Releasenotes

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project will adhere to Semantic Versioning.

We use towncrier for the generation of our release notes file.

Information about unreleased changes can be found here.

General information about release upgrades are documented at How to Upgrade to a new TAROOK release.

v15.0.0 (2026-10-19)

Breaking Changes

  • Calico is now deployed in eBPF mode. For existing deployments running in iptables, ipvs or nftables mode, a migration is necessary. The migration is disruptive.

    Run the following to perform the migration:

    Important

    When performing a release migration (see How to Upgrade to a new TAROOK release), the Calico migration to the eBPF dataplane must be executed before running the apply-all action.

    Important

    During the migration, the default FelixConfiguration will be recreated which removes any manually added configuration. Custom configuration of the FelixConfiguration must be handled via Calico’s helm values as the tigera-operator refuses to continue managing it if it detects manual changes.

    $ MANAGED_K8S_RELEASE_THE_KRAKEN=true \
  ./managed-k8s/actions/apply-k8s-supplements.sh install-calico.yaml

    _ (!2577, !2691)

  • The option yk8s.state_directory has been removed, so the assignment must be removed from flake.nix. The migration script will try to handle that and in case of failure provide the manual migration steps. (!2582)

  • Updated default version of helm chart kube-prometheus-stack of https://github.com/prometheus-community/helm-charts from 84.5.0 to 91.9.0 (!2642, !2675)

New Features

Changed Functionality

  • The CI/CD pipeline now uses Debian 13 images for gateway nodes. (!2477)

  • Since Tarook supports Gateway API (via Envoy), cert-manager’s integration for it will be enabled alongside by default. (!2493, !2696)

  • Openstack anti affinity groups can now be configured for any node, not just workers. (!2607)

  • The Calico network MTU for OpenStack has been reduced by the VXLAN overhead to ensure NodePort traffic can be forward between nodes without packet fragmentation. (!2641)

  • Support for tlsConfig blocks in kube-prometheus-stack Helm chart >= v90.0.0 has been enabled. (!2643)

  • The sntrup761x25519-sha512 post-quantum key exchange algorithm for SSH server has been enabled. (!2650)

  • Reformatting of the containerd and nvidia-cude-driver apt-gpg-key to enable Ubuntu 26.04 LTS support. (!2657)

  • The CI/CD pipeline now uses Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS images for master and worker nodes. (!2657)

Dependencies

Bugfixes

  • The git protocol is now used for Flake inputs in order to avoid GitHub API rate limits. (!2551, !2608)

  • A bug has been fixed that caused the bootstrap role to fail if an interface contained a dot (e.g. bond1.1234) (!2554)

  • Fixed the error handling of the SSH user detection so that failure is handled gracefully.

    The error message now includes failure details. (!2568)

  • The apply-prepare-gw.sh action does not fail anymore if yk8s.wireguard.enabled is set to false. (!2569)

  • Fixed incorrect config warnings for memory request and limits. (!2571)

  • The destroy.sh action now ensures that OpenStack volumes are detached before attempting to delete them. (!2572)

  • A bug has been fixed that didn’t allow updates in the Calico settings to apply. (!2577)

  • Fixed invalid Terraform JSON syntax for OpenStack anti-affinity groups, which caused apply-terraform.sh to fail when yk8s.openstack.nodes.<name>.anti_affinity_group was set. (!2607)

  • A rollout now fails if not all calico-apiservers get ready. (!2626)

Changes in the Documentation

  • A guideline for writing comments has been added to the Coding Guide. (!2581)

  • Add an FAQ entry for fopen: Permission denied when AppArmor blocks wg-up.sh. (!2676)

Deprecations and Removals

  • Removed support for IPSec after it has been deprecated since release v10.0.0.

    Attention

    Potential action required

    In case you still have IPSec enabled (config.yk8s.ipsec.enabled = true), you need to undeploy it before upgrading to this release.

    $ edit config/default.nix  # set `config.yk8s.ipsec.enabled = false`
$ VAULT_TOKEN=${vault_root_token:?} ./managed-k8s/actions/apply-prepare-gw.sh
......
$ edit config/default.nix  # remove `config.yk8s.ipsec.*`
$

    _ (!2382)

  • The option yk8s.kubernetes.network.calico.values_file_path has been removed. Please use yk8s.kubernetes.network.calico.helm.values instead. (!2577)

Other Tasks

  • The CI now generates SBOMs containing Nix dependencies, image dependencies from containers used in the pipeline and runtime dependencies (Ansible Galaxy Collections and Helm Charts). (!2599)

  • Renovate now groups Calico packages. (!2661)

  • Renovate now groups Envoy packages. (!2661)

  • !2663, !2685

Misc