Changes

Enhancement

• Add macOS development support via Lima VM with automatic cross-compilation for external x86_64
  clusters. (#1511, @emy)
• Kubernetes-nmstate can now be installed with Helm: helm install nmstate oci://quay.io/nmstate/kubernetes-nmstate -n nmstate --create-namespace. The Helm chart is the source of truth for operator deployment manifests; OLM and release-manifest installation methods are unchanged. (#1547, @Copilot)
• Replace all instances of interface{} with any alias for improved Go 1.18+ compatibility (#1510, @qinqon)

Bug or Regression

• Broaden stale count cleanup to detect all non-available enactments, not just progressing (#1542, @emy)
• Disable unused metrics server on handler, webhook, and cert-manager components to avoid exposing unnecessary HTTPS ports. (#1512, @qinqon)
• Fix OpenShift conformance failure by adding workload management annotation to console plugin deployment. (#1474, @qinqon)
• Fix arm64 handler image build failure when using nmstate-git from Copr by explicitly specifying the centos-stream-9 chroot name instead of relying on dnf auto-detection. (#1533, @qinqon)
• Fix handler crash loop when default network interface is temporarily reconfigured by eliminating API server dependency at startup for TLS configuration. (#1467, @qinqon)
• Fix handler liveness probe "short write" errors by limiting nmstatectl output to the loopback interface only (#1486, @nmstate-ai[bot])
• Fix operator reconcile failure caused by missing nmstates/finalizers
  RBAC permission after security hardening in #1520. (#1541, @mkowalski)

Uncategorized

• Add s390x support to lint and container build scripts. (#1517, @ashokpariya0)
• Add s390x architecture support to kubernetes-nmstate handler and operator container images. (#1530, @ashokpariya0)
• Bump Go to 1.26 and update dependencies to fix security vulnerabilities in golang.org/x/net and go.opentelemetry.io/otel (#1540, @mkowalski)
• Fix NMState CR becoming permanently stuck in Degraded state after transient
  errors due to SSA field manager conflicts between reconcileStatus() and
  setDegradedCondition() using inconsistent status update mechanisms. (#1552, @mkowalski)
• TLS security profile handling now strictly adheres to the cluster-wide configuration: custom profile curves (TLS key exchange groups, including post-quantum X25519MLKEM768) are honored, unknown or unhonorable profiles fail closed instead of falling back to defaults, and partially unsupported profile entries are reported through a new TLSProfileNotFullyHonored Degraded condition on the NMState CR. (#1554, @mkowalski)

Installation

With Helm

Install the operator and the handler with a single command, using
Helm (>= 3.8):

helm install nmstate oci://quay.io/nmstate/kubernetes-nmstate \
  --version 0.87.0 \
  --namespace nmstate \
  --create-namespace

This deploys the operator and, by default (nmstate.enabled=true), an
NMState custom resource that makes the operator deploy the
kubernetes-nmstate handler on all nodes.

With manifests

First, install kubernetes-nmstate operator:

kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/nmstate.io_nmstates.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/namespace.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/service_account.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/role.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/role_binding.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.87.0/operator.yaml

Once that's done, create an NMState CR, triggering deployment of
kubernetes-nmstate handler:

cat <<EOF | kubectl create -f -
apiVersion: nmstate.io/v1
kind: NMState
metadata:
  name: nmstate
EOF

Changes

Enhancement

• Kube-rbac-proxy is not used any more.
• If TLS profile is available on the platform (now only implemented for OpenShift), it will be used for webhook and metrics server. Configuration will be dynamically updated when the profile changes. (#1453, @mkowalski)
• New metrics kubernetes_nmstate_network_interfaces and kubernetes_nmstate_routes are introduced to track number of network interfaces and number of routes configured per node. (#1414, @mkowalski)
• New metrics, kubernetes_nmstate_policies_status and kubernetes_nmstate_enactments_status, are now available to control the status of applied NNCPs and their corresponding NNCEs. (#1458, @mkowalski)
• Remove networkmanager-go dependency (#1406, @qinqon)
• Remove nodeAffinity for node-role.kubernetes.io/master (only used in Kubernetes < 1.24) (#1422, @koendelaat)
• Replace NNCP validating webhooks with CRD-level CEL and ValidatingAdmissionPolicy for always-on, in-API-server validation (#1437, @qinqon)
• terminationMessagePolicy is now set to FallbackToLogsOnError for all the pods. (#1405, @mkowalski)

Bug or Regression

• Fix applied features gauge double-counting by using absolute Set/Delete instead of incremental Inc/Dec (#1439, @qinqon)
• Fix console plugin pod using the default service account, which violated OpenShift's no-default-service-account policy. (#1451, @qinqon)
• NNCP will not be in a reconcile deadlock after an unexpected cluster/handler restart. (#1427, @emy)
• Prevent apply exhausted or deleted policies on spurious reconcile (#1440, @qinqon)
• Reset NNCE conditions on policy generation change (#1442, @qinqon)
• The Pending() and NotPending() methods were incorrectly using progressing() instead of pending(), returning wrong counts. (#1430, @qinqon)
• Use NNCE pending to calculate NNCP Status (#1431, @qinqon)
• When deployed on OpenShift clusters, namespace is now annotated with openshift.io/node-selector: "". Thanks to this, deployments using custom scheduler do not need any manual action to run correctly. (#1409, @mkowalski)
• openshift.io/node-selector was mistakenly added as a label and not as an annotation to the namespace. It is now fixed (#1425, @mkowalski)

Uncategorized

• Clean up licensing of this project. The top level readme wrongly states this was a GLP-2.0 project whereas every file containing source code had Apache-2.0 header. We now make sure everything is aligned to Apache-2.0. (#1408, @mkowalski)
• Fix ValidatingAdmissionPolicy CEL expression crash when NNCP condition has no reason field, which blocked policy updates and caused intermittent CI timeouts. (#1462, @qinqon)
• Migrate documentation site from Jekyll (Ruby) to Hugo (Go) with Docsy theme (#1445, @qinqon)
• NodeNetworkState does not contain preferred-life-time and valid-life-time any more. Instead, dynamic: true is added. This is at status.currentState.interfaces[].ipv4.address (and respectively for IPv6). (#1413, @mkowalski)
• We now use golang 1.25 and controller-runtime v0.23.2 (#1452, @mkowalski)

Installation

First, install kubernetes-nmstate operator:

kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/nmstate.io_nmstates.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/namespace.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/service_account.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/role.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/role_binding.yaml
kubectl apply -f https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.86.0/operator.yaml

Once that's done, create an NMState CR, triggering deployment of
kubernetes-nmstate handler:

cat <<EOF | kubectl create -f -
apiVersion: nmstate.io/v1
kind: NMState
metadata:
  name: nmstate
EOF