v4.11.0-next.internal.2

• : NONE (by @sowmyav27 in #7168)
• : NONE (by @roehrijn in #7210)
• bugfix: Fix node environment teardown getting stuck when the OpenTofu workspace was already deleted. (by @seanschneeweiss in #7304)
• bugfix: Fixed a race in project space import that could intermittently reject a valid import with "object owner is not allowed project member" shortly after the platform starts. (by @sowmyav27 in #7006)
• bugfix: Fixed an issue where deleting a user or team could remove the owner (and owner access) of projects and other resources owned by unrelated users or teams. (by @roehrijn in #7136)
• bugfix: Honor --dry-run=server for SharedSecret creation and for management.loft.sh status-subresource updates/patches. Previously the dry-run directive was dropped and the change was actually persisted. (by @rlmcpherson in #7060)
• bugfix: Honor --dry-run=server for create/update of OIDC clients and owned access keys, and for shared secret updates. Previously the dry-run directive was dropped and the change was actually persisted. (by @rlmcpherson in #7090)
• bugfix: Honor --dry-run=server for deletes against management.loft.sh resources (e.g. VirtualClusterInstance). Previously the dry-run directive was dropped and the backing object was actually deleted. (by @rlmcpherson in #7043)
• bugfix: Honor --dry-run=server for deletes of shared secrets, owned access keys, and OIDC clients. Previously the dry-run directive was dropped and the backing object was actually deleted. (by @rlmcpherson in #7044)
• bugfix: NONE (by @sowmyav27 in #7005)
• bugfix: Pre-release upgrade checks (Platform) now resolve the vcluster upgrade-version correctly when the platform base's DefaultVClusterVersion already equals the latest vcluster-pro GA, and no longer pick a release candidate as the upgrade target due to sort -V not honoring SemVer pre-release ordering. (by @sowmyav27 in #7192)
• bugfix: The nodes page used an incorrect icon in the table empty state (by @adiron in #6846)
• chore: Internal CI plumbing; release pipeline now notifies vcluster-docs of platform releases via repository_dispatch instead of pushing PRs directly. No user-visible change. (by @Piotr1215 in #6830)
• chore: Move snapshots to storage API to loft-sh/api. (by @mfranczy in #7017)
• deprecation: The API for moving virtual cluster instances between projects (projects.management.loft.sh/migratevirtualclusterinstance) is deprecated and will be removed in a future release. (by @seanschneeweiss in #7276)
• enhacement: OIDC token exchange endpoint can support ADFS access_token_issuer non-standard behavior when "LOFT_OIDC_TRUST_ACCESS_TOKEN_ISSUER=true" env var is set. (by @matskiv in #7299)
• enhancement: Add project quota support for Machine count (by @squ94wk in #7033)
• enhancement: Allow project users to create Machines (by @squ94wk in #6930)
• enhancement: Improve error message when VM isn't schedulable (by @squ94wk in #6965)
• enhancement: Make vMetal dhcp server chart repo and version configurable (by @squ94wk in #6841)
• enhancement: Pre-Release vCluster Checks workflow can now be triggered automatically via repository_dispatch (event type vcluster-prerelease-check) from vcluster-pro's release pipeline, and resolves platform_rc_version to the latest published platform pre-release when left empty. (by @sowmyav27 in #6934)
• enhancement: Update the default vCluster version to 0.34.2. (by @roehrijn in #7084)
• enhancement: vCluster Platform's managemet.loft.sh API now supports ValidatingAdmissionPolicy resources (by @matskiv in #7300)
• enhancement: |
  Database connector now supports server-certificate verification (sslmode=verify-full) for PostgreSQL. Set caCert (PEM bundle) in the connector secret to enable verification both for the Platform's admin connection and for tenant cluster Kine connections. Without caCert, connections now default to sslmode=require instead of being unset, closing a silent plaintext-fallback gap. (by @rlmcpherson in #6935)
• fature: Show tooltip with failed conditions in Node Provider view, and in Node Provider details view. (by @apasyniuk in #6963)
• feature: Add Provisioning Config pane with user/network data to the KubeVirt Machines (by @apasyniuk in #6960)
• feature: Add forwardTokenMode (Off/TokenReview/Passthrough) for tenant clusters. Passthrough forwards the caller's token directly to the tenant cluster's API server without a TokenReview or impersonation. The forwardToken boolean is deprecated but still honored. (by @lizardruss in #7191)
• feature: Add metrics-reader and metrics-writer access-key scope roles for the upcoming monitoring gateway. Scoped access keys now have their SelfSubjectAccessReview responses re-checked against the key's per-cluster scope, so a self review never reports more access than the key can actually exercise. Default loft-management-admin and loft-management-project-user roles now grant metricsread on clusters/virtual cluster instances. (by @johannesfrey in #7029)
• feature: Add metrics-reader and metrics-writer access-key scope roles for the upcoming monitoring gateway. Scoped access keys now have their SelfSubjectAccessReview responses re-checked against the key's per-cluster scope, so a self review never reports more access than the key can actually exercise. The default loft-management-admin role grants metricsread on clusters and virtual cluster instances; per-instance metrics reads for project members are gated through each instance's owner access. (by @johannesfrey in #7108)
• feature: Added RFC 8693 token exchange endpoint for non-interactive SSO authentication. (by @matskiv in #6759)
• feature: Added support for Kubernetes 1.36. Platform and agent k8s libraries, and the synced API types in the loft-sh/api and loft-sh/agentapi mirrors, now run on the 1.36 line. (by @pascalbreuninger in #6750)
• feature: Allow deploying KubeVirt and CDI automatically (by @squ94wk in #6953)
• feature: Allow managing the primary network & interface on KubeVirt VMs through properties (by @squ94wk in #6819)
• feature: Allow specifying network environment through vcluster.com/network-environment property. (by @squ94wk in #6827)
• feature: Allowing restricting allowed node types per project (by @squ94wk in #6811)
• feature: Support vcluster.com/os-image property for KubeVirt providers (by @squ94wk in #6739)
• feature: The vCluster Platform embedded database (kine) can now authenticate to an external PostgreSQL backend using Kerberos/GSSAPI with a mounted keytab. (by @roehrijn in #7074)
• fix: Don't block node provisioning if provider doesn't know IP (by @squ94wk in #6828)
• fix: Fix bare metal server Destroy behavior (by @squ94wk in #6915)
• fix: Handle some edge cases where infra was deleted before Machine clean up (by @squ94wk in #6961)
• fix: Improve cluster overview usage view toggle labels, prevent node claims status column clipping on resize, and fix tenant cluster API client paths to use the project-scoped virtualcluster route. (by @andyluak in #7109)
• fix: Suggest os images for the provider type if provider doesn't specify os-image-type property (by @squ94wk in #6773)
• fix: vCluster VPN coordinator now handles bursts of concurrent NetworkPeer registrations (800+ peers connecting simultaneously) without timeouts, OOM-induced restarts, or peers failing to reach the network. (by @lizardruss in #6797)
• ui: Add redirect to virtual machines list if vm is deleted on details page (by @PRTTMPRPHT in #7229)
• ui: Added "no actions" context menu for empty items in VM graph (by @PRTTMPRPHT in #7242)
• ui: Added all projects view for machines and change table layout of machines (by @PRTTMPRPHT in #6744)
• ui: Added contextual docs links to breadcrumb (by @PRTTMPRPHT in #7075)
• ui: Added deprecation warning for ingress-nginx on status page (by @PRTTMPRPHT in #7046)
• ui: Added graph view in virtual machine details (by @PRTTMPRPHT in #7196)
• ui: Added machine details view and refactor machines form (by @PRTTMPRPHT in #6740)
• ui: Added separate power status tracking for BMHs (by @PRTTMPRPHT in #7056)
• ui: Added validation against missing node pools when creating auto nodes clusters (by @PRTTMPRPHT in #7053)
• ui: Applied new header style across all main pages (by @PRTTMPRPHT in #7110)
• ui: Changed appearance of sleep duration inputs to match new style (by @PRTTMPRPHT in #6954)
• ui: Changed host cluster drilldown to match established drilldown styles (by @PRTTMPRPHT in #7225)
• ui: Changed manual import flow for external tenant clusters (by @PRTTMPRPHT in #7031)
• ui: Fix auto formatting of resource names to not strip the word "instance" away too eagerly (by @PRTTMPRPHT in #6956)
• ui: Fix overlap issues with table batch actions (by @PRTTMPRPHT in #6951)
• ui: Fixed actions availability for virtual machines (by @PRTTMPRPHT in #7234)
• ui: Fixed behavior of metal3 label selectors form elements to include matchLabels (by @PRTTMPRPHT in #6802)
• ui: Fixed capitalization of VPN table headers (by @PRTTMPRPHT in #7163)
• ui: Fixed default table filter placeholder (by @PRTTMPRPHT in #6712)
• ui: Fixed detection of error state for KubeVirt data volumes (by @PRTTMPRPHT in #7235)
• ui: Fixed hover state for user row in sidebar (by @PRTTMPRPHT in #7164)
• ui: Fixed visibility of control plane pods on virtual cluster instance status page. (by @PRTTMPRPHT in #6606)
• ui: Made change template warning only appear when the form is in dirty state (by @PRTTMPRPHT in #6817)
• ui: Made template names wrap in template marketplace (by @PRTTMPRPHT in #7159)
• ui: Removed template entry from tenant cluster header (by @PRTTMPRPHT in #7184)
• ui: Revamped tenant cluster status page (by @PRTTMPRPHT in #7040)