diff --git a/blog/2026/09-17-okd-5.0-release-notes.md b/blog/2026/09-17-okd-5.0-release-notes.md new file mode 100644 index 0000000..4838c96 --- /dev/null +++ b/blog/2026/09-17-okd-5.0-release-notes.md @@ -0,0 +1,180 @@ +--- +title: OKD 5.0 Release Notes +authors: ["pskrbasu"] +date: 2026-09-17 +--- + +## Release Notes: 5.0.0-okd-scos.0 + +This release represents a major platform upgrade featuring **Kubernetes 1.36** and **CRI-O 1.36**, alongside significant storage capabilities reaching General Availability, expanded Dynamic Resource Allocation (DRA) support for AI/GPU workloads, and enhanced multi-cloud platform features. [5.0.0-okd-scos.0](https://amd64.origin.releases.ci.openshift.org/releasestream/5-scos-stable/release/5.0.0-okd-scos.0?from=4.22.0-okd-scos.10) is the source of this information. + + + +:::info +These release notes are non-exhaustive. OKD contains many component projects and you can use the CI produced notes to fully review all the changes that have been made. Let us know if you see any errors or large omissions! +::: + +--- + +### Kubernetes and Platform Core + +* **Kubernetes 1.36.3:** Upgraded from Kubernetes 1.35.6, bringing upstream improvements including stable User Namespaces for Pods, GA Mutating Admission Policies using CEL, and enhanced DRA capabilities for accelerator allocation. +* **kubectl 1.36.2:** CLI upgraded from 1.35.2 with improved resource management and debugging capabilities. +* **CRI-O 1.36.4:** Container runtime upgraded from 1.35.7, aligned with Kubernetes 1.36 for enhanced container lifecycle management and including critical stability fixes. +* **CentOS Stream CoreOS 10:** Base operating system updated to 10.0.20260819-0, providing security and stability improvements including systemd 257-32 and kernel 6.12.0-260. +* **Go 1.26 Toolchain:** Platform components rebased to Go 1.26, improving performance and security across the stack. + +--- + +### Storage + +* **Volume Group Snapshots (GA):** Consistent point-in-time snapshots across multiple PersistentVolumeClaims (PVCs) are now Generally Available, enabling application-consistent backups for multi-volume workloads. CSI drivers must support volume group snapshots to use this capability ([STOR-2534](https://issues.redhat.com/browse/STOR-2534)). +* **Changed Block Tracking (Tech Preview):** The `ExternalSnapshotMetadata` feature enables identification of changed blocks between PersistentVolume snapshots, allowing compatible backup tools to perform efficient incremental backups. This feature is enabled in Tech Preview configurations only. +* **SELinux Volume Mount Upgrade Readiness:** OpenShift 5.0 adds readiness checks for the SELinuxMount behavior planned for OpenShift 5.1. The `SELinuxMountGAReadiness` feature gate identifies workloads that may be incompatible with SELinuxMount becoming generally available and can prevent unsafe upgrades to 5.1. **Note:** OpenShift 5.0 does not enable the general SELinuxMount mount-option behavior by default; recursive relabeling remains active. The faster mount-option labeling is targeted for Kubernetes 1.37 / OpenShift 5.1. + +#### CSI Driver Updates + +* **Azure Disk CSI Driver:** Rebased to upstream v1.34.4 for OCP 5.0, with VolumeAttributesClass e2e test support and improved optional API server configuration handling ([STOR-2533](https://issues.redhat.com/browse/STOR-2533)). +* **Azure File CSI Driver:** Rebased to v1.35.5 with enhanced security through updated dependencies. +* **AWS EBS CSI Driver Operator:** Updated for OCP 5.0 consistency with memory limits added to sidecar containers and improved image pull policy handling ([STOR-2538](https://issues.redhat.com/browse/STOR-2538)). +* **Manila CSI Driver Operator:** Enhanced with init container support for node daemonsets, authentication rework, and writable `/tmp` mounting capabilities. +* **SMB CSI Driver Operator:** Added memory limits to sidecars and resolved DeleteVolume issues with `/tmp` directory access. +* **GCP Persistent Disk CSI Driver Operator:** Minimal implementation introduced for GCP Dedicated instances, including Hyperdisk-balanced StorageClass detection. + +--- + +### Platform and Installation + +#### Multi-Cloud Enhancements + +* **AWS Dual-Stack:** IPv4/IPv6 dual-stack networking support for AWS is now enabled across all deployment profiles. The `AWSDualStackInstall` and `AWSClusterHostedDNSInstall` feature gates are active, supporting dual-stack cluster installations on AWS. +* **AWS Cluster API:** Updated to CAPI v2.13.0 with Kubernetes 1.36 and Go 1.26 support. +* **Azure Cluster API:** Merged CAPI v1.26.0 with upstream fixes and Kubernetes 1.36 compatibility. +* **GCP Persistent Disk:** GCP PD CSI driver operator implementation added for dedicated instances with Hyperdisk support. + +#### vSphere Upgrade Considerations + +* **Node Platform Labeling:** vSphere deployments require nodes to have the `node.openshift.io/platform-type=vsphere` label for proper CSI driver operation. OpenShift 5.0 includes a one-shot `node-label-sync` job that automatically backfills this label on nodes upgraded from older releases. **Important:** Before upgrading from 4.22 to 5.0, verify that all vSphere nodes are correctly labeled and test the vSphere CSI driver paths to ensure storage operations remain functional after the upgrade. This validation is particularly critical for clusters that have been upgraded through multiple versions. + +#### Agent-based Installer + +* **PostgreSQL Upgrade:** Agent installer services upgraded from PostgreSQL v15 to v16, improving database performance and security. +* **OS Streams Support:** Added support for OS Streams in day-2 installations, enabling more flexible node operating system management. +* **NTP Configuration:** New NTP sources field added to InfraEnv and AgentClusterInstall CRDs for exclusive NTP server configuration. +* **Disk Encryption Defaults:** Disk encryption settings are now applied by default on cluster creation, with LUKS root labeling integrated into manifest generation. +* **Go Toolchain:** Agent installer components bumped to Go 1.26.5 with multiple CVE patches addressing dependencies including pgx, moby/moby, and containerd. + +--- + +### Networking + +* **HAProxy Multi-Version Selection (Enabled by Default):** The `IngressControllerMultipleHAProxyVersions` feature gate is now enabled, allowing administrators to select HAProxy versions for IngressControllers. Two versions are available: HAProxy 2.8 (router-haproxy28) and HAProxy 3.2 (router-haproxy32). This is both a networking capability and an upgrade-safety feature—administrators should qualify HAProxy 3.2 and retain the older version when ingress configurations require it. +* **Ingress Controller Dynamic Configuration:** The `IngressControllerDynamicConfigurationManager` feature gate is now unconditionally enabled, supporting more flexible ingress management. +* **Gateway API Management Mode:** The `GatewayAPIManagementMode` feature gate is now enabled, reflecting enhanced Gateway API capabilities for modern ingress patterns. +* **OVN Per-Node Encapsulation:** Added capability for per-node encapsulation IP override in OVN networking, providing enhanced flexibility for overlay network configurations. +* **Kube-VIP:** Updated for improved virtual IP management in bare metal and edge deployments. + +--- + +### Node and Machine Management + +* **DRA Partitionable Devices (GA):** Dynamic Resource Allocation can now split supported accelerator devices into logical partitions for sharing between workloads. This feature is Generally Available in OpenShift 5.0 and enabled by default, making it particularly valuable for GPU and AI workloads. The OpenShift-specific feature gate is no longer required. **Note:** This requires compatible DRA drivers and hardware support. +* **User Namespaces (GA):** User namespaces are generally available. Upstream Kubernetes 1.36 graduated this feature to stable status. Pods can use `spec.hostUsers: false` without configuring a feature gate; the downstream `UserNamespacesSupport` feature-gate registration has been removed, enabling enhanced container isolation and security. +* **Mutating Admission Policies (GA):** Mutating admission policies are generally available through the upstream Kubernetes `admissionregistration.k8s.io/v1` API. They provide CEL-based admission mutation and are enabled by default in Kubernetes 1.36; the pre-GA API runtime configuration is no longer required. +* **etcd Snapshot Threshold:** OpenShift 5.0 configures etcd with a default snapshot threshold of 5,000 applied Raft entries (`--snapshot-count=5000`), improving operational performance and reducing disk I/O. +* **Karpenter Operator:** New karpenter-operator image introduced for advanced node autoscaling and dynamic resource optimization. + +--- + +### Operator Lifecycle Manager (OLM) and Console + +* **OLM Lifecycle and Compatibility:** The `OLMLifecycleAndCompatibility` feature gate is now enabled, supporting improved operator lifecycle management and compatibility tracking. +* **Operator Dependency Streamlining:** Removed LSO (Local Storage Operator) and LVMS as CNV operator dependencies, simplifying the operator ecosystem. +* **Operator Channel Updates:** Multiple operators received channel updates, including MTV-operator migrated to release-v2.12. +* **LVMS Operator Subscription:** Fixed missing LVMS operator subscription name, ensuring proper operator lifecycle management. +* **Hive Operator Migration:** hive-operator migrated from community-operators to upstream-community-operators catalog. +* **Console Enhancements:** + * Enhanced cluster installation page to show all available operators + * Improved operator selection interface with profile-based configuration + * Storage class options added to Hypershift details form + * Fixed custom manifests rendering in local assisted UI + +--- + +### Authentication and Security + +* **Resource-Scoped Authorization:** Added resource-scoped authorization for local auth tokens and urlAuth endpoints, improving security granularity. +* **Authentication Component Proxy:** The `AuthenticationComponentProxy` feature gate is now enabled, supporting improved authentication component isolation. +* **TLS Security Profiles:** Infrastructure Operator now honors TLS security profiles consistently across components. +* **Console Plugin Content Security:** The `ConsolePluginContentSecurityPolicy` feature gate is now unconditionally enabled, enhancing console plugin security. +* **KMS Encryption Provider:** The `KMSEncryptionProvider` feature gate is now unconditionally enabled, supporting external key management systems for etcd encryption. +* **CVE-2026-41178 Mitigation:** Upgraded OpenTelemetry library (go.opentelemetry.io/otel) to v1.44.0, addressing telemetry security vulnerabilities. + +--- + +### Deprecations, Removals, and Upgrade Notes + +#### Decoupled Components + +* **oc-mirror Distribution Change:** Following OCP 5.0 packaging changes, `oc-mirror` has been decoupled from the OCP release payload and is now distributed independently. Disconnected administrators should verify whether `oc-mirror` is included in the OKD release payload or needs to be obtained separately. Check OKD release documentation for the current distribution method. + +#### Kubernetes 1.36 Upstream Changes + +* **gitRepo Volume Plugin Disabled:** Upstream Kubernetes 1.36 disables the deprecated `gitRepo` volume plugin. Workloads using this plugin must migrate to init containers or other alternatives before upgrading. +* **Service externalIPs Deprecation:** The `externalIPs` field in Service objects is deprecated upstream. Workloads or automation using this field should be tested and migrated to supported alternatives. + +#### Continued Deprecations from 4.22 + +The following deprecations from OKD 4.22 remain in effect: +* **oc adm release mirror:** Continue using `oc-mirror` v2 for disconnected mirroring workflows. +* **KVC-based Kernel Module Injection:** Use the Kernel Module Management (KMM) operator instead. +* **runC Container Runtime:** OKD defaults to `crun`; the temporary `runc` override has been removed ([OKD-294](https://issues.redhat.com/browse/OKD-294)). +* **ImageContentSourcePolicy (ICSP):** Migrate to ImageDigestMirrorSet (IDMS). +* **Legacy Kubernetes Topology Labels:** Use modern topology labels (`topology.kubernetes.io/*`). +* **DeploymentConfig:** Migrate to standard Kubernetes Deployments. + +#### Application Compatibility + +* **Client-go API Changes:** Components rebasing to Kubernetes 1.36 include `client-go` API behavior changes. Operators and integrations should validate compatibility. +* **IPVS and cgroup v1:** Validate that workloads do not depend on deprecated upstream support for IPVS and cgroup v1. + +--- + +### Upgrade Path and Stability + +This stable release (5.0.0-okd-scos.0) has been manually accepted by the Technical Release Team (TRT) and is ready for production use. Upgrade testing from 5.0.0-okd-scos.ec.10 succeeded, validating the upgrade path from the final Early Candidate release. + +For detailed changelog and upgrade information, see the [release controller page](https://amd64.origin.releases.ci.openshift.org/releasestream/5-scos-stable/release/5.0.0-okd-scos.0?from=4.22.0-okd-scos.10). + +--- + +### Getting Started + +To deploy OKD 5.0.0-okd-scos.0: + +```bash +openshift-install version +# Ensure you have the 5.0 installer + +# Pull the release image +oc adm release extract --tools \ + quay.io/openshift/okd:5.0.0-okd-scos.0 +``` + +For upgrades from OKD 4.22: +* Review the deprecations and removals section above +* Test vSphere CSI paths if using vSphere +* Validate HAProxy 3.2 compatibility for IngressControllers +* Review SELinux upgrade readiness warnings for incompatible volume-sharing patterns before planning upgrade to 5.1 +* Verify application compatibility with Kubernetes 1.36 API changes + +--- + +### Community and Support + +* **Documentation:** [docs.okd.io](https://docs.okd.io) +* **Slack:** [#openshift-users on Kubernetes Slack](https://kubernetes.slack.com/messages/openshift-users) +* **GitHub:** [github.com/okd-project](https://github.com/okd-project) +* **Issue Tracker:** Report issues at [github.com/okd-project/okd/issues](https://github.com/okd-project/okd/issues) + +Thank you to all contributors who made OKD 5.0 possible!