SD Immutable Installer v1.36.5

SD Immutable Installer v1.36.5

Welcome to the release of version 1.36.5 of the Immutable installer for the SIGHUP Distribution maintained by SIGHUP by ReeVo team.

This release adds support for Kubernetes 1.36.5 and 1.35.9. Both versions use Flatcar 4757.2.1 and a new set of packages. Kubernetes 1.35.5 and 1.34.8 keep the packages of the previous release.

Package Versions 🚢

Kubernetes v1.36.5

Package	Supported Version
flatcar	4757.2.1 (Linux kernel 6.12.111)
etcd	3.6.15
haproxy	3.2.23
containerd	2.3.7
keepalived	2.4.3

Kubernetes v1.35.9

Package	Supported Version
flatcar	4757.2.1 (Linux kernel 6.12.111)
etcd	3.6.15
haproxy	3.2.23
containerd	2.3.7
keepalived	2.4.3

Kubernetes v1.35.5

Package	Supported Version
flatcar	4593.2.3 (Linux kernel 6.12.93)
etcd	3.6.6
haproxy	3.2.9
containerd	2.3.2
keepalived	2.3.4

Kubernetes v1.34.8

Package	Supported Version
flatcar	4593.2.1 (Linux kernel 6.12.87)
etcd	3.6.6
haproxy	3.2.9
containerd	2.3.1
keepalived	2.3.4

Breaking Changes 💔

None

Bug Fixes 🐛

• [#24] kube-control-plane: the installer now creates users that have a space in the name. Before this release, the command that writes the kubeconfig file failed for these users.

New features 🌟

• [#29] Kubernetes 1.36.5 and 1.35.9 are now available. Both run on Flatcar 4757.2.1 (Linux kernel 6.12.111), with containerd 2.3.7, etcd 3.6.15, keepalived 2.4.3, and HAProxy 3.2.23.
• [#31] Add oidc_extra_audiences to kube-control-plane to support multiple OIDC audiences via AuthenticationConfiguration.
• [#26] [#35] The installer now upgrades Kubernetes and the Flatcar OS of the nodes of an Immutable cluster, one node at a time. On each node, the upgrade stages the exact Flatcar version of immutable.yaml and the new system extensions (keepalived included), then drains, reboots and uncordons the node. The os-upgrade role downloads the update payload from update.release.sighup-prod.sighup.io, compares its SHA-256 checksum with immutable.yaml, and stages it with flatcar-update. The role contacts no update server. Because the OS stage completes before the drain, a missing payload, a bad checksum or a bad signature stops the upgrade while the node still runs its pods.
• [#32] [#37] The upgrade needs 2 GiB of free space on / of each node, because the role downloads the update payload (400 to 550 MB) to /var/tmp. If the free space is less, the preflight stops the upgrade before the drain. The downloads of the system extensions and of the update payload use the proxy of spec.infrastructure.proxy, and so does the reachability check of the preflight. If a download fails with a connection error or a timeout, the upgrade tries it again 5 times, with 10 seconds between the attempts. If the checksum of a download does not match, the download fails at once.
• [#35] The upgrade unmasks update-engine on each node that it stages, as the Flatcar documentation recommends. It also writes SERVER=disabled to /etc/flatcar/update.conf. Thus every update check fails, and the node gets no automatic OS update.
• [#38] After the uncordon of a node, the upgrade waits until the pods of the node are Ready. If a pod is not Ready when the wait times out, the upgrade stops. --force pods-running-check skips this wait.