Platform9 Managed Kubernetes Release Notes

Platform9 Managed Kubernetes Version 5.2 Release Notes

Platform9 release 5.2 is now available, bringing support for Ubuntu 20.04, Kubernetes 1.20, new dashboards to view alarms across clusters, the ability to snooze alarms and support for etcd secret encryption.

Release Highlights

Etcd Secrets Encryption

Platform9 now supports Secrets Encryption at Rest. To setup a cluster to use Secrets Encryption the encryption provider config YAML needs to be created on each master node prior to creating the cluster and must reside under /var/opt/pf9/kube/apiserver-config directory and the same absolute path must be provided when creating the cluster

• "apiServerFlags": "--encryption-provider-config=/var/opt/pf9/kube/apiserver-config/encryption-provider.yaml"

To enable secrets encrpyiont add the following custom API Server Flag "apiServerFlags": "--encryption-provider-config=/var/opt/pf9/kube/apiserver-config/encryption-provider.yaml"

It is recommend that the keys be managed by a KMS solution. Known limitation: Keys used to encrypt etcd secrets must be manually rotated."

Ubuntu 20.04 Support

Ubuntu 20.04 support is limited to clusters running Kubernetes version 1.20 and later. New Clusters can be created using Ubuntu 20.04 nodes. Existing clusters must first be upgraded to Kubernetes 1.20 and then each node can be upgraded in place following the instructions provided by Ubuntu.

Kubernetes 1.20

This release includes support for Kubernetes 1.18, 1.19, 1.20 and deprecates support for Kubernetes 1.17. Version 1.17 is included to allow clusters running 1.17 to be scaled. Platform9 recommends all clusters running 1.17 be upgraded.

Dynamic Add-on Management

Clusters running Kubernetes 1.20 are able to take advantage of the Platform9 Add-on Managment API. The Add-on Managment API enables the dynamic management of cluster add-ons such as MetalLB, Autoscaler (AWS and Azure), CoreDNS, Metrics-Server and the Kubernetes Dashboard.

Enhancements & Updates

New Enterprise & Growth - Added the ability to create support tickets directly from the Help page.

New Enterprise - Users can now chat directly with Platform9 without leaving the product.

New When using the Platform9 Network Operator or KubeVirt Calico is set automatically as the Cluster CNI

Updated The workflow for Self Service Users to update their password.

New Users can now create AWS clusters without Route53. Creating a cluster without specifying a Route53 Domain, API Server FQDN and Services FQDN will result in Platform9 utilizing the native AWS endpoints made available by the AWS ELB that is provisioning as part of the cluster.

Updated We moved the Upgrade Available notification to be under the Kubernetes Version on the Infrastructure dashboard.

Updated We added additional help to the Advanced Node Onboarding dashboard.

New Monitoring Overview dashboard to make it quick and easy to find alarms across all clusters.

New Alarms tab to the Cluster Details dashboard to make it easy to view active alarms impacting a cluster.

New Snooze Alarms. We have added the ability to snooze active alarms, select any alarm and choose ‘snooze’ from the alarm table action bar.

New useHostname API field has been added to cluster creation. Setting useHostname to true when creating a cluster will cause all nodes in the cluster to be registered using their hostname instead of IP address. This requires working DNS resolution for kubectl logs and kubectl exec commands to work with this option set. This parameter is ignored when deploying clusters on public clouds - AWS, Azure, and when deploying BareOS IPv6 clusters.

New We have added the ability to specify custom API, Controller and Scheduler flags during cluster creation. This feature should only be used in collaboration with Platform9 Support as specifying invalid flags will result in an inoperable cluster.

Bug Fixes

Fixed an issue impacting the default Deployment yaml template.

Fixed Freedom Plan - a bug that prevented new clusters from being attached to existing Helm Repositories

Fixed an issue that was impacting deploying apps using the Platform9 Helm Service.

Fixed an issue impacting SSO Group Federation.

Fixed a bug that was preventing users from selecting a namespace when deploying Pods using the UI.

Fixed a bug that was causing alarm data to display incorrectly.

Fixed an issue that would cause a grey screen to appear when a cluster was deleted.

Fixed an issue has been resolved that would cause BareOS nodes to show as healthy when they were not.

Fixed a problem that was impacting the Application Catalog Services.

Fixed a bug that was causing excessive logging of "No such file or directory" by the Platform9 hostAgent.

Fixed an issue that was impacting PF9 Express from running in environments with proxy requirements

Fixed an issue that would cause clusters built on CentOS and using Calico to fail.

Package Updates

The following packed components have been upgraded:

• Kubernetes – v1.20.5
• Calico v3.18.1
• etcd – v3.4.14

Please refer to the Managed Kubernetes Support Matrix for v5.2 to view all currently-deployed or supported upstream component versions.

Early Access Features

The following features are part of the (Link Removed):

• Kubevirt: Platform9 now supports Kubevirt as part of our Early Access program. Kubevirt can be enabled during cluster creation, once enable VMs can be created using YAML. Learn more at virtualization on Kubernetes.. New: Kubevirt Early Access - View running Virtual Machine details with the VM Details dashboard. New: Kubevirt Early Access - View all running virtual machines on the Kubevirt dashboards

Known Issues

Known Issue Calico IPAM is only supported when using Calico CNI

Known Issue Calico IPIP is not supported on IPv6 clusters. IPv6 clusters should be created with IPIP set to Never.

Known Issue Deregistering an EKS cluster will only remove it from Platform9. If Platform9 monitoring has deployed on the EKS cluster, it will not be removed. The monitoring stack has to be removed manually before deregistering the cluster.

Known Issue EKS Cluster Import "401 Unauthorized" Notification and Empty Dashboards. If an AWS Cloud Provider is configured to import clusters without the AWS identity being added to the Clusters "system:masters" config-map Platform9 will be unable to access the cluster. It's important to note that if you have used a Cloud Provider to register an EKS cluster that was created with IAM user credentials that don't have access to the EKS K8s cluster Platform9 will fail with 401 Unauthorized error until that IAM user is given access to the K8s cluster. View the EKS documentation here to ensure the correct access has been provisioned at for each imported cluster. https://aws.amazon.com/premiumsupport/knowledge-center/amazon-eks-cluster-access/

Known Issue Platform9 monitoring won't work on ARM-based nodes on EKS.

Known Issue EKS Clusters running within a Private only VPC will be imported in a read-only mode and no Kubernetes data will be available.

Known Issue EKS Cluster running within a Private VPC will not show any data on the Workloads, RBAC, Monitoring and Storage Dashboards.