Google Distributed Cloud air-gapped 1.12.4 release notes

August 26, 2024

Google Distributed Cloud (GDC) air-gapped 1.12.4 is available.
See the product overview to learn about the features of Distributed Cloud.

Updated the Canonical Ubuntu OS image version to 20240621 to apply the latest security patches and important updates. To take advantage of the bug and security vulnerability fixes, you must upgrade all nodes with each release. The following security vulnerabilities are fixed:

The following container image security vulnerabilities are fixed:

Fixed vulnerabilities in the GDC console where strict transport security was not enforced.

Fixed a vulnerability with Microsoft Visual Studio Code in Operations Suite Infrastructure (OI) by updating Microsoft Visual Studio Code to version 1.88.1.

Backup and restore:

  • Persistent volumes that are backed up cannot be deleted.

Billing:

  • The bil-storage-system-cluster subcomponent fails to reconcile due to stale jobs.

Block storage:

  • Grafana pods stuck in Init state due to volume mount errors.

DNS:

  • Org creation fails because DNS traffic to the root admin node ages out.

Istio:

  • The istio-eastwestgateway deployment in the istio-system namespace is stuck.

Logging:

  • The write-ahead log (WAL) can fill the persistent volume (PV) if a Loki pod cannot connect to the storage bucket for hours.

Networking

  • A PodCIDR is not assigned to nodes even though a ClusterCIDRConfig is created.

Object storage:

  • The creation of a new org gets stuck on the VMImageDistributing state.
  • Some object storage upgrade warnings can be ignored.

Operations Suite Infrastructure (OI) :

  • The Fluent Bit installer path is incorrect.
  • The Nessus installer path is incorrect.

Performance:

  • The perf-ptaas subcomponent fails to reconcile due to failure to transfer ownership.

Physical servers:

  • The server bootstrap fails.

  • The server's iLO can't connect to key manager.

Upgrade:

  • The management IP of a server is unreachable during upgrade.
  • A provisioned server might fail to boot and get stuck at retrieving encryption keys.
  • There is an issue with ongoing reconciliation in a subcomponent.
  • When upgrading from 1.12.2 to 1.12.4, the file-netapp-trident subcomponent is stuck on the deletion of StorageClasses.
  • An ansibleplaybook is not upgraded as part of the cluster upgrade.
  • The IAM preflight check fails.
  • The version number for storagecluster is not displayed during upgrade.
  • OrganizationUpgrade status is Unknown, after an upgrade is completed.
  • The opa gatekeeper subcomponent upgrade fails.
  • Jobs are scheduled continuously.
  • The file-netapp-trident subcomponent upgrade has a Reconciliation ongoing status.
  • The system cluster cluster worker node upgrade fails to generate the delta between manifest and snapshot.
  • kubelet fails to remove cgroup for pods with spamming logs.
  • A healthy upstream for the ticketing system is not available.

Vertex AI:

  • The MonitoringTarget shows a Not Ready status when user clusters are being created, causing pre-trained APIs to continually show an Enabling state in the user interface.

Backup and restore:

  • Fixed an issue where alerts for a backup repository may fire even when the repository is healthy.

Block storage:

  • Fixed an issue where HSM certificates in the StorageClusterReconciler are not parsed correctly.
  • Fixed an issue where performance storage classes don't have LUKS encryption enabled.

Cluster management:

  • Fixed an issue where user clusters with Kubernetes version 1.27.x might have node pools that fail to initialize.

Hardware security module:

  • Fixed an issue where a rotatable secret for hardware security modules is in an unknown state.

Identity and access management

  • Fixed an issue where running the elevated access script added a duplicate entry in the kustomization.yaml file.

Monitoring:

  • Fixed an issue where the mon-common subcomponent doesn't deploy the Istio Telemetry object on the mon-system namespace.
  • Fixed an issue where the metrics storage class is incorrectly defined in the configuration.
  • Fixed an issue where the Prober ConfigMap gets reset to include no probe jobs.

NTP server:

  • Fixed an issue with the NTP server having unsynchronized time.

Physical servers:

  • Fixed an issue where the server bootstrap fails due to a nil pointer dereference.

Resource Manager:

  • Fixed an issue where ProjectRoleBinding custom resources were propagating to Kubernetes clusters that weren't ready.

Ticketing system:

  • Fixed an issue where the ticketing system has no healthy upstream.

Upgrade:

  • Fixed an issue where the OS upgrade could prematurely fail due to a short reboot policy period.
  • Fixed an issue where the HSMupgrade fails during upgrade.
  • Fixed an issue where the file-observability subcomponent fails on the org-1-system-cluster during upgrade.

Virtual machine management:

  • Fixed an issue where the VirtualMachineDisk custom resource showed the Failed state after provisioning the underlying storage successfully.
  • Fixed an issue where cluster provisioning in VM disks took a lengthy time to complete.
  • Fixed an issue where a VMRuntime might not be ready due to a network-controller-manager installation failure.

Add-on Manager: