Port 0.43.0

changelog/0.43.md

@@ -0,0 +1,81 @@
+# v0.43.0
+
+Released 2025-01-20
+
+> [!WARNING]
+> **Security Notice(s)**
+> - OpenSearch Dashboards was upgraded to `2.17.1` which mitigates [CVE-2024-45801](https://github.com/advisories/GHSA-mmhx-hmjr-r674)
+<!-- -->
+> [!IMPORTANT]
+> **Platform Administrator Notice(s)**
+> - The diagnostics script now assumes to retrieve GPG keys from a file `$CK8S_CONFIG_PATH/diagnostics_receiver.gpg` if the `CK8S_PGP_FP` environment variable is not set.
+> - Default external traffic policy is now set to `local`. If your infrastructure doesn't support this, please set `.externalTrafficPolicy.local` to false.
+> - The `hnc.excludedNamespaces` configuration option has been removed, you can use `hnc.excludedExtraNamespaces` if you need additional excluded namespaces.
+> - The resource request capacity management alerts have been reworked to target the `elastisys.io/node-group` label instead of being based on node name patterns. As such, any previous override config for `prometheus.capacityManagementAlerts.requestLimit` will be invalid and needs to be reconfigured or removed to use the new defaults.
+> - Migration steps for old releases other than the last five releases have been pruned to simplify repository maintainability.
+>   The old migrations can still be accessed by looking at their respective release tag.
+
+## Release highlights
+
+- Default external traffic policy is now set to `local`. If your infrastructure doesn't support this, please set `.externalTrafficPolicy.local` to false.
+
+## Changes by kind
+
+### Feature(s)
+
+- [#2367](https://github.com/elastisys/compliantkubernetes-apps/pull/2367) - Add extra Application Developer RBAC config @anders-elastisys
+
+### Improvement(s)
+
+- [#2203](https://github.com/elastisys/compliantkubernetes-apps/pull/2203) - apps sc: Alert size over limit only on active indices @aarnq
+- [#2250](https://github.com/elastisys/compliantkubernetes-apps/pull/2250) - Use file with GPG keys for diagnostics script and other improvements @anders-elastisys
+- [#2310](https://github.com/elastisys/compliantkubernetes-apps/pull/2310) - config: move harbor backup schedule and make it configurable @viktor-f
+- [#2317](https://github.com/elastisys/compliantkubernetes-apps/pull/2317) - apps: Change default for external traffic policy to local @Xartos
+  - Default external traffic policy is now set to `local`. If your infrastructure doesn't support this, please set `.externalTrafficPolicy.local` to false.
+- [#2324](https://github.com/elastisys/compliantkubernetes-apps/pull/2324) - Delete admin-rbac last in clean scripts @anders-elastisys
+- [#2331](https://github.com/elastisys/compliantkubernetes-apps/pull/2331) - apps sc: add falco exception for tekton cleanup @lunkan93
+- [#2336](https://github.com/elastisys/compliantkubernetes-apps/pull/2336) - scripts: Fixed idempotency for clean wc script @Xartos
+- [#2337](https://github.com/elastisys/compliantkubernetes-apps/pull/2337) - tests: update velero e2e backup specs and enable user app test @lunkan93
+- [#2350](https://github.com/elastisys/compliantkubernetes-apps/pull/2350) - Upgrade OpenSearch to v2.17.1 @lunkan93
+- [#2351](https://github.com/elastisys/compliantkubernetes-apps/pull/2351) - Add capi repositories as trusted for falco @robinAwallace
+- [#2355](https://github.com/elastisys/compliantkubernetes-apps/pull/2355) - Add harbor disableRedirect schema description @anders-elastisys
+- [#2356](https://github.com/elastisys/compliantkubernetes-apps/pull/2356) - apps sc: increase threshold for thanosobjstore latency alert @viktor-f
+- [#2357](https://github.com/elastisys/compliantkubernetes-apps/pull/2357) - apps: dropping some falco rules @viktor-f
+- [#2368](https://github.com/elastisys/compliantkubernetes-apps/pull/2368) - apps sc: add sub path and name suffix to rclone jobs, harbor restore support azure @viktor-f
+- [#2372](https://github.com/elastisys/compliantkubernetes-apps/pull/2372) - Don't get Cluster API resource metrics in workload cluster @anders-elastisys
+- [#2376](https://github.com/elastisys/compliantkubernetes-apps/pull/2376) - scripts: Add shfmt @aarnq
+- [#2382](https://github.com/elastisys/compliantkubernetes-apps/pull/2382) - apps: Mirror Bitnami images @aarnq
+- [#2386](https://github.com/elastisys/compliantkubernetes-apps/pull/2386) - Fixes and improvements to kube-stack-prometheus alerts @anders-elastisys
+- [#2391](https://github.com/elastisys/compliantkubernetes-apps/pull/2391) - apps: upgrade harbor helm chart to v1.16.1 with appversion v2.12.1 @Pavan-Gunda
+- [#2398](https://github.com/elastisys/compliantkubernetes-apps/pull/2398) - tests: Workflow improvements @aarnq
+
+### Other(s)
+
+- [#2248](https://github.com/elastisys/compliantkubernetes-apps/pull/2248) - documentation: JSON schema contribution guide @aarnq
+- [#2284](https://github.com/elastisys/compliantkubernetes-apps/pull/2284) - bug: apps wc: Fixed network policy to always allow ingress probe @Xartos
+- [#2290](https://github.com/elastisys/compliantkubernetes-apps/pull/2290) - other: all: adding codeowners @OlleLarsson
+- [#2329](https://github.com/elastisys/compliantkubernetes-apps/pull/2329) - bug: config: fix HNC config templating @OlleLarsson
+- [#2332](https://github.com/elastisys/compliantkubernetes-apps/pull/2332) - clean-up: apps: remove ceph node packet drops alert @lunkan93
+- [#2333](https://github.com/elastisys/compliantkubernetes-apps/pull/2333) - clean-up: apps: remove old unused falco-psp-rbac chart @viktor-f
+- [#2334](https://github.com/elastisys/compliantkubernetes-apps/pull/2334) - documentation: Rebrand to Welkin in configuration documentation @cristiklein
+- [#2338](https://github.com/elastisys/compliantkubernetes-apps/pull/2338) - other: all: add PA as codeowner @OlleLarsson
+- [#2340](https://github.com/elastisys/compliantkubernetes-apps/pull/2340) - other: release: update kubectl version to v1.30.4 @davidumea
+- [#2345](https://github.com/elastisys/compliantkubernetes-apps/pull/2345) - bug: apps sc: Fixed issues with log-manager script for azure @Xartos
+- [#2346](https://github.com/elastisys/compliantkubernetes-apps/pull/2346) - clean-up: apps wc: exclude capi namespaces from hnc @lunkan93
+- [#2347](https://github.com/elastisys/compliantkubernetes-apps/pull/2347) - other: Remove goto-scripts as code owners from upstream Helmfile index @simonklb
+- [#2352](https://github.com/elastisys/compliantkubernetes-apps/pull/2352) - other: Rename 'Compliant Kubernetes' to 'Welkin' in dashboards @Carl-Elastisys
+- [#2358](https://github.com/elastisys/compliantkubernetes-apps/pull/2358) - documentation: docs: Update templates @aarnq
+- [#2359](https://github.com/elastisys/compliantkubernetes-apps/pull/2359) - other: Port 0.42.0 @lucianvlad
+- [#2360](https://github.com/elastisys/compliantkubernetes-apps/pull/2360) - documentation: docs: Update LICENSE @cristiklein
+- [#2361](https://github.com/elastisys/compliantkubernetes-apps/pull/2361) - bug: Fixes for diagnostics script with namespace @anders-elastisys
+- [#2362](https://github.com/elastisys/compliantkubernetes-apps/pull/2362) - clean-up: apps: use node-group label in node resource request alerts @lunkan93
+- [#2369](https://github.com/elastisys/compliantkubernetes-apps/pull/2369) - clean-up: docs: Prune old migration docs @aarnq
+- [#2371](https://github.com/elastisys/compliantkubernetes-apps/pull/2371) - other: all: update codeowners with new goto areas @viktor-f
+- [#2374](https://github.com/elastisys/compliantkubernetes-apps/pull/2374) - bug: Fix runbook url for official prometheus alerts @HaoruiPeng
+- [#2379](https://github.com/elastisys/compliantkubernetes-apps/pull/2379) - bug: Fix Velero templating for kopia uploaderType @anders-elastisys
+- [#2380](https://github.com/elastisys/compliantkubernetes-apps/pull/2380) - bug: Fix ck8s ops commands after refactor @anders-elastisys
+- [#2385](https://github.com/elastisys/compliantkubernetes-apps/pull/2385) - other: Port 0.42.1 @lunkan93
+- [#2390](https://github.com/elastisys/compliantkubernetes-apps/pull/2390) - documentation: Fix URL in config schema @cristiklein
+- [#2392](https://github.com/elastisys/compliantkubernetes-apps/pull/2392) - bug: Replace ck8s with Welkin in tests @anders-elastisys
+- [#2393](https://github.com/elastisys/compliantkubernetes-apps/pull/2393) - bug: Fix config schema @cristiklein
+- [#2395](https://github.com/elastisys/compliantkubernetes-apps/pull/2395) - clean-up: apps: Update prometheus-label-enforcer to v0.11.0 @Zash

config/sc-config.yaml

@@ -575,14 +575,15 @@ thanos:
     # It needs to write to (REPLICATION_FACTOR + 1)/2 nodes for success.
     # For more info: https://thanos.io/v0.24/proposals-done/201812-thanos-remote-receive.md/#replication
     replicationFactor: 1
-
+    replicaCount: 1
     resources:
       requests:
         cpu: 150m
         memory: 100Mi
       limits:
         cpu: 1000m
         memory: 1Gi
+    extraFlags: [] #use extraflags when you want to add more command line flags to the component.
 
   ruler:
     # Enables the ruler component

config/schemas/config.yaml

@@ -4873,6 +4873,15 @@ properties:
         type: object
         additionalProperties: false
         properties:
+          replicaCount:
+            title: Thanos receiveDistributor Replicas
+            type: integer
+            default: 1
+          extraFlags:
+            title: Thanos receiveDistributor extraFlags
+            description: |-
+              When set, the arguments will be passed onto the component as command-line flags. Refer to the [upstream doc](https://github.com/bitnami/charts/blob/main/bitnami/thanos/README.md#adding-extra-flags) for more details.
+            type: array
           replicationFactor:
             title: Thanos Replication Factor
             description: Requires that incoming remote write requests are replicated `(replicationFactor + 1) / 2`.

helmfile.d/values/thanos/receiver.yaml.gotmpl

@@ -130,13 +130,18 @@ receiveDistributor:
 
   resources: {{- toYaml .Values.thanos.receiveDistributor.resources | nindent 4 }}
   replicationFactor: {{  .Values.thanos.receiveDistributor.replicationFactor }}
+  replicaCount: {{ .Values.thanos.receiveDistributor.replicaCount }}
 
   containerSecurityContext:
     capabilities:
       drop:
         - ALL
     seccompProfile:
       type: RuntimeDefault
+  {{- if .Values.thanos.receiveDistributor.extraFlags }}
+  extraFlags:
+    {{- toYaml .Values.thanos.receiveDistributor.extraFlags | nindent 4 }}
+  {{ end }}
 
 ruler:
   networkPolicy: