v0.86.0

Changes

Enhancement

• Kube-rbac-proxy is not used any more.
• If TLS profile is available on the platform (now only implemented for OpenShift), it will be used for webhook and metrics server. Configuration will be dynamically updated when the profile changes. (#1453, @mkowalski)
• New metrics kubernetes_nmstate_network_interfaces and kubernetes_nmstate_routes are introduced to track number of network interfaces and number of routes configured per node. (#1414, @mkowalski)
• New metrics, kubernetes_nmstate_policies_status and kubernetes_nmstate_enactments_status, are now available to control the status of applied NNCPs and their corresponding NNCEs. (#1458, @mkowalski)
• Remove networkmanager-go dependency (#1406, @qinqon)
• Remove nodeAffinity for node-role.kubernetes.io/master (only used in Kubernetes < 1.24) (#1422, @koendelaat)
• Replace NNCP validating webhooks with CRD-level CEL and ValidatingAdmissionPolicy for always-on, in-API-server validation (#1437, @qinqon)
• terminationMessagePolicy is now set to FallbackToLogsOnError for all the pods. (#1405, @mkowalski)

Bug or Regression

• Fix applied features gauge double-counting by using absolute Set/Delete instead of incremental Inc/Dec (#1439, @qinqon)
• Fix console plugin pod using the default service account, which violated OpenShift's no-default-service-account policy. (#1451, @qinqon)
• NNCP will not be in a reconcile deadlock after an unexpected cluster/handler restart. (#1427, @emy)
• Prevent apply exhausted or deleted policies on spurious reconcile (#1440, @qinqon)
• Reset NNCE conditions on policy generation change (#1442, @qinqon)
• The Pending() and NotPending() methods were incorrectly using progressing() instead of pending(), returning wrong counts. (#1430, @qinqon)
• Use NNCE pending to calculate NNCP Status (#1431, @qinqon)
• When deployed on OpenShift clusters, namespace is now annotated with openshift.io/node-selector: "". Thanks to this, deployments using custom scheduler do not need any manual action to run correctly. (#1409, @mkowalski)
• openshift.io/node-selector was mistakenly added as a label and not as an annotation to the namespace. It is now fixed (#1425, @mkowalski)

Uncategorized

• Clean up licensing of this project. The top level readme wrongly states this was a GLP-2.0 project whereas every file containing source code had Apache-2.0 header. We now make sure everything is aligned to Apache-2.0. (#1408, @mkowalski)
• Fix ValidatingAdmissionPolicy CEL expression crash when NNCP condition has no reason field, which blocked policy updates and caused intermittent CI timeouts. (#1462, @qinqon)
• Migrate documentation site from Jekyll (Ruby) to Hugo (Go) with Docsy theme (#1445, @qinqon)
• NodeNetworkState does not contain preferred-life-time and valid-life-time any more. Instead, dynamic: true is added. This is at status.currentState.interfaces[].ipv4.address (and respectively for IPv6). (#1413, @mkowalski)
• We now use golang 1.25 and controller-runtime v0.23.2 (#1452, @mkowalski)

Installation

First, install kubernetes-nmstate operator:

kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/nmstate.io_nmstates.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/namespace.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/service_account.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/role.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/role_binding.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/operator.yaml

Once that's done, create an NMState CR, triggering deployment of
kubernetes-nmstate handler:

cat <<EOF | kubectl create -f -
apiVersion: nmstate.io/v1
kind: NMState
metadata:
  name: nmstate
EOF