⚠️ Notice

• Tag to digest resolution for private registries (where the credentials are in a K8s secret) is broken in this release. The fix is available in v1.2.5

🚨 Breaking or Notable

• In v1.2.0 we introduced an experimental field RevisionSpec.MaxDurationSeconds in error. It has been removed in this release. (#12634, @dprotaso)
• Our minimum K8s version is now 1.21 (#12509, @dprotaso)
• PodDisruptionBudget updated to v1 API (#12548, @psschwei)

💫 New Features & Changes

• Improves the error message when a DomainMapping cannot be reconciled because autocreate-cluster-domain-claims is false and the CDC does not exist. (#12439, @julz)
• Utilizes Kubernetes's immediate trigger of readiness probes after startup, restores default periodSeconds for readiness probe to Kuberentes default (10s) (#12550, @psschwei)

🐞 Bug Fixes

• Ensure the activator drains properly and the autoscaler rolls out conservatively. This helps avoid hitting 503s during upgrade. (#12621, @dprotaso)
• Bump google/go-containerregistry which includes various fixes when looking up registry credentials (#12510, @dprotaso)
• Changes liveness probes to directly probe the user container rather than queue proxy. (#12479, @julz)

🧪 Experimental

• PVC support behind the feature flags kubernetes.podspec-persistent-volume-claim kubernetes.podspec-persistent-volume-write (#12458, @skonto)

Dependencies

tags: Release Notes Serving

🚨 Breaking or Notable

💫 New Features & Changes

• Add cluster wide default min-scale (#12290, @nader-ziada)
• HPA autoscaler stabilization window can be set from autoscaling window annotation (#12286, @enoodle)
• Metrics with names other than "cpu" or "memory" are allowed as pod custom metrics. (#12277, @enoodle)

🐞 Bug Fixes

Uncategorized

• Allow setting TCP and HTTP port to be equal to containerPort on readiness and liveness probes. (#12225, @evankanderson)
• Drops the unix socket listener from Queue Proxy, since it is no longer used (#12298, @julz)
• Generated HPAs are now v2beta2.
  Window annotation will be set to HPA stabilization window (#12278, @enoodle)
• Remove performance tests using Mako (#12266, @nader-ziada)
• The activator optimisation which directly probes the queue proxy for readiness rather than waiting for Kubernetes to report readiness is now disabled when exec probes are used (since queue proxy cannot execute these probes on the user container's behalf). (#12250, @julz)
• Use pkg/drain in queue proxy (#12033, @nader-ziada)

Dependencies

⚠️ Notice

• Tag to digest resolution for private registries (where the credentials are in a K8s secret) is broken in this release. The fix is available in v1.2.5

🚨 Breaking or Notable

• In v1.2.0 we introduced an experimental field RevisionSpec.MaxDurationSeconds in error. It is present in this release but has been removed in v1.2.2 (#12634, @dprotaso)
• Our minimum K8s version is now 1.21 (#12509, @dprotaso)
• PodDisruptionBudget updated to v1 API (#12548, @psschwei)

💫 New Features & Changes

• Improves the error message when a DomainMapping cannot be reconciled because autocreate-cluster-domain-claims is false and the CDC does not exist. (#12439, @julz)
• Utilizes Kubernetes's immediate trigger of readiness probes after startup, restores default periodSeconds for readiness probe to Kuberentes default (10s) (#12550, @psschwei)

🐞 Bug Fixes

• Ensure the activator drains properly and the autoscaler rolls out conservatively. This helps avoid hitting 503s during upgrade. (#12621, @dprotaso)
• Bump google/go-containerregistry which includes various fixes when looking up registry credentials (#12510, @dprotaso)
• Changes liveness probes to directly probe the user container rather than queue proxy. (#12479, @julz)

🧪 Experimental

• PVC support behind the feature flags kubernetes.podspec-persistent-volume-claim kubernetes.podspec-persistent-volume-write (#12458, @skonto)

Dependencies

⚠️ Notice

• Tag to digest resolution for private registries (where the credentials are in a K8s secret) is broken in this release. The fix is available in v1.2.5

🚨 Breaking or Notable

• In this release we introduced an experimental field RevisionSpec.MaxDurationSeconds in error. It has been removed in v1.2.2 (#12634, @dprotaso)
• Our minimum K8s version is now 1.21 (#12509, @dprotaso)
• PodDisruptionBudget updated to v1 API (#12548, @psschwei)

💫 New Features & Changes

• Improves the error message when a DomainMapping cannot be reconciled because autocreate-cluster-domain-claims is false and the CDC does not exist. (#12439, @julz)
• Utilizes Kubernetes's immediate trigger of readiness probes after startup, restores default periodSeconds for readiness probe to Kuberentes default (10s) (#12550, @psschwei)

🐞 Bug Fixes

• Bump google/go-containerregistry which includes various fixes when looking up registry credentials (#12510, @dprotaso)
• Changes liveness probes to directly probe the user container rather than queue proxy. (#12479, @julz)

🧪 Experimental

• PVC support behind the feature flags kubernetes.podspec-persistent-volume-claim kubernetes.podspec-persistent-volume-write (#12458, @skonto)

Dependencies

tags: Release Notes Serving

🚨 Breaking or Notable

💫 New Features & Changes

• Add cluster wide default min-scale (#12290, @nader-ziada)
• HPA autoscaler stabilization window can be set from autoscaling window annotation (#12286, @enoodle)
• Metrics with names other than "cpu" or "memory" are allowed as pod custom metrics. (#12277, @enoodle)

🐞 Bug Fixes

Uncategorized

• Allow setting TCP and HTTP port to be equal to containerPort on readiness and liveness probes. (#12225, @evankanderson)
• Drops the unix socket listener from Queue Proxy, since it is no longer used (#12298, @julz)
• Generated HPAs are now v2beta2.
  Window annotation will be set to HPA stabilization window (#12278, @enoodle)
• Remove performance tests using Mako (#12266, @nader-ziada)
• The activator optimisation which directly probes the queue proxy for readiness rather than waiting for Kubernetes to report readiness is now disabled when exec probes are used (since queue proxy cannot execute these probes on the user container's behalf). (#12250, @julz)
• Use pkg/drain in queue proxy (#12033, @nader-ziada)

Dependencies

tags: Release Notes Serving

Changelog since 1.0

🚨 Breaking or Notable

💫 New Features & Changes

• Add cluster wide default min-scale (#12290, @nader-ziada)
• HPA autoscaler stabilization window can be set from autoscaling window annotation (#12286, @enoodle)
• Metrics with names other than "cpu" or "memory" are allowed as pod custom metrics. (#12277, @enoodle)

🐞 Bug Fixes

Uncategorized

• Allow setting TCP and HTTP port to be equal to containerPort on readiness and liveness probes. (#12225, @evankanderson)
• Drops the unix socket listener from Queue Proxy, since it is no longer used (#12298, @julz)
• Generated HPAs are now v2beta2.
  Window annotation will be set to HPA stabilization window (#12278, @enoodle)
• Remove performance tests using Mako (#12266, @nader-ziada)
• The activator optimisation which directly probes the queue proxy for readiness rather than waiting for Kubernetes to report readiness is now disabled when exec probes are used (since queue proxy cannot execute these probes on the user container's behalf). (#12250, @julz)
• Use pkg/drain in queue proxy (#12033, @nader-ziada)

Dependencies

Release notes for Serving 1.1

tags: Release Notes Serving

Changelog since 1.0

🚨 Breaking or Notable

💫 New Features & Changes

• Add cluster wide default min-scale (#12290, @nader-ziada)
• HPA autoscaler stabilization window can be set from autoscaling window annotation (#12286, @enoodle)
• Metrics with names other than "cpu" or "memory" are allowed as pod custom metrics. (#12277, @enoodle)

🐞 Bug Fixes

Uncategorized

• Allow setting TCP and HTTP port to be equal to containerPort on readiness and liveness probes. (#12225, @evankanderson)
• Drops the unix socket listener from Queue Proxy, since it is no longer used (#12298, @julz)
• Generated HPAs are now v2beta2.
  Window annotation will be set to HPA stabilization window (#12278, @enoodle)
• Remove performance tests using Mako (#12266, @nader-ziada)
• The activator optimisation which directly probes the queue proxy for readiness rather than waiting for Kubernetes to report readiness is now disabled when exec probes are used (since queue proxy cannot execute these probes on the user container's behalf). (#12250, @julz)
• Use pkg/drain in queue proxy (#12033, @nader-ziada)

Dependencies

Changelog since 0.25

🚨 Breaking or Notable

• Kubernetes 1.20 is now required

💫 New Features & Changes

• Allow users to set container[*].securityContext.runAsGroup (#12003, @dprotaso)

• A new setting, mesh-compatibility-mode, in the networking config map allows an administrator
  to explicitly tell Activator and Autoscaler to use Direct Pod IP (most efficient, but not compatible
  with mesh being enabled), Cluster IP (less efficient, but needed if mesh is enabled), or to
  Autodetect (the current behaviour, and the default, causes Activator and Autoscaler to first attempt
  Direct Pod IP communication, and then fall back to Cluster IP if it sees a mesh-related error status
  code). (#11999, @julz)

🐞 Bug Fixes

Uncategorized

• Adds more debug logs to background digest resolver (#11959, @julz)
• Dropped the startup probe on the queue-proxy which makes the pods start ~500ms quicker on average. (#11965, @markusthoemmes)
• Removes the ServiceName field from RevisionStatus which has been deprecated for several releases. This field was effectively equal to the revision name. (#11817, @julz)
• User-supplied readinessProbes with a probePeriod set greater than zero are no longer silently ignored after pod startup. (#11190, @julz)
• When enabled, queue proxy tracks the request count for each pod (disabled by default) (#11783, @psschwei)

Dependencies

🚨 Breaking or Notable

1. Fixes for K8s 1.22

Related issue: #11448

Our webhook parser no longer rejects unknown fields in an object's metadata. New fields were introduced in K8s 1.22 which caused Knative's webhook to reject certain operations.

2. Renaming of some net-kourier components

Related issue: knative/networking#448

As part of our efforts to GA/1.0 we've standardized on the naming of our networking plugins that are installed along side Serving. If you're managing your Knative deployment manually with kubectl this will require a two-phase upgrade process. In order to upgrade net-kourier to v0.25.0 using kubectl please follow the steps:

# Apply the new release
$ kubectl apply -f net-kourier.yaml

# Once the deployment is ready apply the same file but 
# prune the old resources
$ kubectl apply -f net-kourier.yaml \
  --prune -l networking.knative.dev/ingress-provider=kourier

3. Disabling namespace certificate provisioning legacy label

The namespace label networking.internal.knative.dev/disableWildcardCert has been deprecated since v0.15.0 release in favour of networking.knative.dev/disableWildcardCert. We have dropped support for this legacy label. (#11626, @nak3)

💫 New Features & Changes

• A feature flag is available to enable priorityClassName for Knative Services. See config-features for details. (#11746, @nealhu)
• Add memory metrics for HPA: hpa.autoscaling.knative.dev (#11668, @zhaojizhuang)
• Added app.kubernetes.io/name labels to resources. It will be replacing app labels in the future. (#11655, @upodroid)
• Containers[*].securityContext.runAsNonRoot can be set to true without a feature flag (#11606, @senthilnathan)
• Users can set spec.template.spec.automountServiceAccountToken to false in a PodSpec in order to opt-out of Kubenetes' default behaviour of mounting a ServiceAccount token in that Pod's containers. (#11723, @psschwei)
• Add v1beta1 version of DomainMapping crd (#11682, @julz)

🐞 Bug Fixes

• Set ENABLE_HTTP2_AUTO_DETECTION to false by default if the feature is not enabled. (#11760, @psschwei)

Dependencies

Changes by Kind

🚨 Breaking or Notable

1. Renaming of some net-* components

Related issue: knative/networking#448

As part of our efforts to GA/1.0 we've standardized on the naming of our networking plugins that are installed along side Serving. If you're managing your Knative deployment manually with kubectl this will require a two-phase upgrade process. Please see the below sections:

Upgrade of net-http01 to v0.24.0

# Apply the new release
$ kubectl apply -f net-http01.yaml

# Once the deployment is ready delete the old resources
$ kubectl delete deployment http01-controller -n knative-serving
$ kubectl delete service challenger -n knative-serving

Upgrade of net-certmanager to v0.24.0

# Apply the new release
$ kubectl apply -f net-certmanager.yaml

# Once the deployment is ready apply the same file but 
# prune the old resources
$ kubectl apply -f net-certmanager.yaml \
  --prune -l networking.knative.dev/certificate-provider=cert-manager

Upgrade net-istio to v0.24.0

# Apply the new release
$ kubectl apply -f net-istio.yaml

# Once the deployment is ready apply the same file but 
# prune the old resources
$ kubectl apply -f net-istio.yaml \
  --prune -l networking.knative.dev/ingress-provider=istio

Upgrade of net-contour to v0.24.0

# Apply the new release
$ kubectl apply -f net-contour.yaml

# Once the deployment is ready apply the same file but 
# prune the old resources
$ kubectl apply -f net-contour.yaml -f contour.yaml \
  --prune -l networking.knative.dev/ingress-provider=contour

Upgrade of namespace certificate controller to v0.24.0

# Apply the new release
$ kubectl apply -f serving-nscert.yaml

# Once the deployment is ready apply the same file but 
# prune the old resources
$ kubectl apply -f serving-nscert.yaml \
  --prune -l networking.knative.dev/wildcard-certificate-provider=nscert

Upgrade of net-kourier to v0.24.0

At this point we've defered the renaming to net-kourier until the next release. We're looking to ensure there is no traffic disruption as part of the upgrade. Thus upgrading to v0.24.0 requires no special instructions.

2. Kubernetes 1.19 is now required

As part of our Kubernetes Minimum Version Principle we now have a hard requirement on Kubernetes Version 1.19.

3. Webhook/Controller RBAC changes

The recommended way to delete a Knative installation is to run kubectl delete -f serving-core.yaml and other release YAMLs you may have applied. There's been a misconception that deleting the knative-serving namespace will perform a similar cleanup but this does not remove cluster scoped resources. In prior releases the cluster state would have prevented the reinstall of Knative Serving. We've addressed this problem but it will require some RBAC permissions on namespaces & finalizers.

Please see the relevant issues & PRs:

• Original issue: knative/pkg#2044
• Workaround: (knative/pkg#2098, @novahe)
• knative-serving-core cluster role has requires permission for namespaces/finalizers. (#11517, @nak3)

4. DomainMapping feature is now BETA

This means it is built in to the main serving-core yaml by default. It is still possible to opt out of the feature by setting replica count of the domainmapping-controller to zero.

As part of this transition the default value for autocreateClusterDomainClaims in the config-network config map has been changed to false meaning cluster-wide permissions are required to delegate the ability to create particular DomainMappings to namespaces.Single tenant clusters may wish to allow arbitrary users to create Domain Mappings by changing this value back to true. (#11573, @julz)

💫 New Features & Changes

• Allow dropping capabilities from a container's security context (#11344, @psschwei)
• Domainmapping can now specify a tls secret to be used as the https certificate (#11250, @shinigambit)
• Provides a feature gate that, when enabled, allows adding capabilities from a container's security context (#11410, @psschwei)
• defaultExternalScheme can now be used to default routes to surface a URL scheme of your choice rather than the default "http". (#11480, @markusthoemmes)
• Optimized generated routes to minimize Envoy configuration size (net-istio#632, @howardjohn)
• Rename Contonr's ClusterRole and ClusterRoleBinding to differ from existing contour installation (net-contour#500, @izabelacg)
• Add a new ConfigMap config-kourier, with the initial enable-service-access-logging setting (net-kourier#523, @markusthoemmes)

🐞 Bug Fixes

• Fixed a bug where traffic would briefly be routed 'wrong', leading to errors due to exceeded queues in deployments with a large activator count and a low service pod count. (#11375, @markusthoemmes)
• Traffic status in Route is updated whenever traffic configuration was wrong. (#11477, @nak3)
• Validates, consistently with other configmaps, that the _example section of the features configmap is not accidentally modified. (#11391, @julz)

Dependencies Changes