v1.10.6

What's Changed

• [release-1.10] bump grpc to v1.56.3 (addressing CVE-2023-44487) by @jsanin-vmw in #14580

Full Changelog: knative-v1.10.5...knative-v1.10.6

v1.10.5

What's Changed

• [release-1.10] Bound buffer for reading stats by @knative-prow-robot in #14541
• [release-1.10] Upgrade to latest dependencies by @knative-automation in #14551

Full Changelog: knative-v1.10.4...knative-v1.10.5

v1.11.3

Changes since v1.11.2

What's Changed

• Bound buffer for reading stats by @knative-prow-robot in #14542
• Upgrade to latest dependencies by @knative-automation in #14552

Full Changelog: knative-v1.11.2...knative-v1.11.3

v1.12.0

Caution

There was a bug introduced in v1.12.0 that can cause traffic to be dropped during upgrades - please install v1.12.4

Changes since v1.11

🚨 Breaking or Notable

• Label the webhook service with "app: webhook" label (#14258, @JordanDeBeer)
• auto-tls is now named external-domain-tls (#14472, @ReToCode)
• internal-encryption is now named system-internal-tls (#14472, @ReToCode)
• cluster-local-domain-tls is introduced as a new alpha state flag to control TLS certificates for cluster-local domains (#14472, @ReToCode)
• Traffic from Ingress to Activator/QP uses TLS 1.3 when system-internal-tls is enabled. (#14074, @nak3)
• Validating webhook will now allow adding the NET_BIND_SERVICE or nil capabilities when secure pods defaults feature is enabled (#14445, @kauana)

💫 New Features & Changes

• Allow shareProcessNamespace to be set for a Knative Service (feature flag: kubernetes.podspec-shareprocessnamespace). Disabled by default. (#14454, @rhuss)
• Internal encryption verifies a new SAN kn-user-<ns>. (#14452, @nak3)
• ReadinessProbe with path contains a query string is supported now. (#14273, @nak3)
• Support gRPC probe. (#14134, @seongpyoHong)
• When system-internal-tls is enabled, queue-proxy mounts the certificate secret as projected-volume and automatically reloads the certificates on change. (#14189, @ReToCode)

🐞Bug Fixes

• Activator correctly propagates pod health when triggered by changes other than pod probes. (#14347, @arsenetar)
• Activator no longer cancels all probes when one fails (#14303, @arsenetar)
• Applied an upper bound to the statistics data read from the queue-proxy by the autoscaler. (#14523, @evankanderson)
• Certificate generation errors are bubbled up to its parent Route. (#14496, @gabo1208)
• Fix secure 'secure-pod-defaults' to work with restricted namespaces (#14363, @KauzClay)

Dependencies

Added

• cloud.google.com/go/dataproc/v2: v2.2.0
• github.com/IBM/sarama: v1.40.1
• github.com/alecthomas/kingpin/v2: v2.3.2
• github.com/google/go-pkcs11: c6f7932
• github.com/grafana/regexp: 6b5c0a4
• github.com/hashicorp/errwrap: v1.1.0
• github.com/hashicorp/go-multierror: v1.1.1
• github.com/iancoleman/orderedmap: v0.3.0
• github.com/pierrec/lz4/v4: v4.1.17
• github.com/prashantv/gostub: v1.1.0
• github.com/prometheus/prometheus: v0.47.0
• github.com/stvp/go-udp-testing: 469649b
• github.com/xhit/go-str2duration/v2: v2.1.0
• google.golang.org/genproto/googleapis/bytestream: 8bfb1ae

Changed

• cloud.google.com/go/accessapproval: v1.6.0 → v1.7.1
• cloud.google.com/go/accesscontextmanager: v1.7.0 → v1.8.1
• cloud.google.com/go/aiplatform: v1.37.0 → v1.50.0
• cloud.google.com/go/analytics: v0.19.0 → v0.21.3
• cloud.google.com/go/apigateway: v1.5.0 → v1.6.1
• cloud.google.com/go/apigeeconnect: v1.5.0 → v1.6.1
• cloud.google.com/go/apigeeregistry: v0.6.0 → v0.7.1
• cloud.google.com/go/appengine: v1.7.1 → v1.8.1
• cloud.google.com/go/area120: v0.7.1 → v0.8.1
• cloud.google.com/go/artifactregistry: v1.13.0 → v1.14.1
• cloud.google.com/go/asset: v1.13.0 → v1.14.1
• cloud.google.com/go/assuredworkloads: v1.10.0 → v1.11.1
• cloud.google.com/go/automl: v1.12.0 → v1.13.1
• cloud.google.com/go/baremetalsolution: v0.5.0 → v1.2.0
• cloud.google.com/go/batch: v0.7.0 → v1.4.1
• cloud.google.com/go/beyondcorp: v0.5.0 → v1.0.0
• cloud.google.com/go/bigquery: v1.50.0 → v1.55.0
• cloud.google.com/go/billing: v1.13.0 → v1.17.0
• cloud.google.com/go/binaryauthorization: v1.5.0 → v1.7.0
• cloud.google.com/go/certificatemanager: v1.6.0 → v1.7.1
• cloud.google.com/go/channel: v1.12.0 → v1.17.0
• cloud.google.com/go/cloudbuild: v1.9.0 → v1.14.0
• cloud.google.com/go/clouddms: v1.5.0 → v1.7.0
• cloud.google.com/go/cloudtasks: v1.10.0 → v1.12.1
• cloud.google.com/go/compute: v1.19.1 → v1.23.0
• cloud.google.com/go/contactcenterinsights: v1.6.0 → v1.10.0
• cloud.google.com/go/container: v1.15.0 → v1.26.0
• cloud.google.com/go/containeranalysis: v0.9.0 → v0.11.0
• cloud.google.com/go/datacatalog: v1.13.0 → v1.17.1
• cloud.google.com/go/dataflow: v0.8.0 → v0.9.1
• cloud.google.com/go/dataform: v0.7.0 → v0.8.1
• cloud.google.com/go/datafusion: v1.6.0 → v1.7.1
• cloud.google.com/go/datalabeling: v0.7.0 → v0.8.1
• cloud.google.com/go/dataplex: v1.6.0 → v1.9.1
• cloud.google.com/go/dataqna: v0.7.0 → v0.8.1
• cloud.google.com/go/datastore: v1.11.0 → v1.14.0
• cloud.google.com/go/datastream: v1.7.0 → v1.10.0
• cloud.google.com/go/deploy: v1.8.0 → v1.13.0
• cloud.google.com/go/dialogflow: v1.32.0 → v1.43.0
• cloud.google.com/go/dlp: v1.9.0 → v1.10.1
• cloud.google.com/go/documentai: v1.18.0 → v1.22.1
• cloud.google.com/go/domains: v0.8.0 → v0.9.1
• cloud.google.com/go/edgecontainer: v1.0.0 → v1.1.1
• cloud.google.com/go/essentialcontacts: v1.5.0 → v1.6.2
• cloud.google.com/go/eventarc: v1.11.0 → v1.13.0
• cloud.google.com/go/filestore: v1.6.0 → v1.7.1
• cloud.google.com/go/firestore: v1.9.0 → v1.13.0
• cloud.google.com/go/functions: v1.13.0 → v1.15.1
• cloud.google.com/go/gkebackup: v0.4.0 → v1.3.1
• cloud.google.com/go/gkeconnect: v0.7.0 → v0.8.1
• cloud.google.com/go/gkehub: v0.12.0 → v0.14.1
• cloud.google.com/go/gkemulticloud: v0.5.0 → v1.0.0
• cloud.google.com/go/gsuiteaddons: v1.5.0 → v1.6.1
• cloud.google.com/go/iam: v1.0.1 → v1.1.2
• cloud.google.com/go/iap: v1.7.1 → v1.9.0
• cloud.google.com/go/ids: v1.3.0 → v1.4.1
• cloud.google.com/go/iot: v1.6.0 → v1.7.1
• cloud.google.com/go/kms: v1.10.1 → v1.15.2
• cloud.google.com/go/language: v1.9.0 → v1.11.0
• cloud.google.com/go/lifesciences: v0.8.0 → v0.9.1
• cloud.google.com/go/logging: v1.7.0 → v1.8.1
• cloud.google.com/go/longrunning: v0.4.1 → v0.5.1
• cloud.google.com/go/managedidentities: v1.5.0 → v1.6.1
• cloud.google.com/go/maps: v0.7.0 → v1.4.0
• cloud.google.com/go/mediatranslation: v0.7.0 → v0.8.1
• cloud.google.com/go/memcache: v1.9.0 → v1.10.1
• cloud.google.com/go/metastore: v1.10.0 → v1.12.0
• cloud.google.com/go/monitoring: v1.13.0 → v1.16.0
• cloud.google.com/go/networkconnectivity: v1.11.0 → v1.13.0
• cloud.google.com/go/networkmanagement: v1.6.0 → v1.9.0
• cloud.google.com/go/networksecurity: v0.8.0 → v0.9.1
• cloud.google.com/go/notebooks: v1.8.0 → v1.10.0
• cloud.google.com/go/optimization: v1.3.1 → v1.5.0
• cloud.google.com/go/orchestration: v1.6.0 → v1.8.1
• cloud.google.com/go/orgpolicy: v1.10.0 → v1.11.1
• cloud.google.com/go/osconfig: v1.11.0 → v1.12.1
• cloud.google.com/go/oslogin: v1.9.0 → v1.10.1
• cloud.google.com/go/phishingprotection: v0.7.0 → v0.8.1
• cloud.google.com/go/policytroubleshooter: v1.6.0 → v1.9.0
• cloud.google.com/go/privatecatalog: v0.8.0 → v0.9.1
• cloud.google.com/go/pubsub: v1.30.0 → v1.33.0
• cloud.google.com/go/pubsublite: v1.7.0 → v1.8.1
• cloud.google.com/go/recaptchaenterprise/v2: v2.7.0 → v2.7.2
• cloud.google.com/go/recommendationengine: v0.7.0 → v0.8.1
• cloud.google.com/go/recommender: v1.9.0 → v1.11.0
• cloud.google.com/go/redis: v1.11.0 → v1.13.1
• cloud.google.com/go/resourcemanager: v1.7.0 → v1.9.1
• cloud.google.com/go/resourcesettings: v1.5.0 → v1.6.1
• cloud.google.com/go/retail: v1.12.0 → v1.14.1
• cloud.google.com/go/run: v0.9.0 → v1.2.0
• cloud.google.com/go/scheduler: v1.9.0 → v1.10.1
• cloud.google.com/go/secretmanager: v1.10.0 → v1.11.1
• cloud.google.com/go/security: v1.13.0 → v1.15.1
• cloud.google.com/go/securitycenter: v1.19.0 → v1.23.0
• cloud.google.com/go/servicedirectory: v1.9.0 → v1.11.0
• cloud.google.com/go/shell: v1.6.0 → v1.7.1
• cloud.google.com/go/spanner: v1.45.0 → v1.49.0
• cloud.google.com/go/speech: v1.15.0 → v1.19.0
• cloud.google.com/go/storage: v1.30.1 → v1.33.0
• cloud.google.com/go/storagetransfer: v1.8.0 → v1.10.0
• cloud.google.com/go/talent: v1.5.0 → v1.6.2
• cloud.google.com/go/texttospeech: v1.6.0 → v1.7.1
• cloud.google.com/go/tpu: v1.5.0 → v1.6.1
• cloud.google.com/go/trace: v1.9.0 → v1.10.1
• cloud.google.com/go/translate: v1.7.0 → v1.9.0
• cloud.google.com/go/video: v1.15.0 → v1.20.0
• cloud.google.com/go/videointelligence: v1.10.0 → v1.11.1
• cloud.google.com/go/vision/v2: v2.7.0 → v2.7.2
• cloud.google.com/go/vmmigration: v1.6.0 → v1.7.1
• cloud.google.com/go/vmwareengine: v0.3.0 → v1.0.0
• cloud.google.com/go/vpcaccess: v1.6.0 → v1.7.1
• cloud.google.com/go/webrisk: v1.8.0 → v1.9.1
• cloud.google.com/go/websecurityscanner: v1.5.0 → v1.6.1
• cloud.google.com/go/workflows: v1.10.0 → v1.12.0
• cloud.google.com/go: v0.110.2 → v0.110.8
• contrib.go.opencensus.io/exporter/prometheus: v0.4.0 → v0.4.2
• github.com/Shopify/sarama: v1.30.0 → v1.19.0
• github.com/alecthomas/jsonschema: f2c9385 → 9eeeec9
• github.com/alecthomas/units: f65c72e → b94a6e3
• github.com/bmizerany/perks: d9a9656 → 03f9df7
• github.com/c2h5oh/datasize: 28bbd47 → 859f65c
• github.com/coreos/go-systemd/v2...

v1.11.2

Changes since v1.11.1

What's Changed

• Rebuild using Go 1.20.10 (to address CVEs) by @ReToCode in #14500
• bump x/net to v0.17 by @nak3 in #14516

Full Changelog: knative-v1.11.1...knative-v1.11.2

v1.10.4

What's Changed

• [release-1.10] Rebuild using Go 1.20.10 (to address CVEs) by @ReToCode in #14501
• [release-1.10] bump x/net to v0.17 by @nak3 in #14517

Full Changelog: knative-v1.10.3...knative-v1.10.4

v1.11.1

Changes since v1.11.0

What's Changed

• fix securityContext for Knative Service Pod (user-container and queue-proxy) by @knative-prow-robot in #14378

Full Changelog: knative-v1.11.0...knative-v1.11.1

v1.10.3

What's Changed

• [release-1.10] fix securityContext for Knative Service Pod (user-container and queue-proxy) by @knative-prow-robot in #14377

Full Changelog: knative-v1.10.2...knative-v1.10.3

v1.11.0

Changes since v1.10

🚨 Breaking or Notable

• We now target v1.25 as our minimum version of Kubernetes
• Activator uses TLS 1.3 as the minimum version when internal encryption is activated for communication with queue-proxy (#13887, @izabelacg)
• Domain mapping controller logic is now merged with the Serving controller. Domainmapping webhook is merged with the Serving webhook. (#14082, @skonto)
• DomainMapping/v1alpha1 is deprecated - use v1beta1 APIs (#14058, @dprotaso)

💫 New Features & Changes

• A new flag is introduced queueproxy.resource-defaults that sets resource requests, limits for Queue Proxy when enabled (applies only to cpu and memory). (#14039, @skonto)
• Activator now has a separate service account, reducing its privileges to the required minimum. (#14133, @davidhadas)
• Queue proxy resources can be configured via annotations at the service level. The resource percentage annotation is now deprecated. (#14038, @skonto)
• Sets DefaultDomain to cluster's domain instead of hardcoded svc.cluster.local (#13964, @kauana)

🐞Bug Fixes

• Autoscaler metric are validated with global autoscaling class if no class annotation is set. (#13978, @xtreme-vikram-yadav)
• Drop cluster-autoscaler.kubernetes.io/safe-to-evict annotations on our control plane to allow nodes to drain (#14035, @dprotaso)
• Fix activator load balancing when using unbounded concurrency and when you have two instances of a revision (#14028, @dprotaso)
• Fix activator load balancing when using containerConcurrency=1 (#14022, @Gekko0114)
• Queue proxy metrics reporting period is now supported for both prometheus and opencensus.
  This allows fine-grained control of how often metrics are exported via a new config map attribute. (#14019, @skonto)
• Tag to digest min TLS version is 1.2 and can be configured higher using the controller environment variable TAG_TO_DIGEST_TLS_MIN_VERSION and supports values "1.2" and "1.3" (#13962, @dprotaso)

Dependencies

Added

• cloud.google.com/go/accessapproval: v1.6.0
• cloud.google.com/go/accesscontextmanager: v1.7.0
• cloud.google.com/go/aiplatform: v1.37.0
• cloud.google.com/go/analytics: v0.19.0
• cloud.google.com/go/apigateway: v1.5.0
• cloud.google.com/go/apigeeconnect: v1.5.0
• cloud.google.com/go/apigeeregistry: v0.6.0
• cloud.google.com/go/appengine: v1.7.1
• cloud.google.com/go/area120: v0.7.1
• cloud.google.com/go/artifactregistry: v1.13.0
• cloud.google.com/go/assuredworkloads: v1.10.0
• cloud.google.com/go/automl: v1.12.0
• cloud.google.com/go/baremetalsolution: v0.5.0
• cloud.google.com/go/batch: v0.7.0
• cloud.google.com/go/beyondcorp: v0.5.0
• cloud.google.com/go/billing: v1.13.0
• cloud.google.com/go/binaryauthorization: v1.5.0
• cloud.google.com/go/certificatemanager: v1.6.0
• cloud.google.com/go/channel: v1.12.0
• cloud.google.com/go/cloudbuild: v1.9.0
• cloud.google.com/go/clouddms: v1.5.0
• cloud.google.com/go/cloudtasks: v1.10.0
• cloud.google.com/go/compute/metadata: v0.2.3
• cloud.google.com/go/contactcenterinsights: v1.6.0
• cloud.google.com/go/container: v1.15.0
• cloud.google.com/go/containeranalysis: v0.9.0
• cloud.google.com/go/datacatalog: v1.13.0
• cloud.google.com/go/dataflow: v0.8.0
• cloud.google.com/go/dataform: v0.7.0
• cloud.google.com/go/datafusion: v1.6.0
• cloud.google.com/go/datalabeling: v0.7.0
• cloud.google.com/go/dataplex: v1.6.0
• cloud.google.com/go/dataproc: v1.12.0
• cloud.google.com/go/dataqna: v0.7.0
• cloud.google.com/go/datastream: v1.7.0
• cloud.google.com/go/deploy: v1.8.0
• cloud.google.com/go/dialogflow: v1.32.0
• cloud.google.com/go/dlp: v1.9.0
• cloud.google.com/go/documentai: v1.18.0
• cloud.google.com/go/domains: v0.8.0
• cloud.google.com/go/edgecontainer: v1.0.0
• cloud.google.com/go/errorreporting: v0.3.0
• cloud.google.com/go/essentialcontacts: v1.5.0
• cloud.google.com/go/eventarc: v1.11.0
• cloud.google.com/go/filestore: v1.6.0
• cloud.google.com/go/firestore: v1.9.0
• cloud.google.com/go/functions: v1.13.0
• cloud.google.com/go/gaming: v1.9.0
• cloud.google.com/go/gkebackup: v0.4.0
• cloud.google.com/go/gkeconnect: v0.7.0
• cloud.google.com/go/gkehub: v0.12.0
• cloud.google.com/go/gkemulticloud: v0.5.0
• cloud.google.com/go/gsuiteaddons: v1.5.0
• cloud.google.com/go/iap: v1.7.1
• cloud.google.com/go/ids: v1.3.0
• cloud.google.com/go/iot: v1.6.0
• cloud.google.com/go/kms: v1.10.1
• cloud.google.com/go/language: v1.9.0
• cloud.google.com/go/lifesciences: v0.8.0
• cloud.google.com/go/logging: v1.7.0
• cloud.google.com/go/longrunning: v0.4.1
• cloud.google.com/go/managedidentities: v1.5.0
• cloud.google.com/go/maps: v0.7.0
• cloud.google.com/go/mediatranslation: v0.7.0
• cloud.google.com/go/memcache: v1.9.0
• cloud.google.com/go/metastore: v1.10.0
• cloud.google.com/go/monitoring: v1.13.0
• cloud.google.com/go/networkconnectivity: v1.11.0
• cloud.google.com/go/networkmanagement: v1.6.0
• cloud.google.com/go/networksecurity: v0.8.0
• cloud.google.com/go/notebooks: v1.8.0
• cloud.google.com/go/optimization: v1.3.1
• cloud.google.com/go/orchestration: v1.6.0
• cloud.google.com/go/orgpolicy: v1.10.0
• cloud.google.com/go/osconfig: v1.11.0
• cloud.google.com/go/oslogin: v1.9.0
• cloud.google.com/go/phishingprotection: v0.7.0
• cloud.google.com/go/policytroubleshooter: v1.6.0
• cloud.google.com/go/privatecatalog: v0.8.0
• cloud.google.com/go/pubsublite: v1.7.0
• cloud.google.com/go/recaptchaenterprise/v2: v2.7.0
• cloud.google.com/go/recommendationengine: v0.7.0
• cloud.google.com/go/recommender: v1.9.0
• cloud.google.com/go/redis: v1.11.0
• cloud.google.com/go/resourcemanager: v1.7.0
• cloud.google.com/go/resourcesettings: v1.5.0
• cloud.google.com/go/retail: v1.12.0
• cloud.google.com/go/run: v0.9.0
• cloud.google.com/go/scheduler: v1.9.0
• cloud.google.com/go/secretmanager: v1.10.0
• cloud.google.com/go/securitycenter: v1.19.0
• cloud.google.com/go/servicedirectory: v1.9.0
• cloud.google.com/go/shell: v1.6.0
• cloud.google.com/go/spanner: v1.45.0
• cloud.google.com/go/speech: v1.15.0
• cloud.google.com/go/storagetransfer: v1.8.0
• cloud.google.com/go/talent: v1.5.0
• cloud.google.com/go/texttospeech: v1.6.0
• cloud.google.com/go/tpu: v1.5.0
• cloud.google.com/go/trace: v1.9.0
• cloud.google.com/go/translate: v1.7.0
• cloud.google.com/go/video: v1.15.0
• cloud.google.com/go/videointelligence: v1.10.0
• cloud.google.com/go/vision/v2: v2.7.0
• cloud.google.com/go/vmmigration: v1.6.0
• cloud.google.com/go/vmwareengine: v0.3.0
• cloud.google.com/go/vpcaccess: v1.6.0
• cloud.google.com/go/webrisk: v1.8.0
• cloud.google.com/go/websecurityscanner: v1.5.0
• cloud.google.com/go/workflows: v1.10.0
• github.com/cenkalti/backoff/v4: v4.1.3
• github.com/go-logr/stdr: v1.2.2
• github.com/google/s2a-go: v0.1.4
• github.com/grpc-ecosystem/grpc-gateway/v2: v2.11.3
• go.opentelemetry.io/otel/exporters/otlp/internal/retry: v1.10.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.10.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.10.0
• google.golang.org/genproto/googleapis/api: 1aefcd6
• google.golang.org/genproto/googleapis/rpc: 9506855
• k8s.io/kms: v0.26.5

Changed

• cloud.google.com/go/asset: v1.5.0 → v1.13.0
• cloud.google.com/go/bigquery: v1.8.0 → v1.50.0
• cloud.google.com/go/compute: v1.10.0 → v1.19.1
• cloud.google.com/go/datastore: v1.1.0 → v1.11.0
• cloud.google.com/go/iam: v0.3.0 → v1.0.1
• cloud.google.com/go/pubsub: v1.3.1 → v1.30.0
• cloud.google.com/go/security: v1.5.0 → v1.13.0
• cloud.google.com/go/storage: v1.22.1 → v1.30.1
• cloud.google.com/go: v0.102.1 → v0.110.2
• github.com/antlr/antlr4/runtime/Go/antlr: f25a4f6 → v1.4.10
• github.com/census-instrumentation/opencensus-proto: v0.3.0 → v0.4.1
• github.com/cespare/xxhash/v2: v2.1.2 → v2.2.0
• github.com/cncf/udpa/go: 04548b0 → c52dc94
• github.com/cncf/xds/go: cb28da3 → e9ce688
• github.com/envoyproxy/go-control-plane: 49ff273 → 9239064
• github.com/envoyproxy/protoc-gen-validate: v0.1.0 → v0.10.1
• github.com/felixge/httpsnoop: v1.0.1 → v1.0.3
• github.com/fsnotify/fsnotify: v1.4.9 → v1.6.0
• github.com/go-kit/log: v0.1.0 → v0.2.0
• github.com/go-logfmt/logfmt: v0.5.0 → v0.5.1
• github.com/golang/glog: v1.0.0 → v1.1.0
• github.com/golang/mock: v1.6.0 → v1.4.4
• github.com/golang/protobuf: v1.5.2 → v1.5.3
• github.com/google/cel-go: v0.12.5 → v0.12.6
• github.com/google/martian/v3: v3.2.1 → v3.0.0
• github.com/google/pprof: 4bb14d4 → 1a94d86
• g...

v1.9.4

Changes since v1.9.3

• Drop the cluster-autoscaler.kubernetes.io/safe-to-evict: "false" annotation on our deployments (#13984, @dprotaso)