Release Notes

5.5.11

Release Date: 2023-05-21

New Features

• Add a configurable helm value - maxJobWaitDuration which overrides the default 10 hours, after which jobs should be canceled.

• Added multicluster licensing statistics to usage reporting

Bug Fixes

• Fixed an issue where retire actions were failing for exported restore points after upgrading K10 to 5.5.9 when using NFS FileStore location profiles.

• Fixed issue with Instant Recovery where Instant Recovery would fail if multiple datacenters were defined in vCenter.

Security Issues

• Update K10 services base image to pull in latest security updates.

Deprecations

• Direct Ceph Integration (RBD only) will be removed in an upcoming release in favor of direct CSI integration. This involves dropping support for Ceph Infrastructure Profile.

5.5.10

Release Date: 2023-05-08

New Features

• Root permissions are no longer required for backup, restore, and export operations to the NFS FileStore location profile. To handle rootless access, a new Supplemental Group field has been added to the NFS FileStore.

• Improved execution times of backups and restores in OpenShift environments by caching OpenShift Route API discovery results.

• Added storage utilization metrics to usage reporting

• A new button on the Policy card allows users to upgrade their policies. Periodically, policies can be upgraded to improve the underlying backups' robustness and space usage. See UpgradeActions for more information.

Bug Fixes

• Enabling Immutable Backups in K10 caused indefinite "Saving" process when more than one day is specified for protection. Fix implemented to ensure day slider works and location profile is created.

Deprecations

• Removed support for Kubernetes 1.22 and OpenShift 4.9.

5.5.9

Release Date: 2023-04-22

New Features

• Support to import applications with block mode exports in clusters that do not natively support block mode exports.

• Instant Recovery decreases restore time for Persistent Volumes. Requires vSphere and a Veeam Backup & Replication server.

• Added the option to rename PVCs during restores.

Bug Fixes

• When upgrading multi-cluster, access tokens are immediately issued to secondary clusters after upgrading the primary cluster. This ensures that secondary clusters don’t have to wait several hours before receiving a license lease.

Security Issues

• Update K10 services base image to pull in latest security updates.

Upgrade Notes

• Additional validation requirements for transforms have been implemented. The policies and transform sets that contain invalid transforms will be marked as invalid. Consequently, policies with invalid transforms or transform sets will not run on schedule. Please refer to Transform Validation Requirements for further information.

• New metrics have been added. If you are using your own instance of Prometheus, you need to add one more target by following this guide.

5.5.8

Release Date: 2023-04-08

New Features

• Added support for Kubernetes 1.26.

• Add license management to Multi-Cluster Manager. See License Management for details.

• Improved execution times of backups and restores in OpenShift environments by caching OpenShift API discovery results.

• Root permissions are no longer required for backup, restore and export operations. The only exception is policies with export to NFS Filestore location profiles. Additionally, for Generic Storage Backups on OCP 4.11 and above, adjustments to the workloads need to be made to continue using this feature. Please see the this section for more details.

• The Veeam Backup & Replication console now has a single pane of glass integration for many Kasten K10 operations, documented in the Veeam Backup & Replication 12: Kasten K10 Integration Guide.

Bug Fixes

• Fixes repeated logging of "inconsistent label" error messages from the catalog.

• Retiring cross-region exported AWS EBS snapshots will fail unless the AWS IAM policy is updated. Please see Creating an IAM Policy and Using K10 with AWS EBS for the updated policies.

• Fixed a bug that allowed users to create profiles outside the K10 namespace via CLI. All profiles that were created outside of the K10 namespace will become invalid. Policies using such profiles will also become invalid and no longer as scheduled until they are assigned a valid profile.

Upgrade Notes

• Multi-cluster deployments should update the configuration of the primary cluster to include an ingress in order to enable the License Management feature. See Upgrading for details.

5.5.7

Release Date: 2023-03-25

New Features

• Added API support for blueprint bindings. New custom resource can be used to automate blueprints assignment to applications by K10 without having to manually annotate workloads.

• Added support to configure the K10 DR restore timeout using the helm flag restore.timeout.

• Option to overwrite existing kubernetes resources to their restore point state during restores.

Bug Fixes

• Fixed an issue where the Kanister Blueprint was not executed when a Custom Resource having the blueprint annotation is included using "Include Filter" in the policy.

Security Issues

• Update K10 services base image to pull in latest security updates.

Known Issues

• If you have an export that includes snapshot references and you want the snapshot to be copied to a different region than the source cluster, then the retirement of exported restore points containing CSI snapshots will fail.

Upgrade Notes

• The format of timestamps in service logs has been updated to match RFC 3339.

Deprecations

• Support for global.upstreamCertifiedImages has been removed from the K10 Helm chart since all images now use Red Hat certified base images by default. The --upstreamCertifiedImages flag has also been removed from the k10offline tool.

Other Notes

• For AKS clusters running K8s 1.24+, ingress traffic is not being forwarded to the respective services in the AKS cluster because the load balancer's health probes fail.

  To resolve this issue when using the nginx ingress controller add the following annotation

  service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path: "/healthz"

  to the affected load balancer service to point it to the correct path.

  Details: https://github.com/Azure/AKS/blob/master/CHANGELOG.md#release-2022-09-11

5.5.6

Release Date: 2023-02-25

New Features

• Added support for overriding built-in backup workflow for Crunchy Data Postgres Operator and K8ssandra. Custom blueprints can now be used by annotating the CRs.

• Added support for Transform Sets.

Bug Fixes

• Fixed an issue where missing or unbound PVC could not be excluded from snapshot.

• Fix distributed policies to properly reference distributed profiles.

• Fixed an issue where by enabling K10 Disaster Recovery with the correct HashiCorp Vault credentials via the UI would fail.

Security Issues

• Upgrade to Go 1.19.6 to mitigate security vulnerabilities.

5.5.5

Release Date: 2023-02-13

New Features

• Added support for providing K10 Disaster Recovery passphrase via secret stored in AWS Secrets Manager.

• Ability to preserve or transform PersistentVolumeClaim annotations on restore.

Bug Fixes

• Fixed CA Cert configmap cleanup issue when backup with multiple applications having Blueprint annotation fails.

• Fixed an issue exporting snapshot references in AWS & Azure to the current region.

Security Issues

• Update K10 services base image to pull in latest security updates.

5.5.4

Release Date: 2023-01-31

New Features

• Running an import policy now pulls in all active restore points from shared storage, not just the latest. If a restore point has been retired according to the export policy retention settings, the import action will clean up the imported restore point in the destination cluster as well.

• Added the repositories API for representing and managing the state of backup data exported by K10.

Security Issues

• Basic users are now restricted from using transforms in RestoreActions.

Upgrade Notes

• Helm settings image.registry and image.repository are being replaced with global.image.registry to set a custom registry. image.tag is being replaced with global.image.tag. image.pullPolicy is being replaced with global.image.pullPolicy.

5.5.3

Release Date: 2023-01-16

New Features

• Upgrade-init pods no longer require root permissions.

• Improved VirtualMachine restore workflow so that manual transforms to VirtualMachines, DataVolumes and PersistentVolumeClaims are no longer required. Any restore points created before this release will still need the transform.

Bug Fixes

• Import Policies outside K10's namespace will be ignored, including Import-and-Restore Policies. This prevents basic users from triggering ImportActions or RestoreActions through Policies in user namespaces.

Security Issues

• It is now possible to prevent basic users from creating ImportActions or RestoreActions. In some multi-tenant environments, these actions should only be available to administrators.

• Update K10 services base image to pull in latest security updates.

5.5.2

Release Date: 2022-12-20

New Features

• New helm flag to exclude applications from the dashboard & compliance considerations.

• Added connect [azure|gcs|pwx|s3|vbr|vsphere] sub-commands to k10tools primer storage command for Day-0/Day-1 checks of storage provider accessibility.

• Added check [awsebs|azure|csi|gcepd|vsphere] sub-commands to k10tools primer storage command for Day-0/Day-1 checks of storage snapshot/restore capabilities.

• Added auth check [oidc|ldap] sub-commands to k10tools primer command for Day-0/Day-1 checks of access to 3rd-party authentication services like AD/LDAP and OIDC.

• Added support for Kubernetes 1.24 and Openshift 4.11.

• Added support for Kubernetes 1.25.

• Added support to include NetworkAttachmentDefinitions referenced by VirtualMachines, while managing them.

• Added support to snapshot/restore the OpenShift Virtualization Virtual Machines that have DataVolumes defined separately i.e., not as part of VirtualMachine resource.

Bug Fixes

• Fixed an issue where Kanister sidecar injection was failing with configmaps "custom-ca-bundle-store" already exists when multiple apps were installed concurrently.

• Fixed K10 upgrade failure when vmWare.taskTimeoutMin helm flag is set.

• Fix Red Hat Marketplace installations to reference the correct Dex image.

• Prevent a transformation negative test from causing restores to fail.

• Fixed an issue where backup of multiple VirtualMachines simultaneously resulted in Blueprint not found error.

Security Issues

• Upgrade to Go 1.19.4 to mitigate security vulnerabilities.

• Update K10 services base image to pull in latest security updates.

Deprecations

• Command k10tools primer storage vsphere-connect is deprecated in favor of k10tools primer storage connect vsphere.

• Command k10tools primer storage pwx-connect is deprecated in favor of k10tools primer storage connect pwx.

• Command k10tools primer storage csi-checker is deprecated in favor of k10tools primer storage check csi.

Other Notes

• Built-in Prometheus now requires Kubernetes API permissions to discover K10 pods. Refer to the documentation for the details.

5.5.1

Release Date: 2022-11-18

Bug Fixes

• Fixed export action failures when exporting CSI snapshots with VolumeSnapshotClass``containing ``snapshot.storage.kubernetes.io/is-default-class=true annotation.

• Increased the threshold for warning of slow immutable backup scans, and clarified the explanation in the associated warning message.

• Prevented a false-positive warning for immutable backups data integrity checks.

• Fixed bug where clicking on tabs on the Policies page would switch back to the primary cluster.

Security Issues

• Update K10 services base image to pull in latest security updates.

5.5.0

Release Date: 2022-11-05

Release Summary

With this release, Kasten by Veeam scales the simplicity of operations to bridge the Kubernetes skills gap with powerful capabilities, including autonomous operations and cloud-native expansion.

Kasten K10 adds capabilities for autonomous operations & decisions, that simplify data protection at scale:

• Backup Windows: Kasten K10 will automatically start/stop backup operations based on configured, per policy, off-peak hours.

• Job Staggering: Kasten K10 will not only honor the backup windows but will further automate the sequencing of the underlying backup jobs, thereby optimizing the utilization of the infrastructure resources.

• Policy Presets: Operations teams can define multiple protection policies that specify parameters such as backup frequency and location, which can then be re-used by application teams. This ensures the separation of concerns while scaling operations in a cloud-native environment.

Red Hat OpenShift Virtualization: OpenShift Virtualization enables you to run and manage Virtual Machine (VM) and container workloads side-by-side on Red Hat OpenShift. Kasten K10 now adds support for those VM workloads.

GitOps Pipeline Integration: Defining your application and configuration as code and enabling feature velocity with CI/CD is one of the key benefits provided by GitOps. Kasten K10 can now integrate into GitOps workflows to backup applications right before a new automated release.

IPv6 Support: IP address exhaustion is a here-and-now issue that organizations using IPv4 face. Kasten K10 addresses this issue by operating in IPv6 environments such as Amazon EKS.

VMware Tanzu: Kasten K10 now also supports NFS as a storage target in block mode for these environments.

Azure Managed Identity: Kasten K10 further simplifies security with support for Azure Managed Identities. You can now authenticate with any resource that supports Azure Active Directory authentication.

New Features

• Use an existing passphrase stored inside a Vault instance when enabling a K10 Disaster Recovery profile.

• K10 now supports backup/restore and migration of OpenShift Virtualization Virtual Machines.

• Added support for Policy Presets. Refer to this page for more details.

• Added Presets page to manage Policy Presets on the K10 Dashboard.

• Added support for HashiCorp Vault Kubernetes Authentication method.

Bug Fixes

• Fix a situation where immutable backups blob integrity checks were triggering a false positive.

• Fixed the external link in K10 installation documentation that points to AWS page for creating an IAM Role and Policy for Service Account.

• Fixed issue where users were being routed back to the primary cluster when clicking certain links or buttons inside a secondary cluster.

Security Issues

• Update K10 services base image to pull in latest security updates.

Other Notes

• K10 doesn't use OpenSSL and isn't affected by the recently announced CVE-2022-3602 and CVE-2022-3786 vulnerabilities. Additionally, the version of OpenSSL in the underlying Docker images is 1.1.1, which is also unaffected.

5.0.11

Release Date: 2022-10-21

New Features

• Added support to use Azure File Share as a target for backups and exports via an NFS FileStore location profile.

• Block-mode snapshot exports can now be sent to an NFS File Storage Location.

• Add Garbage Collector to clean up RetireActions, ImportRunActions and expired RestorePointContents.

• Option added to set an expiration time for a manual snapshot.

• Added a Prometheus metric for highest nodes seen per month.

• Added processed volumes progress and data transfer rates to Action Details for exports.

Security Issues

• Upgrade Dex image to mitigate security vulnerabilities.

• Upgrade to Go 1.19.2 to mitigate security vulnerabilities.

Upgrade Notes

• When verifying an LDAP host, the Common Name of the certificate is no longer consulted, a valid Subject Alternate Name (SAN) must be provided instead. Installations using LDAP authentication should check that the LDAP host's certificate has an appropriate SAN for the host.

  For more information, see the Common Name Certificates troubleshooting section.

5.0.10

Release Date: 2022-10-07

New Features

• Added support for NFS FileStore location profile for etcd backup and restore of OpenShift Container Platform clusters.

• Added form view for installing the K10 operator on Openshift platform.

• Add support for running K10 in IPv6 clusters on EKS. See EKS IPv6 Support for more details.

• Users without list permissions on profiles can now manually enter the profile name when creating a policy via the UI.

• New helm options to configure concurrent sub-operation limit for each restore action.

Bug Fixes

• Fixed an issue with updating infrastructure profile to include new spec for Azure Managed Identity with default ID feature.

• Improved data upload performance on subsequent runs of export operation.

Known Issues

• For import operation to be successful, the target cluster K10 namespace must match the source cluster namespace.

5.0.9

Release Date: 2022-09-23

New Features

• The kubectl command now displays additional columns for Action objects, including their current Status.

• Added support for Azure Managed Identity, with a specific client ID or with default ID. Refer to Azure Managed Disks page for more details.

• Added support for staggering when a Backup Window is used.

• Added progress indication for actions and policy runs.

• Added a new action status filter on policy run pages that includes the ability to filter on cancelled actions.

Bug Fixes

• Fixed a bug that caused the creation of blueprints from the Blueprints page on the K10 Dashboard to fail without a clear error message.

• Fixed an issue detecting region mismatches when creating an immutability-enabled profile.

Security Issues

• Update Grafana version to 9.1.5 to pull in the latest security updates.

• Update K10 services base image to pull in latest security updates.

5.0.8

Release Date: 2022-09-12

New Features

• Added support for Backup Window in a backup policy.

Bug Fixes

• Fixed an issue where Azure profile creation was failing in the UI.

• Hide the "Run Once" button if the policy was not created in the k10 namespace.

• Paused notifications no longer cover side panels, therefore the delete button of Restore Point Details remains clickable.

• Fixed an issue where the k10.kasten.io/isRunNow label was missing from the BackupActions and ExportActions created when a K10 policy was triggered using the "run once" button on K10 dashboard.

Security Issues

• Update K10 services base image to pull in latest security updates.

Upgrade Notes

• The gateway service has changed from using the upstream emissary image to a custom built emissary image. If you are using K10 in an airgapped environment, consider re-running the steps here to get the latest set of K10 images and then updating your air-gapped repository with any new images.

5.0.7

Release Date: 2022-08-29

Bug Fixes

• Using backup and export with custom export retention settings now allows the user to have 0 retained local backups via the UI.

• Fix "Unexpectedly empty PVC name" error when restoring backups without PVCs.

• Fixes rare issue that could prevent direct upgrade from very old K10 version to K10 versions 5.0.1-5.0.4.

Deprecations

• Removed the option to automatically create buckets during profile creation if they don't exist. Prior creation is now required.

5.0.5

Release Date: 2022-08-12

New Features

• Warning when adding a Veeam Backup & Replication location profile with a server different from the already saved

• Upload end time is now displayed in restore point content details via the API.

Bug Fixes

• Restoration from an immutable backup will use a point-in-time slightly later than the recorded upload end time for each PVC data upload to help compensate for clock skew.

• Fixed a bug that caused Grafana alerts creation to fail due to the DataSource authorization issue.

• Fixed an issue where in certain rare cases K10 would throw a false positive alert for tampering with an immutable backups repository.

• Fixed an issue where backups would fail with a "Storage Class referenced by PVC not found" error when a PVC associated with the application was excluded using filters and when the PVC's storage class did not exist in the cluster.

Security Issues

• Update K10 services base image to pull in latest security updates.

• Update Emissary Ingress to 3.1.0 to include latest security updates.

Upgrade Notes

• Updated K10's Grafana sub chart to version 6.32.9.

5.0.4

Release Date: 2022-07-30

New Features

• Added ability to set up IPv6 listener for frontend service. It is usable if cluster was configured in IPv6-only mode.

• Added support for Kubernetes 1.23.

• Added support for OpenShift 4.10.

• Added new regions for profiles such as AWS Jakarta and GCP Milan.

• Added keyboard navigation and a Back button to the Guided Tour.

• The use of a Veeam Backup Repository in a vSphere with Tanzu guest cluster is now supported. See vSphere for details.

Bug Fixes

• Fixed an issue where snapshot jobs fail due to lack of AWS credentials even though they are provided in an infrastructure profile.

• Fixed an issue where V2 Kanister Blueprints were failing on non-workload subjects.

• Longhorn CSI storage classes are now identified as CSI.

• Fixed an issue where GCP buckets were created in the wrong location if not pre-created before profile creation.

• Fixes a visual bug where four or more exported restore points displays improperly and not in a stack.

5.0.3

Release Date: 2022-07-18

New Features

• Added ability to manage service account for pods running during k10tools primer GVS operations. Refer to this page for more details.

Bug Fixes

• Added ambassador_id in all ambassador resources created by K10. This will ensure that the K10's ambassador will not conflict with other ambassador instances running on the same cluster.

• Fixed an issue where the backup data stats were being gathered twice as often as needed.

• Fixed an issue with failing restore of resources with a long persistent volume claim name

• Omit Aggregated API watch termination message from logs.

• Fixed an issue where PVCs were restored without their annotations.

• The number of pods that can run simultaneously to gather backup data stats has been reduced.

Security Issues

• Upgrade to Go 1.17.12 to include the latest security patches.

5.0.2

Release Date: 2022-07-01

New Features

• Using an immutable-backups-enabled location profile with the generic volume snapshot or shareable volumes workflow will warn the user that immutability guarantees are unsupported, but will otherwise backup and restore as a standard (non-immutable) location profile.

• Added the ability to create an Azure infrastructure profile for specifying Azure credentials.

Bug Fixes

• Fixed an error preventing the restoration of backups created via the generic volume snapshot workflow with an immutable backups enabled location profile.

• Added owner reference to the secret of automatically created infrastructure profile.

Security Issues

• Update K10 services base image to pull in latest security updates.

• Update Emissary Ingress (Ambassador) to 3.0.0 to include latest security updates.

5.0.1

Release Date: 2022-06-17

New Features

• Added optional storageclass (-s) parameter to the k10tools Generic Volume Snapshot Capabilities Check command.

• Added manual validation of storage classes to the dashboard (Settings -> Support) for admin users. This is the same validation performed by k10tools.

Bug Fixes

• Fixed a regression backing up applications with multiple non-workload PVCs. Issue introduced in version 4.5.13.

• Fixed issue retiring snapshot+export policy runs that select no applications and do not trigger export.

Security Issues

• Update K10 services base image to pull in latest security updates.

Known Issues

• The generic storage and shareable volume backup and restore workflows are not compatible with immutable backups location profiles; their use together is not supported.

Upgrade Notes

• NOTE: K10 5.0.1 is not compatible with Kubernetes v1.24.0. The following instructions are applicable for future releases of K10.

  With the release of Kubernetes v1.24.0, client.authentication.k8s.io/v1alpha1 has been deprecated. Amazon EKS users with older clusters will be required to perform the following operations before upgrading K10.

  1. Upgrade aws-cli to the latest version.

  2. Run the aws eks update-kubeconfig --name ${EKS_CLUSTER_NAME} [FLAGS] command to update the Kubernetes configuration. For more information on the command, see https://awscli.amazonaws.com/v2/documentation/api/latest/reference/eks/update-kubeconfig.html.

  If you have questions or need support, see Support and Troubleshooting.

5.0.0

Release Date: 2022-06-06

Release Summary

With this latest release of Kasten K10, we focused on security enhancements, improved operational capabilities, and expanded ecosystem support.

Security features include KMS integration with AWS KMS and HashiCorp Vault, a Kubernetes-native RBAC objects UI, ransomware attack detection with AWS S3 or S3-compatible storage supporting S3 Object Lock, data protection policy guardrails, and support for Veeam-hardened Linux repositories with immutability that offers comprehensive ransomware protection.

To better support left-shifting data protection operations, we added fully integrated add-ons for newly launched Amazon EKS Blueprints, Level III certified Red Hat OpenShift Operator with full lifecycle capabilities, new built-in Kanister Blueprints for MS SQL and Crunchy Data Postgres Operator, and simplified UX for operations with the new Kanister Blueprint editor for a more intuitive and streamlined workflow, and a new report mechanism for critical metrics.

We continued enhancing ecosystem support and added support for Red Hat and SUSE Rancher Marketplaces. We also added support for VMWare vSphere with Tanzu and Falco.

New Features

• Added Blueprints page to manage Kanister Blueprints on the K10 Dashboard. Refer to this page for more details.

• Support for block mode exports to an Object Storage Location is now available in vSphere environments.

• Added support for external Prometheus to scrape K10 metrics. For more information, see Integrating External Prometheus with K10.

• Added support for Crunchy Data Postgres Operator backup and restore with K10. Refer to this page for more details.

• Users will now get alerts on K10 Dashboard when policy validation fails.

• vSphere with Tanzu guest clusters are now supported. Access to vCenter is required from the guest cluster and the additional Cns.Searchable privilege is required for the account used to connect to vCenter. Available functionality is described in the vSphere storage integration section.

  The Velero vSphere Operator is used to enable changed block tracking in vSphere with Tanzu guest clusters, as explained in the K10 knowledge base article Enable changed block tracking in vSphere with Tanzu guest clusters. Please ensure that the operator version used is compatible with the Kubernetes version of the supervisor.

  Support for block mode exports to a Veeam Backup Repository Location with vSphere with Tanzu guest clusters is currently experimental and not enabled by default.

Bug Fixes

• Fixed bug where a policy's export setting could be updated to an incompatible profile.

• Fix for the regression of the PVC transform feature.

• Fixed issue with excluding non-workload PVCs by label.

Security Issues

• Upgrade to Go 1.17.10 to include the latest security patches.

Upgrade Notes

• The K10 config-svc has been updated and renamed to controllermanager-svc.

• Upgrade bundled Prometheus from version 2.26.0 to 2.34.0.

Other Notes

• Beginning with this version, the free Starter edition of K10 is restricted to 5 nodes or fewer.

4.5.15

Release Date: 2022-05-13

New Features

• Increased the timeout for K10 DR backup operation to 60 minutes.

• The K10 Operator now supports K10 Disaster Recovery.

• Limited access users can now view their namespaces' RBAC objects in the dashboard.

Bug Fixes

• Fixes issue where run actions fail and automatic retirement ceases for a policy with selective export and independent export retention schedule.

Security Issues

• Update Grafana version to 8.5.0 to pull in the latest security updates.

• Update K10 services base image to pull in latest security updates.

4.5.14

Release Date: 2022-04-23

New Features

• Added manual validation to policies.

Bug Fixes

• Fixed an issue that caused UI to timeout while loading actions for non-admin users.

• The K10 DR restore process now has a more robust timeout handling mechanism.

• Ensured the Operator deployed K10 instance uses the Red Hat registry version of kanister-tools image.

• Fixed an issue that prevented the backup of custom resources named "services".

• Fixed issue where cluster ID and system info were not displaying properly after switching clusters inside a multicluster dashboard.

Upgrade Notes

• The repository and image name of the ingress gateway used by K10 changed in v4.5.12. Upgrades from versions prior to v4.5.12 will need to explicitly reset the ambassadorImage helm value. See this knowledge base article for more information.

Other Notes

• Updated documentation to include offline OpenShift K10 operator installation instructions.

• The Export snapshot data to VBR repository label in the backup policy dialog has changed to Export snapshot data in block mode.

4.5.13

Release Date: 2022-04-09

New Features

• Infrastructure profile for AWS is now supported. Refer to AWS storage page for more details.

• Added manual validation to Location & Infrastructure profiles.

• Added the ability to manage (create, edit) Blueprints on the dashboard.

Bug Fixes

• Fixed an issue where K10 DR restore failed when K10 was installed on a non-default namespace.

Security Issues

• Update K10 services base image to pull in latest security updates.

Deprecations

• Restore and retirement operations for exported restore points and Generic Volume Snapshots created in K10 releases older than 2.5.1 have been deprecated. If you have questions or need support, see Support and Troubleshooting.

• Starting with the next major release of K10, the number of free nodes will be reduced from 10 to 5. If you believe you will be affected by this change, please reach out to your Kasten Sales Representative.

4.5.12

Release Date: 2022-03-25

New Features

• Support added for Azure government object store locations.

• Introducing a Role Based Access Control (RBAC) dashboard for customizing access to K10's dashboard and APIs.

• Added the ability to limit the number of reports retained.

Security Issues

• Update K10 services base image to pull in latest security updates.

Other Notes

• Upgraded Ambassador from 1.14 to 2.2.2.

4.5.11

Release Date: 2022-03-15

New Features

• Compliance and snapshot/export storage size metric names updated and added to Grafana. See the Monitoring documentation for more details.

• Add volume snapshot size information to RestorePoint.

• Added a filter option to filter restore points that were created manually.

Bug Fixes

• Fixed an issue where the restore application phase attempted recreation of an existing namespace.

• Added a display for "System Policies" to the dashboard.

Security Issues

• Update Ambassador to 1.14.3 to include latest security updates.

Other Notes

• Improved node count calculation for license enforcement.

4.5.10

Release Date: 2022-02-28

Bug Fixes

• Fixed bug where Passkey names were not honored while storing in catalog.

• Fixed an issue introduced in K10 release 4.5.9 due to which import policies were importing old restore points instead of latest restore point.

• Fixed a message on policy run actions such that "All successfully completed" should not be displayed if some actions were cancelled.

Security Issues

• Upgrade to Go 1.17.7 to mitigate CVE-2022-23772 and CVE-2022-23806.

4.5.9

Release Date: 2022-02-12

New Features

• Upgraded Fluent-bit version in logging service from 0.14.8 to 1.18.11

• Issues with protecting and monitoring immutable backups are now shown in Alert Messages panel on the dashboard.

• Introduced a new helm flag ingress.pathType to set path type for ingress resources. Defaults to ImplementationSpecific.

• Added support for installing K10 enterprise editions via Red Hat Marketplace

Bug Fixes

• Fixed an issue that caused exports of cluster-scoped resources to fail.

• Fixed an issue where exports were failing for policies deleted and recreated with the same name. The issue was introduced in K10 release 4.5.2. After upgrading source and destination clusters to 4.5.9, to apply this fix, the export policy must be deleted and recreated while the import policy must be updated with the newly generated import details.

• Fixed bug where a policy that uses Kanister hooks for backup was not displaying the hooks on the form when editing the policy.

• Fixed a bug where the EULA acceptance form would not display when there is no connection to the outside internet.

Security Issues

• Fix CVE-2021-23017 discovered in the previous nginx versions.

• Update K10 services base image to pull in latest security updates.

Upgrade Notes

• Upgrade frontend nginx server to the 1.20 series.

4.5.8

Release Date: 2022-01-31

New Features

• Added an events service for processing background events in K10.

• Infrastructure profile for GCP is now supported. Refer to Google Cloud Platform page for more details.

• Added highest nodes seen per month to Settings -> Licenses. Last two months only.

• Added support for OpenShift 4.9.

Bug Fixes

• Fixed an issue with failed jobs being displayed as running in certain conditions.

• Fixed an issue that could potentially log sensitive information when KubeTask function is used in Kanister Blueprints.

• The "Grant Permissions" button on the multi-cluster dashboard was not pre-populating the form correctly and has been fixed.

Other Notes

• Add resourceVersion to Action resources.

4.5.7

Release Date: 2022-01-16

New Features

• Enable cleanup of orphaned snapshots for vSphere.

• Enable cleanup of orphaned snapshots for Ceph.

• Added an option to download troubleshooting logs from K10 dashboard.

• Cancelling parent RunAction jobs now cancels the child jobs.

• Added support for Kubernetes 1.22.

• New k10tool command to list FCD snapshots taken by K10.

• Add ability to download PDFs of reports in the Dashboard.

Bug Fixes

• Allow use of k10tools primer upgrade in previous releases.

• Fixed an issue that caused the first export of a backup with multiple volumes to fail.

• Improved the error message when attempting to create a policy or profile with an existing name.

• Fixed a bug where restoring of some cluster-scoped resources was not working in the dashboard.

Security Issues

• Update K10 services base image to pull in latest security updates.

4.5.6

Release Date: 2021-12-17

New Features

• Added the ability to tag vSphere snapshots.

• Allow Prometheus and Grafana to be disabled separately.

• Overall action metrics are now emitted in addition to the specific action metrics.

• Added the ability to view the details on a policy run action.

• Added the ability to create a custom schedule for report generation.

• Tagging of vSphere snapshots can now be enabled.

• Add the ability to view the recommended Helm based K10 upgrade steps to k10tools and dashboard.

• Added support for HashiCorp Vault Transit Secret Engine to protect K10 encryption key.

• Veeam Backup support. This release supports the export of vSphere CSI provisioned volume snapshot data to a Veeam Backup Repository when using a supported vSphere cluster. Immutable Veeam repositories are not supported at this time. The feature requires Veeam Backup 11a CP3 (build number 11.0.1.1261 P20211211) or greater.

Bug Fixes

• Fixed an issue due to which the unmounted PVCs were not being listed on the Application Details page.

• Fixed an issue that caused application scoped policies to fail validation when using NFS FileStore location profile.

• Fixed an issue that caused snapshots to fail for workloads having both Generic Volume Snapshot and Kanister Blueprint annotations.

• Fixed issue with labels on export actions when multiple policies select same application.

• Fixed an issue that caused imports to fail when using Google Cloud Storage location profiles.

Security Issues

• Update Grafana version to pull in fix for CVE-2021-43798.

Known Issues

• Release 4.5.5 requires global.imagePullSecret to be set to k10-ecr when either secrets.dockerConfig or secrets.dockerConfigPath is set. Customers upgrading from a previous version will need to set this if using docker repository credentials.

Upgrade Notes

• Upgraded Ambassador from 1.9.1 to version 1.13.8 when using certified Red Hat images with Helm.

• Overall action metrics are now used in dashboards and reports. As such, action data from before the upgrade may not be shown.

Deprecations

• Deprecate the use of grafana.image.pullSecrets and prometheus.imagePullSecrets in favor of global.imagePullSecret.

4.5.5

Release Date: 2021-12-06

New Features

• Added support for installation via AWS marketplace for containers anywhere.

• Added a new global helm value global.imagePullSecret. Specify a secret name using this helm value if a custom docker config is provided for a private repository using global.dockerConfig or global.dockerConfigPath.

• New report fields results.general.infraType, results.general.authType, results.general.k10namespace, results.general.aws.

• Added on demand frequency option to policies API and dashboard.

Bug Fixes

• RunActions generated by application scoped policies can now be seen on the dashboard.

• Kubeconfig file input now accepts file types with no extension by default and is clickable.

• Fixed an issue that caused Generic Volume Snapshots of unmounted PVCs to fail when they are created using CSI provisioners.

4.5.4

Release Date: 2021-11-24

Bug Fixes

• Fixed a regression introduced in version 4.5.3, which impacted volume snapshots in VMware clusters.

4.5.3

Release Date: 2021-11-19

New Features

• Introduced a new helm flag services.aggregatedapis.hostNetwork that can be used to enable hostNetwork for aggregatedapis service pod.

• Re-import of RestorePoint now supported after deleting RestorePointContent

Bug Fixes

• EFS volumes that were left behind during export are cleaned up.

• Option to skip certificate verification now also applies to Immutable Backups bucket validation during profile creation.

• Fixed a bug on the policy form where export retention values are not reset correctly.

• Enable Reports switch value is now correct after page refresh.

• Fixed issue where form data was not populating correctly when editing an Import policy.

• Fixed a bug where a paused policy is unintentionally resumed after editing.

Known Issues

• The first time a backup with multiple volume snapshots is exported to an export location, data in the location may be inconsistent in a way that renders that location unusable. ExportActions to this repository will fail. As a temporary workaround, delete the contents of the export location for that application. Rerun the ExportAction, but select only a single volume. Future ExportActions will now work for this policy, even with multiple volume snapshots selected.

4.5.2

Release Date: 2021-11-10

New Features

• A success message has been added to the Actions card to indicate that all phases have completed successfully.

Bug Fixes

• Fix service disk usage reporting for some environments.

• Fixed an error related to the image of the init container in the Grafana deployment during installation of K10 using the OpenShift operator.

• Fixed a permission error seen during the startup of the init container in Grafana's deployment during installation of K10 using the OpenShift operator.

• K10's grafana deployment now honors the global.persistence.enabled , global.peristence.storageClass and global.persistence.accessMode helm values.

• Fixed an issue that caused exports to NFS FileStore location to fail when K10 is installed as an OpenShift Operator.

• Fixed an issue that caused restore of unmounted PVCs from exported/imported restore points to fail when using an NFS FileStore location profile.

• Remove creation of the k10-k10 SecurityContextConstraint in OpenShift environments to workaround https://access.redhat.com/solutions/4727461

Security Issues

• Update K10 services base image to pull in latest security updates.

Upgrade Notes

• The helm values grafana.persistence.size , grafana.persistence.accessModes and grafana.persistence.storageClassName have been deprecated. The helm values for configuring any stateful service's PVCs (including Grafana) are global.persistence.enabled, global.persistence.size, global.persistence.accessMode and global.persistence.storageClass. To ensure that the Grafana PVC is not recreated during an upgrade, the global.persistence helm values must match the deprecated helm values.

Other Notes

• Updated AWS EFS permissions in the docs to better reflect K10's requirements.

4.5.1

Release Date: 2021-10-26

Bug Fixes

• Correct the secrets mount path to be /var/run/secrets.

• Conflict when another Grafana installation is already present in the cluster.

4.5.0

Release Date: 2021-10-25

Release Summary

With this latest release of Kasten K10, we focused on delivering an improved out-of-the-box experience, expanding edge capabilities, and broadening ecosystem support for data services and partner technologies. These innovations will help organizations protect and optimize their Kubernetes investments. On the improved out-of-the-box experience front, we added built-in support for monitoring and alerting to help our customers quickly identify issues in their Kasten K10 deployments, get notified of those issues, and fix them as quickly as possible. We also added reporting capabilities that lets you access reports through our GUI and through native Kubernetes tooling such as kubectl or the Kubernetes API. Many of our customers have expressed interest in deploying Kubernetes at the edge of their environment and asked us to help support them in their journey. We’re happy to announce that Kasten K10 now support K3s as well as EKS-Anywhere.

New Features

• Introducing integration with Grafana. A new dashboard in Grafana lets users monitor K10 actions, policy runs and storage consumption. Alerts can be created using Grafana's dashboard based on K10 metrics. See the Monitoring documentation for more details.

• The immutable backups feature is now available by default.

• Added support for K8ssandra backup and restore with K10. Refer to this page for more details.

• The dashboard now supports adding blueprints to application workloads.

• Introducing scheduled reports on the dashboard. See the Usage & Reports page to enable report generation.

Bug Fixes

• Fixed an issue where K10 air-gapped DR restore was failing as kanister-tools image defaulted to github container registry.

• Avoid spurious errors by creating cluster secrets before clusters.

• Fixed issue of K10 service disk usage metrics with incorrect units.

• Allow manual cluster removal when automatic disconnection is not possible.

• Fixed a bug on multi-cluster dashboard where the number of actions could be negative after removing a cluster.

• The Policy Form now correctly refreshes data when switching between Snapshot and Import Actions.

• Fixed a bug where K10 upgrade checks was displaying error messages on air-gap systems.

Upgrade Notes

• If Prometheus was previously disabled with prometheus.server.enabled = false, the grafana.enabled value must be updated to match.

4.0.13

Release Date: 2021-09-28

New Features

• Added support for AWS KMS to protect K10 encryption key.

• Memory and CPU resources for Generic Volume Copy pods used for exporting snapshots can now be configured using helm options. Refer to this page for more details.

• Added a new helm option kanister.podReadyWaitTimeout to configure timeout to wait for Kanister pods to reach the ready state during K10 operations.

• Dynamic EFS snapshots are now supported via the shareable volume snapshot mechanism.

• Simplified RDS PostgreSQL integration with K10. Refer to this page for more details.

• The dashboard now has an Alert Messages panel for centrally displaying helpful warnings.

Bug Fixes

• Fixed issue where blueprint backup annotation was being ignored.

• Fixed an issue where unsupported PVCs caused an error; even though they were excluded through filters.

• Fix accessing secondary clusters when the primary cluster is using basic authentication.

• Fixed an issue where an inadvertent schema change in the catalog caused a requested index not found error after upgrading to 4.0.11.

• Fixed an issue that caused restores to fail on workloads annotated with older Kanister blueprints when deployed with workloads annotated with V2 Kanister blueprints in the same namespace.

• Fixed issue with restoring pods that contained affinities.

• Fixed a bug where global policies showed empty import migration string option.

Security Issues

• Update K10 services base image to pull in latest security updates.

Upgrade Notes

• This release will perform a catalog schema upgrade. The catalog service's PVC size may have to be increased to ensure a successful upgrade.

Other Notes

• Update Ambassador to 1.14.1

4.0.12

Release Date: 2021-09-13

New Features

• Emit metrics to indicate when an action has started, ended, and been skipped.

• Added support for K10 DR Restore in air-gapped installation mode.

• The Application Details panel now displays custom resources.

• The dashboard now supports resource filters for import and restore policies.

• The dashboard now supports pre/post kanister-execution hooks for manual exports of restore points.

Known Issues

• After running the k10multicluster disconnect command to remove a cluster, it might continue to be listed on K10's multi-cluster dashboard. This happens only if the cluster was added to K10 in a release older than 4.0.10. The workaround for removing the cluster would be to remove the finalizer dist.kio.kasten.io/manual-debootstrap from the cluster's spec using kubectl edit cluster <cluster name> --namespace=kasten-io-mc.

Other Notes

• Update documentation to indicate Kubernetes 1.20 and 1.21 are supported.

4.0.11

Release Date: 2021-08-28

Bug Fixes

• Fixed an issue where profile validation would fail with the error The requested DurationSeconds exceeds the MaxSessionDuration set for this role. K10's config service now uses the helm value awsConfig.assumeRoleDuration to avoid this error.

• Automatically remove Prometheus scrape configs when a cluster is deleted.

• Fix the Prometheus server to automatically reload its configuration when changed.

• Fixes issue where 500 errors appear on Dashboard for non-admin users.

• Fixed a bug in the dashboard policy form where an edited form was not retaining the setting for exporting snapshot references only.

Known Issues

• If K10 has been deployed using an AWS IAM role and if this error is seen in K10's logs The requested DurationSeconds exceeds the MaxSessionDuration set for this role, then this can be fixed by either setting the K10 helm value awsConfig.assumeRoleDuration to a value that is less than or equal to the maximum session duration for the IAM role or by increasing the maximum session duration. For documentation about how to view and edit the maximum session duration for an IAM role see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session.

4.0.10

Release Date: 2021-08-16

New Features

• K10 now supports pre-action Kanister hooks and pre/post action hooks are now supported on backup actions.

• When clusters are deleted, resources created during bootstrapping are automatically cleaned up.

• Secondary clusters in a multi-cluster setup now support all authentication methods.

• A new helm value awsConfig.assumeRoleDuration can be used to configure the duration of a session token generated by AWS for an IAM role. The minimum value is 15 minutes and the maximum value is the maximum duration setting for that IAM role. For documentation about how to view and edit the maximum session duration for an IAM role see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session.

• The Dashboard now supports disconnecting secondary clusters from a multi-cluster system.

• Actions related to Policy Runs are now grouped. Policy Runs now have a dedicated page where you can view policy run details and actions.

Bug Fixes

• Use service account token for cluster connection when bootstrapping through the API or UI.

• Made Generic Volume Snapshot deletion idempotent to avoid failures stating that the snapshot was not found.

• Fixed bug where a policy that targets both cluster-scoped resources and applications by label was creating an invalid policy spec.

• Fixed a Dashboard bug that was incorrectly showing resource filter options when editing import policies.

Security Issues

• Update K10 services base image to pull in latest security updates.

Upgrade Notes

• CRD APIs are updated from v1beta1 to v1, that are available since Kubernetes version v1.16.

4.0.9

Release Date: 2021-08-03

New Features

• Added a new sub-command openshift prepare-install to the k10tools command. It generates the helm installation command for installing K10 in an OpenShift cluster. Refer to the K10 Tools Page for more details.

• Renamed the remove command in k10multicluster to disconnect.

• On the Dashboard, a manual restore now presents the option to specify an alternate location profile for restoring an external restore point.

• Improved display of Kanister-related workloads on the Dashboard application details panel.

• The policy form on the Dashboard now shows other non-matching profiles in addition to the profile options that are compatible with the given migration string.

Bug Fixes

• Support vSphere xfs exports and restores.

• Label filtering has increased the number of navigable actions in the dashboard.

Security Issues

• Update K10 services base image to pull in latest security updates.

Other Notes

• Performance improvement to dashboard though use of label indexes.

4.0.8

Release Date: 2021-07-21

Bug Fixes

• Update govmomi version to support error checking.

4.0.7

Release Date: 2021-07-19

New Features

• Validate secondary cluster connections while bootstrapping with the k10multicluster tool.

• Preserve source volume tags for provider snapshots.

• Support CSI cross-region migration for AWS, Azure and Google cloud service providers.

• The Dashboard now supports the advanced export option for specifying an azure resource group when copying volume snapshots.

Bug Fixes

• Fix the overall status condition for Bootstrap objects to not indicate failure prematurely.

• Fix to support snapshot exports of xfs formatted vSphere volumes.

• Multi-cluster global policy form now displays selector labels from all clusters and not just the primary cluster.

• Fixed bug where policy shows error for missing profile after creating a profile in the policy form.

• Added a message to global policies and profiles to clarify that they won't be validated until after they are distributed to clusters.

Deprecations

• The type sub-field has been deprecated from Kanister blueprint actions.

• Removed support for Kubernetes 1.15.

4.0.6

Release Date: 2021-07-03

New Features

• Application and action state summary added to RunAction details.

• Added Helm options to override Kanister operation timeouts.

• Added new Azure regions for Germany, Australia, China, Norway, S Africa, Switzerland, and UAE.

Bug Fixes

• Fixed an issue where custom URL path set by ingress.urlPath or route.path was not working with authentication methods except basic authentication.

• Fixed an issue that caused backups to fail on workloads annotated with older Kanister blueprints when deployed with workloads annotated with V2 Kanister blueprints in the same namespace.

• Fixed an issue that would cause long running Generic Volume Snapshot backups to timeout after 4 hours due to the default Kubernetes streaming connection idle timeout.

• Fixed an issue where import jobs on a destination cluster would fail with the error chacha20poly1305: message authentication failed if the source cluster had an existing export policy and was upgraded from a pre-3.0.9 to a newer release. After upgrading source and destination clusters to 4.0.6 to apply this fix, the import policy will need to be updated. Refer to https://kb.kasten.io/knowledge for instructions.

• Fixed an issue related to accessing K10's instance of prometheus when ingress.urlPath or route.path is used. The K10 helm values for prometheus will have to be updated if one of these helm values is used. Refer to the documentation for accessing K10's dashboard using ingress here and OpenShift routes here.

• Fixed a bug in the Dashboard where the letter F could not be entered into the search field of the YAML editor dialog.

• An improved fix for a bug where editing a policy with sub-frequency options resets the frequency settings.

Security Issues

• Fix proxy requests to secondary clusters to be restricted to the secondary cluster.

• Update K10 services base image to pull in latest security updates.

Other Notes

• Update Ambassador to 1.13.8.

4.0.5

Release Date: 2021-06-21

New Features

• Introduced a new helm flag cluster.domainName to set custom cluster domain name in an environment where the domain name is not cluster.local.

• Transform paths now accept escape characters to support objects with keys that contain /. Current transform paths that contain ~ characters may need modification. See transforms documentation, "Paths" section, for details.

• Label index added. Searches using label filters on k10.kasten.io labels will be faster.

• Kanister artifacts created by backup of an application annotated with V2 Kanister blueprint will now include snapshot size information.

Bug Fixes

• Fixed an issue where K10 Disaster Recovery restore was failing if K10 was installed with custom CA certificate.

• Fixed an issue where backup data stats for K10 DR backup were not getting updated on the data usage page.

• Fixed an issue that could duplicate storage class artifact in RestorePoint and cause ExportAction to fail.

Security Issues

• Update Go to pull in latest security fixes.

• Update K10 services base image to pull in latest security updates.

Upgrade Notes

• This release will perform a catalog schema upgrade to add label indexes that support label filtering.

Other Notes

• Kanister release 0.60.0 introduced some breaking changes to V2 blueprints that use kando to write and read data. Note that we removed the gzip command from the bash command since the stream is deduplicated/compressed during processing. Similarly, the corresponding gunzip command has been removed from the restore action. Due to this, the backups performed using V2 blueprints from Kanister releases 0.58.0 and 0.59.0 can no longer be restored using the newer blueprint. To restore such backups after upgrading to the latest blueprint, delete the blueprint before triggering the restore.

4.0.4

Release Date: 2021-06-09

New Features

• Added policy detail to RunAction resource. Added counts of action status to RunAction details sub-resource.

Bug Fixes

• Made blueprint creation idempotent to avoid failure stating that it already exists.

• Fixes issue with policies that export cluster-scoped resources. The issue was introduced in K10 release 4.0.2.

• Fixed an issue where the dashboard service would CrashLoopBackoff periodically if K10 was configured with a FileStore profile.

• Fixed an issue where custom CA certificate ConfigMap was getting deleted after the backup.

• Fixed an issue where Generic Volume Snapshot into an NFS FileStore location would fail if triggered on a workload with no PVCs.

• Fixed issue with application scoped policies where migration token would unexpectedly get deleted.

• Fixed Multi-Cluster issue where users without any bindings were able to view clusters as admins.

• Fixed an issue that caused Generic Volume Snapshot and K10 Disaster Recovery operations to timeout when using NFS FileStore location profile.

• The dashboard no longer displays error message banners after logout.

• Fixed a problem where appended white space in filter fields was not being trimmed.

Security Issues

• Update Ambassador to 1.13.6 to include latest security updates.

• Update K10 services base image to pull in latest security updates.

Known Issues

• An issue has been identified with policies that export cluster-scoped resources. The issue results in failure to export migration metadata and may prevent export of some or all applications selected by the policy. One workaround is to disable "Snapshot Cluster-Scoped Resources" in such policies and to perform a manual snapshot and export of cluster-scoped resources. This issue was introduced in K10 release 4.0.2.

4.0.3

Release Date: 2021-05-25

New Features

• Add arm64 support (including Apple Silicon) for k10multicluster and k10tools.

• Added support for immutable backups when exporting to a locked object store bucket.

• Support for NFS FileStore profiles is now out of preview mode and available for production use.

• Kanister-enabled applications can now be configured to use NFS FileStore profiles. Refer to this section for more details.

Bug Fixes

• Readiness probe for the config service reporting ready before CRDs have been registered.

• Fixed an issue with retirement of K10 Disaster Recovery restore points when using an NFS FileStore profile.

• Fixes issue with policy-driven retirement of exported backups for policies that select multiple applications. Issue was introduced in K10 release 4.0.2.

• Fixed an issue with filters during backup that lead to volume binding problems during restore.

Security Issues

• Upgrade golang.org/x/net prevent denial of service (CVE-2021-33194).

4.0.2

Release Date: 2021-05-10

New Features

• Kafka topic backup and restore using Adobe Kafka Connect S3 is now supported.

• Policies that protect multiple applications by creating and exporting snapshots as backups now create a separate ExportAction for each application. When each BackupAction completes an ExportAction for the application is started. BackupActions and ExportActions for different applications protected by the same policy may now run concurrently. A successful ExportAction creates an exported RestorePoint and exports snapshot data if that option is set in the policy. If a BackupAction fails or is skipped, the ExportAction for that application is skipped with a corresponding reason. Once all BackupActions and ExportActions complete, all successful ExportActions are pushed to the migration location together.

• Pre-flight checks are able to distinguish unsupported vSphere TKGS clusters.

Bug Fixes

• When editing a K10 disaster recovery policy, the policy form is limited to supported features.

• Fixed a bug where editing policies with sub-hourly frequencies did not preserve sub-hourly frequency settings.

• Fixed a bug where the dropdown on resource filter dialog sometimes would not register the click.

• The Dashboard now correctly displays multiple exported restore points for the same application and scheduled time.

Security Issues

• Update K10 services base image to pull in latest security updates.

Other Notes

• Add Kubernetes 1.19 to the list of supported versions.

4.0.1

Release Date: 2021-04-28

Release Summary

With this latest release of Kasten K10, we have taken our focus on security and application protection to the next level to introduce a Kubernetes-native ransomware protection solution. This solution leverages immutable object storage backups, which will enable in a future release the ability to specify the retention period for backups. The retention setting ensures that the backed-up content cannot be altered during that time period. Automation via policies combines not only the actions you want to take (e.g., snapshots) but also the retention period for object immutability.

We have continued to make advancements to our multi-cluster operation so that operations can work at the speed of DevOps with secure self-service portals. Authorized users can now manage their own clusters, create backup policies for their own application namespaces and add secondary clusters directly through the multi-cluster manager for easy scalability.

Lastly, we also added support for NFS for migration and as a backup target in addition to object storage options.

New Features

• added detail sub-resource to run actions

Bug Fixes

• Fixed an issue where K10 Disaster Recovery restore failed when using NFS FileStore profiles with custom path prefix.

• Fixed an issue where in some cases CSI snapshots were failing due to invalid labels.

3.0.13

Release Date: 2021-04-18

New Features

• Filter objects by label when performing restores while using the API.

• Added support to identify error events associated with an OpenShift service account while debugging OpenShift authentication using the k10tools command. Refer to the K10 Tools Page for more details.

Bug Fixes

• Fixed an issue that caused prometheus deployment to be created even if prometheus.enabled option is set to false.

• Fixes issue with retirement of restore points created by policies that select multiple applications and perform selective export.

Security Issues

• Update Ambassador version to pull in security fixes in Envoy 1.15.4

3.0.12

Release Date: 2021-04-10

New Features

• Secondary clusters can now be added directly through the multi-cluster manager using a portable kubeconfig.

• Introduced helm flag gateway.insecureDisableSSLVerify that can be used to disable ssl verification for gateway pod.

• Added a command to k10multicluster that generates portable Kubernetes configs.

• The Dashboard now links to related documentation.

• Users who are granted permissions with a k10 cluster role binding now are able to browse into secondary clusters on the Dashboard using those permissions.

Bug Fixes

• Improve error message with more detail when jobs fail due to "Unique index violated".

• Fixed an issue that caused backup of AWS RDS Aurora DB cluster to fail.

• Ignore kanister pods during backup.

• When editing a cluster role binding that targets all clusters, the form is now correctly populated.

3.0.11

Release Date: 2021-03-27

New Features

• Enable cleanup of orphaned snapshots for Azure disk.

• Place grouped PVCs on the same node during Generic Volume Snapshot restores.

• Added a new command to k10tools - k10tools debug ca-certificate to validate CA certificate installation in K10. Refer to the K10 Tools Page for more details.

• Enable cleanup of orphaned snapshots for Cinder.

• On restores, generic volumes are placed in the zones specified by the pod affinity.

• Added support for Generic Volume Snapshots of unmounted PVCs. Refer to this section for more details.

• Custom labels and annotations can be configured for Kanister pods launched during K10 operations. Refer to Configuring custom labels and annotations for more details.

• Added a new debugger for debugging K10's OpenShift authentication mode. Refer to the K10 Tools Page for more details.

• Scheduled policy runs will be paused when free disk space on K10 stateful services goes below 25% to avoid abrupt failures.

• Preserve volume modes on restore.

• K10 Rate Limiter controls number of concurrent operations across policies and actions. K10 Helm options allow configuration of limits for snapshot creation operations and generic storage backup operations.

• Added a "create a policy" button for one-click policy creation of cluster-scoped resources.

• Sometimes it necessary to create multiple artifact transforms that are just slightly different from one another, so we've added a duplicate button to the transform for easy copy and paste.

Bug Fixes

• The search input field on the code editor window now correctly focuses the cursor.

Known Issues

• Fixed a bug the transform form would get stuck in edit mode and not allow the creation of new transforms.

3.0.10

Release Date: 2021-03-13

New Features

• Enable cleanup of orphaned snapshots for AWS EBS and EFS.

• Enable cleanup of orphaned snapshots for Google cloud engine.

• Introducing the ability to create application-scoped policies by non administrative users. Refer to this page for more details.

• K10 Dashboard will now alert users when available disk space on K10 stateful services is below 25%.

• Clean up snapshots created by failed CSI backups.

• The Dashboard now enables users to add one or many secondary clusters to a multi-cluster deployment.

• Better handling on the Dashboard for users with limited access.

• The Dashboard's restore point panel now indicates when a restore point has been imported.

Bug Fixes

• Fixed a potential crash when creating an NFS FileStore profile with a non-existent PVC.

• Fixed an issue with the k10tools tool for debugging OpenShift authentication.

• Preserve access modes of PVCs and PVs on restore.

• Fix multicluster bootstrapping in environments where ServiceAccounts have multiple secrets.

Deprecations

• Removed Helm v2 commands from K10 documentation.

• Removed Helm v2 checks from K10 pre-flight scripts.

3.0.9

Release Date: 2021-02-28

New Features

• Added errors and exceptions to Action API resources.

• CSI volume snapshot objects are now labeled with Kasten labels.

• Improve backup performance for policies that cover a large number of namespaces.

• Added support to configure memory and CPU resources for injected Kanister Sidecar container using helm values used for Generic Volume Restore pod. Refer to Generic Volume Backup and Restore Resource Requirements for more details.

Bug Fixes

• Fixed issue where an extra cluster settings tab appeared for K10 setup with basic or no authentication.

• Fixed issue where k10primer tool incorrectly required the kasten-io namespace to be created before running it. It will now run in the default namespace by default.

• Fixed an issue in OpenShift environments where DeploymentConfig labels were not enumerated when creating a policy.

• Fixed an issue with the k10multicluster tool removing the wrong cluster.

• On Dashboard artifact card, volumes size is now correctly formatted instead of being shows in bytes.

3.0.8

Release Date: 2021-02-16

New Features

• Added applications sub-command to k10tools debug command to get complete application information from the specified namespace.

• Reduced K10 Disaster Recovery backup retention count from 50 to 4.

• Added new helm options to configure memory and CPU resources for the Generic Volume Restore pod.

• Added a new tool - k10genericbackup to make Kubernetes workloads compatible for K10 Generic Storage Backup by injecting a Kanister sidecar.

• Added backupactions sub-command to k10tools debug command to allow debugging of backup actions present on the cluster.

• Kanister Backup/Restore workflow can now create Root CA ConfigMap in the application namespace when cacertconfigmap.name helm option is enabled. This ConfigMap is created when the Root CA Cert ConfigMap is not available in the application namespace and is deleted at the end of Kanister workflow.

• Enterprise license node limits now stack. Support for additional nodes may now be purchased without invalidating the previous license.

• Multi-Cluster admins can now configure cluster-level access for non-admin users through the dashboard as well as via API.

• Added gvs-cluster-check sub-command to k10tools primer command to check cluster compatibility for K10 Generic Volume Snapshots.

• Helm upgrade will restart all the K10 service pods if the k10-config config map or K10 related secrets are modified.

• Added disk usage Prometheus metrics for stateful K10 services.

• Retire action details are available in the K10 Dashboard and API.

• Added the ability to manage multi-cluster RBAC resources to the Dashboard.

• Added ability to specify the VolumeSnapshotClass as an annotation to the StorageClass.

Bug Fixes

• Fixed an issue that caused updating prometheus policy metrics to fail due to the presence of policies in Indeterminate state.

• Fixed an issue where a failure to meter in a GKE marketplace deployed instance would cause the metering service to restart.

• Fixes an issue where the gateway service would not start if an IngressClass resource was present in the cluster.

Upgrade Notes

• This release requires re-bootstrapping of all secondary clusters.

3.0.7

Release Date: 2021-01-30

New Features

• A new binary named k10tools is available for validation and debugging the environment where K10 is installed. Refer to this page for more information.

• Pods created by Kanister are labeled with createdBy: kanister.

• Added optional override of Kanister operation timeouts.

• Ability to handle volumes of size smaller than 1 GiB.

• Exported restore points now indicate the export type - whether the restore point contains references to snapshots or portable data.

Bug Fixes

• Fixes an issue in OpenShift environments where DeploymentConfig labels were not enumerated when creating a policy.

• Fixes issue of not backing up Custom Resources in some cases when Custom Resource Definition defines multiple versions.

• Fixed an issue in the helm chart that caused K10 pods to fail with ImagePullBackOff error after upgrade.

• Fixes issue where imported cluster restore point could not be manually restored.

• Fixed an issue that caused policy validation status to be stuck in Indeterminate state after K10 upgrade.

• Fixed a bug on distributions page where text overlapped on narrower page widths.

Known Issues

• The gateway service does not start if an IngressClass resource is present in the cluster. The workaround is to update the gateway service image to quay.io/datawire/ambassador:1.11.0.

Upgrade Notes

• This release will perform a catalog schema upgrade.

Other Notes

• The k10_primer.sh script has been updated. If the latest version of the script is used with a version of K10 <= 3.0.6, an error about a missing image might be seen. Upgrade K10 and retry the script to address this error.

3.0.6

Release Date: 2021-01-21

Bug Fixes

• Fixed an issue with Generic Volume Snapshot blueprint needed for restoration of PVCs containing symbolic links.

• Fixes issue of bad counts in dashboard Policies card.

3.0.5

Release Date: 2021-01-17

New Features

• K10 service storage can be compacted in service procedure.

• When a workload with Kanister sidecar injection feature enabled is updated, K10 will automatically update the existing kanister-tools sidecar image to the latest version.

• Owner references are preserved for restored objects.

• When creating a policy to import and restore, users now have the option to not restore cluster-scoped resources.

• Restore points that were generated by clicking "Run Once" on the policy now display an icon to indicate this.

• Restore actions on the Dashboard now link to the restore point that was used for the restore.

• Added support for stable (v1) Kubernetes Volume Snapshot APIs.

• Additional error information is available when a backup fails due to a workload not being ready.

Bug Fixes

• Fixed a potential crash when exporting a restore point to an NFS File Storage Location.

• Fixed an issue with restoration of PVCs containing symbolic links with absolute paths.

• Fixed an issue with restoring PVCs containing symbolic links where retries would always fail.

• The Dashboard will now detect when a user's authentication has expired and redirect to the Logout page.

3.0.4

Release Date: 2020-12-31

New Features

• New helm options to define a list of groups and users whose members are granted admin-level access to K10's dashboard.

• Added support for installation of K10 on Azure Stack.

• New helm options to resize PVC sizes of individual services.

• Introducing the ability to protect cluster-scoped (non-namespaced) resources in addition to protecting application namespaces.

• Introduced a new helm value global.upstreamCertifiedImages to use Red Hat certified versions of upstream container images.

• K10 will generate a ConfigMap in the application namespace containing a private CA certificate when the cacacertconfigmap.name helm option is enabled and if the Kanister sidecar injection feature is used for that application.

Known Issues

• Dashboard users creating import+restore policies to restore cluster-scoped resources must set restoreClusterResources using kubectl edit. Refer to restoreParameters in the Policy API specification.

3.0.3

Release Date: 2020-12-14

New Features

• Added a new helm value auth.groupAllowList to define a list of groups whose members are allowed to access K10's dashboard.

• Added a new isRunNow label to differentiate RestorePoint resources created by run once option of a Policy.

• Added a new helm value auth.ldap.restartPod to force a restart of the authentication service pod.

• Added support to snapshot and restore standalone pods.

• The support page now displays information about the currently authenticated user and also provides a link to the cluster status page.

Bug Fixes

• Fixed an issue where Active Directory passwords with certain special characters were causing authentication service failures.

• Fixed issue with multi-cluster dashboard not visible when K10 is setup in no authentication mode.

• Fixed the image tag of K10 images reported by the k10offline list-images command.

Other Notes

• Upgraded Ambassador API Gateway to version 1.9.1.

3.0.2

Release Date: 2020-11-25

Bug Fixes

• Fixed issue where policy creation fails for applications with names starting with numbers.

• Fixed an issue where the ingress.urlPath helm option was being ignored while setting up K10's services.

• Fixes an issue where the webhook to create Generic Backup sidecars was always configured with the kasten-io namespace instead of the namespace K10 was deployed in.

• Fixed an issue where the ingress.urlPath helm option was not being used while setting up Active Directory and OpenShift based authentication.

• Retrying Policy edits no longer results in invalid Policies being created.

• Fixed issues during snapshot and restore of containers that include a VolumeMount with a subPath.

Deprecations

• helm v2 is no longer supported. helm should be upgraded to v3 or higher. To upgrade the helm version used to install K10, please use the community developed plugin. See https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/

3.0.1

Release Date: 2020-11-14

Release Summary

The K10 Multi-Cluster Manager is now generally available. K10 multi-cluster allows management of multiple Kubernetes clusters through a single dashboard. Using the k10multicluster tool, primary-secondary relationships may be created between K10 instances in different clusters. Once logged-in to a primary K10 instance and granted the correct authorization, users have access to the multi-cluster dashboard that contains aggregate metrics and action summaries of the all secondary clusters. In addition, the main dashboards of secondary instances may be accessed directly through the multi-cluster dashboard. K10 resources, specifically Policies and Profiles, may be synchronized from primaries to secondaries.

New Features

• Set auth.openshift.useServiceAccountCA to true to setup K10's Authentication Service with OpenShift's CA certificate for verifying TLS connections to the OpenShift OAuth server.

• The Dashboard snapshot storage chart now only reflects namespaces that the user has permissions to view.

Bug Fixes

• The cacertconfigmap.name helm option can be used to update K10's Authentication Service's trust store with a private root CA certificate for OpenShift based authentication.

• Fix to enable restores of PVCs that are missing a StorageClass.

• Fixed a bug where the profile card, shown in a pop-up, always used the dark mode color scheme.

Security Issues

• Mitigate potential crashes caused by malicious certificates.

2.5.25

Release Date: 2020-11-07

New Features

• Improve the responsiveness for user and dashboard queries for K10 actions.

• Performance improvements to dashboard compliance checks.

• Auto dark mode on Dashboard automatically switches between light/dark modes based on day/night time.

• When restoring an application via the UI, support selecting/deselecting all artifacts by resource type instead of choosing them individually.

Bug Fixes

• Fixed an issue where CSI snapshot pre-checks were run even if a Kanister blueprint was being used to backup the workload.

• Fixed an issue which would result in the global policy form not showing the complete list of namespaces when one or more clusters was unreachable.

• Fixed an issue that would cause backup jobs to fail when writing to a Minio object store running Minio version RELEASE.2020-08-25T00-21-20Z or newer.

• Fixed an issue that would cause backup of Portworx volumes with an empty storage class to fail.

• Fixed an issue where some export or import policy runs would fail after K10 Disaster Recovery.

Known Issues

• The Kanister kando tool does not use multi-part uploads for Azure Blob storage. This impacts Kanister Blueprints that use Azure Blob profiles and when uploading objects larger than 256 MiB.

• Retrying Policy edits may cause invalid Policies to skip validation and still be created. The workaround is to recreate the Policy.

• Restore actions fail when restoring PVC's that use annotations to reference a StorageClass. The workaround is to use a transform to add a StorageClass during restore.

• When restoring a generic storage backup of a PVC that was mounted in a container at a sub path, the sub path is ignored and data is restored in the new root of the restored PVC.

Deprecations

• Removed support for OpenShift 4.3

2.5.24

Release Date: 2020-10-26

New Features

• K10 dashboard can now authenticate against an Active Directory or LDAP server.

• Add namespace label to prometheus metrics for snapshot sizes which can be used to filter by applications.

• Add namespace label to prometheus metrics for PVC count and PVC size which can be used to filter by application.

• Support for NFS FileStore profiles is now available in preview mode.

• Introducing a preview of the multi-cluster dashboard, which adds the ability to monitor and manage several clusters in one dashboard view.

Bug Fixes

• Fixed an issue where the catalog_actions_count metrics values become negative on deleting restore points.

• Fixed an issue that caused creation of Infrastructure Profiles from Dashboard to fail.

• Fixed an issue where K10 DR failed if specific special characters were used in the passphrase.

Known Issues

• Backup jobs fail when writing to a Minio object store running Minio version RELEASE.2020-08-25T00-21-20Z or newer. The workaround is to use an older Minio release till this is addressed.

• When K10 is deployed with OIDC authentication, the dashboard may show errors after the token generated by the OIDC provider has expired. Reloading the dashboard will fix the error.

Upgrade Notes

• This release will perform a catalog schema upgrade.

Deprecations

• Removed support for Kubernetes 1.14

• Removed support for OpenShift 3.11

Other Notes

• Readjusted the disaster recovery sidecar default resource requirements.

2.5.23

Release Date: 2020-10-10

New Features

• Additional metrics for catalog store and jobs service operations.

• Introduced helm flag services.executor.hostNetwork that can be used to enable hostNetwork for executor pods.

• Improved performance and scalability of exports and retirement of applications with large numbers of artifacts.

• Added --json flag to k10offline list-images command to provide output in JSON format.

Bug Fixes

• Fixed the logic that displays the dashboard loading animation.

• Fixed issue with restore of Kanister protected application in different cluster.

• The Dashboard UI has been updated with the latest storage regions for Azure and Google.

• Fixed a bug where deleted applications were not being shown on the applications restore page.

Other Notes

• Update vSphere documentation with CSI driver requirement.

2.5.22

Release Date: 2020-09-28

New Features

• Exclude filters can now be applied to workloads that are not ready.

• Added support for authenticating tokens present in Authorization Bearer Token Header.

• Add policy label to prometheus metrics for K10 actions which can be used to filter by policy name.

• Application details on Dashboard now include OpenShift Route resources.

Bug Fixes

• Fixed the image tag of Dex reported by the k10offline tool.

• Fixed issue with AWS backups, where user with correct role permissions was reported as unauthorized.

• Fixed bug with cancel action workflow where cancelling resulted in error message.

• Fix CrashLoopBackoff issues with the Config service when invalid Profiles were missing Secrets.

• Fixed an issue that caused exports to repositories created before release 2.5.18 to fail.

• Fixed retirement and restore of exported restore point for Kanister-enabled application.

• Fixed potential race between snapshot GC and reusing a deleted directory in a snapshot

• Fixed an issue where restores get stuck and eventually fail if K10 was deployed with the cacertconfigmap.name helm option and if the namespace where the application is being restored does not have a config map containing the root CA in it.

2.5.20

Release Date: 2020-09-14

New Features

• Add metrics for catalog store operations.

• Improved performance and scalability for applications with large numbers of artifacts.

• Added the ability to set runAsUser option for K10Primer.

Bug Fixes

• Fixed a bug where the Application list was not getting refreshed on the UI dashboard if the underlying resource watcher encountered a timeout.

• The K10 dashboard in deployments with no authentication configured or Basic authentication mode did not show an option to create a namespace during restore.

• Fixed K10Primer issue when validating a CSI provisioner.

• K10Primer uses the CSI snapshots restoreSize when performing a restore.

• Only backup StorageClass when taking a snapshot of a PersistentVolumeClaim.

• Airgapped installation issue, where Prometheus pod was not coming into running state, has been fixed.

• Fixed issue with handling errors when creating backups by exporting snapshots.

• On the manual snapshot form, we now show "insufficient permissions" instead of "no options" on the profiles dropdown when the user does not have permissions to list profiles.

2.5.19

Release Date: 2020-09-05

New Features

• Added support for additional GKE regions: asia-northeast2, asia-northeast3, asia-southeast2, us-west3 and us-west4.

• Do not display the Data card on the dashboard for "Basic" users.

• etcd backup for Kubernetes clusters installed via kubeadm is now supported.

• etcd backup for OpenShift Container Platform clusters is now supported.

• Improved response times for expensive queries from the dashboard by using an authorization cache.

• Users will only be able to see the names of applications or namespaces on the dashboard they have access to.

Bug Fixes

• The persistentvolumeclaims resource is now visible in the resource drop down list.

• Fix an issue with the Helm chart that would break installs initiated through the Rancher dashboard.

• Fixed potential index compaction issue that would resurrect deleted content entries during full maintenance

• Restoring into a new namespace now works correctly for RBAC users with and without namespace creation permissions.

Known Issues

• Checking a basic user's permissions may be slow when they first login to clusters with a large number of namespaces. This may cause up to a 30 second delay in loading some UI elements such as applications, actions, and compliance information.

Other Notes

• Increase default memory request for disaster recovery sidecar.

2.5.18

Release Date: 2020-08-31

New Features

• Change the default timeout for restore operations (from 90 minutes to 10 hours) since users can now cancel stuck jobs via the API.

• K10 now supports cancellation of in-progress actions through Dashboard and API.

• Added compliance data stats to Prometheus metrics.

• K10 dashboard can now authenticate against the built-in OAuth server in OpenShift Container Platform environments.

• Dashboard editor dialog windows now support text search.

• The Dashboard data page now only shows application data for namespaces the user has permissions to view.

• Switch service discovery to use Kubernetes DNS by default and provide an optional Helm setting to use Kubernetes endpoints in environments where DNS is disabled or not working.

• Added the ability to create an infrastructure profile for vSphere.

• Added a new Dashboard infrastructure profile type for vSphere configuration.

Bug Fixes

• Adds missing metrics for retire actions, running actions, and pending actions.

• Fixed restore of application with generic storage backup and Kanister blueprint with hooks.

• An issue (required volume not mounted) that occurred in case of multi replica workload during GVS is fixed

• Added validations for vSphere credentials.

• vSphere persistent volumes are no longer left in 'Failed' state upon claim deletion.

Known Issues

• vSphere persistent volumes are left in a 'Released' state. Fixed in v2.0.0 of vSphere's external-provisioner.

2.5.17

Release Date: 2020-08-16

New Features

• On the policy form, values for exported snapshot retention can be "Set to Zero" with a new action link.

• K10 deployments now have default resource requests for memory and CPU.

• Added support for OpenShift 4.4 and 4.5, and Kubernetes 1.18

• Resource requests and limits can be set by Helm values for K10 deployments.

Bug Fixes

• Fix PodSpecOverride while restoring applications using Generic Volume Snapshot.

• Correctly display total/retired artifact counts.

• Fix problem when backup fails with unready workloads despite ignoreExceptions being set.

• Fixed timeout issue when restoring CSI backups from an object store.

• Fixes the retirement of restore points that contain both Kanister-protected workloads and Generic Volume Snapshots in the same restore point.

Known Issues

• When the authentication service is restarted due to upgrades, manual restarts or errors, users might see 403 errors while accessing the dashboard due to scheduling issues in the gateway service. Restarting the gateway service should resolve the 403 errors.

Deprecations

• Removed support for OpenShift 4.2 and Kubernetes 1.13.

Other Notes

• Reduce DeleteSnapshot scope for AWS IAM permissions.

• Support for OpenShift 4.3 and Kubernetes 1.14 will be removed in an upcoming release.

• Kanister Blueprints that implement the backup action must return at least one output artifact if they want K10 to invoke a delete action upon restore point retirement.

2.5.16

Release Date: 2020-08-02

New Features

• Use Kubernetes Endpoints for service discovery instead of cluster DNS.

• Add license compliance information in prometheus metrics. So that compliance, with respect to time, can be seen in the dashboard.

• Support token authentication mode with OAuth proxy for OpenShift clusters.

• Added support for Portworx infrastructure profiles.

• Added direct (non-CSI) support for Portworx storage.

• Applications for policies can be selected via wildcard selectors.

• Added support to create an OpenShift Route object to connect to the K10 dashboard.

Bug Fixes

• Fixed a Dashboard bug where the retry of a backup action omitted profile info and resulted in failed actions.

• Fixed issue where restore from a generic-volume-snapshot could result in multiple PVC restore processes.

• Fixed an issue where an application creation via the OpenShift console fails when Kanister sidecar injection feature is enabled.

• Fixes issue where export action fails when policy selects no applications to snapshot.

Known Issues

• ManagedFields in API objects are not preserved when taking backups. Introduced in Kubernetes 1.18.x (OpenShift 4.5.x), they track the actor in the system who last modified each field in an API object. They are used by server-side apply report conflicting patches to objects. Since these are omitted by K10, executing server-side apply after an application is restored may result in different behavior than before restore.

• Sidecar injection for generic volume snapshots is not supported in Kubernetes 1.18+ or OpenShift 4.5+. Do not use the helm value injectKanisterSidecar.enabled=true on these versions.

• When K10 is deployed with the helm option auth.tokenAuth.enabled set to true, and when OAuth proxy is used for authentication, the OAuth proxy session is not cleared when the user signs out of the dashboard.

• PersistentVolumes provisioned by K10 on vSphere do not get removed when they are released.

Upgrade Notes

• The K10 Helm chart options persistence are moved under global.persistence. Setting global.persistence.storageClass now overwrites default StorageClass for Prometheus PVCs.

2.5.15

Release Date: 2020-07-20

New Features

• K10 automatically adds the k10.kasten.io/forcegenericbackup="true" annotation to selected workloads to enforce generic backups when the Kanister sidecar injection feature is enabled.

• Dashboard now shows DR restore progress and displays suggested actions with failure messages.

• When OIDC based authentication is enabled, if K10 is not able to get the user's information from the OIDC token, it will use the provider's userinfo endpoint to get it.

Bug Fixes

• Fixed an issue where an injected Kanister sidecar was failing on OpenShift due to a root SecurityContext. An injected Kanister sidecar's SecurityContext is copied from the primary container.

• If configured authentication method is basic, ignore any authentication cookie in requests.

Other Notes

• Document how to run Prometheus with a specific user and group ID.

2.5.14

Release Date: 2020-07-07

New Features

• Added ability to add licenses using the Dashboard.

• Validate OpenStack Cinder profiles upon creation.

• Added ability to remove a license using the Dashboard.

• Improve catalog storage utilization and reduce DR resource and time requirements by performing catalog pruning.

• K10 Disaster Recovery now performs app-consistent backups of the K10 catalog store.

• K10 now creates an export restore point whenever a snapshot is exported. This includes when a policy is used to copy snapshots to another region.

• Exported restore points are now visible in the API as RestorePoint resources in the namespace of the snapshot RestorePoint resource as well as being RestorePointContent resources.

• K10 policies that select multiple applications now copy each application independently and export all successfully copied applications by default. Application copy errors are noted as exceptions in the ExportAction and an export restore point is not created for an application with a copy error.

• When manually restoring an application, the UI will provide the option of adding transforms previously used to restore that application.

• Added support for taking generic snapshots of DeploymentConfigs

• New OIDC-related settings - auth.oidcAuth.groupClaim and auth.oidcAuth.groupPrefix have been added to K10's Helm chart.

• Add a Helm option to allow modification of the K10 service security context.

• Additional statistics are collected for backups exported to object storage.

• Simplify license updates and deletes. No Helm upgrade or patches required anymore.

• Support pre-populated namespace labels in the policy creation form.

• Improvement in the user experience on the dashboard when an OIDC provider returns an error.

• New OIDC-related setting - auth.oidcAuth.prompt has been added to K10's helm chart.

• Dashboard now supports specifying region for OpenStack infrastructure profiles.

• Dashboard charts with multiple result sets are now customizable, allowing you to select which results to display.

• Support page now displays an upgrade button when a newer version of K10 is available.

Bug Fixes

• Fixed an issue where switching between K10 clusters while using kubectl proxy would result in a token validation error on the dashboard due to invalid cookies in the browser cache.

• Fixed an issue that caused Kanister operations to fail when the subject of the Blueprint was an OpenShift DeploymentConfig.

• Fixes bugs leading to early retirement of snapshots when using storage class overrides or independent retention counts.

• Fixes bug with object storage data metrics when using the option to ignore exceptions for export.

• Fixes bug with import after exporting snapshot data using the option to ignore exceptions for export.

• When "View Action YAML" was clicked, the format of the action was not correct. This has been fixed.

• Fixed a Dashboard bug when editing a transform that replaces a value with JSON.

• Fixed cosmetic bug where object storage profiles with no region showed 'undefined' in profile dropdowns.

• Fixed an issue with K10 installation when these options are used together - cacertconfigmap.name and auth.tokenAuth.enabled.

• The K10 Helm chart now checks if ingress.annotations are set before using them.

• Fixed issue with profile validation where the original error was being masked.

• Fixed an issue where the APIServer was failing to call the mutating webhook endpoint on OpenShift clusters.

Security Issues

• Module upgrades to address CVE-2020-14040.

• Upgraded Ambassador to incorporate the Envoy 1.14.3 security update.

Upgrade Notes

• A schema change is required and will reduce storage consumed by the K10 catalog.

Deprecations

• The default docs location has changed to support documentation versioning.

2.5.13

Release Date: 2020-06-21

New Features

• The Dashboard data page now displays object storage usage for each application.

• Simplify K10 Disaster Recovery by not requiring the K10 cluster passphrase on recovery.

• The Object Storage Data Usage will now include K10 Disaster Recovery statistics.

• K10Primer tool will use the same node selector and tolerations for all test pods it creates.

• Added a new settings tab for viewing installed licenses and license details.

• The compliance and storage services have been merged with the dashboard service to reduce the total number of the pods required by K10.

• Add hold support for policy-created backups.

• Object storage usage metrics can now be viewed for individual applications.

• New OIDC-related settings - auth.oidcAuth.usernameClaim and auth.oidcAuth.usernamePrefix have been added to K10's Helm chart.

• Added progress bar to indicate when a Dashboard page is still being loaded.

• Added support to automatically inject Kanister sidecars into pods for Generic Volume Backup. This can be done cluster-wide or, with label filtering, at the namespace or workload level.

• Include skipped actions in prometheus metrics.

• During manual snapshot or policy snapshot, added the ability to filter resources by label.

• Added a support tab under settings on the Dashboard that displays information about the cluster, K10, and how to contact support.

Bug Fixes

• Fixed an issue where Kanister actions would fail with OpenShift DeploymentConfig workloads.

• Fixed a case where object storage data usage may not update immediately following a backup.

• Fixed bug that prevented the test transform operation from displaying its results.

• Improve error message when no OIDC configuration is discovered from the provider URL specified for OIDC authentication.

• Fixed temporary metering service report creation errors when the service is restarted.

• Fixed bug where policy delete did not remove policy from Dashboard.

• Fixes issue with retiring restore points for policies that selected zero applications.

• Fixes metering service bug when the Kubernetes API server is unresponsive.

Deprecations

• The following labels have been removed from the metrics exposed by jobs service to Prometheus - job_id, phase, policy_id, scheduled_time, start_time, status, finish_time and attempt_count. jobs_running metric has also been removed to optimize storage consumption by Prometheus.

2.5.12

Release Date: 2020-06-07

New Features

• Policies that select multiple applications treat application snapshot failures independently.

• Allow users with only namespace access to create backups.

• New CSI checker application that verifies CSI snapshot/restore capabilities.

• Move EFS support out of preview mode.

• K10Primer pre-check validates the existence of required CSI feature gate.

• Failed backup jobs can now be retried from the Job Details panel.

• YAML for jobs can now be viewed and copied to the clipboard from the Job Details panel.

• Add support for Kubernetes auditing.

• Add guidance for K10 resource requirements.

• Added support for Kubernetes 1.17 and Beta Snapshot CRDs.

• K10 can be used with an OpenID Connect(OIDC) provider irrespective of whether the Kubernetes cluster is configured with the same OIDC provider, a different OIDC provider, or no authentication system. K10 achieves this by using Kubernetes User Impersonation.

• All PVCs within a namespace are snapshotted, independent of being linked to a workload.

• Added the ability to use pre-made example transforms on the Dashboard.

Bug Fixes

• Fixed an issue where backup restore points were not displaying the volume snapshot as a selectable artifact on the Dashboard.

• Disable RBAC resource creation for the Prometheus server which would not work in OCP 3.11 clusters.

• Fixed compliance calculation issue when using policies with advanced frequency options.

• Fixed a bug where transform JSON field does not retain its value when editing.

Security Issues

• When K10 is deployed with OIDC, user-initiated actions (via the API, CLI, or the dashboard) will be attributed to the user instead of the K10 service account.

Upgrade Notes

• The k10-dashboard-view ClusterRole has been updated and renamed to k10-config-view. Check and update bindings for users and service accounts.

Deprecations

• We only support Helm v2.16.0+ from this release.

2.5.11

Release Date: 2020-05-29

New Features

• Added the ability to filter policies by name.

• Improved the display of job errors by surfacing the nested root cause messages.

Bug Fixes

• Dashboard login page now accepts a variety of authentication tokens versus only JWT tokens.

2.5.10

Release Date: 2020-05-29

New Features

• No longer require a VolumeSnapshotClass with Retain deletion policy.

• Workaround EFS's behavior where a restored instance is placed in a child directory by moving child directory's contents to the file system's root after restore.

• Adjust namespace metadata for cloned Helm 3 applications.

• Adding a new tool, K10Primer, that validates a Kubernetes cluster prior to installing K10

• Installation of trusted but private root certificate authorities to be used by K10 for verifying TLS connections to object stores.

Bug Fixes

• Exclude VolumeSnapshot objects in application backup.

• Cleanup VolumeSnapshot resources if the driver failed the snapshot operation.

• Fixed an issue that caused temporary secrets to be left behind after computing object store data usage statistics.

• Fixes issue where multiple VolumeSnapshotClasses with K10 annotations caused snapshot failures.

• Recreate provisioner annotations for Ceph-RBD provisioned Persistent Volumes on restore.

• Updated prometheus's baseURL and prefixURL Helm values to work with K10 routes.

• Fix backup data charts not populating on dashboard.

• Fixed problem deleting old actions.

Known Issues

• Kanister Blueprints used for database-level application backup currently do not work with private root CAs. An available workaround is to disable TLS verification of these object stores for Location profiles in use with Kanister.

Upgrade Notes

• This release will perform a catalog schema upgrade.

• We no longer require or recommend a Retain deletionPolicy for VolumeSnapshotClasses.

2.5.9

Release Date: 2020-05-10

New Features

• The air-gapped installation process was simplified.

• Improve the display of job errors by showing error details in a modal window with color syntax-highlighting.

• Generate skipped jobs when policy scheduler offline across scheduling window.

Bug Fixes

• Added Ceph profile validation on create.

• The K10 dashboard will not allow the creation of policies or profiles if the K10 install namespace is not known.

• Fixed a bug where the code editor window sometimes displayed unformatted code.

• Fixed a bug that prevented K10 disaster recovery from a manual run of the disaster recovery policy.

• Fixed a bug that caused some restores to fail after K10 Disaster Recovery.

• Fixed a bug that could cause object store logical data size to be under-reported.

Security Issues

• Upgraded several JavaScript packages to address recently disclosed CVEs.

Upgrade Notes

• K10 image comes with Ceph tools enabled.

Other Notes

• Combined the policy and profile services to reduce the number of pods used by K10.

2.5.8

Release Date: 2020-05-02

New Features

• Add AWS Africa (Cape Town) and Europe (Milan) regions.

• Added infrastructure profiles for direct (non-CSI) integration with Ceph and OpenStack Cinder.

• Added ability to pause scheduled runs of policies.

• Support specifying a region when an endpoint is used with S3 compatible Profiles.

• Retention of snapshots and exported backups supports pausing and editing of policies.

Bug Fixes

• Discover AWS region from node labels when EC2 instance metadata endpoint is not reachable.

• EBS snapshot jobs fail gracefully if AWS credentials are not provided.

• Fixed a bug in the k10-ns-admin Role for GET permission on secrets in the K10 namespace.

• Fixed unlikely case where manual policy run could retire artifacts created by a scheduled policy run.

2.5.7

Release Date: 2020-04-27

New Features

• Allow specifying which StorageClass should be used when exporting snapshot data.

• Volume type transforms on restore are now supported for Azure Disks. Supported storage account types of Azure Disks include Standard_LRS, Premium_LRS, StandardSSD_LRS, UltraSSD_LRS.

• Policy scheduler now waits until the next scheduled time after a policy edit to start a new job.

• Reduction in space consumed by the metering service (used for cloud market place billing). The service will delete legacy data and will ensure new data is not retained indefinitely.

• Added finer control of policy frequency, start times, and snapshot retention to the K10 API and Dashboard.

• Force a file-system level backup if a workload has the k10.kasten.io/forcegenericbackup annotation.

Bug Fixes

• Improve Ceph snapshot mechanism.

• Fixed perpetual UI alerts on outdated failed K10 service/pods.

• Fixed a bug that caused Object Storage Data Usage statistics to be inaccurate.

• Fixed a bug with S3-compatible Location profiles. K10 used transport layer security by default even if the user specified http:// as the transport protocol in the location profile's endpoint.

Upgrade Notes

• Kanister profiles are being deprecated. Disable and re-enable any existing DR policy after an upgrade to switch to using a Location profile.

Deprecations

• For storage providers that are not supported by K10, do not automatically attempt a file-system backup unless the workload has the k10.kasten.io/forcegenericbackup annotation.

Other Notes

• Enabled zoom for documentation images.

2.5.6

Release Date: 2020-04-19

Bug Fixes

• Fixed a bug that caused K10 DR backups to fail after a successful retirement of DR snapshots.

2.5.5

Release Date: 2020-04-17

New Features

• Add a Prometheus metric to indicate if K10 DR is enabled.

• New pre-flight script to validate CSI Snapshot capability.

• Ability to transform PersistentVolumeClaim labels on restore.

Bug Fixes

• Fixed a bug that caused failure in retirement of K10 Disaster Recovery snapshots.

• Fix issue with Azure profiles incompatibility while creating import policies.

• Resolves early retirement of artifacts after K10 disaster recovery.

• Preserve PersistentVolumeClaim labels on restore.

• Fixed UI bug that prevented import/restore policy creation.

Other Notes

• Workaround documented for the migration of EFS CSI Volumes in EKS clusters using the K10 dashboard and AWS CLI/Console.

• Increase timeout for waiting for ready pods to 15 minutes.

2.5.4

Release Date: 2020-04-12

New Features

• Support specifying destination region (Azure, AWS) and account (AWS) when exporting snapshots.

• Added the ability to define TLS certificates in the K10 ingress definition. This allows the use an external ingress controller and definition of a custom FQDN to access the K10 platform through the HTTPS protocol.

• Reduced the number of Kubernetes workloads by combining the jobs and jobs queue services.

• Consolidate Profiles into a new type: Location Profiles.

• Reduction in memory consumed by the metering service (used for cloud marketplace billing).

• New policies now wait until the first scheduled time to run. Use a manual policy run before then if desired.

• API support for offset policy run times (e.g., choose an hour to run a daily backup).

• Volume type transforms on restore are now supported for GCE Persistent Disk and AWS EBS. Supported types for GCE Persistent Disk include pd-ssd and pd-standard. Supported types for AWS EBS include standard, io1, gp2, sc1 and st1.

Bug Fixes

• Fix cryptography service failing to start when the catalog service isn't yet available.

• Fixed a bug in the DR Restore tool when no skipResource argument was specified.

Known Issues

• The Object Storage Data Usage statistics may not be completely accurate.

Upgrade Notes

• Existing import and export profiles will be converted to location profiles automatically.