[gardener/gardener]

⚠️ Breaking Changes

• [OPERATOR] The VPAForETCD feature gate is promoted to beta and now enabled by default. by @voelzmo [#9873]
• [OPERATOR] The CoreDNSQueryRewriting feature gate has been promoted to GA. It was already enabled by default and can now no longer be turned off. The feature gate will be removed in a future release. by @ScheererJ [#9889]
• [OPERATOR] The MutableShootSpecNetworkingNodes feature gate has been promoted to GA. It was already enabled by default and can now no longer be turned off. The feature gate will be removed in a future release. by @ScheererJ [#9890]
• [DEVELOPER] The deprecated fields .spec.{reloadConfigFilePath,command} and .status.{units,files} have been removed from the extensions.gardener.cloud/v1alpha1.OperatingSystemConfig API. by @rfranzke [#9885]

📰 Noteworthy

• [DEVELOPER] gardenlet now creates a secret called worker-pools-operatingsystemconfig-hashes in the shoot namespace on seed clusters. This secret will be used to upgrade the operating system config key calculation in the future. by @MichaelEischer [#9846]
• [DEPENDENCY] The "list MachineDeployments" call in the generic Worker actuator has been moved right before its first usage to prevent that the list is outdated before it's used. by @rfranzke [#9925]

✨ New Features

• [OPERATOR] The Kubelet configuration was enhanced to add configured worker taints during node registration. Earlier, only the machine-controller-manager was responsible to add taints to the Nodes which happened asynchronously, so that unwanted workload might have already scheduled to these workers. by @timuthy [#9872]
• [OPERATOR] gardenlet is now capable of keeping itself updated by pulling configuration and deployment values from the garden cluster. This way, regular manual Helm deployments can be avoided. Read all about it here.
  Please note, a Gardenlet Helm chart is required on an OCI repository. Gardener will provide this officially in a future release. by @rfranzke [#9874]
• [DEVELOPER] gardener-operator local development setup supports creating seeds, shoots and managed-seeds now. Please see the docs for details. by @oliver-goetz [#9763]

🐛 Bug Fixes

• [OPERATOR] A bug causing the maintenance state to no get update even though maintenance succeeds has been fixed. by @acumino [#9945]

🏃 Others

• [DEPENDENCY] The envoyproxy/envoy image has been updated to v1.30.2. Release Notes by @gardener-ci-robot [#9926]
• [DEPENDENCY] The gardener/vpn2 image has been updated to 0.25.0. Release Notes by @gardener-ci-robot [#9904]
• [DEPENDENCY] The registry.k8s.io/dns/k8s-dns-node-cache image has been updated to 1.23.1. by @gardener-ci-robot [#9938]
• [DEPENDENCY] The gardener/terminal-controller-manager image has been updated to v0.33.0. Release Notes by @gardener-ci-robot [#9896]
• [DEPENDENCY] The quay.io/kiwigrid/k8s-sidecar image has been updated to 1.27.4. by @gardener-ci-robot [#9943]
• [DEPENDENCY] The quay.io/brancz/kube-rbac-proxy image has been updated to v0.18.0. by @gardener-ci-robot [#9917]
• [OPERATOR] The auto-scaling by VPA is now disabled for the conntrack-fix sidecar container of kube-proxy. The corresponding container does not need vertical auto-scaling. by @ialidzhikov [#9953]

📖 Documentation

• [OPERATOR] Clarify the importance of correctly configuring shoot service account issuer hostname if Gardener Operator is not used. by @dimityrmirchev [#9923]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.97.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.97.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.97.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.97.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.97.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.97.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.97.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.97.0

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Fix a regression where etcd alerts for the virtual Garden cluster did not work. by @vicwicker [#9974]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.96.4
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.96.4
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.96.4
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.96.4
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.96.4
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.96.4
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.96.4
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.96.4

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Fix a regression where etcd alerts for the virtual Garden cluster did not work. by @vicwicker [#9973]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.95.6
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.95.6
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.95.6
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.95.6
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.95.6
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.95.6
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.95.6
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.95.6

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Fix a regression where etcd alerts for the virtual Garden cluster did not work. by @vicwicker [#9973]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.94.5
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.94.5
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.94.5
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.94.5
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.94.5
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.94.5
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.94.5
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.94.5

[gardener/gardener]

✨ New Features

• [OPERATOR] gardenlet's Pod garbage collector (part of its shoot-care controller) now considers Pods with reason NodeAffinity, i.e., it auto-deletes such Pods. by @rfranzke [#9951]

🏃 Others

• [DEPENDENCY] The gardener/dashboard image has been updated to 1.74.2. Release Notes by @ialidzhikov [#9948]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.94.4
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.94.4
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.94.4
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.94.4
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.94.4
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.94.4
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.94.4
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.94.4

[gardener/gardener]

✨ New Features

• [OPERATOR] gardenlet's Pod garbage collector (part of its shoot-care controller) now considers Pods with reason NodeAffinity, i.e., it auto-deletes such Pods. by @rfranzke [#9950]

🏃 Others

• [DEPENDENCY] The gardener/dashboard image has been updated to 1.74.2. Release Notes by @ialidzhikov [#9947]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.95.5
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.95.5
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.95.5
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.95.5
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.95.5
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.95.5
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.95.5
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.95.5

[gardener/gardener]

✨ New Features

• [OPERATOR] gardenlet's Pod garbage collector (part of its shoot-care controller) now considers Pods with reason NodeAffinity, i.e., it auto-deletes such Pods. by @rfranzke [#9949]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.96.3
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.96.3
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.96.3
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.96.3
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.96.3
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.96.3
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.96.3
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.96.3

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] The broken prometheus-longterm ScrapeConfigs introduced with v1.95.0 have been fixed. by @bd3lage [#9918]
• [OPERATOR] gardenlet: An issue causing alerts contributed by extensions containing a multi-line expr not to be properly translated in a PrometheusRule is now fixed. by @dimitar-kostadinov [#9920]
• [USER] A bug in the Prometheus dashboard for shoots not showing metrics for most panels has been fixed. by @rfranzke [#9928]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.95.4
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.95.4
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.95.4
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.95.4
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.95.4
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.95.4
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.95.4
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.95.4

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] A race condition has been fixed which could cause unrelated Pods to claim the PersistentVolume of a Prometheus or Alertmanager deployment during migration to the management of prometheus-operator. by @rfranzke [#9841]
• [OPERATOR] A bug has been fixed which prevented Plutono dashboards contributed from extensions to appear in the UI. by @rfranzke [#9809]
• [USER] A bug has been fixed which prevented Shoot deletion in case it was still annotated with maintenance.gardener.cloud/operation. by @rfranzke [#9860]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.94.3
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.94.3
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.94.3
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.94.3
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.94.3
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.94.3
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.94.3
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.94.3

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Fix a bug that unconditionally enables the DiscoveryServerDown alert even when the Gardener Discovery Server is not enabled. by @vpnachev [#9906]
• [OPERATOR] The broken prometheus-longterm ScrapeConfigs introduced with v1.95.0 have been fixed. by @bd3lage [#9901]
• [OPERATOR] gardenlet: An issue causing alerts contributed by extensions containing a multi-line expr not to be properly translated in a PrometheusRule is now fixed. by @dimitar-kostadinov [#9909]
• [USER] A bug in the Prometheus dashboard for shoots not showing metrics for most panels has been fixed. by @rfranzke [#9927]

🏃 Others

• [DEPENDENCY] The gardener/dashboard image has been updated to 1.75.1. Release Notes by @gardener-ci-robot [#9908]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.96.2
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.96.2
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.96.2
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.96.2
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.96.2
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.96.2
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.96.2
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.96.2

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Increase VPA admission-controller rate limits to avoid endless eviction loops in case when many Pods are evicted at the same time. by @voelzmo [#9887]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.96.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.96.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.96.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.96.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.96.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.96.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.96.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.96.1

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Increase VPA admission-controller rate limits to avoid endless eviction loops in case when many Pods are evicted at the same time. by @voelzmo [#9886]
• [OPERATOR] A regression is fixed and now the shoot control plane Prometheus forwards its alerts to the seed alertmanager. by @istvanballok [#9884]
• [USER] A bug has been fixed which prevented Shoot deletion in case it was still annotated with maintenance.gardener.cloud/operation. by @rfranzke [#9859]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.95.3
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.95.3
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.95.3
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.95.3
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.95.3
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.95.3
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.95.3
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.95.3

[gardener/gardener]

⚠️ Breaking Changes

• [DEVELOPER] The pkg/utils/kubernetes.{Key,ObjectMeta{FromKey}} functions have been dropped. Use client.ObjectKey or metav1.ObjectMeta instead. by @rfranzke [#9808]
• [DEVELOPER] ControllerDeployment objects using a custom type (other than helm) are deprecated. Support for custom types will be removed when the core.gardener.cloud/v1beta1 API version is dropped. by @timebertt [#9771]
• [DEVELOPER] Packages extensions/pkg/util/{secret,index} were removed. by @dimityrmirchev [#9784]
• [DEVELOPER] The allow-shoot-networks NetworkPolicy has been dropped entirely, hence, the networking.gardener.cloud/to-shoot-networks=allowed label has no effect anymore and should be removed. by @rfranzke [#9752]
• [DEPENDENCY] With the removal of the github.com/gardener/gardener/extensions/pkg/webhook/controlplane/genericmutator.Ensurer#EnsureKubeAPIServerService func, the provider extensions using the genericmutator.Ensurer no longer need to mutate Services and should no longer mutate Services to prevent no-op webhook invocations. by @ialidzhikov [#9770]
• [DEPENDENCY] The github.com/gardener/gardener/extensions/pkg/webhook/controlplane/genericmutator.Ensurer#EnsureKubeAPIServerService func is removed. This func was used before the introduction of ManagedIstio/APIServerSNI (when the kube-apiserver Service was of type LoadBalancer) to set cloud provider specific annotations to the Service. However, after ManagedIstio/APIServerSNI are unconditionally enabled (the kube-apiserver Service is of type ClusterIP) this func is no longer used. Nowadays, istio-ingressgateway Service annotations can be provided via the Seed spec. by @ialidzhikov [#9770]

📰 Noteworthy

• [DEVELOPER] The hack/generate-controller-registration.sh script now generates a ControllerDeployment object in the core.gardener.cloud/v1 API version. by @timebertt [#9771]

✨ New Features

• [DEVELOPER] The secrets manager has new option for controlling the secret rotation. If the new generate option RenewAfterValidityPercentage(v) is set, a secret will be renewed based on whichever comes first: The percentage of validity you specify in RenewAfterValidityPercentage or 10 days before the secret's end of validity. If not specified, the default 80% is used as before. by @MartinWeindel [#9819]
• [DEVELOPER] Extensions deploying shoot cluster system components can now make use of the pkg/component/observability/monitoring/prometheus/shoot.ClusterComponentScrapeConfigSpec function in order to generate a ScrapeConfig for the shoot's Prometheus. by @rfranzke [#9737]
• [DEVELOPER] Skaffold now rebuilds components if embedded files have changed. by @maboehm [#9778]
• [OPERATOR] A new core.gardener.cloud/v1 API version is introduced which only includes the ControllerDeployment resource for now. The new version of the ControllerDeployment drops the type and providerConfig fields in favor of a well-structured section for helm-based ControllerDeployments. by @timebertt [#9771]
• [OPERATOR] Use .spec.settings.loadBalancerServices.proxyProtocol and .spec.settings.loadBalancerServices.zones[].proxyProtocol to specify whether your seed's load balancer services should terminate proxy protocol. The explicit nature of the setting allows a seamless migration while enforcing a good security posture. by @ScheererJ [#9844]
• [OPERATOR] The VPAAndHPAForAPIServer feature gate is now also implemented for the gardener-operator. When enabled, the virtual-garden-kube-apiserver and gardener-apiserver are scaled simultaneously by VPA and HPA on the same metric (CPU and memory usage). by @ialidzhikov [#9735]
• [OPERATOR] gardener-operator is now able to manage gardener-discovery-server. For details, please check the Discovery Server configuration section. by @dimityrmirchev [#9746]
• [OPERATOR] It is now possible to specify an OCI repository in ControllerDeployments describing from where the Helm chart can be pulled (instead of specifying a base64-encoded chart in the specification). by @maboehm [#9823]
• [USER] Users can now enable managed service account issuers for their shoots if the Gardener installation has this capability enabled. For details, please check the Managed Service Account Issuer documentation. by @dimityrmirchev [#9746]

🐛 Bug Fixes

• [USER] A bug has been fixed which prevented Shoot deletion in case it was still annotated with maintenance.gardener.cloud/operation. by @rfranzke [#9854]
• [USER] An issue causing the node-problem-detector to be OOMKilled is now fixed. Previously, too low memory limit was set when VPA was enabled for the Shoot. by @ialidzhikov [#9797]
• [OPERATOR] gardenlet: An issue causing Shoot deletion to fail due to "Secret etcd-backup not found" error caused by not yet created shoot namespace is now fixed. by @Kostov6 [#9871]
• [OPERATOR] A regression is fixed and now the shoot control plane Prometheus forwards its alerts to the seed alertmanager. by @istvanballok [#9876]
• [OPERATOR] gardenlet: An issue causing gardenlet to trigger unnecessary kube-apiserver rolling updates by reverting the VPN sidercar containers resource requests set by HVPA for HA Shoots is now fixed by disabling autoscaling for the VPN sidecar containers. by @ialidzhikov [#9875]
• [DEVELOPER] The {virtual|runtime}-garden Prometheus / blackbox-exporter probes in the local gardener-operator setup are fixed. by @istvanballok [#9832]

🏃 Others

• [OPERATOR] Nodes are now labeled with "worker.gardener.cloud/gardener-node-agent-secret-name", which includes the expected name of the secret used by gardener-node-agent. by @MichaelEischer [#9757]
• [OPERATOR] The Cache Prometheus scrapes the kubelet and cadvisor metrics directly, without using the proxy feature of the API server. by @istvanballok [#9716]
• [OPERATOR] The CoreDNSQueryRewriting feature gate has been promoted to beta and is turned on by default. by @ScheererJ [#9820]
• [OPERATOR] Introduce a unified single alert for all seed conditions. Previous seed alerts GardenletDown, GardenletUnknown, SeedAPIServerUnavailable, SeedControlPlaneUnhealthy and SeedSystemComponentsUnhealthy are removed. by @vicwicker [#9750]
• [OPERATOR] The resource requests of the vpn-client-{0,1} sidecar container are reduced from 100m and 100Mi to 20m and 10Mi. The resource requests of the vpn-controller-path sidecar container are reduced from 20Mi to 10Mi. by @ialidzhikov [#9875]
• [OPERATOR] Port 8132 of istio ingress gateway will respond to all ordinary http requests regardless of the target domain with a redirect (301) to the https port by @ScheererJ [#9831]
• [OPERATOR] Introduce new label shoot_dashboard_url in the alerts from the garden Prometheus by @vicwicker [#9818]
• [OPERATOR] Resource limits are removed for the observability components by @istvanballok [#9785]
• [OPERATOR] The MutableShootSpecNetworkingNodes feature gate has been promoted to beta and is turned on by default. by @ScheererJ [#9824]
• [OPERATOR] Shoot clusters with Kubernetes version >= v1.29 will use cluster-autoscaler v1.29.0. by @rishabh-11 [#9822]
• [DEPENDENCY] The registry.k8s.io/pause image has been updated to 3.10. by @gardener-ci-robot [#9837]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.96.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.96.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.96.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.96.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.96.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.96.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.96.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.96.0

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed which prevented Plutono dashboards contributed from extensions to appear in the UI. by @rfranzke [#9810]
• [OPERATOR] A race condition has been fixed which could cause unrelated Pods to claim the PersistentVolume of a Prometheus or Alertmanager deployment during migration to the management of prometheus-operator. by @rfranzke [#9840]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.95.2
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.95.2
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.95.2
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.95.2
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.95.2
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.95.2
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.95.2
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.95.2

[gardener/gardener]

🏃 Others

• [OPERATOR] gardenlet: An issue causing the blackbox-exporter Deployment to be created and to be unhealthy in the Shoot control plane for Shoots with .spec.purpose=testing is now fixed. by @ialidzhikov [#9798]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.95.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.95.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.95.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.95.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.95.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.95.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.95.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.95.1

[gardener/gardener]

🐛 Bug Fixes

• [USER] A bug has has been fixed which caused unneeded gardener-node-agent reconciliations after each Shoot reconciliation even if the underlying OperatingSystemConfig did not contain relevant changes. by @rfranzke [#9731]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.94.2
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.94.2
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.94.2
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.94.2
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.94.2
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.94.2
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.94.2
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.94.2

[gardener/gardener]

🐛 Bug Fixes

• [USER] A bug has has been fixed which caused unneeded gardener-node-agent reconciliations after each Shoot reconciliation even if the underlying OperatingSystemConfig did not contain relevant changes. by @rfranzke [#9733]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.92.3
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.92.3
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.92.3
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.92.3
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.92.3
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.92.3
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.92.3
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.92.3

[gardener/gardener]

🐛 Bug Fixes

• [USER] A bug has has been fixed which caused unneeded gardener-node-agent reconciliations after each Shoot reconciliation even if the underlying OperatingSystemConfig did not contain relevant changes. by @rfranzke [#9732]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.93.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.93.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.93.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.93.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.93.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.93.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.93.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.93.1

[gardener/gardener]

⚠️ Breaking Changes

• [OPERATOR] The .monitoring.shoot.remoteWrite.queueConfig field is no longer available in the gardenlet component configuration. If needed, you have to register a webhook for the monitoring.coreos.com/v1.Prometheus object named shoot in the shoot namespaces. The webhook can inject the needed configuration in .spec.remoteWrite[0].queueConfig. by @rfranzke [#9695]

📰 Noteworthy

• [DEVELOPER] The extensions.gardener.cloud/v1alpha1.Worker resource now has a new .spec.pools[].userDataSecretRef field which references a Secret containing the actual user data. the .spec.pools[].userData field is deprecated and will be removed in a future version. Worker extensions should fetch the user data from the secret and can use the extensions/pkg/controller/worker.FetchUserData helper function for it. by @rfranzke [#9722]
• [DEVELOPER] The legacy method for extensions to provide observability configuration for shoot clusters (via ConfigMaps labelled with extensions.gardener.cloud/configuration=monitoring) is deprecated and will be removed in a future release. Please refer to this document to get information about the new, recommended way, and start migrating to it. by @rfranzke [#9695]

✨ New Features

• [OPERATOR] Gardener can now support clusters with Kubernetes version 1.30. To allow creation/update of 1.30 clusters you will have to update the version of your provider extension(s) to a version that supports 1.30 as well. Please consult the respective releases and notes in the provider extension's repository. by @shafeeqes [#9689]
• [OPERATOR] A new feature gate named VPAAndHPAForAPIServer is introduced to gardenlet. When enabled, the Shoot Kubernetes API Server is scaled simultaneously by VPA and HPA on the same metric (CPU and memory usage). The new feature aims to replace the existing HVPA autoscaling mechanism for the Shoot Kubernetes API server. by @ialidzhikov [#9678]
• [USER] It is now possible to configure Projects with the "four-👀 approval concept for deletion" concept. For now, this can only be applied to Shoots. If configured, the user confirming a Shoot deletion (via the confirmation.gardener.cloud/deletion annotation) must not be the same user who is sending the DELETE request. This can help preventing accidental/unintentional Shoot deletion. Find all information about the feature in this document. by @rfranzke [#9680]
• [DEVELOPER] Gardener can now support clusters with Kubernetes version 1.30. Extension developers have to prepare individual extensions as well to work with 1.30. by @shafeeqes [#9689]

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed which caused regeneration of managedresource-shoot-core-system-* Secrets on each Shoot reconciliation. by @rfranzke [#9718]
• [USER] A bug has has been fixed which caused unneeded gardener-node-agent reconciliations after each Shoot reconciliation even if the underlying OperatingSystemConfig did not contain relevant changes. by @rfranzke [#9723]

🏃 Others

• [OPERATOR] e2e-kind tests can now run successfully in an IPv4-only environment by @ScheererJ [#9693]
• [OPERATOR] Validation of DNSRecords: allow domain names starting with an underscore "_" by @MartinWeindel [#9714]
• [OPERATOR] The istio ingress gateway access log now includes the connections initiated via apiserver-proxy, i.e. cluster-internal communication via kubernetes.default.svc.cluster.local. by @ScheererJ [#9686]
• [OPERATOR] Replaced HVPA for the vali StatefulSet with VPA. Additionally, the curator kube-rbac-proxy and telegraf containers of the vali StatefulSet now specify CPU resource requests of 5m each. by @plkokanov [#9611]
• [OPERATOR] Updated MCM metrics list used to configure prometheus by @rishabh-11 [#9684]
• [OPERATOR] The kube-controller-manager component is now scaled by VPA, instead of HVPA. by @andrerun [#9698]
• [OPERATOR] Modified the CPU and memory resource requests for the plutono container to 5m and 45Mi, respectively. Additionally, reduced the vali container CPU resource requests to 20m. by @plkokanov [#9754]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.95.0
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.95.0
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.95.0
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.95.0
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.95.0
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.95.0
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.95.0
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.95.0

[gardener/gardener]

🐛 Bug Fixes

• [OPERATOR] Fix an issue in the etcd component which caused Shoot deletion to fail when the VPAForETCD feature gate was enabled by @voelzmo [#9703]

Docker Images

• admission-controller: europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.94.1
• apiserver: europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver:v1.94.1
• controller-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager:v1.94.1
• gardenlet: europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet:v1.94.1
• node-agent: europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent:v1.94.1
• operator: europe-docker.pkg.dev/gardener-project/releases/gardener/operator:v1.94.1
• resource-manager: europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager:v1.94.1
• scheduler: europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler:v1.94.1