[gardener]

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed which prevented components using the networking.resources.gardener.cloud/from-world-to-ports annotation from being reached from internal IP addresses when the cluster was using Cilium as CNI. (gardener/gardener#7891, @gardener-ci-robot)

🏃 Others

• [USER] The following images are updated: (gardener/gardener#7901, @gardener-ci-robot)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.21.5 -> v1.21.6 (for Kubernetes 1.21)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.22.5 -> v1.22.6 (for Kubernetes 1.22)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.23.3 -> v1.23.4 (for Kubernetes 1.23)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.24.2 -> v1.24.3 (for Kubernetes 1.24)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.25.2 -> v1.25.3 (for Kubernetes 1.24)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.26.1 -> v1.26.2 (for Kubernetes 1.26)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.70.1
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.70.1
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.70.1
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.70.1
operator: eu.gcr.io/gardener-project/gardener/operator:v1.70.1
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.70.1
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.70.1

[gardener]

🐛 Bug Fixes

• [OPERATOR] An issue causing an UID conflict between two Grafana dashboards is now fixed by removing the unneeded "istio-workload-dashboard.json" dashboard. Moreover, the Istio Ingress Gateway has been fixed by providing a valid configuration file. (gardener/gardener#7758, @axel7born)

🏃 Others

• [OPERATOR] The nested kubelet in the Gardener e2e tests (in prow/kind) now work on hosts using cgroupsv2 (gardener/gardener#7799, @gardener-ci-robot)
• [DEVELOPER] Set cgroupDriver of provider-local to systemd. (gardener/gardener#7804, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.67.3
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.67.3
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.67.3
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.67.3
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.67.3
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.67.3
operator: eu.gcr.io/gardener-project/gardener/operator:v1.67.3

[gardener]

⚠️ Breaking Changes

• [USER] Gardener sets minDomains for shoot system components to the number of zones configured in the system component worker pool(s). (gardener/gardener#7826, @timuthy)
  • ⚠️ It is strongly recommended to place at least one worker node per availability zone for system component workers in order to ensure hitch-free rolling updates and scheduling of pods. You may need to adjust the maximum: <number-of-zones> values of your system component worker pool(s).
  • This configuration only takes effect for clusters which enabled feature gate MinDomainsInPodTopologySpread (enabled by default as of Kubernetes v1.27).
• [USER] The spec.secretBindingName, .spec.networking, .spec.networking.type, spec.maintenance.autoUpdate.machineImageVersion fields in the Shoot API are now made optional to prepare for the introduction of workerless Shoots feature. Please see https://github.com/gardener/gardener/issues/7635 for more details. (gardener/gardener#7828, @shafeeqes)
• [OPERATOR] The promoted or deprecated feature gates ManagedIstio and ReversedVPN have been removed. Remove these feature gates before updating to this version of Gardener. (gardener/gardener#7830, @rfranzke)
• [DEVELOPER] The gardener.cloud/timestamp annotation is now formatted as time.RFC3339Nano. (gardener/gardener#7796, @dimityrmirchev)

✨ New Features

• [USER] It is now possible to specify custom linux kernel settings per worker pool for Shoots via .spec.provider.workers[].sysctls, which may override Gardener default values. (gardener/gardener#7825, @ScheererJ)
• [USER] Secrets/ConfigMaps referenced in .spec.resources of Shoots are now protected with a finalizer to ensure they do not disappear from the system as long as they are still referenced somewhere. (gardener/gardener#7850, @rfranzke)
• [OPERATOR] gardener-operator now deploys Istio components into the garden runtime cluster. (gardener/gardener#7817, @timuthy)
• [OPERATOR] The highavailabilityconfig webhook configures topology spread constraints with minDomains=<number-of- zones>. This configuration only takes effect for clusters which enabled feature gate MinDomainsInPodTopologySpread (default as of Kubernetes v1.27). Please note, this configuration will require at least one worker node per registered availability zone so that Kubernetes can spread the respective seed, shoot and control-plane pods across zones. (gardener/gardener#7826, @timuthy)
• [OPERATOR] Gardener now supports seed clusters with Kubernetes versions up to v1.26. (gardener/gardener#7831, @shafeeqes)
• [OPERATOR] Annotations in seed.spec.settings.loadBalancerServices.annotations are now applied to the Nginx-Ingress load balancer service in the seed cluster. (gardener/gardener#7835, @timuthy)
• [OPERATOR] The gardener-operator does now also manage kube-state-metrics. (gardener/gardener#7836, @rfranzke)
• [DEVELOPER] The local deployment of Gardener is extended so that it is now possible to create a second single zone HA Seed. This Seed can be used to test the control plane migration scenario for HA Shoots. Additionally, make targets were added to trigger the control plane migration integration test with HA Shoots: test-e2e-local-migration-ha-single-zone to test the migration locally, and ci-e2e-kind-migration-ha-single-zone mainly intended to be used in Gardener prow jobs. (gardener/gardener#7742, @plkokanov)

🐛 Bug Fixes

• [OPERATOR] Prevent nil pointer exceptions on shoot deletion in gardenlet when seed namespace is gone. (gardener/gardener#7827, @oliver-goetz)
• [OPERATOR] gardener-apiserver: The kubelet version constraint validation is now fixed to also cover the Shoot K8s version update. Previously it was possible to update the Shoot K8s version to a new minor version when the Shoot has a worker pool with machine image version which kubeletVersionConstraint does not match the new K8s version. (gardener/gardener#7853, @ialidzhikov)

📖 Documentation

• [DEPENDENCY] The flags which went out-of-support in MCM v0.49.0 have been cleaned up from MCM deployment yaml. (gardener/gardener#7829, @himanshu-kun)

🏃 Others

• [OPERATOR] Suppress the event-logger nest filter's warnings in the fluent-bit. (gardener/gardener#7832, @vlvasilev)
• [OPERATOR] Fixed an issue that would cause the gardenlet to run into CrashLoopBackoff when following the docs/development/getting_started_locally.md#remote-local-setup guide. (gardener/gardener#7841, @plkokanov)
• [OPERATOR] When Seed's spec.settings.ownerChecks.enabled=false gardenlet is now able to delete the owner DNSRecord for a Shoot stuck in deletion where the kube-apiserver Deployment is missing but the Infrastructure is present and cannot be deleted for some reason (infrastructure dependency, invalid credentials). (gardener/gardener#7842, @ialidzhikov)
• [OPERATOR] The Istio Ingress-Gateway deployment was refined to speed up seed bootstrapping times. (gardener/gardener#7844, @timuthy)
• [OPERATOR] Change log mount path of node-problem-detector from /var/log to /var/log/journal. (gardener/gardener#7860, @AleksandarSavchev)
• [OPERATOR] Gardener now deploys the cluster-autoscaler earlier in the shoot reconciliation flow without checking if the worker pools are ready. (gardener/gardener#7774, @rishabh-11)
• [DEVELOPER] Update local-setup to [email protected]. (gardener/gardener#7831, @shafeeqes)
• [DEVELOPER] Deactivate leader election, health and readiness checks when running make *-debug. (gardener/gardener#7847, @oliver-goetz)
• [DEVELOPER] Improves testing flakiness of logging testmachinery test by making the loki init-container reliable. (gardener/gardener#7848, @nickytd)
• [DEVELOPER] Go version is updated to 1.20.4. (gardener/gardener#7862, @shafeeqes)
• [DEVELOPER] The register-kind2-env and tear-down-kind2-env will no longer try to deploy and delete the seed-local Secret. This fixes an issue where tear-down-kind2-env would hang as it deletes and then waits for the seed-local Secret to be deleted which can not happen as long as the local Seed which uses it still exists. (gardener/gardener#7742, @plkokanov)
• [DEVELOPER] Introduced a new field called machineDeploymentsLastUpdateTime in the Worker status to keep track of the time when the status of the Worker resource was last updated with the latest machine deployments. (gardener/gardener#7774, @rishabh-11)

[hvpa-controller]

✨ New Features

• [OPERATOR] HVPA supports k8s versions >= 1.25 by switching to k8s.io/autoscaling/v2 when necessary for all API calls. (gardener/hvpa-controller#121, @voelzmo)
• [OPERATOR] Added a LeaderElectionID to the controller options, allowing to run multiple instances of HVPA with leader election when --leader-elect=true is passed as commandline arg (gardener/hvpa-controller#122, @voelzmo)

🏃 Others

• [OPERATOR] Updated go to 1.19.9 (gardener/hvpa-controller#123, @voelzmo)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.70.0
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.70.0
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.70.0
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.70.0
operator: eu.gcr.io/gardener-project/gardener/operator:v1.70.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.70.0
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.70.0

[gardener]

🐛 Bug Fixes

• [OPERATOR] Prevent nil pointer exceptions on shoot deletion in gardenlet when seed namespace is gone. (gardener/gardener#7833, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.69.1
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.69.1
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.69.1
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.69.1
operator: eu.gcr.io/gardener-project/gardener/operator:v1.69.1
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.69.1
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.69.1

[gardener]

⚠️ Breaking Changes

• [OPERATOR] Seed and ManagedSeed API validation has been enhanced by the following checks: (gardener/gardener#7695, @timuthy)
  • (a) New ManagedSeeds can only use the very same zone(s) (managedSeed.spec.gardenlet.config.seedConfig.spec.provider.zones) that are available in the referenced Shoot (shoot.spec.provider.workers[].zones).
  • (b) Existing ManagedSeeds can only add additional zones that are available in the referenced shoot.
  • (c) Removing elements in seed.spec.provider.zones is denied if shoots are still scheduled to the affected seed.
  • These restrictions were removed in Gardener v1.60 to compensate a zone mismatch issue in Azure that is in the meantime fixed by the Azure provider extension v1.34.
  • ⚠️ Before upgrading to this Gardener version, please make sure to check existing ManagedSeed objects. They should configure as many as zone as there are available in the referenced shoot - see check (c).
• [OPERATOR] gardenlet now cleans up VolumeSnapshot and VolumeSnapshotContent resources from the v1 API of the snapshot.storage.k8s.io group. v1 is served starting external-snapshotter@v4. Before upgrading to this version of Gardener make sure that provider extension install at least external-snapshotter@v4 and do not install any lower version. (gardener/gardener#7759, @ialidzhikov)

✨ New Features

• [OPERATOR] Annotations in GardenletConfiguration.seedConfig.metadata.annotations are added to the Seed object during registration. If an annotation is removed from seedConfig, it is not removed from the Seed object. (gardener/gardener#7753, @timebertt)
• [OPERATOR] It is now possible to perform control plane migration for HA shoot clusters. (gardener/gardener#7626, @plkokanov)
• [DEVELOPER] Gardener's local setup now supports bootstrapping a Seed with IPv6 single-stack networking using make gardener-up IPFAMILY=ipv6. See the documentation for more detailed steps. (gardener/gardener#7561, @breuerfelix)
• [DEVELOPER] Developers can now use make gardener-debug to start a skaffold-based debugging loop which allows remote debugging of Gardener Core pods using Delve. See the documentation for more details. (gardener/gardener#7755, @oliver-goetz)
• [DEVELOPER] generate-controller-registration.sh now supports extension charts with fully-qualified image values instead of the usual image stanza with values for repository and tag. With this, skaffold can be configured (using resourceSelector) to inject a freshly-built image reference into the generated ControllerDeployment. (gardener/gardener#7757, @timebertt)

🐛 Bug Fixes

• [OPERATOR] An issue causing the garden/grafana Pod to fail to reach to the garden/loki Pod on cilium Seed clusters is now mitigated. (gardener/gardener#7766, @Kristian-ZH)
• [OPERATOR] An issue causing state-metrics-seed status to show down falsely has been fixed. (gardener/gardener#7771, @acumino)
• [OPERATOR] An issue causing the "cache" Prometheus in the (managed) seed's garden namespace to fail when scraping the node-exporter-s in the kube-system namespace has been fixed. (gardener/gardener#7772, @istvanballok)
• [OPERATOR] A bug in grafana dashboards checking kube-apiserver job for kube-controller-manager up status is now fixed. (gardener/gardener#7773, @shafeeqes)
• [OPERATOR] Fixed potential leaks of ShootStates that could happen when a Shoot cluster is deleted. This is achieved by no longer exiting early from the deletion flow if the shoot's seed Namespace has been deleted. The same logic has been applied to the migration flow for consistency. (gardener/gardener#7789, @plkokanov)
• [OPERATOR] A bug causing kube-controller-manager to fail to clean up ShootState resources is now fixed. (gardener/gardener#7793, @shafeeqes)

🏃 Others

• [OPERATOR] The .spec.settings.ownerChecks field of the Seed configuration is deprecated. The "bad-case" control plane migration is being removed in favor of the HA Shoot control planes (see https://github.com/gardener/gardener/issues/6302). The field will be locked to false in a future version of Gardener. In this way gardenlet will clean up all owner DNSRecords. Finally, the field will be removed from the API. Set this field to false to be prepared for the above-mentioned locking. (gardener/gardener#7748, @dimitar-kostadinov)
• [OPERATOR] The SeedChange and CopyEtcdBackupsDuringControlPlaneMigration feature gates have been promoted to GA and are now locked to true. (gardener/gardener#7763, @plkokanov)
• [OPERATOR] The nested kubelet in the Gardener e2e tests (in prow/kind) now work on hosts using cgroupsv2 (gardener/gardener#7780, @danielfoehrKn)
• [OPERATOR] The following images are updated: (gardener/gardener#7787, @elankath)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.21.4 -> v1.21.5 (for Kubernetes 1.21)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.22.4 -> v1.22.5 (for Kubernetes 1.22)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.23.2 -> v1.22.3 (for Kubernetes 1.23)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.24.1 -> v1.24.2 (for Kubernetes 1.24)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.25.1 -> v1.25.2 (for Kubernetes 1.25)
  • eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler: v1.26.1 (for Kubernetes 1.26)
• [DEVELOPER] The logging integration test is now switched from the loki Service to logging Service. (gardener/gardener#7778, @vlvasilev)
• [DEVELOPER] Set cgroupDriver of provider-local to systemd. (gardener/gardener#7797, @oliver-goetz)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.69.0
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.69.0
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.69.0
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.69.0
operator: eu.gcr.io/gardener-project/gardener/operator:v1.69.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.69.0
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.69.0

[gardener]

🏃 Others

• [OPERATOR] The nested kubelet in the Gardener e2e tests (in prow/kind) now work on hosts using cgroupsv2 (gardener/gardener#7798, @gardener-ci-robot)
• [DEVELOPER] Set cgroupDriver of provider-local to systemd. (gardener/gardener#7806, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.66.3
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.66.3
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.66.3
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.66.3
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.66.3
operator: eu.gcr.io/gardener-project/gardener/operator:v1.66.3
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.66.3

[gardener]

⚠️ Breaking Changes

• [OPERATOR] The gardener controlplane Helm chart does no longer contain the value global.apiserver.serviceEnabled. global.apiserver.serviceEnabled is replaced by global.apiserver.service.enabled. Before you upgrade to this version, please make sure that you adapt the corresponding value to its new equivalent. (gardener/gardener#7729, @ialidzhikov)
• [DEVELOPER] Developers should no longer introduce new container images from Docker Hub. Please configure the prow job for copying images to the gardener GCR instead. Consult the component checklist for more information. (gardener/gardener#7698, @timebertt)
• [DEPENDENCY] The extensions/pkg/webhook/certificates.AddCertificateManagementToManager function does now take a list of source webhook configs instead of a single webhook config only. (gardener/gardener#7693, @rfranzke)

✨ New Features

• [OPERATOR] The Garden API was extended with the new .spec.virtualCluster.{dns,kubernetes,networking} sections. For now, they only allow configuring the necessary information for the deployment of kube-apiserver. Since the API server is not deployed yet, any configuration does not have any effect. Still, you must make sure to already specify at least .spec.virtualCluster.kubernetes.version, .spec.virtualCluster.dns.domain, and .spec.virtualCluster.networking.services. In the upcoming releases, gardener-operator will also take over the management of the kube-apiserver deployment whilst taking the configuration into account. (gardener/gardener#7693, @rfranzke)
• [OPERATOR] The Garden resource now supports a setting for topology-aware routing. For more details, see the Topology-aware Traffic Routing documentation. (gardener/gardener#7729, @ialidzhikov)
• [OPERATOR] gardener-operator is now managing the kube-apiserver instance as part of the virtual garden cluster control plane. (gardener/gardener#7730, @rfranzke)
• [OPERATOR] Enable memory-saver mode for the VPA recommender. It stops tracking resource consumption for Containers without matching VPAs and frees up memory. (gardener/gardener#7746, @voelzmo)

🐛 Bug Fixes

• [OPERATOR] A bug causing the gardenlet to be unable to access the BackupBucket generated secret in garden namespace is now fixed. (gardener/gardener#7708, @shafeeqes)
• [OPERATOR] A bug has been fixed which prevented existing secrets from being adopted when they were named kube-apiserver-etcd-encryption-key or service-account-key. (gardener/gardener#7710, @rfranzke)
• [OPERATOR] A bug has been fixed for the Gardener Operator that occasionally caused "404 not-found" errors when garden resources where applied and the operator ran with multiple replicas. (gardener/gardener#7739, @timuthy)
• [OPERATOR] A panic causing gardenlet to fail to startup when there is already a terminating Shoot namespace in the Seed is now fixed. (gardener/gardener#7743, @ialidzhikov)
• [OPERATOR] An issue causing an UID conflict between two Grafana dashboards is now fixed by removing the unneeded "istio-workload-dashboard.json" dashboard. (gardener/gardener#7751, @axel7born)

🏃 Others

• [USER] The following image is updated: (gardener/gardener#7715, @ialidzhikov)
  • registry.k8s.io/metrics-server/metrics-server: v0.6.2 -> v0.6.3
• [OPERATOR] node-problem-detector has been upgraded to v0.8.13 (gardener/gardener#7707, @acumino)
• [OPERATOR] Gardenlet switched from a "PodExec" based approach to calling the appropriate HTTP endpoint for initiating full snapshots. This usually takes place when the ETCD encryption key was rotated or during control-plane migration. (gardener/gardener#7714, @timuthy)
• [OPERATOR] Now the fluent-bit's output plugin targets the logging service instead of the previously used loki service. (gardener/gardener#7731, @nickytd)
• [OPERATOR] Change the path of update-local-ca-certificates.sh script from /etc/ssl to /var/lib/ssl on our worker nodes. (gardener/gardener#7740, @AleksandarSavchev)
• [OPERATOR] nginx-ingress-controller-seed image is updated to v1.7.0 for 1.24.x+ seeds. (gardener/gardener#7741, @shafeeqes)
• [DEVELOPER] The server certificate of the kube-apiserver deployment now contains the <service-name>.<namespace>.svc.cluster.local SAN. (gardener/gardener#7735, @rfranzke)
• [DEVELOPER] Update local-setup to [email protected]. (gardener/gardener#7737, @oliver-goetz)
• [DEVELOPER] Go version is updated to 1.20.3. (gardener/gardener#7752, @oliver-goetz)
• [DEVELOPER] The controllermanager and gardenlet controller reconciliations are now limited to a 1m timeout. Additionally, there is a 1m limit on predicate functions that use contexts. (gardener/gardener#7147, @plkokanov)

[etcd-backup-restore]

🐛 Bug Fixes

• [OPERATOR] Fixes a bug in snapshotter loop when backup-restore fails to collect events or fails to apply watch if required etcd revision has been compacted. (gardener/etcd-backup-restore#600, @ishan16696)

🏃 Others

• [USER] Introduce CLI flag --restoration-temp-snapshots-dir to configure directory used for temporarily persisting delta snapshots during restoration. (gardener/etcd-backup-restore#609, @shreyas-s-rao)
• [USER] Fix behavior of --data-dir for etcdbrctl compact command to be consistent with the flag's usage in other etcdbrctl commands. (gardener/etcd-backup-restore#609, @shreyas-s-rao)
• [OPERATOR] Enhances the scale-up detection conditions to avoid potential failure while from migrating single node etcd to multi-node etcd cluster. (gardener/etcd-backup-restore#608, @ishan16696)
• [OPERATOR] Optimize disk usage during restoration of delta snapshots, and remove scope for errors in the process. (gardener/etcd-backup-restore#609, @shreyas-s-rao)
• [OPERATOR] Allow for flexible build opts for other CI tools. (gardener/etcd-backup-restore#610, @shreyas-s-rao)
• [OPERATOR] Etcd snapshots are copied in parallel instead of sequentially (10 in parallel by default, configurable via --max-parallel-copy-operations). (gardener/etcd-backup-restore#591, @timebertt)
• [OPERATOR] Restrict the file permissions of safe_guard file from 644 to 600. (gardener/etcd-backup-restore#607, @AleksandarSavchev)

[etcd-custom-image]

🏃 Others

• [OPERATOR] Base alpine image upgraded from 3.15.6 to 3.15.7 (gardener/etcd-custom-image#31, @aaronfern)

[etcd-druid]

⚠️ Breaking Changes

• [USER] The default value for druid CLI flag ignore-operation-annotation is now set to false. This means druid will now respect the gardener.cloud/operation annotation for reconciling the Etcd resource by default. This change allows for developers to follow best practices during local development and testing. (gardener/etcd-druid#506, @shreyas-s-rao)

✨ New Features

• [DEVELOPER] Introduce integration tests for testing the functionalities of each controller, which can be run using make test-integration. (gardener/etcd-druid#506, @shreyas-s-rao)
• [DEVELOPER] Eliminated ServiceAccount helm charts and converted into Golang component with added unit tests. (gardener/etcd-druid#535, @seshachalam-yv)

🐛 Bug Fixes

• [OPERATOR] Squash multiple bugs in controllers as part of the refactoring process. (gardener/etcd-druid#506, @shreyas-s-rao)
• [DEVELOPER] ETCD Statefulset and Services only use instance:<ETCD Name> as selector field. (gardener/etcd-druid#521, @abdasgupta)

🏃 Others

• [OPERATOR] A bug that caused control plane migrations to fail for shoots with numeric names and a leading 0 has been fixed by eliminating the EtcdCopyBackupsTask helm chart. (gardener/etcd-druid#553, @seshachalam-yv)
• [OPERATOR] etcd-custom-image updated from v3.4.13-bootstrap-8 to v3.4.13-bootstrap-9 (gardener/etcd-druid#555, @aaronfern)
• [OPERATOR] Adapt etcdbrctl dir path flags data-dir and restoration-temp-snapshots-dir based on etcd-backup-restore#609. (gardener/etcd-druid#570, @shreyas-s-rao)
• [OPERATOR] Upgraded golang version to 1.20 (gardener/etcd-druid#542, @unmarshall)
  • Upgraded dependencies including upstream gardener/gardener dependency to 1.65.0
  • Upgrades client-go to v0.26.1
  • Upgrades controller-runtime to 0.14.4
• [DEVELOPER] Remove helm charts for EtcdCopyBackupsTask controller in favour of go code (gardener/etcd-druid#553, @seshachalam-yv)
• [DEVELOPER] Refactor etcd-druid code: refactor CLI flags, restructure controllers, add controller configs, add controller-specific unit tests, restructure existing controller tests into controller-specific integration tests. This makes etcd-druid easier to maintain and contribute to. (gardener/etcd-druid#506, @shreyas-s-rao)
• [DEPENDENCY] Update HVPA dependency to github.com/gardener/hvpa-controller/api:v0.5.0. (gardener/etcd-druid#522, @Kostov6)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.68.0
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.68.0
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.68.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.68.0
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.68.0
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.68.0
operator: eu.gcr.io/gardener-project/gardener/operator:v1.68.0

[gardener]

🐛 Bug Fixes

• [OPERATOR] A panic causing gardenlet to fail to startup when there is already a terminating Shoot namespace in the Seed is now fixed. (gardener/gardener#7744, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.67.2
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.67.2
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.67.2
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.67.2
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.67.2
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.67.2
operator: eu.gcr.io/gardener-project/gardener/operator:v1.67.2

[gardener]

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed which prevented existing secrets from being adopted when they were named kube-apiserver-etcd-encryption-key or service-account-key. (gardener/gardener#7716, @gardener-ci-robot)
• [OPERATOR] A bug causing the gardenlet to be unable to access the BackupBucket generated secret in garden namespace is now fixed. (gardener/gardener#7725, @gardener-ci-robot)
• [DEVELOPER] A bug in managedresources.NewRegistry that was leading to excessive memory usage when this function is called multiple times has been fixed. (gardener/gardener#7700, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.66.2
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.66.2
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.66.2
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.66.2
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.66.2
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.66.2
operator: eu.gcr.io/gardener-project/gardener/operator:v1.66.2

[gardener]

🐛 Bug Fixes

• [OPERATOR] A bug causing the gardenlet to be unable to access the BackupBucket generated secret in garden namespace is now fixed. (gardener/gardener#7726, @gardener-ci-robot)
• [OPERATOR] A bug has been fixed which prevented existing secrets from being adopted when they were named kube-apiserver-etcd-encryption-key or service-account-key. (gardener/gardener#7719, @gardener-ci-robot)
• [DEVELOPER] A bug in managedresources.NewRegistry that was leading to excessive memory usage when this function is called multiple times has been fixed. (gardener/gardener#7701, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.65.4
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.65.4
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.65.4
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.65.4
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.65.4
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.65.4
operator: eu.gcr.io/gardener-project/gardener/operator:v1.65.4

[gardener]

🐛 Bug Fixes

• [OPERATOR] A bug causing the gardenlet to be unable to access the BackupBucket generated secret in garden namespace is now fixed. (gardener/gardener#7728, @gardener-ci-robot)
• [OPERATOR] A bug has been fixed which prevented existing secrets from being adopted when they were named kube-apiserver-etcd-encryption-key or service-account-key. (gardener/gardener#7717, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.67.1
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.67.1
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.67.1
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.67.1
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.67.1
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.67.1
operator: eu.gcr.io/gardener-project/gardener/operator:v1.67.1

[gardener]

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed which prevented existing secrets from being adopted when they were named kube-apiserver-etcd-encryption-key or service-account-key. (gardener/gardener#7718, @gardener-ci-robot)
• [OPERATOR] A bug causing the gardenlet to be unable to access the BackupBucket generated secret in garden namespace is now fixed. (gardener/gardener#7727, @gardener-ci-robot)
• [DEVELOPER] A bug in managedresources.NewRegistry that was leading to excessive memory usage when this function is called multiple times has been fixed. (gardener/gardener#7699, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.64.4
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.64.4
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.64.4
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.64.4
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.64.4
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.64.4
operator: eu.gcr.io/gardener-project/gardener/operator:v1.64.4

[gardener]

⚠️ Breaking Changes

• [OPERATOR] The deprecated fields seed.spec.dns.ingressDomain, seed.spec.dns.provider.domains, seed.spec.dns.provider.zones has been removed from the Seed API. Please check your Seed manifests and remove any usage before upgrading to this Gardener version. (gardener/gardener#7602, @shafeeqes)
• [DEPENDENCY] The deprecated {Deploy,Cleanup}MachineDependencies methods have been dropped from the WorkerDelegate interface. Similar, the deprecated WorkerCredentialsDelegate interface has been dropped. (gardener/gardener#7600, @rfranzke)
• [DEPENDENCY] Deprecated functions DeprecatedDetermineError, DeprecatedDetermineErrorCodes, and DeprecatedNewWrappedLastErrors have been dropped . (gardener/gardener#7641, @acumino)
• [OPERATOR] (gardener/gardener#6693, @himanshu-kun)
  • spec.settings.dependencyWatchdog.endpoint in the Seed API has been deprecated and will go out of support in future releases. Use spec.settings.dependencyWatchdog.weeder instead.
  • spec.settings.dependencyWatchdog.probe in the Seed API has been deprecated and will go out of support in future releases. Use spec.settings.dependencyWatchdog.prober instead.

✨ New Features

• [USER] Gardener considers the readiness of CSI Drivers on the node before scheduling user workload. Please refer to the documentation for more details. (gardener/gardener#7621, @SimonKienzler)
• [OPERATOR] Shoot clusters using provider-local can now have multiple worker nodes with calico as CNI. (gardener/gardener#7684, @ScheererJ)
• [OPERATOR] gardenlet's cache support has been enhanced to virtually all object kinds it requires from the Gardener API server. Earlier, objects like ShootStates, Projects, SecretBindings, ControllerDeployments, etc. couldn't be cached for security reasons. Especially in large landscapes, this enhancement will lead to less load on the Gardener API server besides reducing the overall network traffic. (gardener/gardener#7632, @timuthy)
• [DEVELOPER] Extensions should label csi-driver-node pods that they manage with node.gardener.cloud/wait-for-csi-node-<suffix>=<driver-name> to ensure user workload is only scheduled to nodes once the driver is properly registered. Please refer to the documentation for more details. (gardener/gardener#7621, @SimonKienzler)
• [DEVELOPER] The Helm chart values provided when extension controllers are deployed are now including the new value gardener.seed.name. (gardener/gardener#7624, @MartinWeindel)
• [DEVELOPER] Developers can now use make gardener-dev to start a skaffold-based dev loop which can trigger new builds and deployments when changing source files. See the documentation for more details. (gardener/gardener#7659, @timebertt)
• [DEVELOPER] The local deployment of Gardener with extensions can now deal with multiple seeds. Additional seeds can be added and removed again. (gardener/gardener#7673, @MartinWeindel)

🐛 Bug Fixes

• [USER] A bug has been fixed that caused Grafana dashboard panels related to kubernetes API server monitoring to show no data. (gardener/gardener#7639, @rickardsjp)
• [OPERATOR] An issue has been fixed which caused undesired PATCH requests when updating the state in the Worker or ShootState resources. (gardener/gardener#7637, @rfranzke)
• [OPERATOR] A bug causing Shoot deletion to fail if the gardener-apiserver is upgraded during deletion is now fixed. (gardener/gardener#7656, @shafeeqes)
• [DEVELOPER] A bug in managedresources.NewRegistry that was leading to excessive memory usage when this function is called multiple times has been fixed. (gardener/gardener#7694, @vpnachev)
• [DEPENDENCY] Extensions can now define conditions to clean them from extensions status in the health check controller. (gardener/gardener#7660, @acumino)

📖 Documentation

• [USER] Added document in which we share our HA best practices with end users to help them make their software highly available. (gardener/gardener#7556, @vlerenc)

🏃 Others

• [OPERATOR] Switched images from DockerHub to copies in Gardener GCR (gardener/gardener#7686, @robinschneider)
• [OPERATOR] Update Istio to v1.17.1 (gardener/gardener#7631, @axel7born)
• [OPERATOR] Minimal Loki init container with tunef2s now enables the large_dir filesystem feature on Loki PV. (gardener/gardener#7650, @vlvasilev)
• [OPERATOR] Update node local dns to version 1.22.20. (gardener/gardener#7663, @DockToFuture)
• [DEVELOPER] The Shoot creation test does no longer hard-code the spec.kubernetes.enableStaticTokenKubeconfig field to true. The field will be now defaulted by gardener-apiserver: for Shoots with K8s < 1.26, it is set to true; for Shoots with K8s >= 1.26, it is set to false. (gardener/gardener#7609, @ialidzhikov)
• [DEVELOPER] The following dependencies are updated: (gardener/gardener#7612, @shafeeqes)
  • k8s.io/* : v0.26.1 -> v0.26.2
  • sigs.k8s.io/controller-runtime: v0.14.4 -> v0.14.5
• [DEPENDENCY] The following dependency has been updated:(gardener/gardener#6693, @himanshu-kun)
  • github.com/gardener/dependency-watchdog: v0.7.0 -> v1.0.0

[dependency-watchdog]

⚠️ Breaking Changes

• [OPERATOR] Introduces backward incompatible changes to the API/Config. Consumers should adapt to the new changes. (gardener/dependency-watchdog#67, @unmarshall) Please refer the docs for details.
• [OPERATOR] Command name for dependency-watchdog has been changed to weeder and probe has been changed to prober. Command line options have also changed. Please refer the docs for details.(github.com/gardener/dependency-watchdog#67,@unmarshall)

✨ New Features

• [OPERATOR] In prober, support for multiple replicas for the dependent resources has been added. Previously this was hard coded to 1 making it difficult for dependency-watchdog to operate on resource which have a HA setup. Dependency-Watchdog will not interfere with HPA or any other entity which has been setup to scale out/in resources in a k8s cluster.(github.com/gardener/dependency-watchdog#67,@unmarshall)
• [OPERATOR] [Gardener]: It has been ensured that during hibernation (either when hibernating or waking up from hibernation) and during control-plane-migration, dependency-watchdog acts responsibly and prevents scale out/in operations which could interfere with these operations.(github.com/gardener/dependency-watchdog#67,@unmarshall)
• [DEVELOPER] This new version now uses controller-runtime. Usage of client-go is limited to:(github.com/gardener/dependency-watchdog#67,@unmarshall)
  • Create a watch
  • Create a discovery client
  • Use scale sub-resource
    The above are currently not supported by the controller-runtime.
• [USER] Previously prober only supported Deployment resources. This version onwards any k8s resource that has a scale sub-resource is supported.(github.com/gardener/dependency-watchdog#67,@unmarshall)

🏃 Others

• [DEVELOPER] Added envtest and KIND based tests for prober and weeder.(github.com/gardener/dependency-watchdog#67,@unmarshall)
• [DEVELOPER] Extensive documentation added for concepts, usage and contributions.(github.com/gardener/dependency-watchdog#67,@unmarshall)
• [OPERATOR] Build and tests are now run using prow.(github.com/gardener/dependency-watchdog#67,@unmarshall)
• [OPERATOR] Gardener version used has been bumped to v1.59.0 .(github.com/gardener/dependency-watchdog#67,@unmarshall)
• [OPERATOR] fixed RetryUntilPredicate tests. (gardener/dependency-watchdog#73, @rishabh-11)
• [OPERATOR] updated golang version to v1.19.4. (gardener/dependency-watchdog#73, @rishabh-11)
• [DEVELOPER] Many makefile targets have been added including format, check-vulnerabilites etc (gardener/dependency-watchdog#65, @himanshu-kun)

[hvpa-controller]

🏃 Others

• [OPERATOR] Bumped go to 1.19.7 (gardener/hvpa-controller#120, @voelzmo)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.67.0
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.67.0
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.67.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.67.0
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.67.0
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.67.0
operator: eu.gcr.io/gardener-project/gardener/operator:v1.67.0

[gardener]

🐛 Bug Fixes

• [OPERATOR] A bug causing Shoot deletion to fail if the gardener-apiserver is upgraded during deletion is now fixed. (gardener/gardener#7661, @gardener-ci-robot)
• [DEPENDENCY] Extensions can now define conditions to clean them from extensions status in the health check controller. (gardener/gardener#7676, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.66.1
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.66.1
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.66.1
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.66.1
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.66.1
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.66.1
operator: eu.gcr.io/gardener-project/gardener/operator:v1.66.1

[gardener]

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.64.3
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.64.3
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.64.3
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.64.3
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.64.3
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.64.3
operator: eu.gcr.io/gardener-project/gardener/operator:v1.64.3

[gardener]

🐛 Bug Fixes

• [DEPENDENCY] Extensions can now define conditions to clean them from extensions status in the health check controller. (gardener/gardener#7677, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.65.3
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.65.3
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.65.3
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.65.3
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.65.3
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.65.3
operator: eu.gcr.io/gardener-project/gardener/operator:v1.65.3

[gardener]

⚠️ Breaking Changes

• [OPERATOR] All the functionality related to the deprecated field spec.dns.ingressDomain in the Seed has been removed. Subsequently, .spec.dns.ingressDomain will be dropped from the Seed API in a later release of Gardener. Before upgrading to this Gardener version, make sure to switch all seeds to .spec.ingress and .spec.dns.provider. Please find more details here, https://github.com/gardener/gardener/blob/master/docs/deployment/deploy_gardenlet_manually.md#kubernetes-cluster-that-should-be-registered-as-a-seed-cluster (gardener/gardener#7529, @shafeeqes)
• [OPERATOR] The fields .spec.dns.provider.domains and .spec.dns.provider.zones in the Seed are deprecated, and all the functionality related to the deprecated fields has been removed. Subsequently these fields will be dropped from the Seed API in a later release of Gardener. Before upgrading to this Gardener version, make sure to switch all seeds not to use these fields. (gardener/gardener#7529, @shafeeqes)
• [OPERATOR] The ForceRestore feature gate has been removed. (gardener/gardener#7543, @plkokanov)
• [OPERATOR] The Gardener API server now has the following validation enforced for ManagedSeeds: (gardener/gardener#7546, @ialidzhikov)
  • It is now forbidden to set the Seed secretRef when the Shoot static token kubeconfig is disabled. (ManagedSeed admission plugin)
  • It is now forbidden to disable the Shoot static token kubeconfig when the Seed secretRef is set. (ShootManagedSeed admission plugin)

✨ New Features

• [OPERATOR] A new feature for toplogy-aware routing is introduced. The feature enables topology-aware traffic routing in the seed clusters using the Kubernetes feature TopologyAwareHints. For more details, see the Topology-aware Traffic Routing documentation. (gardener/gardener#7191, @ialidzhikov)
• [OPERATOR] A new feature gate (alpha) FullNetworkPoliciesInRuntimeCluster was introduced. If enabled, it adds NetworkPolicys to namespaces running extensions. Only enable this when all extensions registered in your system support it. (gardener/gardener#7589, @rfranzke)

🐛 Bug Fixes

• [USER] Updates to the AuditPolicy referenced by Shoots are now also validated against the Kubernetes versions of those shoot clusters. This fixes an issue where it was possible to specify an unsupported audit.k8s.io version when updating the ConfigMap which contains the AuditPolicy. (gardener/gardener#7563, @plkokanov)
• [OPERATOR] A bug has been fixed which prevented blackbox-exporter to scrape the kube-apiservers of shoot clusters via the istio-ingressgateway. As a result, its "external probe" was always failing. (gardener/gardener#7603, @rfranzke)
• [USER] Fixes control-plane migration of hibernated shoot being stuck if shoot was hibernated for 24h (gardener/gardener#7608, @Kumm-Kai)

📖 Documentation

• [USER] Add additional information about custom server config to custom-dns-config docs. (gardener/gardener#7559, @axel7born)
• [USER] Adding documentation on the webhook remediator and how users can to fix it (gardener/gardener#7535, @etiennnr)

🏃 Others

• [USER] The .spec.kubernetes.kubeAPIServer.enableBasicAuthentication field is now no-op - the gardener-apiserver no longer defaults this field and no longer validates it. The field will be set always to nil on CREATE/UPDATE request. (gardener/gardener#7534, @ialidzhikov)
  • End users specifying this field should no longer specify it. The field will be removed in a future version of Gardener.
• [OPERATOR] The following dependency is updated: (gardener/gardener#7553, @acumino)
  • go.uber.org/automaxprocs: v1.4.0 -> v1.5.1
  • golang.org/x/crypto: v0.1.0 -> v0.6.0
  • golang.org/x/tools: v0.4.0 -> v0.6.0
  • gonum.org/v1/gonum: v0.11.0 -> v0.12.0
  • github.com/onsi/ginkgo/v2: v2.6.1 -> v2.8.3
  • github.com/onsi/gomega: v1.24.2 -> v1.27.1
• [OPERATOR] Removed minAllowed.cpu from all VPA objects (gardener/gardener#7572, @voelzmo)
• [OPERATOR] This PR adds required labels for exposureclass handler in vpn-seed-server service so that NetworkPolicy controller can create required network policies for allowing ingress traffice to vpn-seed-server pods. (gardener/gardener#7587, @acumino)
• [OPERATOR] The BackupEntry and Shoot "Migration" reconcilers were removed, as part of the removal of the control plane migration "bad case" scenario. (gardener/gardener#7543, @plkokanov)
• [OPERATOR] The ManagedSeed controller does no longer tries to sync the Seed kubeconfig Secret when Shoot's static token kubeconfig is not enabled. (gardener/gardener#7546, @ialidzhikov)
• [DEVELOPER] Network policies for Istio-System and Istio-Ingress have been adapted and now make use of GRM's NetworkPolicy Controller. (gardener/gardener#7570, @timuthy)
• [DEVELOPER] Update to Go 1.20.2. (gardener/gardener#7616, @oliver-goetz)

[etcd-backup-restore]

🐛 Bug Fixes

• [OPERATOR] Fixes a bug in snapshotter loop when backup-restore fails to collect events or fails to apply watch if required etcd revision has been compacted. (gardener/etcd-backup-restore#602, @ishan16696)

[hvpa-controller]

🏃 Others

• [OPERATOR] Bumped golang.org/x/text from 0.3.7 to 0.3.8 (gardener/hvpa-controller#116, @dependabot[bot])
• [OPERATOR] Bumped golang.org/x/net from 0.0.0-20220722155237-a158d28d115b to 0.7.0 (gardener/hvpa-controller#118, @dependabot[bot])

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.66.0
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.66.0
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.66.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.66.0
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.66.0
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.66.0
operator: eu.gcr.io/gardener-project/gardener/operator:v1.66.0

[gardener]

🐛 Bug Fixes

• [OPERATOR] A bug has been fixed which prevented blackbox-exporter to scrape the kube-apiservers of shoot clusters via the istio-ingressgateway. As a result, its "external probe" was always failing. (gardener/gardener#7604, @rfranzke)
• [OPERATOR] Fixes a bug in snapshotter loop when backup-restore fails to collect events or fails to apply watch if required etcd revision has been compacted. (https://github.com/gardener/etcd-backup-restore/pull/602, @ishan16696)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.65.2
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.65.2
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.65.2
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.65.2
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.65.2
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.65.2
operator: eu.gcr.io/gardener-project/gardener/operator:v1.65.2

[gardener]

🏃 Others

• [OPERATOR] This PR adds required labels for exposureclass handler in vpn-seed-server service so that NetworkPolicy controller can create required network policies for allowing ingress traffice to vpn-seed-server pods. (gardener/gardener#7588, @gardener-ci-robot)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.65.1
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.65.1
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.65.1
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.65.1
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.65.1
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.65.1
operator: eu.gcr.io/gardener-project/gardener/operator:v1.65.1

[gardener]

🐛 Bug Fixes

• [OPERATOR] An issue has been fixed that caused hibernated shoots with HA control-planes being stuck in deletion. (gardener/gardener#7560, @timuthy)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.64.2
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.64.2
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.64.2
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.64.2
resource-manager: eu.gcr.io/gardener-project/gardener/resource-manager:v1.64.2
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.64.2
operator: eu.gcr.io/gardener-project/gardener/operator:v1.64.2