Skip to content

v0.27.0

Latest
Latest
Compare
Choose a tag to compare
@github-actions github-actions released this 18 Mar 12:45
· 26 commits to main since this release
v0.27.0
This tag was signed with the committer’s verified signature.
embik Marvin Beckers
GPG key ID: 8D1FDCE97DA8B385
Verified
Learn about vigilant mode.
614ecbf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes by Kind

Breaking Change

  • Release artifacts for ppc64le are no longer published (#3211, @embik)

Security

API Change

  • Expose the kcp e2e test framework through the SDK. (#3327, @sttts)
  • Updated dependencies to be in line with Kubernetes v1.31.6 (#3307, @gman0)

Feature

  • Pass through original identity of controllers accessing a logical cluster through the APIExport virtual workspace. To get the required permissions, a warrant mechanism is added through user extra fields that attaches secondary user identities purely used for authorization. (#3156, @sttts)
  • Make APIExportEndpointSlices consumer aware (#3256, @mjudeikis)
  • Add workspace phase reporter reconciler (#3183, @mjudeikis)
  • Add the Unavailable phase to the API (#3183, @mjudeikis)
  • Implement exclusion of Unavailable workspaces from serving via proxy to avoid serving something which is not supposed to be served. (#3183, @mjudeikis)
  • Add OpenAPI v3 schema support to the Virtual Workspace framework (#3246, @xmudrii)
  • Add --accept-permission-claim and --reject-permission-claim flag to kubectl kcp bind apiexport (#3334, @mjudeikis)
  • Add original user/groups information as extra to the impersonating client used by virtual workspace. (#3155, @turkenh)
  • Add support for external webhook authorization. (#3198, @xrstf)
  • Add user info support for scopes through the extra key authentication.kcp.io/scopes: cluster:<name>,... to contain a user in a certain cluster. Multiple extra values are conjunctive, i.e. their intersection is the allowed scope. (#3235, @sttts)
  • Enable structured authentication configuration from a file with —authentication-config flag. (#3295, @cnvergence)
  • Enhance local development experience for VirtualWorkspaces, adding --mappings-file option for local dev (#3199, @mjudeikis)
  • Provide --authorization-order flag that allows kcp administrator to tune the authorizer behaviour and rearrange the order. (#3281, @cnvergence)
  • Provide a feature gate GlobalServiceAccount that enables cross-workspace ServiceAccount authorization (requires --service-account-lookup=false in sharded environments). (#3328, @cnvergence)
  • Replicate APIExportEndpointSlices to cache server (#3277, @mjudeikis)

Bug or Regression

  • Fix critical race condition between APIBindings and CRDs potentially allowing the same resource to be bound by multiple bindings or CRDs, leading to data loss or inconsistent state. (#3251, @sttts)
  • Fix external modifications to annotations being reverted by admission webhook (#3229, @ntnn)
  • Add additional validation for impersonation to prevent groups and extras privileged impersonations. (#3243, @mjudeikis)
  • Fix regression in DeepCopy generator (#3188, @mjudeikis)
  • Purposefully crash if leader election was won but controllers failed to install, allowing another instance to take leadership (#3196, @embik)
  • Update kcp start options to print to stdout (#3237, @jmcshane)

Other (Cleanup or Flake)

Dependencies

Added

  • github.com/kcp-dev/embeddedetcd: v1.0.2

Changed

Removed

Contributors

xrstf, sttts, and 8 other contributors
Assets 29
Loading