⚠️ Notice

• Tag to digest resolution for private registries (where the credentials are in a K8s secret) is broken in this release. The fix is available in v1.3.2

🚨 Breaking or Notable

• We dropped the alpha field RevisionSpec.MaxDurationSeconds in favour of fixing the behaviour of the existing Timeout field. (#12635, @dprotaso)

💫 New Features & Changes

• Allow readiness probe port to be different than the user container port. (#12606, @izabelacg)
• net-certmanager starts testing cert-manager v1.7.1. (#12605, @nak3)

🐞 Bug Fixes

• Bump prometheus/client_golang to v1.11.1 in order to address CVE-2022-21698 (#12653, @qu1queee)
• Ensure the activator drains properly and the autoscaler rolls out conservatively. This helps avoid hitting 503s during upgrade. (#12617, @dprotaso)
• Fix an activator crash that could disrupt traffic (503) (#12679, @dprotaso)
• Fix tag to digest resolution when the registry credential is in a K8s secret (#12655, #12761, @dprotaso)
• Provides more detailed error messages for invalid values of autoscaling.knative.dev/initial-scale (#12704, @psschwei)
• Remove an unnecessary start delay when resolving a tag to digest (#12668, @dprotaso)
• Switches selectors for Knative resources to use the recommended app.kubernetes.io labels (#12587, @psschwei)
• The validating webhook returns a more accurate error for invalid autoscaling.knative.dev/target values (#12698, @psschwei)
• Updates serving configmap validating webhook to use an objectSelector to reduce unnecessary webhook invocations (#12612, @psschwei)

Dependencies

⚠️ Notice

• Tag to digest resolution for private registries (where the credentials are in a K8s secret) is broken in this release. The fix is available in v1.2.5

🚨 Breaking or Notable

• In v1.2.0 we introduced an experimental field RevisionSpec.MaxDurationSeconds in error. It has been removed in this release. (#12634, @dprotaso)
• Our minimum K8s version is now 1.21 (#12509, @dprotaso)
• PodDisruptionBudget updated to v1 API (#12548, @psschwei)

💫 New Features & Changes

• Improves the error message when a DomainMapping cannot be reconciled because autocreate-cluster-domain-claims is false and the CDC does not exist. (#12439, @julz)
• Utilizes Kubernetes's immediate trigger of readiness probes after startup, restores default periodSeconds for readiness probe to Kuberentes default (10s) (#12550, @psschwei)

🐞 Bug Fixes

• Ensure the activator drains properly and the autoscaler rolls out conservatively. This helps avoid hitting 503s during upgrade. (#12621, @dprotaso)
• Fixes an activator panic when the throttle encounters a cache.DeleteFinalStateUnknown (#12680, @dprotaso)
• Remove an unnecessary start delay when resolving tag to digests (#12669, #12761, @dprotaso)
• Controllers now properly shut down and relinquish their K8s leases. This fixes potential dropped traffic during upgrades. (knative/pkg#2436, @dprotaso)
• Bump google/go-containerregistry which includes various fixes tag to digest when looking up registry credentials (#12510, @dprotaso)
• Fix an activator crash that could disrupt traffic (503) (#12676, @dprotaso)
• Changes liveness probes to directly probe the user container rather than queue proxy. (#12479, @julz)

🧪 Experimental

• PVC support behind the feature flags kubernetes.podspec-persistent-volume-claim kubernetes.podspec-persistent-volume-write (#12458, @skonto)

Dependencies

⚠️ Notice

• Tag to digest resolution for private registries (where the credentials are in a K8s secret) is broken in this release. The fix is available in v1.3.2

🚨 Breaking or Notable

• We dropped the alpha field RevisionSpec.MaxDurationSeconds in favour of fixing the behaviour of the existing Timeout field. (#12635, @dprotaso)

💫 New Features & Changes

• Allow readiness probe port to be different than the user container port. (#12606, @izabelacg)
• net-certmanager starts testing cert-manager v1.7.1. (#12605, @nak3)

🐞 Bug Fixes

• Bump prometheus/client_golang to v1.11.1 in order to address CVE-2022-21698 (#12653, @qu1queee)
• Ensure the activator drains properly and the autoscaler rolls out conservatively. This helps avoid hitting 503s during upgrade. (#12617, @dprotaso)
• Fix an activator crash that could disrupt traffic (503) (#12679, @dprotaso)
• Fix tag to digest resolution when the registry credential is in a K8s secret (#12655, @dprotaso)
• Provides more detailed error messages for invalid values of autoscaling.knative.dev/initial-scale (#12704, @psschwei)
• Remove an unnecessary start delay when resolving a tag to digest (#12668, @dprotaso)
• Switches selectors for Knative resources to use the recommended app.kubernetes.io labels (#12587, @psschwei)
• The validating webhook returns a more accurate error for invalid autoscaling.knative.dev/target values (#12698, @psschwei)
• Updates serving configmap validating webhook to use an objectSelector to reduce unnecessary webhook invocations (#12612, @psschwei)

Dependencies

⚠️ Notice

• Tag to digest resolution for private registries (where the credentials are in a K8s secret) is broken in this release. The fix is available in v1.2.5

🚨 Breaking or Notable

• In v1.2.0 we introduced an experimental field RevisionSpec.MaxDurationSeconds in error. It has been removed in this release. (#12634, @dprotaso)
• Our minimum K8s version is now 1.21 (#12509, @dprotaso)
• PodDisruptionBudget updated to v1 API (#12548, @psschwei)

💫 New Features & Changes

• Improves the error message when a DomainMapping cannot be reconciled because autocreate-cluster-domain-claims is false and the CDC does not exist. (#12439, @julz)
• Utilizes Kubernetes's immediate trigger of readiness probes after startup, restores default periodSeconds for readiness probe to Kuberentes default (10s) (#12550, @psschwei)

🐞 Bug Fixes

• Ensure the activator drains properly and the autoscaler rolls out conservatively. This helps avoid hitting 503s during upgrade. (#12621, @dprotaso)
• Fixes an activator panic when the throttle encounters a cache.DeleteFinalStateUnknown (#12680, @dprotaso)
• Remove an unnecessary start delay when resolving tag to digests (#12669, #12761, @dprotaso)
• Controllers now properly shut down and relinquish their K8s leases. This fixes potential dropped traffic during upgrades. (knative/pkg#2436, @dprotaso)
• Bump google/go-containerregistry which includes various fixes tag to digest when looking up registry credentials (#12510, @dprotaso)
• Fix an activator crash that could disrupt traffic (503) (#12676, @dprotaso)
• Changes liveness probes to directly probe the user container rather than queue proxy. (#12479, @julz)

🧪 Experimental

• PVC support behind the feature flags kubernetes.podspec-persistent-volume-claim kubernetes.podspec-persistent-volume-write (#12458, @skonto)

Dependencies

tags: Release Notes Serving

🚨 Breaking or Notable

💫 New Features & Changes

• Add cluster wide default min-scale (#12290, @nader-ziada)
• HPA autoscaler stabilization window can be set from autoscaling window annotation (#12286, @enoodle)
• Metrics with names other than "cpu" or "memory" are allowed as pod custom metrics. (#12277, @enoodle)
• Allow setting TCP and HTTP port to be equal to containerPort on readiness and liveness probes. (#12225, @evankanderson)

🐞 Bug Fixes

• Controllers now properly shut down and relinquish their K8s leases. This fixes potential dropped traffic during upgrades. (knative/pkg#2436, @dprotaso)
• Remove an unnecessary start delay when resolving a tag to digest (#12668, @dprotaso)
• Fixes an activator panic when the throttle encounters a cache.DeleteFinalStateUnknown (#12680, @dprotaso)
• The activator optimisation which directly probes the queue proxy for readiness rather than waiting for Kubernetes to report readiness is now disabled when exec probes are used (since queue proxy cannot execute these probes on the user container's behalf). (#12250, @julz)

Uncategorized

• Drops the unix socket listener from Queue Proxy, since it is no longer used (#12298, @julz)
• Generated HPAs are now v2beta2.
  Window annotation will be set to HPA stabilization window (#12278, @enoodle)
• Remove performance tests using Mako (#12266, @nader-ziada)
• Use pkg/drain in queue proxy (#12033, @nader-ziada)

Dependencies

Changelog since 0.25

🚨 Breaking or Notable

• Kubernetes 1.20 is now required

💫 New Features & Changes

• Allow users to set container[*].securityContext.runAsGroup (#12003, @dprotaso)

• A new setting, mesh-compatibility-mode, in the networking config map allows an administrator
  to explicitly tell Activator and Autoscaler to use Direct Pod IP (most efficient, but not compatible
  with mesh being enabled), Cluster IP (less efficient, but needed if mesh is enabled), or to
  Autodetect (the current behaviour, and the default, causes Activator and Autoscaler to first attempt
  Direct Pod IP communication, and then fall back to Cluster IP if it sees a mesh-related error status
  code). (#11999, @julz)

🐞 Bug Fixes

• Controllers now properly shut down and relinquish their K8s leases. This fixes potential dropped traffic during upgrades. (knative/pkg#2436, @dprotaso)

Uncategorized

• Adds more debug logs to background digest resolver (#11959, @julz)
• Dropped the startup probe on the queue-proxy which makes the pods start ~500ms quicker on average. (#11965, @markusthoemmes)
• Removes the ServiceName field from RevisionStatus which has been deprecated for several releases. This field was effectively equal to the revision name. (#11817, @julz)
• User-supplied readinessProbes with a probePeriod set greater than zero are no longer silently ignored after pod startup. (#11190, @julz)
• When enabled, queue proxy tracks the request count for each pod (disabled by default) (#11783, @psschwei)

Dependencies

🚨 Breaking or Notable

• The per-namespace wildcard certificate provisioner has been integrated into the base controllers
  and is now controlled by the namespace-wildcard-cert-selector field. This field allows you
  to use a Kubernetes LabelSelector to choose which namespaces should have certificates
  provisioned.

  To migrate existing usage of the serving-nscert controller, do the following:

  1. Set the namespace-wildcard-cert-selector to the value:

     matchExpressions:
      - key: "networking.knative.dev/disableWildcardCert"
        operator: "NotIn"
        values: ["true"]
     

  2. Remove the Deployment, Service and ClusterRole defined by the serving-nscert.yaml resources
     in the previous release. (#12174, @evankanderson)

• Controllers now properly shut down and relinquish their K8s leases. This fixes potential dropped traffic during upgrades. (knative/pkg#2436, @dprotaso)

💫 New Features & Changes

• Per-namespace wildcard certificate provisioning has been integrated into the main
  Knative controllers and is no longer a separate install. It is now controlled by a
  label selector on Kubernetes namespaces.
• A new experimental feature, "concurrencyStateEndpoint", allows a webhook to be informed when a container's concurrency goes to/from zero (#11802, #12162, #11917, @psschwei)
• When mesh compatibility mode is not set to "auto" in the networking config map,
  the activator will respect Kubernetes's readiness state and avoid probing when
  kubernetes readiness propagates more quickly than the activator's probe. (#12086, @julz)

🐞 Bug Fixes

• Fixes an issue where TLS certificates are requested before domain-ownership is established. (#12080, @mattmoor)

Dependencies

Added

Nothing has changed.

Changed

• cloud.google.com/go/storage: v1.10.0 → v1.18.2
• cloud.google.com/go: v0.84.0 → v0.97.0
• github.com/cncf/xds/go: fbca930 → aa0b789
• github.com/envoyproxy/go-control-plane: 63b5d3c → cf90f65
• github.com/golang/mock: v1.5.0 → v1.6.0
• github.com/google/pprof: 01bbb19 → 4bb14d4
• github.com/googleapis/gax-go/v2: v2.0.5 → v2.1.1
• github.com/prometheus/common: v0.30.0 → v0.31.1
• github.com/yuin/goldmark: v1.3.5 → v1.4.0
• go.uber.org/goleak: v1.1.10 → 6911603
• go.uber.org/zap: v1.19.0 → v1.19.1
• golang.org/x/net: e898025 → 4f30a5c
• golang.org/x/oauth2: 2bc19b1 → 6b3c2da
• golang.org/x/sys: 59db8d7 → d61c044
• golang.org/x/tools: v0.1.5 → v0.1.7
• google.golang.org/api: v0.50.0 → v0.58.0
• google.golang.org/genproto: 8bfb893 → 37fc393
• google.golang.org/grpc: v1.40.0 → v1.41.0
• k8s.io/gengo: de9496d → 39e73c8
• knative.dev/caching: 0184eb9 → f2af269
• knative.dev/hack: 815cd31 → b96d65a
• knative.dev/networking: 69ad454 → c3606d9
• knative.dev/pkg: 5ae4821 → 5d9d300
• sigs.k8s.io/yaml: v1.2.0 → v1.3.0

Removed

Nothing has changed.

⚠️ Notice

• Tag to digest resolution for private registries (where the credentials are in a K8s secret) is broken in this release. The fix is available in v1.2.5

🚨 Breaking or Notable

• In v1.2.0 we introduced an experimental field RevisionSpec.MaxDurationSeconds in error. It has been removed in this release. (#12634, @dprotaso)
• Our minimum K8s version is now 1.21 (#12509, @dprotaso)
• PodDisruptionBudget updated to v1 API (#12548, @psschwei)

💫 New Features & Changes

• Improves the error message when a DomainMapping cannot be reconciled because autocreate-cluster-domain-claims is false and the CDC does not exist. (#12439, @julz)
• Utilizes Kubernetes's immediate trigger of readiness probes after startup, restores default periodSeconds for readiness probe to Kuberentes default (10s) (#12550, @psschwei)

🐞 Bug Fixes

• Ensure the activator drains properly and the autoscaler rolls out conservatively. This helps avoid hitting 503s during upgrade. (#12621, @dprotaso)
• Bump google/go-containerregistry which includes various fixes when looking up registry credentials (#12510, @dprotaso)
• Changes liveness probes to directly probe the user container rather than queue proxy. (#12479, @julz)

🧪 Experimental

• PVC support behind the feature flags kubernetes.podspec-persistent-volume-claim kubernetes.podspec-persistent-volume-write (#12458, @skonto)

Dependencies

tags: Release Notes Serving

🚨 Breaking or Notable

💫 New Features & Changes

• Add cluster wide default min-scale (#12290, @nader-ziada)
• HPA autoscaler stabilization window can be set from autoscaling window annotation (#12286, @enoodle)
• Metrics with names other than "cpu" or "memory" are allowed as pod custom metrics. (#12277, @enoodle)

🐞 Bug Fixes

Uncategorized

• Allow setting TCP and HTTP port to be equal to containerPort on readiness and liveness probes. (#12225, @evankanderson)
• Drops the unix socket listener from Queue Proxy, since it is no longer used (#12298, @julz)
• Generated HPAs are now v2beta2.
  Window annotation will be set to HPA stabilization window (#12278, @enoodle)
• Remove performance tests using Mako (#12266, @nader-ziada)
• The activator optimisation which directly probes the queue proxy for readiness rather than waiting for Kubernetes to report readiness is now disabled when exec probes are used (since queue proxy cannot execute these probes on the user container's behalf). (#12250, @julz)
• Use pkg/drain in queue proxy (#12033, @nader-ziada)

Dependencies

⚠️ Notice

• Tag to digest resolution for private registries (where the credentials are in a K8s secret) is broken in this release. The fix is available in v1.2.5

🚨 Breaking or Notable

• In v1.2.0 we introduced an experimental field RevisionSpec.MaxDurationSeconds in error. It is present in this release but has been removed in v1.2.2 (#12634, @dprotaso)
• Our minimum K8s version is now 1.21 (#12509, @dprotaso)
• PodDisruptionBudget updated to v1 API (#12548, @psschwei)

💫 New Features & Changes

• Improves the error message when a DomainMapping cannot be reconciled because autocreate-cluster-domain-claims is false and the CDC does not exist. (#12439, @julz)
• Utilizes Kubernetes's immediate trigger of readiness probes after startup, restores default periodSeconds for readiness probe to Kuberentes default (10s) (#12550, @psschwei)

🐞 Bug Fixes

• Ensure the activator drains properly and the autoscaler rolls out conservatively. This helps avoid hitting 503s during upgrade. (#12621, @dprotaso)
• Bump google/go-containerregistry which includes various fixes when looking up registry credentials (#12510, @dprotaso)
• Changes liveness probes to directly probe the user container rather than queue proxy. (#12479, @julz)

🧪 Experimental

• PVC support behind the feature flags kubernetes.podspec-persistent-volume-claim kubernetes.podspec-persistent-volume-write (#12458, @skonto)

Dependencies