Release Notes

4.0.2

Release Date: 2021-05-10

New Features

  • Kafka topic backup and restore using Adobe Kafka Connect S3 is now supported.

  • Policies that protect multiple applications by creating and exporting snapshots as backups now create a separate ExportAction for each application. When each BackupAction completes an ExportAction for the application is started. BackupActions and ExportActions for different applications protected by the same policy may now run concurrently. A successful ExportAction creates an exported RestorePoint and exports snapshot data if that option is set in the policy. If a BackupAction fails or is skipped, the ExportAction for that application is skipped with a corresponding reason. Once all BackupActions and ExportActions complete, all successful ExportActions are pushed to the migration location together.

  • Pre-flight checks are able to distinguish unsupported vSphere TKGS clusters.

Bug Fixes

  • When editing a K10 disaster recovery policy, the policy form is limited to supported features.

  • Fixed a bug where editing policies with sub-hourly frequencies did not preserve sub-hourly frequency settings.

  • Fixed a bug where the dropdown on resource filter dialog sometimes would not register the click.

  • The Dashboard now correctly displays multiple exported restore points for the same application and scheduled time.

Security Issues

  • Update K10 services base image to pull in latest security updates.

Other Notes

  • Add Kubernetes 1.19 to the list of supported versions.

4.0.1

Release Date: 2021-04-28

Release Summary

With this latest release of Kasten K10, we have taken our focus on security and application protection to the next level to introduce a Kubernetes-native ransomware protection solution. This solution leverages immutable object storage backups, which will enable in a future release the ability to specify the retention period for backups. The retention setting ensures that the backed-up content cannot be altered during that time period. Automation via policies combines not only the actions you want to take (e.g., snapshots) but also the retention period for object immutability.

We have continued to make advancements to our multi-cluster operation so that operations can work at the speed of DevOps with secure self-service portals. Authorized users can now manage their own clusters, create backup policies for their own application namespaces and add secondary clusters directly through the multi-cluster manager for easy scalability.

Lastly, we also added support for NFS for migration and as a backup target in addition to object storage options.

New Features

  • added detail sub-resource to run actions

Bug Fixes

  • Fixed an issue where K10 Disaster Recovery restore failed when using NFS FileStore profiles with custom path prefix.

  • Fixed an issue where in some cases CSI snapshots were failing due to invalid labels.

3.0.13

Release Date: 2021-04-18

New Features

  • Filter objects by label when performing restores while using the API.

  • Added support to identify error events associated with an OpenShift service account while debugging OpenShift authentication using the k10tools command. Refer to the K10 Tools Page for more details.

Bug Fixes

  • Fixed an issue that caused prometheus deployment to be created even if prometheus.enabled option is set to false.

  • Fixes issue with retirement of restore points created by policies that select multiple applications and perform selective export.

Security Issues

  • Update Ambassador version to pull in security fixes in Envoy 1.15.4

3.0.12

Release Date: 2021-04-10

New Features

  • Secondary clusters can now be added directly through the multi-cluster manager using a portable kubeconfig.

  • Introduced helm flag gateway.insecureDisableSSLVerify that can be used to disable ssl verification for gateway pod.

  • Added a command to k10multicluster that generates portable Kubernetes configs.

  • The Dashboard now links to related documentation.

  • Users who are granted permissions with a k10 cluster role binding now are able to browse into secondary clusters on the Dashboard using those permissions.

Bug Fixes

  • Improve error message with more detail when jobs fail due to "Unique index violated".

  • Fixed an issue that caused backup of AWS RDS Aurora DB cluster to fail.

  • Ignore kanister pods during backup.

  • When editing a cluster role binding that targets all clusters, the form is now correctly populated.

3.0.11

Release Date: 2021-03-27

New Features

  • Enable cleanup of orphaned snapshots for Azure disk.

  • Place grouped PVCs on the same node during Generic Volume Snapshot restores.

  • Added a new command to k10tools - k10tools debug ca-certificate to validate CA certificate installation in K10. Refer to the K10 Tools Page for more details.

  • Enable cleanup of orphaned snapshots for Cinder.

  • On restores, generic volumes are placed in the zones specified by the pod affinity.

  • Added support for Generic Volume Snapshots of unmounted PVCs. Refer to this section for more details.

  • Added a new debugger for debugging K10's OpenShift authentication mode. Refer to the K10 Tools Page for more details.

  • Scheduled policy runs will be paused when free disk space on K10 stateful services goes below 25% to avoid abrupt failures.

  • Preserve volume modes on restore.

  • K10 Rate Limiter controls number of concurrent operations across policies and actions. K10 Helm options allow configuration of limits for snapshot creation operations and generic storage backup operations.

  • Added a "create a policy" button for one-click policy creation of cluster-scoped resources.

  • Sometimes it necessary to create multiple artifact transforms that are just slightly different from one another, so we've added a duplicate button to the transform for easy copy and paste.

Bug Fixes

  • The search input field on the code editor window now correctly focuses the cursor.

Known Issues

  • Fixed a bug the transform form would get stuck in edit mode and not allow the creation of new transforms.

3.0.10

Release Date: 2021-03-13

New Features

  • Enable cleanup of orphaned snapshots for AWS EBS and EFS.

  • Enable cleanup of orphaned snapshots for Google cloud engine.

  • Introducing the ability to create application-scoped policies by non administrative users. Refer to this page for more details.

  • K10 Dashboard will now alert users when available disk space on K10 stateful services is below 25%.

  • Clean up snapshots created by failed CSI backups.

  • The Dashboard now enables users to add one or many secondary clusters to a multi-cluster deployment.

  • Better handling on the Dashboard for users with limited access.

  • The Dashboard's restore point panel now indicates when a restore point has been imported.

Bug Fixes

  • Fixed a potential crash when creating an NFS FileStore profile with a non-existent PVC.

  • Fixed an issue with the k10tools tool for debugging OpenShift authentication.

  • Preserve access modes of PVCs and PVs on restore.

  • Fix multicluster bootstrapping in environments where ServiceAccounts have multiple secrets.

Deprecations

  • Removed Helm v2 commands from K10 documentation.

  • Removed Helm v2 checks from K10 pre-flight scripts.

3.0.9

Release Date: 2021-02-28

New Features

  • Added errors and exceptions to Action API resources.

  • CSI volume snapshot objects are now labeled with Kasten labels.

  • Improve backup performance for policies that cover a large number of namespaces.

Bug Fixes

  • Fixed issue where an extra cluster settings tab appeared for K10 setup with basic or no authentication.

  • Fixed issue where k10primer tool incorrectly required the kasten-io namespace to be created before running it. It will now run in the default namespace by default.

  • Fixed an issue in OpenShift environments where DeploymentConfig labels were not enumerated when creating a policy.

  • Fixed an issue with the k10multicluster tool removing the wrong cluster.

  • On Dashboard artifact card, volumes size is now correctly formatted instead of being shows in bytes.

3.0.8

Release Date: 2021-02-16

New Features

  • Added applications sub-command to k10tools debug command to get complete application information from the specified namespace.

  • Reduced K10 Disaster Recovery backup retention count from 50 to 4.

  • Added new helm options to configure memory and CPU resources for the Generic Volume Restore pod.

  • Added a new tool - k10genericbackup to make Kubernetes workloads compatible for K10 Generic Storage Backup by injecting a Kanister sidecar.

  • Added backupactions sub-command to k10tools debug command to allow debugging of backup actions present on the cluster.

  • Kanister Backup/Restore workflow can now create Root CA ConfigMap in the application namespace when cacertconfigmap.name helm option is enabled. This ConfigMap is created when the Root CA Cert ConfigMap is not available in the application namespace and is deleted at the end of Kanister workflow.

  • Enterprise license node limits now stack. Support for additional nodes may now be purchased without invalidating the previous license.

  • Multi-Cluster admins can now configure cluster-level access for non-admin users through the dashboard as well as via API.

  • Added gvs-cluster-check sub-command to k10tools primer command to check cluster compatibility for K10 Generic Volume Snapshots.

  • Helm upgrade will restart all the K10 service pods if the k10-config config map or K10 related secrets are modified.

  • Added disk usage Prometheus metrics for stateful K10 services.

  • Retire action details are available in the K10 Dashboard and API.

  • Added the ability to manage multi-cluster RBAC resources to the Dashboard.

  • Added ability to specify the VolumeSnapshotClass as an annotation to the StorageClass.

Bug Fixes

  • Fixed an issue that caused updating prometheus policy metrics to fail due to the presence of policies in Indeterminate state.

  • Fixed an issue where a failure to meter in a GKE marketplace deployed instance would cause the metering service to restart.

  • Fixes an issue where the gateway service would not start if an IngressClass resource was present in the cluster.

Upgrade Notes

  • This release requires re-bootstrapping of all secondary clusters.

3.0.7

Release Date: 2021-01-30

New Features

  • A new binary named k10tools is available for validation and debugging the environment where K10 is installed. Refer to this page for more information.

  • Pods created by Kanister are labeled with createdBy: kanister.

  • Added optional override of Kanister operation timeouts.

  • Ability to handle volumes of size smaller than 1 GiB.

  • Exported restore points now indicate the export type - whether the restore point contains references to snapshots or portable data.

Bug Fixes

  • Fixes an issue in OpenShift environments where DeploymentConfig labels were not enumerated when creating a policy.

  • Fixes issue of not backing up Custom Resources in some cases when Custom Resource Definition defines multiple versions.

  • Fixed an issue in the helm chart that caused K10 pods to fail with ImagePullBackOff error after upgrade.

  • Fixes issue where imported cluster restore point could not be manually restored.

  • Fixed an issue that caused policy validation status to be stuck in Indeterminate state after K10 upgrade.

  • Fixed a bug on distributions page where text overlapped on narrower page widths.

Known Issues

  • The gateway service does not start if an IngressClass resource is present in the cluster. The workaround is to update the gateway service image to quay.io/datawire/ambassador:1.11.0.

Upgrade Notes

  • This release will perform a catalog schema upgrade.

Other Notes

  • The k10_primer.sh script has been updated. If the latest version of the script is used with a version of K10 <= 3.0.6, an error about a missing image might be seen. Upgrade K10 and retry the script to address this error.

3.0.6

Release Date: 2021-01-21

Bug Fixes

  • Fixed an issue with Generic Volume Snapshot blueprint needed for restoration of PVCs containing symbolic links.

  • Fixes issue of bad counts in dashboard Policies card.

3.0.5

Release Date: 2021-01-17

New Features

  • K10 service storage can be compacted in service procedure.

  • When a workload with Kanister sidecar injection feature enabled is updated, K10 will automatically update the existing kanister-tools sidecar image to the latest version.

  • Owner references are preserved for restored objects.

  • When creating a policy to import and restore, users now have the option to not restore cluster-scoped resources.

  • Restore points that were generated by clicking "Run Once" on the policy now display an icon to indicate this.

  • Restore actions on the Dashboard now link to the restore point that was used for the restore.

  • Added support for stable (v1) Kubernetes Volume Snapshot APIs.

  • Additional error information is available when a backup fails due to a workload not being ready.

Bug Fixes

  • Fixed a potential crash when exporting a restore point to an NFS File Storage Location.

  • Fixed an issue with restoration of PVCs containing symbolic links with absolute paths.

  • Fixed an issue with restoring PVCs containing symbolic links where retries would always fail.

  • The Dashboard will now detect when a user's authentication has expired and redirect to the Logout page.

3.0.4

Release Date: 2020-12-31

New Features

  • New helm options to define a list of groups and users whose members are granted admin-level access to K10's dashboard.

  • Added support for installation of K10 on Azure Stack.

  • New helm options to resize PVC sizes of individual services.

  • Introducing the ability to protect cluster-scoped (non-namespaced) resources in addition to protecting application namespaces.

  • Introduced a new helm value global.upstreamCertifiedImages to use Red Hat certified versions of upstream container images.

  • K10 will generate a ConfigMap in the application namespace containing a private CA certificate when the cacacertconfigmap.name helm option is enabled and if the Kanister sidecar injection feature is used for that application.

Known Issues

  • Dashboard users creating import+restore policies to restore cluster-scoped resources must set restoreClusterResources using kubectl edit. Refer to restoreParameters in the Policy API specification.

3.0.3

Release Date: 2020-12-14

New Features

  • Added a new helm value auth.groupAllowList to define a list of groups whose members are allowed to access K10's dashboard.

  • Added a new isRunNow label to differentiate RestorePoint resources created by run once option of a Policy.

  • Added a new helm value auth.ldap.restartPod to force a restart of the authentication service pod.

  • Added support to snapshot and restore standalone pods.

  • The support page now displays information about the currently authenticated user and also provides a link to the cluster status page.

Bug Fixes

  • Fixed an issue where Active Directory passwords with certain special characters were causing authentication service failures.

  • Fixed issue with multi-cluster dashboard not visible when K10 is setup in no authentication mode.

  • Fixed the image tag of K10 images reported by the k10offline list-images command.

Other Notes

  • Upgraded Ambassador API Gateway to version 1.9.1.

3.0.2

Release Date: 2020-11-25

Bug Fixes

  • Fixed issue where policy creation fails for applications with names starting with numbers.

  • Fixed an issue where the ingress.urlPath helm option was being ignored while setting up K10's services.

  • Fixes an issue where the webhook to create Generic Backup sidecars was always configured with the kasten-io namespace instead of the namespace K10 was deployed in.

  • Fixed an issue where the ingress.urlPath helm option was not being used while setting up Active Directory and OpenShift based authentication.

  • Retrying Policy edits no longer results in invalid Policies being created.

  • Fixed issues during snapshot and restore of containers that include a VolumeMount with a subPath.

Deprecations

3.0.1

Release Date: 2020-11-14

Release Summary

The K10 Multi-Cluster Manager is now generally available. K10 multi-cluster allows management of multiple Kubernetes clusters through a single dashboard. Using the k10multicluster tool, primary-secondary relationships may be created between K10 instances in different clusters. Once logged-in to a primary K10 instance and granted the correct authorization, users have access to the multi-cluster dashboard that contains aggregate metrics and action summaries of the all secondary clusters. In addition, the main dashboards of secondary instances may be accessed directly through the multi-cluster dashboard. K10 resources, specifically Policies and Profiles, may be synchronized from primaries to secondaries.

New Features

  • Set auth.openshift.useServiceAccountCA to true to setup K10's Authentication Service with OpenShift's CA certificate for verifying TLS connections to the OpenShift OAuth server.

  • The Dashboard snapshot storage chart now only reflects namespaces that the user has permissions to view.

Bug Fixes

  • The cacertconfigmap.name helm option can be used to update K10's Authentication Service's trust store with a private root CA certificate for OpenShift based authentication.

  • Fix to enable restores of PVCs that are missing a StorageClass.

  • Fixed a bug where the profile card, shown in a pop-up, always used the dark mode color scheme.

Security Issues

  • Mitigate potential crashes caused by malicious certificates.

2.5.25

Release Date: 2020-11-07

New Features

  • Improve the responsiveness for user and dashboard queries for K10 actions.

  • Performance improvements to dashboard compliance checks.

  • Auto dark mode on Dashboard automatically switches between light/dark modes based on day/night time.

  • When restoring an application via the UI, support selecting/deselecting all artifacts by resource type instead of choosing them individually.

Bug Fixes

  • Fixed an issue where CSI snapshot pre-checks were run even if a Kanister blueprint was being used to backup the workload.

  • Fixed an issue which would result in the global policy form not showing the complete list of namespaces when one or more clusters was unreachable.

  • Fixed an issue that would cause backup jobs to fail when writing to a Minio object store running Minio version RELEASE.2020-08-25T00-21-20Z or newer.

  • Fixed an issue that would cause backup of Portworx volumes with an empty storage class to fail.

  • Fixed an issue where some export or import policy runs would fail after K10 Disaster Recovery.

Known Issues

  • The Kanister kando tool does not use multi-part uploads for Azure Blob storage. This impacts Kanister Blueprints that use Azure Blob profiles and when uploading objects larger than 256 MiB.

  • Retrying Policy edits may cause invalid Policies to skip validation and still be created. The workaround is to recreate the Policy.

  • Restore actions fail when restoring PVC's that use annotations to reference a StorageClass. The workaround is to use a transform to add a StorageClass during restore.

  • When restoring a generic storage backup of a PVC that was mounted in a container at a sub path, the sub path is ignored and data is restored in the new root of the restored PVC.

Deprecations

  • Removed support for OpenShift 4.3

2.5.24

Release Date: 2020-10-26

New Features

  • K10 dashboard can now authenticate against an Active Directory or LDAP server.

  • Add namespace label to prometheus metrics for snapshot sizes which can be used to filter by applications.

  • Add namespace label to prometheus metrics for PVC count and PVC size which can be used to filter by application.

  • Support for NFS FileStore profiles is now available in preview mode.

  • Introducing a preview of the multi-cluster dashboard, which adds the ability to monitor and manage several clusters in one dashboard view.

Bug Fixes

  • Fixed an issue where the catalog_actions_count metrics values become negative on deleting restore points.

  • Fixed an issue that caused creation of Infrastructure Profiles from Dashboard to fail.

  • Fixed an issue where K10 DR failed if specific special characters were used in the passphrase.

Known Issues

  • Backup jobs fail when writing to a Minio object store running Minio version RELEASE.2020-08-25T00-21-20Z or newer. The workaround is to use an older Minio release till this is addressed.

  • When K10 is deployed with OIDC authentication, the dashboard may show errors after the token generated by the OIDC provider has expired. Reloading the dashboard will fix the error.

Upgrade Notes

  • This release will perform a catalog schema upgrade.

Deprecations

  • Removed support for Kubernetes 1.14

  • Removed support for OpenShift 3.11

Other Notes

  • Readjusted the disaster recovery sidecar default resource requirements.

2.5.23

Release Date: 2020-10-10

New Features

  • Additional metrics for catalog store and jobs service operations.

  • Introduced helm flag services.executor.hostNetwork that can be used to enable hostNetwork for executor pods.

  • Improved performance and scalability of exports and retirement of applications with large numbers of artifacts.

  • Added --json flag to k10offline list-images command to provide output in JSON format.

Bug Fixes

  • Fixed the logic that displays the dashboard loading animation.

  • Fixed issue with restore of Kanister protected application in different cluster.

  • The Dashboard UI has been updated with the latest storage regions for Azure and Google.

  • Fixed a bug where deleted applications were not being shown on the applications restore page.

Other Notes

  • Update vSphere documentation with CSI driver requirement.

2.5.22

Release Date: 2020-09-28

New Features

  • Exclude filters can now be applied to workloads that are not ready.

  • Added support for authenticating tokens present in Authorization Bearer Token Header.

  • Add policy label to prometheus metrics for K10 actions which can be used to filter by policy name.

  • Application details on Dashboard now include OpenShift Route resources.

Bug Fixes

  • Fixed the image tag of Dex reported by the k10offline tool.

  • Fixed issue with AWS backups, where user with correct role permissions was reported as unauthorized.

  • Fixed bug with cancel action workflow where cancelling resulted in error message.

  • Fix CrashLoopBackoff issues with the Config service when invalid Profiles were missing Secrets.

  • Fixed an issue that caused exports to repositories created before release 2.5.18 to fail.

  • Fixed retirement and restore of exported restore point for Kanister-enabled application.

  • Fixed potential race between snapshot GC and reusing a deleted directory in a snapshot

  • Fixed an issue where restores get stuck and eventually fail if K10 was deployed with the cacertconfigmap.name helm option and if the namespace where the application is being restored does not have a config map containing the root CA in it.

2.5.20

Release Date: 2020-09-14

New Features

  • Add metrics for catalog store operations.

  • Improved performance and scalability for applications with large numbers of artifacts.

  • Added the ability to set runAsUser option for K10Primer.

Bug Fixes

  • Fixed a bug where the Application list was not getting refreshed on the UI dashboard if the underlying resource watcher encountered a timeout.

  • The K10 dashboard in deployments with no authentication configured or Basic authentication mode did not show an option to create a namespace during restore.

  • Fixed K10Primer issue when validating a CSI provisioner.

  • K10Primer uses the CSI snapshots restoreSize when performing a restore.

  • Only backup StorageClass when taking a snapshot of a PersistentVolumeClaim.

  • Airgapped installation issue, where Prometheus pod was not coming into running state, has been fixed.

  • Fixed issue with handling errors when creating backups by exporting snapshots.

  • On the manual snapshot form, we now show "insufficient permissions" instead of "no options" on the profiles dropdown when the user does not have permissions to list profiles.

2.5.19

Release Date: 2020-09-05

New Features

  • Added support for additional GKE regions: asia-northeast2, asia-northeast3, asia-southeast2, us-west3 and us-west4.

  • Do not display the Data card on the dashboard for "Basic" users.

  • etcd backup for Kubernetes clusters installed via kubeadm is now supported.

  • etcd backup for OpenShift Container Platform clusters is now supported.

  • Improved response times for expensive queries from the dashboard by using an authorization cache.

  • Users will only be able to see the names of applications or namespaces on the dashboard they have access to.

Bug Fixes

  • The persistentvolumeclaims resource is now visible in the resource drop down list.

  • Fix an issue with the Helm chart that would break installs initiated through the Rancher dashboard.

  • Fixed potential index compaction issue that would resurrect deleted content entries during full maintenance

  • Restoring into a new namespace now works correctly for RBAC users with and without namespace creation permissions.

Known Issues

  • Checking a basic user's permissions may be slow when they first login to clusters with a large number of namespaces. This may cause up to a 30 second delay in loading some UI elements such as applications, actions, and compliance information.

Other Notes

  • Increase default memory request for disaster recovery sidecar.

2.5.18

Release Date: 2020-08-31

New Features

  • Change the default timeout for restore operations (from 90 minutes to 10 hours) since users can now cancel stuck jobs via the API.

  • K10 now supports cancellation of in-progress actions through Dashboard and API.

  • Added compliance data stats to Prometheus metrics.

  • K10 dashboard can now authenticate against the built-in OAuth server in OpenShift Container Platform environments.

  • Dashboard editor dialog windows now support text search.

  • The Dashboard data page now only shows application data for namespaces the user has permissions to view.

  • Switch service discovery to use Kubernetes DNS by default and provide an optional Helm setting to use Kubernetes endpoints in environments where DNS is disabled or not working.

  • Added the ability to create an infrastructure profile for vSphere.

  • Added a new Dashboard infrastructure profile type for vSphere configuration.

Bug Fixes

  • Adds missing metrics for retire actions, running actions, and pending actions.

  • Fixed restore of application with generic storage backup and Kanister blueprint with hooks.

  • An issue (required volume not mounted) that occurred in case of multi replica workload during GVS is fixed

  • Added validations for vSphere credentials.

  • vSphere persistent volumes are no longer left in 'Failed' state upon claim deletion.

Known Issues

  • vSphere persistent volumes are left in a 'Released' state. Fixed in v2.0.0 of vSphere's external-provisioner.

2.5.17

Release Date: 2020-08-16

New Features

  • On the policy form, values for exported snapshot retention can be "Set to Zero" with a new action link.

  • K10 deployments now have default resource requests for memory and CPU.

  • Added support for OpenShift 4.4 and 4.5, and Kubernetes 1.18

  • Resource requests and limits can be set by Helm values for K10 deployments.

Bug Fixes

  • Fix PodSpecOverride while restoring applications using Generic Volume Snapshot.

  • Correctly display total/retired artifact counts.

  • Fix problem when backup fails with unready workloads despite ignoreExceptions being set.

  • Fixed timeout issue when restoring CSI backups from an object store.

  • Fixes the retirement of restore points that contain both Kanister-protected workloads and Generic Volume Snapshots in the same restore point.

Known Issues

  • When the authentication service is restarted due to upgrades, manual restarts or errors, users might see 403 errors while accessing the dashboard due to scheduling issues in the gateway service. Restarting the gateway service should resolve the 403 errors.

Deprecations

  • Removed support for OpenShift 4.2 and Kubernetes 1.13.

Other Notes

  • Reduce DeleteSnapshot scope for AWS IAM permissions.

  • Support for OpenShift 4.3 and Kubernetes 1.14 will be removed in an upcoming release.

  • Kanister Blueprints that implement the backup action must return at least one output artifact if they want K10 to invoke a delete action upon restore point retirement.

2.5.16

Release Date: 2020-08-02

New Features

  • Use Kubernetes Endpoints for service discovery instead of cluster DNS.

  • Add license compliance information in prometheus metrics. So that compliance, with respect to time, can be seen in the dashboard.

  • Support token authentication mode with OAuth proxy for OpenShift clusters.

  • Added support for Portworx infrastructure profiles.

  • Added direct (non-CSI) support for Portworx storage.

  • Applications for policies can be selected via wildcard selectors.

  • Added support to create an OpenShift Route object to connect to the K10 dashboard.

Bug Fixes

  • Fixed a Dashboard bug where the retry of a backup action omitted profile info and resulted in failed actions.

  • Fixed issue where restore from a generic-volume-snapshot could result in multiple PVC restore processes.

  • Fixed an issue where an application creation via the OpenShift console fails when Kanister sidecar injection feature is enabled.

  • Fixes issue where export action fails when policy selects no applications to snapshot.

Known Issues

  • ManagedFields in API objects are not preserved when taking backups. Introduced in Kubernetes 1.18.x (OpenShift 4.5.x), they track the actor in the system who last modified each field in an API object. They are used by server-side apply report conflicting patches to objects. Since these are omitted by K10, executing server-side apply after an application is restored may result in different behavior than before restore.

  • Sidecar injection for generic volume snapshots is not supported in Kubernetes 1.18+ or OpenShift 4.5+. Do not use the helm value injectKanisterSidecar.enabled=true on these versions.

  • When K10 is deployed with the helm option auth.tokenAuth.enabled set to true, and when OAuth proxy is used for authentication, the OAuth proxy session is not cleared when the user signs out of the dashboard.

  • PersistentVolumes provisioned by K10 on vSphere do not get removed when they are released.

Upgrade Notes

  • The K10 Helm chart options persistence are moved under global.persistence. Setting global.persistence.storageClass now overwrites default StorageClass for Prometheus PVCs.

2.5.15

Release Date: 2020-07-20

New Features

  • K10 automatically adds the k10.kasten.io/forcegenericbackup="true" annotation to selected workloads to enforce generic backups when the Kanister sidecar injection feature is enabled.

  • Dashboard now shows DR restore progress and displays suggested actions with failure messages.

  • When OIDC based authentication is enabled, if K10 is not able to get the user's information from the OIDC token, it will use the provider's userinfo endpoint to get it.

Bug Fixes

  • Fixed an issue where an injected Kanister sidecar was failing on OpenShift due to a root SecurityContext. An injected Kanister sidecar's SecurityContext is copied from the primary container.

  • If configured authentication method is basic, ignore any authentication cookie in requests.

Other Notes

  • Document how to run Prometheus with a specific user and group ID.

2.5.14

Release Date: 2020-07-07

New Features

  • Added ability to add licenses using the Dashboard.

  • Validate OpenStack Cinder profiles upon creation.

  • Added ability to remove a license using the Dashboard.

  • Improve catalog storage utilization and reduce DR resource and time requirements by performing catalog pruning.

  • K10 Disaster Recovery now performs app-consistent backups of the K10 catalog store.

  • K10 now creates an export restore point whenever a snapshot is exported. This includes when a policy is used to copy snapshots to another region.

  • Exported restore points are now visible in the API as RestorePoint resources in the namespace of the snapshot RestorePoint resource as well as being RestorePointContent resources.

  • K10 policies that select multiple applications now copy each application independently and export all successfully copied applications by default. Application copy errors are noted as exceptions in the ExportAction and an export restore point is not created for an application with a copy error.

  • When manually restoring an application, the UI will provide the option of adding transforms previously used to restore that application.

  • Added support for taking generic snapshots of DeploymentConfigs

  • New OIDC-related settings - auth.oidcAuth.groupClaim and auth.oidcAuth.groupPrefix have been added to K10's Helm chart.

  • Add a Helm option to allow modification of the K10 service security context.

  • Additional statistics are collected for backups exported to object storage.

  • Simplify license updates and deletes. No Helm upgrade or patches required anymore.

  • Support pre-populated namespace labels in the policy creation form.

  • Improvement in the user experience on the dashboard when an OIDC provider returns an error.

  • New OIDC-related setting - auth.oidcAuth.prompt has been added to K10's helm chart.

  • Dashboard now supports specifying region for OpenStack infrastructure profiles.

  • Dashboard charts with multiple result sets are now customizable, allowing you to select which results to display.

  • Support page now displays an upgrade button when a newer version of K10 is available.

Bug Fixes

  • Fixed an issue where switching between K10 clusters while using kubectl proxy would result in a token validation error on the dashboard due to invalid cookies in the browser cache.

  • Fixed an issue that caused Kanister operations to fail when the subject of the Blueprint was an OpenShift DeploymentConfig.

  • Fixes bugs leading to early retirement of snapshots when using storage class overrides or independent retention counts.

  • Fixes bug with object storage data metrics when using the option to ignore exceptions for export.

  • Fixes bug with import after exporting snapshot data using the option to ignore exceptions for export.

  • When "View Action YAML" was clicked, the format of the action was not correct. This has been fixed.

  • Fixed a Dashboard bug when editing a transform that replaces a value with JSON.

  • Fixed cosmetic bug where object storage profiles with no region showed 'undefined' in profile dropdowns.

  • Fixed an issue with K10 installation when these options are used together - cacertconfigmap.name and auth.tokenAuth.enabled.

  • The K10 Helm chart now checks if ingress.annotations are set before using them.

  • Fixed issue with profile validation where the original error was being masked.

  • Fixed an issue where the APIServer was failing to call the mutating webhook endpoint on OpenShift clusters.

Security Issues

  • Module upgrades to address CVE-2020-14040.

  • Upgraded Ambassador to incorporate the Envoy 1.14.3 security update.

Upgrade Notes

  • A schema change is required and will reduce storage consumed by the K10 catalog.

Deprecations

  • The default docs location has changed to support documentation versioning.

2.5.13

Release Date: 2020-06-21

New Features

  • The Dashboard data page now displays object storage usage for each application.

  • Simplify K10 Disaster Recovery by not requiring the K10 cluster passphrase on recovery.

  • The Object Storage Data Usage will now include K10 Disaster Recovery statistics.

  • K10Primer tool will use the same node selector and tolerations for all test pods it creates.

  • Added a new settings tab for viewing installed licenses and license details.

  • The compliance and storage services have been merged with the dashboard service to reduce the total number of the pods required by K10.

  • Add hold support for policy-created backups.

  • Object storage usage metrics can now be viewed for individual applications.

  • New OIDC-related settings - auth.oidcAuth.usernameClaim and auth.oidcAuth.usernamePrefix have been added to K10's Helm chart.

  • Added progress bar to indicate when a Dashboard page is still being loaded.

  • Added support to automatically inject Kanister sidecars into pods for Generic Volume Backup. This can be done cluster-wide or, with label filtering, at the namespace or workload level.

  • Include skipped actions in prometheus metrics.

  • During manual snapshot or policy snapshot, added the ability to filter resources by label.

  • Added a support tab under settings on the Dashboard that displays information about the cluster, K10, and how to contact support.

Bug Fixes

  • Fixed an issue where Kanister actions would fail with OpenShift DeploymentConfig workloads.

  • Fixed a case where object storage data usage may not update immediately following a backup.

  • Fixed bug that prevented the test transform operation from displaying its results.

  • Improve error message when no OIDC configuration is discovered from the provider URL specified for OIDC authentication.

  • Fixed temporary metering service report creation errors when the service is restarted.

  • Fixed bug where policy delete did not remove policy from Dashboard.

  • Fixes issue with retiring restore points for policies that selected zero applications.

  • Fixes metering service bug when the Kubernetes API server is unresponsive.

Deprecations

  • The following labels have been removed from the metrics exposed by jobs service to Prometheus - job_id, phase, policy_id, scheduled_time, start_time, status, finish_time and attempt_count. jobs_running metric has also been removed to optimize storage consumption by Prometheus.

2.5.12

Release Date: 2020-06-07

New Features

  • Policies that select multiple applications treat application snapshot failures independently.

  • Allow users with only namespace access to create backups.

  • New CSI checker application that verifies CSI snapshot/restore capabilities.

  • Move EFS support out of preview mode.

  • K10Primer pre-check validates the existence of required CSI feature gate.

  • Failed backup jobs can now be retried from the Job Details panel.

  • YAML for jobs can now be viewed and copied to the clipboard from the Job Details panel.

  • Add support for Kubernetes auditing.

  • Add guidance for K10 resource requirements.

  • Added support for Kubernetes 1.17 and Beta Snapshot CRDs.

  • K10 can be used with an OpenID Connect(OIDC) provider irrespective of whether the Kubernetes cluster is configured with the same OIDC provider, a different OIDC provider, or no authentication system. K10 achieves this by using Kubernetes User Impersonation.

  • All PVCs within a namespace are snapshotted, independent of being linked to a workload.

  • Added the ability to use pre-made example transforms on the Dashboard.

Bug Fixes

  • Fixed an issue where backup restore points were not displaying the volume snapshot as a selectable artifact on the Dashboard.

  • Disable RBAC resource creation for the Prometheus server which would not work in OCP 3.11 clusters.

  • Fixed compliance calculation issue when using policies with advanced frequency options.

  • Fixed a bug where transform JSON field does not retain its value when editing.

Security Issues

  • When K10 is deployed with OIDC, user-initiated actions (via the API, CLI, or the dashboard) will be attributed to the user instead of the K10 service account.

Upgrade Notes

  • The k10-dashboard-view ClusterRole has been updated and renamed to k10-config-view. Check and update bindings for users and service accounts.

Deprecations

  • We only support Helm v2.16.0+ from this release.

2.5.11

Release Date: 2020-05-29

New Features

  • Added the ability to filter policies by name.

  • Improved the display of job errors by surfacing the nested root cause messages.

Bug Fixes

  • Dashboard login page now accepts a variety of authentication tokens versus only JWT tokens.

2.5.10

Release Date: 2020-05-29

New Features

  • No longer require a VolumeSnapshotClass with Retain deletion policy.

  • Workaround EFS's behavior where a restored instance is placed in a child directory by moving child directory's contents to the file system's root after restore.

  • Adjust namespace metadata for cloned Helm 3 applications.

  • Adding a new tool, K10Primer, that validates a Kubernetes cluster prior to installing K10

  • Installation of trusted but private root certificate authorities to be used by K10 for verifying TLS connections to object stores.

Bug Fixes

  • Exclude VolumeSnapshot objects in application backup.

  • Cleanup VolumeSnapshot resources if the driver failed the snapshot operation.

  • Fixed an issue that caused temporary secrets to be left behind after computing object store data usage statistics.

  • Fixes issue where multiple VolumeSnapshotClasses with K10 annotations caused snapshot failures.

  • Recreate provisioner annotations for Ceph-RBD provisioned Persistent Volumes on restore.

  • Updated prometheus's baseURL and prefixURL Helm values to work with K10 routes.

  • Fix backup data charts not populating on dashboard.

  • Fixed problem deleting old actions.

Known Issues

  • Kanister Blueprints used for database-level application backup currently do not work with private root CAs. An available workaround is to disable TLS verification of these object stores for Location profiles in use with Kanister.

Upgrade Notes

  • This release will perform a catalog schema upgrade.

  • We no longer require or recommend a Retain deletionPolicy for VolumeSnapshotClasses.

2.5.9

Release Date: 2020-05-10

New Features

  • The air-gapped installation process was simplified.

  • Improve the display of job errors by showing error details in a modal window with color syntax-highlighting.

  • Generate skipped jobs when policy scheduler offline across scheduling window.

Bug Fixes

  • Added Ceph profile validation on create.

  • The K10 dashboard will not allow the creation of policies or profiles if the K10 install namespace is not known.

  • Fixed a bug where the code editor window sometimes displayed unformatted code.

  • Fixed a bug that prevented K10 disaster recovery from a manual run of the disaster recovery policy.

  • Fixed a bug that caused some restores to fail after K10 Disaster Recovery.

  • Fixed a bug that could cause object store logical data size to be under-reported.

Security Issues

  • Upgraded several JavaScript packages to address recently disclosed CVEs.

Upgrade Notes

  • K10 image comes with Ceph tools enabled.

Other Notes

  • Combined the policy and profile services to reduce the number of pods used by K10.

2.5.8

Release Date: 2020-05-02

New Features

  • Add AWS Africa (Cape Town) and Europe (Milan) regions.

  • Added infrastructure profiles for direct (non-CSI) integration with Ceph and OpenStack Cinder.

  • Added ability to pause scheduled runs of policies.

  • Support specifying a region when an endpoint is used with S3 compatible Profiles.

  • Retention of snapshots and exported backups supports pausing and editing of policies.

Bug Fixes

  • Discover AWS region from node labels when EC2 instance metadata endpoint is not reachable.

  • EBS snapshot jobs fail gracefully if AWS credentials are not provided.

  • Fixed a bug in the k10-ns-admin Role for GET permission on secrets in the K10 namespace.

  • Fixed unlikely case where manual policy run could retire artifacts created by a scheduled policy run.

2.5.7

Release Date: 2020-04-27

New Features

  • Allow specifying which StorageClass should be used when exporting snapshot data.

  • Volume type transforms on restore are now supported for Azure Disks. Supported storage account types of Azure Disks include Standard_LRS, Premium_LRS, StandardSSD_LRS, UltraSSD_LRS.

  • Policy scheduler now waits until the next scheduled time after a policy edit to start a new job.

  • Reduction in space consumed by the metering service (used for cloud market place billing). The service will delete legacy data and will ensure new data is not retained indefinitely.

  • Added finer control of policy frequency, start times, and snapshot retention to the K10 API and Dashboard.

  • Force a file-system level backup if a workload has the k10.kasten.io/forcegenericbackup annotation.

Bug Fixes

  • Improve Ceph snapshot mechanism.

  • Fixed perpetual UI alerts on outdated failed K10 service/pods.

  • Fixed a bug that caused Object Storage Data Usage statistics to be inaccurate.

  • Fixed a bug with S3-compatible Location profiles. K10 used transport layer security by default even if the user specified http:// as the transport protocol in the location profile's endpoint.

Upgrade Notes

  • Kanister profiles are being deprecated. Disable and re-enable any existing DR policy after an upgrade to switch to using a Location profile.

Deprecations

  • For storage providers that are not supported by K10, do not automatically attempt a file-system backup unless the workload has the k10.kasten.io/forcegenericbackup annotation.

Other Notes

  • Enabled zoom for documentation images.

2.5.6

Release Date: 2020-04-19

Bug Fixes

  • Fixed a bug that caused K10 DR backups to fail after a successful retirement of DR snapshots.

2.5.5

Release Date: 2020-04-17

New Features

  • Add a Prometheus metric to indicate if K10 DR is enabled.

  • New pre-flight script to validate CSI Snapshot capability.

  • Ability to transform PersistentVolumeClaim labels on restore.

Bug Fixes

  • Fixed a bug that caused failure in retirement of K10 Disaster Recovery snapshots.

  • Fix issue with Azure profiles incompatibility while creating import policies.

  • Resolves early retirement of artifacts after K10 disaster recovery.

  • Preserve PersistentVolumeClaim labels on restore.

  • Fixed UI bug that prevented import/restore policy creation.

Other Notes

  • Workaround documented for the migration of EFS CSI Volumes in EKS clusters using the K10 dashboard and AWS CLI/Console.

  • Increase timeout for waiting for ready pods to 15 minutes.

2.5.4

Release Date: 2020-04-12

New Features

  • Support specifying destination region (Azure, AWS) and account (AWS) when exporting snapshots.

  • Added the ability to define TLS certificates in the K10 ingress definition. This allows the use an external ingress controller and definition of a custom FQDN to access the K10 platform through the HTTPS protocol.

  • Reduced the number of Kubernetes workloads by combining the jobs and jobs queue services.

  • Consolidate Profiles into a new type: Location Profiles.

  • Reduction in memory consumed by the metering service (used for cloud marketplace billing).

  • New policies now wait until the first scheduled time to run. Use a manual policy run before then if desired.

  • API support for offset policy run times (e.g., choose an hour to run a daily backup).

  • Volume type transforms on restore are now supported for GCE Persistent Disk and AWS EBS. Supported types for GCE Persistent Disk include pd-ssd and pd-standard. Supported types for AWS EBS include standard, io1, gp2, sc1 and st1.

Bug Fixes

  • Fix cryptography service failing to start when the catalog service isn't yet available.

  • Fixed a bug in the DR Restore tool when no skipResource argument was specified.

Known Issues

  • The Object Storage Data Usage statistics may not be completely accurate.

Upgrade Notes

  • Existing import and export profiles will be converted to location profiles automatically.