|
| 1 | +<!-- |
| 2 | +https://github.com/cozystack/cozystack/releases/tag/v1.7.0 |
| 3 | +--> |
| 4 | + |
| 5 | +# Cozystack v1.7.0 |
| 6 | + |
| 7 | +Cozystack v1.7.0 adds **Proxmox VE as a substrate for tenant Kubernetes workers**, turns worker pools into first-class **`KubernetesNodes` resources**, introduces a **community Marketplace for External-Apps repositories** together with a reworked dashboard and Admin portal, extends the unified backup interface to **MongoDB, Redis, Valkey, RabbitMQ and Kafka** (plus PostgreSQL point-in-time recovery), and brings **TLS and admission-time hardening to the managed databases**. It also adds **managed Valkey**, **distributed tracing**, a **ComputePlane tenant module**, **arm64 image builds** and **slim installation variants**. |
| 8 | + |
| 9 | +This page lists only what has to be known before upgrading; every change in the release is in the [full changelog](https://github.com/cozystack/cozystack/blob/v1.7.0/docs/changelogs/v1.7.0.md). |
| 10 | + |
| 11 | +## ⚠️ Breaking Changes and Required Actions |
| 12 | + |
| 13 | +Several changes in this release alter behavior of running clusters. Read this section before applying the v1.7.0 Platform Package. |
| 14 | + |
| 15 | +1. **Talos v1.14.2 needs `drbd_transport_tcp` (#4598).** Before upgrading a node, add `drbd_transport_tcp` to its Talos `machine.kernel.modules` next to `drbd`; without it DRBD cannot connect to any peer. ([details][pre-upgrade]) |
| 16 | +2. **Tenant Kubernetes worker pools move to `KubernetesNodes` (#3315, #3379).** Existing pools are adopted on upgrade and roll their worker VMs once; a pool that is not adopted is listed in ConfigMap `cozy-system/cozystack-migration-56-unadopted` and needs to be adopted or recreated by hand, a cluster that uses the `ingressNginx` addon needs a pool with `roles: [ingress-nginx]`, and the `addons.fluxcd` addon is removed. ([details][pre-upgrade]) |
| 17 | +3. **Kamaji rolls every tenant control plane (#4398).** Every tenant kube-apiserver rolls on the first reconcile and again when the tenant's `kubernetes` release is upgraded; in between, a tenant that sets `--enable-admission-plugins=` in `controlPlane.apiServer.extraArgs` runs with Kamaji's default admission plugins, which do not include NodeRestriction. Plan the upgrade window accordingly. ([details][pre-upgrade]) |
| 18 | +4. **Cilium takes its addresses from a reserved block on Kube-OVN variants (#4778).** `networking.podCIDR` must be `/20` or wider on these variants, and each Cilium agent restarts twice when upgrading from v1.6.4 or earlier. ([details][pre-upgrade]) |
| 19 | +5. **KubeVirt eviction and hotplug changes (#4403, #4453).** VMs that cannot live-migrate are shut down and restarted instead of blocking a drain, but a running VM keeps the old strategy until it restarts, so restart such VMs once after upgrading if their nodes need to drain. On a `VMInstance` the upgrade unplugs a volume hot-plugged only on the VMI: before upgrading, detach it inside the guest, remove it with `virtctl removevolume`, and add the disk to the VMInstance's `spec.disks`, where at v1.6.5 it attaches only at the VM's next restart. ([details][pre-upgrade]) |
| 20 | +6. **External exposure now requires TLS (#4639, #4847, #2682).** Redis exposure needs `tls.enabled: true`, external PostgreSQL refuses plaintext sessions unless `tls.required: false` is set, and external OpenSearch moves to the chart's cert-manager CA; clients that connected with `sslmode=disable` or skipped certificate verification must be updated. ([details][pre-upgrade]) |
| 21 | +7. **Tenant route hostnames are mandatory (#3475, #3342, #4638, #3872).** An `HTTPRoute`, `TLSRoute` or `GRPCRoute` in a `tenant-*` namespace must declare a non-empty `spec.hostnames`; an existing route without them keeps serving, but its next update, a Helm upgrade included, is refused. ([details][pre-upgrade]) |
| 22 | +8. **Managed PostgreSQL and MariaDB user passwords (#4078, #4574).** `users[].password` is no longer honored and passwords are always auto-generated; roles left behind by users removed from `users` on v1.6.x are dropped on the first reconcile, and clients still logging in with such a role lose access. ([details][pre-upgrade]) |
| 23 | +9. **Smaller breaking changes (#4405, #4569, #3411, #3195, #4512, #4200).** Fix `vm-instance` resources that cannot size a VM, keep `ApplicationDefinition.spec.release.prefix` within `^[a-z0-9-]*$` and upgrade FoundationDB 7.1.x clusters to 7.3 first; multus now stages the reference CNI plugins into `/opt/cni/bin`, and HTTPCache is removed from the catalog. ([details][pre-upgrade]) |
| 24 | +10. **A platform variant switch on a live cluster is refused (#4790, backport #5021).** A switch goes through only with `networking.acknowledgeVariantChange` set to the new variant, and a cluster whose `cozystack.networking` variant was set by hand needs `cozystack.networking` in `bundles.disabledPackages` before the upgrade. ([details][pre-upgrade]) |
| 25 | +11. **A golden-image disk into an unsuitable LINSTOR class is refused (#4796, backport #5022).** Existing disks are exempt; for a new one use the golden image's StorageClass, or have the platform administrator set the CDI `cloneStrategyOverride` to `copy`. ([details][pre-upgrade]) |
| 26 | +12. **Pod rolls on upgrade.** Kafka clusters, SeaweedFS components, `kube-multus`, the LINSTOR pods and the Redis Sentinel and data pods roll once (#5019, #5028, #5018, #5020, #4831), and every PostgreSQL instance restarts at least once (#3951); a cluster with one instance is unavailable while its pod restarts. ([details][pre-upgrade]) |
| 27 | +13. **FoundationDB selects a release line, not a version (#5085, backport #5108).** `version: v7.3` or `v7.4` deploys 7.3.63 or 7.4.1, a cluster on another patch of its line is moved to the pinned one, downwards included, and a release on 7.1 or on mismatched lines is refused; check the running patch of every FoundationDB cluster before upgrading and read the `cozystack.io/migration-60-needs-attention` annotation afterwards. ([details][pre-upgrade]) |
| 28 | +14. **Image overrides of Kubernetes, KubernetesNodes and OpenSearch are no longer read (#5085, backport #5108).** Stored `images.*` values are ignored, with no API warning, and the workloads move to the platform's images; check custom OpenSearch images before upgrading, set `version` on an OpenSearch release that stores `version: null`, and mirror `docker.io` and `ghcr.io` on air-gapped management-cluster nodes. ([details][pre-upgrade]) |
| 29 | +15. **A disk still importing holds its release during the upgrade (#5087, backport #5126).** Such a `vm-disk` release can fail its upgrade and occupy a helm-controller worker until it reconciles on its own, about 20 minutes on a test cluster; finish running imports before upgrading (`kubectl get dv -A`). ([details][pre-upgrade]) |
| 30 | +16. **Read the migration log right after the upgrade.** Read it with `kubectl logs -n cozy-system job/cozystack-migration-hook` once the migrations finish; on a test cluster it could no longer be read about 20 minutes after the run. ([details][pre-upgrade]) |
| 31 | +17. **Free disk space on the nodes.** Observed on a test cluster: nodes reported `DiskPressure` during the platform upgrade and the kubelet evicted pods, so make sure the nodes have free disk space before upgrading. ([details][pre-upgrade]) |
| 32 | + |
| 33 | +[pre-upgrade]: https://github.com/cozystack/cozystack/blob/v1.7.0/docs/changelogs/v1.7.0.md#pre-upgrade-checks-and-required-actions |
| 34 | + |
| 35 | +Every breaking change, one entry per pull request: [Breaking changes in this release](https://github.com/cozystack/cozystack/blob/v1.7.0/docs/changelogs/v1.7.0.md#breaking-changes-in-this-release). |
| 36 | + |
| 37 | +## Contributors |
| 38 | + |
| 39 | +We'd like to thank all contributors who made this release possible: |
| 40 | + |
| 41 | +* [**@2mind**](https://github.com/2mind) |
| 42 | +* [**@androndo**](https://github.com/androndo) |
| 43 | +* [**@Arsolitt**](https://github.com/Arsolitt) |
| 44 | +* [**@batonogov**](https://github.com/batonogov) |
| 45 | +* [**@chathurabuddi**](https://github.com/chathurabuddi) |
| 46 | +* [**@crossRT**](https://github.com/crossRT) |
| 47 | +* [**@gireassen**](https://github.com/gireassen) |
| 48 | +* [**@harshitrwt**](https://github.com/harshitrwt) |
| 49 | +* [**@IvanHunters**](https://github.com/IvanHunters) |
| 50 | +* [**@kvaps**](https://github.com/kvaps) |
| 51 | +* [**@kvapsova**](https://github.com/kvapsova) |
| 52 | +* [**@lexfrei**](https://github.com/lexfrei) |
| 53 | +* [**@lfinmauritius**](https://github.com/lfinmauritius) |
| 54 | +* [**@lllamnyp**](https://github.com/lllamnyp) |
| 55 | +* [**@magic-peach**](https://github.com/magic-peach) |
| 56 | +* [**@matthieu-robin**](https://github.com/matthieu-robin) |
| 57 | +* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri) |
| 58 | +* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) |
| 59 | +* [**@nightcityblade**](https://github.com/nightcityblade) |
| 60 | +* [**@opsmon**](https://github.com/opsmon) |
| 61 | +* [**@pujitha24**](https://github.com/pujitha24) |
| 62 | +* [**@scooby87**](https://github.com/scooby87) |
| 63 | +* [**@shaurya703**](https://github.com/shaurya703) |
| 64 | +* [**@sircthulhu**](https://github.com/sircthulhu) |
| 65 | +* [**@themoriarti**](https://github.com/themoriarti) |
| 66 | +* [**@tym83**](https://github.com/tym83) |
| 67 | +* [**@yankawai**](https://github.com/yankawai) |
| 68 | +* [**@youdie006**](https://github.com/youdie006) |
| 69 | +* [**@yrahman82**](https://github.com/yrahman82) |
| 70 | + |
| 71 | +### New Contributors |
| 72 | + |
| 73 | +We're excited to welcome our first-time contributors: |
| 74 | + |
| 75 | +* [**@2mind**](https://github.com/2mind) - First contribution! |
| 76 | +* [**@batonogov**](https://github.com/batonogov) - First contribution! |
| 77 | +* [**@chathurabuddi**](https://github.com/chathurabuddi) - First contribution! |
| 78 | +* [**@crossRT**](https://github.com/crossRT) - First contribution! |
| 79 | +* [**@gireassen**](https://github.com/gireassen) - First contribution! |
| 80 | +* [**@harshitrwt**](https://github.com/harshitrwt) - First contribution! |
| 81 | +* [**@lfinmauritius**](https://github.com/lfinmauritius) - First contribution! |
| 82 | +* [**@magic-peach**](https://github.com/magic-peach) - First contribution! |
| 83 | +* [**@nightcityblade**](https://github.com/nightcityblade) - First contribution! |
| 84 | +* [**@opsmon**](https://github.com/opsmon) - First contribution! |
| 85 | +* [**@pujitha24**](https://github.com/pujitha24) - First contribution! |
| 86 | +* [**@shaurya703**](https://github.com/shaurya703) - First contribution! |
| 87 | +* [**@youdie006**](https://github.com/youdie006) - First contribution! |
| 88 | + |
| 89 | +**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.6.0...v1.7.0 |
0 commit comments