Skip to main content
Version: 1.33.3

SIGHUP Distribution Release v1.33.3

Welcome to SD release v1.33.3.

The distribution is maintained with ❤️ by the team SIGHUP by ReeVo.

This patch release backports the v1.35.0 and v1.35.1 module updates and features to the v1.33 line, while keeping Kubernetes 1.33 as the supported minor version. It targets Kubernetes v1.33.12 on-premises (bumped from 1.33.7 in v1.33.2) and continues to support EKS 1.33.

Installer Updates​

  • on-premises 📦 installer: v1.35.5
    • Installs Kubernetes version 1.33.12 and adds support for Kubernetes v1.34.8.
    • Updates etcd, containerd and runc.
  • eks 📦 installer: v3.5.0
    • Verified compatibility with Kubernetes 1.33.

Module updates 📦​

  • aws 📦 provider module: v5.3.0
    • Bumps cluster-autoscaler to v1.35.0, aws-load-balancer-controller to v3.4.0 and aws-node-termination-handler to v1.25.6.
  • auth 📦 core module: v0.7.0
    • Bumps Dex to v2.45.1, Gangplank to v1.2.1 and Pomerium to v0.32.7.
  • dr 📦 core module: v3.4.0
    • Bumps Velero to v1.18.1 and Velero plugins to v1.14.1 (AWS, Microsoft Azure and GCP).
    • Updates MinIO image to the Chainguard fork.
  • ingress 📦 core module: v5.1.0
    • Bumps cert-manager to v1.20.2, ExternalDNS to v0.21.0 and HAProxy to v3.2.8.
    • Updates NGINX images to the Chainguard fork v1.15.5.
  • logging 📦 core module: v5.4.0
    • Bumps OpenSearch to v3.7.0, OpenSearch Dashboard to v3.7.0, Logging operator to v6.5.1 and Loki to v3.7.2.
    • Updates MinIO image to the Chainguard fork.
    • Enables OpenSearch Dashboards Explore.
    • Adds access-log-exporter sidecar to the gateway for NGINX metrics.
    • Requires module-ingress >= v5.0.0 due to updated ingress-nginx log regex expecting the $host field.
  • monitoring 📦 core module: v4.2.0
    • Bumps AlertManager to v0.31.1, Blackbox exporter to v0.28.0, Grafana to v12.4.1, Kubernetes RBAC proxy to v0.21.0, Kubernetes state metrics to v2.18.0, Node exporter to v1.10.2, Prometheus operator to v0.89.0, Prometheus operated to v3.10.0, x509 exporter to v4.1.0 and Mimir to v3.0.4.
    • Updates MinIO image to the Chainguard fork.
    • Enables Grafana Drilldown dashboard.
    • Fixes some broken dashboard metrics, x509-exporter certificate watch paths and Grafana alerts.
  • networking 📦 core module: v4.0.0
    • Bumps Cilium to v1.18.11 and Tigera to v1.40.13.
    • Enables Whisker observability UI.
  • policy 📦 core module: v1.17.0
    • Bumps Gatekeeper to v3.22.2, Gatekeeper Policy Manager to v1.1.1 and Kyverno to v1.18.1.
  • tracing 📦 core module: v1.5.0
    • Bumps tempo-distributed to v2.10.5.
    • Updates MinIO image to the Chainguard fork.

New features 🌟​

  • [#504] Add Whisker Network Observability UI tool for clusters using Tigera Calico as CNI.
  • [#519] Allow overriding the pomerium auth ingress through spec.distribution.modules.auth.overrides.ingresses.pomerium.
  • [#527] The distribution is now a data-only repository: it no longer ships the generated Go types. It provides the public JSON schemas, defaults, templates, rules and kfd.yaml. furyctl now owns its config types (see furyctl#674), so integrators that previously imported the generated Go library should migrate accordingly.
  • [#530] Add support for a per-host dnsZone override in furyctl.yaml for masters, etcd, nodes, and loadBalancers host entries. When set on a host, the local value takes precedence over the global spec.kubernetes.dnsZone when computing kubernetes_hostname and etcd_initial_cluster. This makes it possible to assign different FQDNs to hosts in different DNS zones.
  • [#539] Pin ansible (with its python + uv build toolchain and the galaxy collections) under tools.common in kfd.yaml, so furyctl installs a self-contained, versioned Ansible via the bundled mise for the OnPremises kind instead of requiring it on the host. Optional and backward compatible: distributions without the block keep using the host Ansible.
  • [#543] New customResources distribution field: add a new customResources field under the distribution phase configuration that allows the deployment of custom resources together with the distribution phase. This allows to solve some cyclic dependencies that could arise using Kustomize Plugins (like the storage). Plugins remain the preferred way to deploy additional resources.
  • [#553] EKSCluster: added schema validation to require at least one of privateAccess or publicAccess to be true in the Kubernetes API server configuration.
  • [#554] Monitoring: bump PrometheusAgent version to 3.10.0

Bug Fixes 🐛​

  • [#515] Don't try to delete Kyverno Policies when CRDs are not present: the distribution pre-apply script tried to delete the default Kyverno policies even when the CRDs were not present in the cluster. Now the script checks for the CRDs before attempting to delete them.
  • [#532] Fix worker nodes not receiving custom registry in OnPremises clusters: kubernetes_image_registry was placed under master.vars instead of all.vars in the generated hosts.yaml, causing worker nodes to fall back to the default registry.sighup.io/fury/on-premises registry for the pause container (sandbox_image).
  • [#537] Fix PrometheusOperatorRejectedResources false positive: Deploy the AlertmanagerConfigs included with the monitoring module only when URLs are set for the webhooks they use, otherwise a PrometheusOperatorRejectedResources alert would be triggered because of missing Secrets causing alert noise.
  • [#549] Fix Gatekeeper Policy Manager NetworkPolicy blocking ingress traffic when auth provider is not SSO.
  • [#555] Monitoring templates: don't try to patch the alertmanagerConfigs when they are not being deployed at all.
  • [#564] OnPremises: fixed a race in the preflight verify-playbook.yaml where fetching admin.conf from multiple masters in parallel could randomly fail with a checksum mismatch.
  • [#580] EKSCluster: add a kapp rebase rule so spec.loadBalancerClass on the HAProxy LoadBalancer Services always keeps value the AWS Load Balancer Controller webhook already set on them, instead of trying to clear it during the upgrade.

Breaking changes 💔​

  • [#505] Support NFTables mode for kube-proxy in on-premises clusters. Now the boolean kubeProxy.enabled field is removed and replaced by the kubeProxy.type enum (ipvs, nftables, none). Migrate existing configurations as follows: enabled: false becomes type: none; enabled: true (or the field omitted) becomes type: ipvs, which is also the default when type is omitted.
  • [#519] For the EKSCluster and KFDDistribution kinds, spec.distribution.modules.auth.overrides.ingresses now only accepts the gangplank, dex and pomerium keys. Previously any key was accepted; configurations using other keys will now fail schema validation.

Upgrade procedure​

Check the upgrade docs for the steps to upgrade the SIGHUP Distribution from one version to the next using furyctl.