v0.87.0

Changes

Enhancement

• Add macOS development support via Lima VM with automatic cross-compilation for external x86_64
  clusters. (#1511, @emy)
• Kubernetes-nmstate can now be installed with Helm: helm install nmstate oci://quay.io/nmstate/kubernetes-nmstate -n nmstate --create-namespace. The Helm chart is the source of truth for operator deployment manifests; OLM and release-manifest installation methods are unchanged. (#1547, @Copilot)
• Replace all instances of interface{} with any alias for improved Go 1.18+ compatibility (#1510, @qinqon)

Bug or Regression

• Broaden stale count cleanup to detect all non-available enactments, not just progressing (#1542, @emy)
• Disable unused metrics server on handler, webhook, and cert-manager components to avoid exposing unnecessary HTTPS ports. (#1512, @qinqon)
• Fix OpenShift conformance failure by adding workload management annotation to console plugin deployment. (#1474, @qinqon)
• Fix arm64 handler image build failure when using nmstate-git from Copr by explicitly specifying the centos-stream-9 chroot name instead of relying on dnf auto-detection. (#1533, @qinqon)
• Fix handler crash loop when default network interface is temporarily reconfigured by eliminating API server dependency at startup for TLS configuration. (#1467, @qinqon)
• Fix handler liveness probe "short write" errors by limiting nmstatectl output to the loopback interface only (#1486, @nmstate-ai[bot])
• Fix operator reconcile failure caused by missing nmstates/finalizers
  RBAC permission after security hardening in #1520. (#1541, @mkowalski)

Uncategorized

• Add s390x support to lint and container build scripts. (#1517, @ashokpariya0)
• Add s390x architecture support to kubernetes-nmstate handler and operator container images. (#1530, @ashokpariya0)
• Bump Go to 1.26 and update dependencies to fix security vulnerabilities in golang.org/x/net and go.opentelemetry.io/otel (#1540, @mkowalski)
• Fix NMState CR becoming permanently stuck in Degraded state after transient
  errors due to SSA field manager conflicts between reconcileStatus() and
  setDegradedCondition() using inconsistent status update mechanisms. (#1552, @mkowalski)
• TLS security profile handling now strictly adheres to the cluster-wide configuration: custom profile curves (TLS key exchange groups, including post-quantum X25519MLKEM768) are honored, unknown or unhonorable profiles fail closed instead of falling back to defaults, and partially unsupported profile entries are reported through a new TLSProfileNotFullyHonored Degraded condition on the NMState CR. (#1554, @mkowalski)

Installation

With Helm

Install the operator and the handler with a single command, using
Helm (>= 3.8):

helm install nmstate oci://quay.io/nmstate/kubernetes-nmstate \
  --version 0.87.0 \
  --namespace nmstate \
  --create-namespace

This deploys the operator and, by default (nmstate.enabled=true), an
NMState custom resource that makes the operator deploy the
kubernetes-nmstate handler on all nodes.

With manifests

First, install kubernetes-nmstate operator:

kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/nmstate.io_nmstates.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/namespace.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/service_account.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/role.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/role_binding.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/operator.yaml

Once that's done, create an NMState CR, triggering deployment of
kubernetes-nmstate handler:

cat <<EOF | kubectl create -f -
apiVersion: nmstate.io/v1
kind: NMState
metadata:
  name: nmstate
EOF