-shoot-rsyslog-relp:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp:v0.5.1
v0.5.0
[gardener/gardener-extension-shoot-rsyslog-relp]
⚠️ Breaking Changes
[USER]
When changing referenced TLS secret inshoot.spec.resources[]
the user should provide only immutable secret by @Kostov6 [#76]
🐛 Bug Fixes
[OPERATOR]
Fixed an issue that caused audit logs to be duplicated in journald if thesystem-journald-audit
socket was enabled. Now if thesystem-journald-audit
socket exists on the node, it is disabled and stopped when this extension is used. by @plkokanov [#104][USER]
Rsyslog processes logs on nodes with os suse-chost 15 SP3 by @Kostov6 [#123]
🏃 Others
[OPERATOR]
Errors that can occur when loading audit rules are now ignored and reported as warnings. This allows all correct audit rules to be loaded. by @plkokanov [#128][OPERATOR]
Thersyslog-relp
action which is used to forward logs to a RELP server now uses a separate in-memory queue of 100000 messages. Additionally, it also uses a disk queue of max 48 MiB which is used to store messages after the in-memory queue is exhausted or to save the current messages in the in-memory queue when thersyslog
service is restarted. by @plkokanov [#115][OPERATOR]
This extension is now using the new way of providing monitoring configuration (ref GEP-19) in case a shoot cluster's Prometheus has been migrated to management viaprometheus-operator
. by @rfranzke [#99]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp-admission:v0.5.0
- gardener-extension-shoot-rsyslog-relp:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp:v0.5.0
v0.4.4
[gardener/gardener-extension-shoot-rsyslog-relp]
🏃 Others
[OPERATOR]
The directory where the tls certificates are copied on the node -/etc/ssl/rsyslog
, is now created with default (0755
) permissions so that it can be read by anrsyslog
process that is started withoutcap_dac_override
capability. by @plkokanov [#112]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp-admission:v0.4.4
- gardener-extension-shoot-rsyslog-relp:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp:v0.4.4
v0.4.3
[gardener/gardener-extension-shoot-rsyslog-relp]
🏃 Others
[OPERATOR]
If the certificates used for thersyslog-relp
tls connection are changed, thersyslog
service on the nodes is restarted so that it can properly load the new certificates. by @plkokanov [#107]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp-admission:v0.4.3
- gardener-extension-shoot-rsyslog-relp:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp:v0.4.3
v0.4.2
[gardener/gardener-extension-shoot-rsyslog-relp]
🏃 Others
[OPERATOR]
The reconciliation of theshoot-rsyslog-relp
extension no longer waits for theextension-shoot-rsyslog-relp-shoot
MangedResource
to be deleted during reconciliations, if theShoot
cluster is hibernated. The wait will still be executed when theShoot
is woken up to ensure that the resources deployed in theShoot
are removed. by @plkokanov [#93]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp-admission:v0.4.2
- gardener-extension-shoot-rsyslog-relp:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp:v0.4.2
v0.4.1
[gardener/gardener-extension-shoot-rsyslog-relp]
🏃 Others
[OPERATOR]
TheConfigMap
deployed for the monitoring configuration of theshoot-rsyslog-relp
extension inShoot
control planes is no longerimmutable
. This fixes an issue that could causeprometheus-0
pods to get stuck inCrashLoopBackOff
. by @plkokanov [#91]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp-admission:v0.4.1
- gardener-extension-shoot-rsyslog-relp:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp:v0.4.1
v0.4.0
[gardener/gardener-extension-shoot-rsyslog-relp]
⚠️ Breaking Changes
[OPERATOR]
CA and server certificates for the admission component are managed automatically. Passing custom certificates via Helm values is not supported anymore. by @timuthy [#57][OPERATOR]
Change OCI Image Registry from GCR (eu.gcr.io/gardener-project
) to Artifact-Registry (europe-docker.pkg.dev/gardener-project/releases
). Users should update their references. by @ccwienk [#47][OPERATOR]
extension-shoot-rsyslog-relp
no longer supports Shoots with Кubernetes version == 1.24. by @Kostov6 [#79]
📰 Noteworthy
[DEVELOPER]
Thecharts/images.yaml
file was moved toimagevector/images.yaml
. by @plkokanov [#66]
🐛 Bug Fixes
[OPERATOR]
Fixed an issue where theextension-shoot-rsyslog-relp-configuration-cleaner
ManagedResource could block Shoot deletion if theshoot-rsyslog-relp
was disabled before the Shoot deletion was triggered, and disabling the extension failed while trying to deploy the said ManagedResource and wait for it to become ready. by @plkokanov [#80]
🏃 Others
[OPERATOR]
Bumpedgit.luolix.top/gardener/gardener
tov1.89.0.
by @plkokanov [#73][OPERATOR]
The extension now deploys thersyslog
configuration files by mutating theOperatingSystemConfig
resource via a mutating webhook. Cleanup of thersyslog
configuration files is still handled by thersyslog-relp-configuration-cleaner
daemonset. by @plkokanov [#41][OPERATOR]
Bump github.com/gardener/gardener to 1.86.0. by @timuthy [#57][OPERATOR]
Fixed an issue wherersyslog.service
would never get enabled if it was not already enabled by default. by @plkokanov [#58][OPERATOR]
The name of thegardener-extension-shoot-rsyslog-relp-admission
chart is now correctly specified asgardener-extension-shoot-rsysloog-relp-admission
. Previously it wasgardener-extension-shoot-rsyslog-relp
. This should not require anything to be done by operators when upgrading the chart. by @plkokanov [#39][OPERATOR]
The repository is now compliant with the REUSE license format. by @plkokanov [#71][DEVELOPER]
Thevendor
directory was removed in favor of thego mod cache
. by @timuthy [#57][DEVELOPER]
Bumped golang tov1.22.0
by @plkokanov [#73]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp-admission:v0.4.0
- gardener-extension-shoot-rsyslog-relp:
europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/shoot-rsyslog-relp:v0.4.0
v0.3.1
[gardener/gardener-extension-shoot-rsyslog-relp]
🏃 Others
[OPERATOR]
Incresed memory limits for the init containers of thersyslog-relp-configurator
andrsyslog-relp-configuration-cleaner
daemonsets from16Mi
to32Mi
by @plkokanov [#51]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
eu.gcr.io/gardener-project/gardener/extensions/shoot-rsyslog-relp-admission:v0.3.1
- gardener-extension-shoot-rsyslog-relp:
eu.gcr.io/gardener-project/gardener/extensions/shoot-rsyslog-relp:v0.3.1
v0.3.0
[gardener/gardener-extension-shoot-rsyslog-relp]
⚠️ Breaking Changes
[OPERATOR]
Thesecurity.gardener.cloud/pod-security-enforce
annotation in the ControllerRegistration is set tobaseline
. With this, the pods running in the extension namespace should comply withbaseline
pod-security standard. by @AleksandarSavchev [#17]
✨ New Features
[USER]
Theshoot-rsyslog-relp
configuration now allows users to specify which tls library should be used bylibrerlp
when tls communication is enabled via thetls.tlsLib
optional field. The possible options aregnutls
andopenssl
. When the field is omitted,librelp
uses its default tls library which in most cases isgnutls
. More information can be found here: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imrelp.html#tls-tlslib by @plkokanov [#27][USER]
shoot-rsyslog-relp
extension now supports Shoot Force Deletion. by @acumino [#24]
🏃 Others
[OPERATOR]
Metrics for the rsyslog service running on the shoot nodes are now exposed and collected according to the following:- The metrics are available on the
node-exporter
's/metrics
endpoint. - The names of the new metrics match the
rsyslog_pstat_.+
regex. - The metrics are scraped and collected in the shoot's prometheus instance.
- A dedicated plutono dashboard is added which displays the rsyslog metrics. by @plkokanov [#32]
- The metrics are available on the
[OPERATOR]
Fixed an issue where the rsyslog systemd unit could become stuck in a failed state immediately after it is installed on the shoot's nodes, if theshoot-rsyslog-relp
extension was enabled on the shoot before that. Theconfigure-rsyslog.sh
script which is responsible for configuring and restarting the rsyslog systemd unit will now wait for thesyslog.service
symlink to be created before attempting to configure and restart the rsyslog systemd unit. by @plkokanov [#34][OPERATOR]
The shoot-rsyslog-relp extension is now aligned with Gardener's component checklist:- RBAC for the
shoot-rsyslog-relp
extension controller have been drastically reduced to only the required ones. - The deployment for the
shoot-rsyslog-relp
extension controller now contains the proper label for HA -high-availability-config.resources.gardener.cloud/type: controller
- The
shoot-rsyslog-relp
admission pod no longer has aSecurityContext
. This will be automatically added by theseccomp-profile
webhook of thegardener-resource-manager
- The
rsyslog-relp-configurator
andrsyslog-relp-configuration-cleaner
pods now use theRuntimeDefault
seccomp profile. - The init containers of the
rsyslog-relp-configurator
andrsyslog-relp-configuration-cleaner
pods no longer run in privileged mode. - The
rsyslog-relp-configurator
andrsyslog-relp-configuration-cleaner
now specify resource requests and limits. PodSecurityPolicy
s for thersyslog-relp-configurator
andrsyslog-relp-configuration-cleaner
are now deployed in the shoot cluster, if its kubernetes version is1.24.x
. by @plkokanov [#29]
- RBAC for the
[OPERATOR]
The healthcheck controller is now removed. Starting v1.65.0, gardenlet perform health checks for all ManagedResources in the Shoot control plane in the Seed. There is no longer need of the custom healthcheck controller in the shoot-rsyslog-relp extension as it was doing the same job. It was performing health check for the ManagedResource it deploys. by @plkokanov [#28][OPERATOR]
Thersyslog-relp-configuration-cleaner
is no longer deployed on Shoot deletion withshoot-rsyslog-relp
extension enabled. The Extension deletion occurs after the Worker deletion. There are no Nodes, hence there is no need to clean up registry configuration. by @plkokanov [#30]
Docker Images
- gardener-extension-shoot-rsyslog-relp-admission:
eu.gcr.io/gardener-project/gardener/extensions/shoot-rsyslog-relp-admission:v0.3.0
- gardener-extension-shoot-rsyslog-relp:
eu.gcr.io/gardener-project/gardener/extensions/shoot-rsyslog-relp:v0.3.0