Release Proposal v2.30.0

[tico88612]

Announcement

Ingress NGINX is sunset. This is the final version supporting Ingress NGINX. We'll remove ingress-nginx in future versions.
For more information, please see the Kubernetes blog.

Kubernetes Dashboard is archived. This is the final version supporting Kubernetes Dashboard. We'll remove Kubernetes Dashboard in future versions. For more information, please see the announcement.

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• Action required
  containerd_discard_unpacked_layers is now applied only for containerd < 2.1 to avoid warnings with the Transfer Service used in newer versions. (Disable discard_unpacked_layers for containerd >= 2.1 #12821, @guoard)
• Cilium k8sServiceHost and k8sServicePort are now derived from kube_apiserver_global_endpoint instead of being auto-detected, so users must ensure this endpoint is correctly set and reachable from all nodes. (fix(cilium): add dynamic api server endpoint configuration #12624, @r3m8)

Changes by Kind

API Change

• Removed deprecated runtime_engine and runtime_root keys from containerd configuration. (Remove deprecated keys from containerd config #12820, @guoard)

Feature

• Crio: add option pull_progress_timeout (crio: add option pull_progress_timeout #12555, @pedro-peter)
• Fixed kube_vip_version variable for managing kube-vip version instead of kube_vip_image_tag (kube-vip: Fix template, drop all capabilities and use kube_vip_version #12835, @ThisIsQasim)
• RockyLinux 10 support (experimental) (RockyLinux 10 support (experimental) #12355, @tico88612)
• Support kubernetes v1.34.1 ([kubernetes] Support kubernetes 1.34 #12549, @i-yasuda)
• The default Openstack security groups now allow ICMPv6 for general IPv6 functionality. (terraform openstack: allow ICMPv6 by default #12805, @rptaylor)
• Update kube-vip to v1.0.3 (Update kube-vip to v1.0.3 #12815, @LawiK974)
• Upgrade Gateway API to 1.4.0 (Feat: Gateway API auto bump #12714, @tico88612)
• Upgrade containerd/nerdctl default version to 2.2.1 (Upgrade containerd and nerdctl from 2.1.6 to 2.2.1 #12825, @guoard)
• contrib/collection.sh will create and install the source as collection. (Feature/12227 script to install the tag checked out as collection version. #12660, @bbaassssiiee)

Documentation

• Fix(cilium): prevent installation failure with unprivileged agent (docs(cilium): update documentation for unprivileged agent configuration #12628, @r3m8)
• The default namespace for MetalLB resources is now metallb-system. (add metallb_namespace default value and docs update #12860, @kittywaresz)

Bug or Regression

• Action-required
  Adding a control plane node in first place is now explicitly unsupported, the new control plane should be placed at the end of your kube_control_plane group (control-plane: fix first_kube_control_plane delegation with kube_override_hostname #12636, @clwluvw)
• Add a wait after control plane joining to prevent a kubeadm preflight error when upgrading the control plane configuration at the same time. (wait for control plane node to become ready after joining #12794, @VannTen)
• Deployments using Calico in vxlan mode without eBPF but with localhost load balancers will now work. (Set Calico CNI API server endpoint when using localhost load balancers #12598, @rickerc)
• Fix Calico apiserver RBAC permissions for Kubernetes 1.33+ (Update Calico apiserver RBAC for Kubernetes 1.33+ #12654, @rickerc)
• Fix Cilium loadBalancer.mode rendering in Kubespray values template. (Fix Cilium loadBalancer.mode rendering in Kubespray template #12701, @intojhanurag)
• Fix RBAC for calico using the etcd datastore (Add rbac for calico kube-controllers to access services #12828, @LawiK974)
• Fix automatic certs renew with systemd timer (k8s-certs-renew: fix broken script #12876, @VannTen)
• Fix broken upgrade path/control plane node rotation for cluster using calico in etcd datastore mode with separate etcd.
  etcd_cert_dir_mode is deleted (always use 0700) (Fix bad permissions for calico certificates #12908, @VannTen)
• Fix kubeadm init retry after first failure on cluster creation (Fix kubeadm init retry #12785, @VannTen)
• Fix(calico): Add missed rbac verb watch for hostendpoints (fix(calico): Add missed rbac verb watch for hostendpoints #12641, @jmeza-xyz)
• Fixed an issue in the config.json.j2 template where the CRI-O registry authentication configuration could render invalid JSON when multiple crio_registry_auth entries were defined, resulting in duplicate top-level auths keys in the generated config. (cri-o: fix duplicate top-level "auths" keys in registry config template #12845, @accuROAMC)
• Removing external etcd member (not stacked with control plane) should now work without erroring out because the node is not in the kubernetes cluster (Remove etcd member by peerURLs #12682, @VannTen)
• Update CSI components image version (Update CSI components image version #12627, @xin053)
• [feat] Setting timezone under SELinux. ([feat] Setting timezone under SELinux. #12436, @bbaassssiiee)
• apiserver_loadbalancer_domain_name default to loadbalancer_apiserver.address if defined (Use loadbalancer IP as default apiserver endpoint if no LB hostname is used #12872, @VannTen)

Other (Cleanup or Flake)

• Old versions of several components are removed (Remove checksums for old versions of various components #12735, @VannTen)
• Remove left-over 'master' tags (cleanup tags deprecated tags 'master' #12795, @VannTen)
• Use cilium native CNI chaining for portmap plugin instead of manually writing /etc/cni/net.d/000-cilium-portmap.conflist (Use cilium native CNI chaining for portmap plugin #12814, @ThisIsQasim)

Components

• kubernetes 1.34.3
• etcd 3.5.26
• docker 28.3
• containerd 2.2.1
• cri-o 1.34.4
• cni-plugins 1.8.0
• calico 3.30.6
• cilium 1.18.6
• flannel 0.27.3
• kube-ovn 1.12.21
• kube-router 2.1.1
• multus 4.2.2
• kube-vip 1.0.3
• cert-manager 1.15.3
• coredns 1.12.1
• ingress-nginx 1.13.3
• argocd 2.14.5
• helm 3.18.4
• metallb 0.13.9
• registry 2.8.1
• aws-ebs-csi-plugin 0.5.0
• azure-csi-plugin 1.10.0
• cinder-csi-plugin 1.30.0
• gcp-pd-csi-plugin 1.9.2
• local-path-provisioner 0.0.32
• local-volume-provisioner 2.5.0
• node-feature-discovery 0.16.4

[ThisIsQasim]

Would it be possible to bump the containerd version to latest before the release? That would enable subPath support for imageVolumes

[tico88612]

@ThisIsQasim #12825, but I don't think it will be merged anytime soon; I'll consider handling it in the next release.

[bbaassssiiee]

Can PR12533 please be merged and included? Then SELinux can be enforcing!

[guoard]

Could these pull requests be merged and included in the 2.30.0 release?
#12820
#12821
#12827

[tmurakam]

Shall we include #12634 for etcd 3.6?
EDIT: Let's skip this.

[sathieu]

Hello,

Is there an ETA of the release? No hurry, we just need to know. Thanks 🙏

[tico88612]

@sathieu I'm still evaluating which PRs need to be blocked. I think the latest we'll release should be by the end of January.

[VannTen]

#12872 should be a blocker IMO (#12850 is possibly the same issue)

[tico88612]

Hi @ant31 @yankay @VannTen @mzaian
The release note is ready. Do we have any blocker issues? Or otherwise give +1?

[VannTen]

LGTM

[tico88612]

I will release 2.30.0 next week.

/assign

[tico88612]

#12908 (comment)

[ThisIsQasim]

I just noticed that #12835 isn’t mentioned here. It is needed for the kube-vip 1.0.3 upgrade.