Release Proposal v2.26

[yankay]

This proposal is for the release of v2.26.0

Changes by Kind

Deprecation / Removal

• Deprecating support for Centos7; they are not tested anymore (CI: remove centos7 and weave jobs from test pipeline #11344, @ant31)
• Remove Debian 10 support. (CI: Remove Debian 10 support & macvlan test move to Debian 11 #11347, @tico88612)
• Remove the kubeadm_version which is always equal to kube_version (Remove kubeadm_version and use kube_version instead #11473, @VannTen)
• Drop support for Kubernetes 1.27.x minimum version now is 1.28.x (Update 'KUBESPRAY_VERSION and kube_version_min_required', cleanup old hashes. #11221, @mzaian)

Feature / Major Changes

• Make kubernetes v1.30.4 default (Add hashes for Kubernetes 1.30.4 and set default #11455, @kokyhm)
• Add hashes for Kubernetes v1.30.3 default (Make kubernetes v1.30.3 default  #11391, @tico88612), Add hashes for Kubernetes v1.30.2 default ([kubernetes] Support kubernetes 1.30 #11343, @tmurakam), Add hashes for Kubernetes 1.30.0, 1.30.1 and 1.30.2 ([kubernetes] Add hashes for kubernetes 1.30 (#11109) #11261, @tmurakam), Add hashes for kubernetes 1.29.7, 1.28.[11-12] ([kubernetes] Add hashes for kubernetes 1.29.7, 1.28.[11-12] #11407, @mzaian)
• Add option ubuntu_kernel_unattended_upgrades_disabled to control unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu (Support disable kernel unattended-upgrades on Ubuntu #11296, @tu1h)
• Added option to configure dependencies for kubelet.service (Added option to configure dependencies for kubelet.service #11297, @ledroide)
• Adds the possibility to add extra arguments to the various containers in the cinder-csi plugin.(add the ability to configure extra args to the different cinder-csi-p… #11169, @Payback159)
• Allow to run kubespray with an empty kube_node group, to provision only the control plane (Allow empty kube_node group #11248, @VannTen)
• CentOS 7 yum repo baseurl update (Fix CentOS 7 yum repo baseurl update #11360, @tico88612)
• Check CentOS-Base.repo exists for CentOS 7 (Check CentOS-Base.repo exists for CentOS 7 #11402, @tu1h)
• Check if peers is defined when peering with routers (make sure peers is defined. #11259, @ehsan310)
• OpenStack Cloud Controller Manager upgrade to 1.30.0 (Bump: OpenStack Cloud Controller Manager to 1.30.0 #11358, @tico88612)
• Rename systemd module to systemd_service (Rename systemd module to systemd_service #11396, @tu1h)
• User has the ability to configure calico-kube-controllers log level (Make calico-kube-controllers log level configurable #11335, @mirwan)
• User has the ability to configure local_volume_provisioner log level (Make local_volume_provisioner log level configurable #11336, @mirwan)
• User has the ability to configure netchecker components log levels (Make netchecker log levels configurable #11334, @mirwan)
• You can now disable installing OS dependencies using system's package manager by skipping system-packages tag. (Add 'system-packages' tag to control installing packages from OS repos #10872, @hedayat)
• kubelet_max_parallel_image_pulls represents the maximum number of image pulls in parallel (Add options to control images pulling of kubelet #11094, @tu1h)
• Update reset task to support Tencent OS (reset_restart_network_service_name) (fix reset network for tencent OS #11459, @KubeKyrie)
• Add conditional checking on ubuntu kernel unattended_upgrades disabling (Add conditional checking on ubuntu kernel unattended_upgrades disabling #11479, @tu1h)

Applications

• Bump Cinder CSI Plugin to v1.30.0 (Bump Cinder CSI Plugin to v1.30.0 #11374, @tico88612)
• Bump upcloud csi driver to v1.1.0 in order to enable csi volume snapshots. (Upgrade upcloud csi driver to v1.1.0 and add snapshot features #11303, @Elias-elastisys)
• User has a possibility to fix nodePort of ingress-nginx service with property in addons.yaml ([ingress-nginx] Enable to fix the nodePort of ingress-nginx service  #11310, @mochizuki875)
• Update kube-vip to v0.8.0 (Update kube-vip to v0.8.0 #11156, @jisnardo)
• [cert-manager] upgrade to v1.14.7 ([cert-manager] upgrade to v1.14.7 #11341, @tico88612)
• [cert-manager] add support v1.13.6 ([cert-manager] upgrade to v1.13.6 #11279, @tico88612)
• [ingress-nginx] upgrade controller to version 1.11.2 ([ingress-nginx] upgrade to 1.11.2 #11463, @mzaian)
• [helm] Upgrade to v3.15.4, add 3.15.x, and drop 3.13.x (upgrade helm to v3.15.4 #11486, @yankay)
• Add support for LB in UpCloud private zone (Add support for LB in upcloud private zone #11260, @davidumea)
• Bump UpCloud terraform module to v5.6.0
  UpCloud servers specify server groups to be apart of, eliminates manual rescheduling. (upcloud: v5.6.0 and better server groups #11311, @robinAwallace)
• Update node-feature-discovery to v0.16.4 (Update node-feature-discovery to v0.16.4 #11250, @mzaian)
• Allow for configuring etcd progress notify interval and default set to 5s (Allow for configuring etcd progress notify interval #11499, @liuxu623)
• Support Gateway API CRDs install (Feat: Gateway API CRDs install support #11376, @tico88612)
• Increase ansible timeout to 300 (Increase ansible timeout to 300 #11354, @rptaylor)

Network

• [calico] Change calico default version to v3.28.1, add v3.28.0 and checksum , Update calico apiserver deployment to use new readiness probe (Calico v3.28.[0-1] checksums and change calico default version #11234, @ehsan310)
• [calico] add calico support v3.27.4 to fix high cpu load due to XDP program in iptables ([calico] Update calico to v3.27.4 to fix high cpu issues #11476, @ehsan310)
• Add cilium_hubble_event_buffer_capacity & cilium_hubble_event_queue_size vars (add cilium_hubble_event_buffer_capacity & cilium_hubble_event_queue_size vars #10943, @pedro-peter)
• [network] bump cni version to v1.4.0 (bump cni version to v1.4.0 #10698, @cyclinder)
• Change weave CNI to community version and upgrade to the latest version (2.8.7) (Bump CNI weave 2.8.1 to 2.8.7 (community version) #11228, @tico88612)
• [kube-ovn] update to v1.12.21 ([kube-ovn] update version to 1.12.21 #11445, @oilbeater)

Container-Managers

• [containerd] Make containerd 1.7.21 default ([containerd] add hashes for versions v1.7.21 and make v1.7.21 default #11478, @yankay)
• [containerd] added debug config variables (Add containerd config options #11080, @spnngl)
• [containerd] fixes wrong templating for tracing config ([containerd/tracing]: fix containerd tracing templating #11372, @ugur99)
  [runc] Upgrade to v1.1.13 ([containerd] add hashes for versions '1.6.32-34', 'v1.7.17-20' and make v1.7.20 default #11413, @mzaian)
• Update docker cli version 26.1.2 (update docker cli version for ubuntu #11291, @ErikJiang)

Documentation

• Update RELEASE.md for upgrading k8s (Update RELEASE.md for upgrading k8s #11321, @yankay)

Bug or Regression

• Delete /etc/NetworkManager/conf.d/dns.conf on reset. (Cleanup NetworkManager dns.conf on Reset #11440, @HoKim98)
• Fix Hetzner kubernetes group names (fix Hetzner group names #11232, @jmaccabee13)
• Fix: skip multus when not defined (fix: skip multus when not defined #10934, @darkobas2)
• Ingress-nginx-controller admission service is automatically created when ingress_nginx_webhook_enabled: true ([ingress-nginx] Create admission service automatically #11309, @mochizuki875)
• Provide missing advertise-address flag to kube-apiserver (Provide missing advertise-address flag to kube-apiserver #11387, @derselbst)
• Update reset task to support Kylin OS (reset_restart_network_service_name) (fix kylin OS choose NetworkManager #11406, @KubeKyrie)
• Updated indentation in cni-kube-ovn.yml.j2 (L658) (Update cni-kube-ovn.yml.j2 #11357, @sanshah1211)
• Fix CI with fail docker pull in gitlab runner by change DOCKER_HOST (Fix CI fail with download_localhost #11315, @yankay)
• Fix etcd not starting up when using a custom access address (Fix etcd not starting up when using a custom access address #11388, @derselbst)
• Fix the Auto Bump PR is blocked by the label do-not-merge/release-note-label-needed by adding dependabot release-note-none label. (fix auto bump PR is blocked by label #11256, @yankay)
• Fix kube_reserved so it only controls kubeReservedCgroup . (fix kube_reserved so it only controls kubeReservedCgroup #11367, @rptaylor)
• Disables reconfiguring the cluster during upgrade (remove --config option from kubeadm upgrade apply) (Fix: remove --config option from kubeadm upgrade (#11350) #11352, @tmurakam)
• Fix error in boostrap-os when git does not handle symlinks (boostrap-os: use import_tasks instead of symlinks #11508, @VannTen)
• Fix static kube-apiserver advertise address based on first control plane (fix static api server advertise address #11457, @Seljuke)
• Fix incorrect member matching when removing etcd nodes (fix: incorrect member matching when removing etcd nodes #11488, @ErikJiang)
• Fix double pop of access_ip (fix double pop of access_ip #11435, @rptaylor)
• Fix use super-admin.conf for kube-vip on first master when it exists to support initial k8s v1.29+ installation with kube-vip enabled (fix: use super-admin.conf for kube-vip on first master when it exists #11422, @Seljuke)

Other (Cleanup or Flake)

• Contrib playbooks are no longer included in the ansible kubespray collection (Cleanup galaxy.yml  #11239, @VannTen)
• Reduced required python packages in requirements.txt (Relax requirements.txt restrictions #11199, @itayporezky)
• Fix openstack cleanup by change the delete security_group order (Fix openstack cleanup by changing the delete security_group order #11299, @yankay)
• RHEL 7, Centos 7 and derivatives are no longer supported. (Drop support for RHEL 7 / CentOS 7 #11246, @VannTen)
• Use TasksMask=infinity on ostree systems for docker systemd service (Remove systemd version + ostree check for docker TasksMax #11493, @VannTen)

Supported Components

• Core
  • kubernetes v1.30.4
  • etcd v3.5.12
  • docker v26.1
  • containerd v1.7.21
  • cri-o v1.30.3 (experimental: see CRI-O Note. Only on fedora, ubuntu and centos based OS)
• Network Plugin
  • cni-plugins v1.2.0
  • calico v3.28.1
  • cilium v1.15.4
  • flannel v0.22.0
  • kube-ovn v1.12.21
  • kube-router v2.0.0
  • multus v3.8
  • weave v2.8.7
  • kube-vip v0.8.0
• Application
  • cert-manager v1.14.7
  • coredns v1.11.1
  • ingress-nginx v1.11.2
  • krew v0.4.4
  • argocd v2.11.0
  • helm v3.15.4
  • metallb v0.13.9
  • registry v2.8.1
• Storage Plugin
  • cephfs-provisioner v2.1.0-k8s1.11
  • rbd-provisioner v2.1.1-k8s1.11
  • aws-ebs-csi-plugin v0.5.0
  • azure-csi-plugin v1.10.0
  • cinder-csi-plugin v1.30.0
  • gcp-pd-csi-plugin v1.9.2
  • local-path-provisioner v0.0.24
  • local-volume-provisioner v2.5.0
  • node-feature-discovery v0.16.4

Known issues

N/A

Notes

• Deprecating support for Centos7
• The Ansible version has been upgrade to 9.8.0
• Change weave CNI to community version https://github.com/weaveworks/weave

Maintainers

Great respect for joining maintainers 🎉

• Adding myself (VannTen) as approver Adding myself (VannTen) as approver #11483 @VannTen
• Add tico88612 as reviewer Add tico88612 as reviewer #11453 @tico88612
• owners: move ant31 from emeritus_approvers to approvers owners: move ant31 from emeritus_approvers to approvers #11247 @ant31

Pending Tasks

Beta Give feedback

1. [kube-ovn] update version to 1.12.21 #11445
   approved cncf-cla: yes lgtm ok-to-test release-note size/XXL +6
   
2. Bump: Kubernetes to v1.30.4 #11448
   help wanted kind/feature +2
3. Add containerd config options #11080
   approved cncf-cla: yes kind/feature lgtm ok-to-test release-note size/M +7
   
4. Fix: remove --config option from kubeadm upgrade (#11350) #11352
   approved cncf-cla: yes kind/bug lgtm ok-to-test release-note size/XS +7
   
5. [CI] Add a CI job to test cluster upgrading, and fix bug of testcases_run.sh #11458
   approved cncf-cla: yes kind/feature lgtm ok-to-test release-note-none size/M +7
   
6. [calico] Update calico to v3.27.4 to fix high cpu issues #11476
   approved cncf-cla: yes kind/feature kind/network lgtm ok-to-test release-note size/XS +8
   
7. Feat: Gateway API CRDs install support #11376
   approved cncf-cla: yes kind/feature lgtm ok-to-test release-note size/XXL +7
   
8. upgrade helm to v3.15.4 #11486
   approved cncf-cla: yes lgtm ok-to-test release-note size/M +6
   
9. bump nerdctl from v1.7.4 to v1.7.6 #11480
   good first issue help wanted kind/feature +3
   
10. boostrap-os: use import_tasks instead of symlinks #11508
    approved cncf-cla: yes kind/bug lgtm ok-to-test release-note size/M +7
    
11. Drop support for RHEL 7 / CentOS 7 #11246
    approved cncf-cla: yes kind/cleanup lgtm ok-to-test release-note-action-required size/L +7
    

[yankay]

Hi, Dear Sir @mzaian @VannTen @kubernetes-sigs/kubespray-maintainers

Please give some advice about the release proposal,
And please give an lgtm to the Release Proposal issue.

Best Regards.
Thank you very much ╰(°▽°)╯

[tmurakam]

@yankay
Please include #11352 to fix #11350, without this cluster upgrade will fail.

[tico88612]

There are a few more critical PRs I'd like to bring up here:

• Fix: remove --config option from kubeadm upgrade (#11350) #11352 : Because the kubeadm 1.30 command line parameters have been changed, resulting in an error when upgrading, I'm here to test the upgrade manually, and it's no problem.
• fix static api server advertise address #11457 : Because PR Provide missing advertise-address flag to kube-apiserver #11387 caused Issue HA kube-apiserver.yaml Manifests Always configured With First Control Plane Node IP #11423, we may need to revert. (I've also noticed on my master branch that the advertised address for each API Server is the same, which doesn't make sense.)

Minor PRs:

• Feat: Gateway API CRDs install support #11376 : Gateway API installation support

[mzaian]

Please consider this once it's completed #11234 I have already provided a PR for release-2.25 #11476

[rptaylor]

Thanks @yankay for putting this together. Could you please include:

• fix double pop of access_ip #11435 This is an important but simple fix to prevent Ansible inventory from breaking on Openstack.
• Increase ansible timeout to 300 #11354 A convenience that helps on large clusters.

[yankay]

• bump helm from v3.14.2 to v3.15.4  #11481
• bump nerdctl from v1.7.4 to v1.7.6 #11480

[VannTen]

I didn't do much this release cycle, so I don't have much to add, but a small remarks on the release notes formatting ; the following could probably merged in two entry for more clarity:

Make kubernetes v1.30.4 default (
#11455, @kokyhm)
Make Kubernetes v1.30.3 default (
Make kubernetes v1.30.3 default #11391, @tico88612)
Make kubernetes v1.30.2 default (
#11343, @tmurakam)
Add hashes for Kubernetes 1.30.0, 1.30.1 and 1.30.2 (
#11261, @tmurakam)
Add hashes for kubernetes 1.29.7, 1.28.[11-12] (
#11407, @mzaian)
->
Make kubernetes v1.30.4 default
Add hashes for ...etc

[yankay]

I didn't do much this release cycle, so I don't have much to add, but a small remarks on the release notes formatting ; the following could probably merged in two entry for more clarity:

Make kubernetes v1.30.4 default ( #11455, @kokyhm) Make Kubernetes v1.30.3 default ( Make kubernetes v1.30.3 default #11391, @tico88612) Make kubernetes v1.30.2 default ( #11343, @tmurakam) Add hashes for Kubernetes 1.30.0, 1.30.1 and 1.30.2 ( #11261, @tmurakam) Add hashes for kubernetes 1.29.7, 1.28.[11-12] ( #11407, @mzaian) -> Make kubernetes v1.30.4 default Add hashes for ...etc

Thanks @VannTen .
It has been changed.

[cyclinder]

Hi @yankay, Coud you please release include #11422? thank.

[0ekk]

Hi @yankay, Could you also add #11479 into this release?

[VannTen]

@yankay do you want to include #11246 as well ? I was of the impression that Centos7 install's were broken anyway, and including it would facilitate backporting some fixes to 1.26.x after we cut the release.

[Payback159]

@yankay , please also consider #11207

[yankay]

Thanks @VannTen @mzaian @cyclinder @tu1h @tico88612 @mzaian @rptaylor

There is no pending bug for release now :-) And the kubespray can be released this week. (2024/9/6).
I suggest the code freeze before release, except for some bug fixes or small PR.

[yankay]

@yankay do you want to include #11246 as well ? I was of the impression that Centos7 install's were broken anyway, and including it would facilitate backporting some fixes to 1.26.x after we cut the release.

I really appreciate this PR,
but I'm not very sure it can be merged this week :-)

[VannTen]

I'll address the reviews this afternoon, I was on holiday until yesterday ^

[VannTen]

Another candidate : #11508 -> #11152 is pretty annoying and hard to diagnose, and the fix is pretty easy.

[yankay]

Hi @yankay, Could you also add #11479 into this release?

HI @tu1h

The None is in the PR, so the release note cannot be collected automatedly.
So please fill it in the fulture.

[yankay]

Thanks for all. 🎉🎉🎉
It has been released