Google Distributed Cloud (software only) for bare metal 1.30 release notes

This document lists production updates to Google Distributed Cloud (software only) for bare metal (formerly known as Google Distributed Cloud Virtual, previously known as Anthos clusters on bare metal). Check this page periodically for any new announcements.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

November 22, 2024

Release 1.30.300-gke.84

Google Distributed Cloud for bare metal 1.30.300-gke.84 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.30.300-gke.84 runs on Kubernetes 1.30.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixes:

• Fixed an issue where the control plane VIP might become unavailable because Keepalived didn't check correctly that the VIP is on a node with a responsive HAProxy.

• Fixed an issue where the registry mirror reachability check fails for a single unreachable registry mirror. Now the reachability check applies to configured registry mirrors only, instead of all registry mirrors.

The following container image security vulnerabilities have been fixed in 1.30.300-gke.84:

• Low-severity container vulnerabilities:

  • CVE-2024-43167

  • CVE-2024-43168

Known issues:

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

October 10, 2024

Release 1.30.200-gke.101

Google Distributed Cloud for bare metal 1.30.200-gke.101 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.30.200-gke.101 runs on Kubernetes 1.30.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Updated the bmctl update command to identify differences (if any) between the preview feature annotations in the cluster configuration file and the annotations in the deployed Cluster resource.

Fixes:

• Fixed an issue where the control plane VIP might become unavailable because Keepalived didn't check correctly that the VIP is on a node with a responsive HAProxy.

• Fixed Cloud Audit Logging failure due to allowlisting issue with multiple project IDs.

The following container image security vulnerabilities have been fixed in 1.30.200-gke.101:

• Critical container vulnerabilities:

  • CVE-2024-37371

• High-severity container vulnerabilities:

  • CVE-2023-47038

  • CVE-2024-0553

  • CVE-2024-0567

  • CVE-2024-37370

  • CVE-2024-39487

  • CVE-2024-41040

  • CVE-2024-41046

  • CVE-2024-41049

  • CVE-2024-41059

  • CVE-2024-41070

  • CVE-2024-42104

  • CVE-2024-42148

• Medium-severity container vulnerabilities:

  • CVE-2016-3709

  • CVE-2023-5981

  • CVE-2024-36901

  • CVE-2024-36938

  • CVE-2024-41009

  • CVE-2024-41012

  • CVE-2024-41055

  • CVE-2024-41063

  • CVE-2024-41064

  • CVE-2024-42101

  • CVE-2024-42102

  • CVE-2024-42131

  • CVE-2024-42137

  • CVE-2024-42152

  • CVE-2024-42153

  • CVE-2024-42154

  • CVE-2024-42157

  • CVE-2024-42161

  • CVE-2024-42223

  • CVE-2024-42224

  • CVE-2024-42229

  • CVE-2024-42232

  • CVE-2024-42236

  • CVE-2024-42244

  • CVE-2024-42247

  • CVE-2024-7264

• Low-severity container vulnerabilities:

  • CVE-2022-2309

  • CVE-2022-48303

  • CVE-2024-41007

Known issues:

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

September 25, 2024

Release 1.30.100-gke.96

Google Distributed Cloud for bare metal 1.30.100-gke.96 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.30.100-gke.96 runs on Kubernetes 1.30.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Functionality changes:

• Added --skip-preflight flag to the bmctl upgrade command to prevent preflight checks from running during an upgrade.

The following container image security vulnerabilities have been fixed in 1.30.100-gke.96:

• High-severity container vulnerabilities:

  • CVE-2020-22218

  • CVE-2024-7348

  • GHSA-87m9-rv8p-rgmg

• Medium-severity container vulnerabilities:

  • CVE-2024-6104

  • GHSA-mh55-gqvf-xfwm

Known issues:

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

August 29, 2024

Release 1.30.0-gke.1930

Google Distributed Cloud for bare metal 1.30.0-gke.1930 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.30.0-gke.1930 runs on Kubernetes 1.30.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Version 1.16 end of life: In accordance with the Version Support Policy, version 1.16 (all patch releases) of Google Distributed Cloud for bare metal has reached its end of life and is no longer supported.

New and updated features:

• Preview: Added support for keyless mode for clusters. This feature uses short-lived tokens and Workload Identity Federation for your cluster and workload credentials, instead of the default long-lived service account keys and Kubernetes Secrets. This feature provides improved security and reduces credential maintenance.

• Preview: Added support for Custom Scheduler Configuration for pods to automatically spread workloads across cluster nodes for increased reliability.

• GA: Added support for admin and hybrid clusters to manage multiple versions of user clusters concurrently.

• GA: Added support for node-level private registry configuration for workload images.

• GA: Updated the bmctl update command to display the difference between the specs in the YAML cluster configuration file and the deployed Cluster resource. The diff covers the specs for both the Cluster resource and the NodePool resource.

• GA: Added support for rolling back select node pool upgrades.

• GA: Added support for specifying a session duration for Identity Service-issued tokens. You can set a session duration between 15 and 1440 minutes (24 hours). Shorter sessions provide better security (at the cost of more frequent reauthentication). Longer sessions reduce the frequency for reauthentication (at the cost of reduced security).

• Preview: Updated the gcloud beta container fleet memberships get-credentials command to use a connect gateway preview feature that lets you run the kubectl attach, cp, and exec commands. For more information, see Limitations.

Functionality changes:

• Updated the node pool upgrade behavior. Version 1.30 and higher clusters, support all node pool versions from the preceding two minor versions. The preview.baremetal.cluster.gke.io/two-minor-version-node-pool: enable annotation isn't required when upgrading clusters from version 1.29 to version 1.30.

• Updated the bmctl version command to return the metadata image digest in the response. To print only the metadata image digest only, specify the new --option value metadata-digest.

• Deprecated the spec.gkeVersion field in the Machine custom resource. Starting with version 1.30.0, the spec.gkeVersion field is set to empty. For accurate version information, use anthosBareMetalVersion (GDC for bare metal version) in the Cluster resource spec or gkeVersion (Kubernetes version) in the Cluster resource status.

• Updated Kubernetes audit logging to include request and response payloads from the Kubernetes API server for bare metal custom resources, such as Cluster, NodePool, BareMetalMachine, and BareMetalCluster.

• Updated registry mirror support to allow you to specify a port for host addresses.

• Updated the networking preflight check to verify that either the ip_tables or the nf_tables kernel module is available for loading, instead of being explicitly loaded.

• Updated the stackdriver custom resource to remove the feature gate for using Managed Service for Prometheus for system metrics featureGates.GMPForSystemMetrics. This feature gate has defaulted to on (true) since version 1.16. If you have manually disabled using Managed Service for Prometheus for system metrics, upgrading to version 1.30 might be a breaking change for some system metrics formats.

• Added checks to validate the SSH client certificate file type before saving the certificate as a Secret.

• Updated GKE Identity Service custom resource definition to change the description for IdentityServiceOptions and improve formatting.

• Added preflight checks for available disk space in specific directories:

  • During cluster creation, the following directories are checked:

    • / (the root directory) has at least 4 GiB of free space

    • /var/log/fluent-bit-buffers has at least 12 GiB of free space

    • /var/opt/buffered-metrics has at least 10016 MiB of free space

  • During a cluster upgrade, the following directory is checked:

    • / (the root directory) has at least 2 GiB of free space

• GA: Adopted the GKE audit policy, instead of the previous unpopulated policy.

Fixes:

• Fixed an issue where old, inoperable WebHook resources caused problems with cluster upgrades.

• Fixed an issue where upgraded clusters didn't get label updates that match the labels applied for newly created clusters, for a given version.

• Fixed an issue where service accounts created by using the --create-service-accounts flag with the bmctl create config command don't have enough permissions.

• Fixed an issue where the kubelet doesn't honor shortened, 1-second grace period for pod deletion during eviction-based draining.

The following container image security vulnerabilities have been fixed in 1.30.0-gke.1930:

• High-severity container vulnerabilities:

  • CVE-2019-16884

  • CVE-2021-30465

  • CVE-2021-33194

  • CVE-2021-38561

  • CVE-2021-43565

  • CVE-2021-43816

  • CVE-2022-23648

  • CVE-2022-27191

  • CVE-2022-27664

  • CVE-2022-32149

  • CVE-2022-41723

  • CVE-2022-43945

  • CVE-2022-48655

  • CVE-2023-6270

  • CVE-2023-39323

  • CVE-2023-45285

  • CVE-2023-45287

  • CVE-2023-52434

  • CVE-2023-52447

  • CVE-2024-0565

  • CVE-2024-0841

  • CVE-2024-0985

  • CVE-2024-21626

  • CVE-2024-26581

  • CVE-2024-26593

  • CVE-2024-26882

  • CVE-2024-26883

  • CVE-2024-26884

  • CVE-2024-26885

  • CVE-2024-26898

  • CVE-2024-26907

  • CVE-2024-26934

  • CVE-2024-27020

  • CVE-2024-36971

  • CVE-2024-36978

  • CVE-2024-38583

  • CVE-2024-39480

  • CVE-2024-39495

  • CVE-2024-40902

  • CVE-2024-41000

  • CVE-2024-41087

  • CVE-2024-41092

• Medium-severity container vulnerabilities:

  • CVE-2019-19921

  • CVE-2021-31525

  • CVE-2021-32760

  • CVE-2021-41103

  • CVE-2021-43784

  • CVE-2022-23471

  • CVE-2022-29162

  • CVE-2022-29526

  • CVE-2022-31030

  • CVE-2022-38096

  • CVE-2022-40735

  • CVE-2022-41717

  • CVE-2023-7042

  • CVE-2023-25153

  • CVE-2023-25173

  • CVE-2023-28642

  • CVE-2023-39318

  • CVE-2023-39319

  • CVE-2023-39326

  • CVE-2023-47233

  • CVE-2023-48795

  • CVE-2023-52429

  • CVE-2023-52435

  • CVE-2023-52458

  • CVE-2024-0340

  • CVE-2024-0607

  • CVE-2024-2961

  • CVE-2024-22099

  • CVE-2024-23849

  • CVE-2024-23850

  • CVE-2024-23851

  • CVE-2024-24857

  • CVE-2024-24858

  • CVE-2024-24861

  • CVE-2024-25739

  • CVE-2024-26600

  • CVE-2024-26601

  • CVE-2024-26602

  • CVE-2024-26606

  • CVE-2024-26900

  • CVE-2024-26901

  • CVE-2024-26903

  • CVE-2024-26910

  • CVE-2024-26978

  • CVE-2024-27013

  • CVE-2024-27019

  • CVE-2024-28122

  • CVE-2024-28182

  • CVE-2024-33599

  • CVE-2024-33600

  • CVE-2024-33601

  • CVE-2024-33602

  • CVE-2024-35255

  • CVE-2024-35978

  • CVE-2024-35982

  • CVE-2024-35984

  • CVE-2024-35990

  • CVE-2024-35997

  • CVE-2024-36008

  • CVE-2024-36288

  • CVE-2024-36902

  • CVE-2024-37370

  • CVE-2024-37371

  • CVE-2024-38662

  • CVE-2024-38780

  • CVE-2024-39292

  • CVE-2024-39475

  • CVE-2024-39476

  • CVE-2024-39482

  • CVE-2024-39484

  • CVE-2024-39489

  • CVE-2024-39493

  • CVE-2024-40960

  • CVE-2024-40961

  • CVE-2024-40995

  • CVE-2024-41006

  • CVE-2024-41089

  • CVE-2024-41095

  • CVE-2024-42070

  • CVE-2024-42076

  • CVE-2024-42077

  • CVE-2024-42082

  • GHSA-6xv5-86q9-7xr8

  • GHSA-7ww5-4wqc-m92c

• Low-severity container vulnerabilities:

  • CVE-2021-4440

  • CVE-2023-5363

  • CVE-2023-6246

  • CVE-2023-6779

  • CVE-2023-6780

  • CVE-2023-25809

  • CVE-2024-2511

  • CVE-2024-4741

  • CVE-2024-5535

  • GHSA-5j5w-g665-5m35

  • GHSA-77vh-xpmg-72qh

  • GHSA-c9cp-9c75-9v8c

Known issues:

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.