Releasenotes

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project will adhere to Semantic Versioning.

We use towncrier for the generation of our release notes file.

Information about unreleased changes can be found here.

General information about release upgrades are documented at How to Upgrade to a new TAROOK release.

v11.0.1 (2025-10-21)

Bugfixes

  • A bug in the migration script has been fixed (!2175)

v11.0.0 (2025-10-17)

Breaking changes

New Features

  • Ansible hosts can now be defined and referenced via Nix. See yk8s.infra.ansible_hosts. (!1250)

  • The helm chart for etcd-backup can now be configured with arbitrary values through yk8s.k8s-service-layer.etcd-backup.helm.values. (!1569)

  • The helm chart url, name and version can now be configured for the nvidia device plugin through yk8s.nvidia.device_plugin.helm. (!1784)

  • The helm chart for the Nvidia device plugin can now be configured with arbitrary values through yk8s.nvidia.device_plugin.helm.values. (!1784)

  • The helm chart for ingress-nginx can now be configured with arbitrary values through yk8s.k8s-service-layer.ingress.helm.values. (!1810)

  • An option to disable SNAT’ing for ch-k8s-lbaas has been added: yk8s.ch-k8s-lbaas.enable_snat.

    Warning

    Be aware that disabling SNAT’ing potentially has performance implications.

    When directly coming from a previous release and you want to disable SNAT’ing right away without having done a full rollout yet, you have to adjust the gateway nodes first. In that case, rollout the necessary changes with:

    $ ./managed-k8s/actions/apply-prepare-gw.sh
$ ./managed-k8s/actions/apply-k8s-supplements.sh install-ch-k8s-lbaas.yaml

    . (!1943)

  • The functionality of yk8s.kubernetes.apiserver.audit_logs.enabled has been refined such that the settings take effect on cluster initialization already and modifications to the settings are not applied during Kubernetes upgrades only but on normal rollouts. The settings are also reflected in the kube-system/kubeadm-config ConfigMap in the cluster now which ensures freshly provisioned control-plane nodes have the setting right away. (!1956)

Changed functionality

Bugfixes

  • The type of yk8s.kubernetes.apiserver.audit_logs.policy has been changed such that individual values can be overwritten. (!1956)

  • A bug has been fixed which prevented to deploy rook-ceph in a different namespace than the default: yk8s.k8s-service-layer.rook.namespace. (!1998)

  • Ansible and Helm now don’t try to use user-wide (cache) directories anymore. (!2051)

  • Darwin as well as Linux on aarch64 are not supported by Tarook. Thus, they have been removed from the list of supported systems. (!2067)

  • Fixed the vault_v1 Ansible role to deploy the vault-backup ServiceMonitor only when monitoring is enabled via yk8s.kubernetes.monitoring.enabled. (!2069)

  • Adjust review link to new url (!2085)

  • Fixed an issue where regex validation of IP patterns did not work on macOS hosts. (!2104)

  • Deploying Vault on Kubernetes through yk8s.k8s-service-layer.vault requires cert-manager which is now documented and enforced at config evaluation. (!2114)

  • Fixed a bug which prevented etcd-backup to be deployed in a modified namespace: yk8s.k8s-service-layer.etcd-backup.helm.release_namespace. (!2122)

  • The .gitignore file of the cluster repository now includes the ‘managed by yk8s’ markers from cluster repo initialization already, not just after the first release migration. (!2131)

  • SSH host certificates are now always generated using the yaook/nodes Vault approle. Previously the orchestrator’s credentials were used when USE_VAULT_IN_DOCKER=true (see Developing with Vault) was set which prevented the use of unpriviledged Vault tokens. (!2132)

Changes in the Documentation

  • A note that nix (Nix) >= 2.9.0 is required has been added to Initialization. (!2063)

  • Documentation generation is restricted to the latest five major versions from now on. (!2102)

  • Merged the tutorials into the guides section (!2130)

Deprecations and Removals

Other Tasks

Misc