Please note
* **Support for the current implementation of the linstor module has been discontinued**. The module will be removed in the next Deckhouse Kubernetes Platform release. You can use the [sds-drbd](https://deckhouse.io/modules/sds-drbd/stable/faq.html#migrating-from-the-deckhouse-kubernetes-platform-linstorhttpsdeckhouseiodocumentationv157modules041-linstor--built-in-module-to-sds-drbd) module as a substitute.
* **Deckhouse Kubernetes Platform will fail to upgrade** if the cluster uses **Istio version lower than 1.16** (see the [globalVersion](https://deckhouse.io/documentation/v1.57/modules/110-istio/configuration.html#parameters-globalversion) parameter or the `istio.io/rev=` [annotation](https://deckhouse.io/documentation/v1.57/modules/110-istio/#activating-istio-to-work-with-the-application) attached to the Namespace).
Major changes
* _PrometheusRemoteWrite._ This resource configures the way monitoring data is transmitted over the _Prometheus remote-write_ protocol. You can now add a CA certificate to it (using the [tlsConfig.ca](https://deckhouse.io/documentation/v1.57/modules/300-prometheus/cr.html#prometheusremotewrite) field). This comes in handy when self-signed certificates are used, in private environments, etc.
* The [upmeter](https://deckhouse.io/documentation/v1.57/modules/500-upmeter/) module has got a fixed data rotation period of one and a half years.
New mechanism of working with modules
You can now connect additional modules from the module source (the [ModuleSource](https://deckhouse.io/documentation/v1.57/cr.html#modulesource) resource). These modules are updated independently of the Deckhouse Kubernetes Platform updates (the way the internal modules are treated has not changed — they continue to be updated along with the new Deckhouse Kubernetes Platform versions). Note that the `deckhouse` ModuleSource will be enabled automatically when you upgrade Deckhouse Kubernetes Platform to version 1.57.
The [ModuleUpdatePolicy](https://deckhouse.io/documentation/v1.57/cr.html#moduleupdatepolicy) resource lets you manage the way modules are updated. It is automatically created and defaults to match the existing Deckhouse Kubernetes Platform update mode in the cluster.
Here are some useful commands to:
* Get a list of modules available in the `deckhouse` ModuleSource:
shell
kubectl get ms deckhouse -o yaml
* Get release history and available module updates:
shell
kubectl get mr
* Get module update mode (for the `deckhouse` ModuleSource):
shell
kubectl get mup deckhouse -o yaml
If manual update mode is set, updates will remain in the _Pending_ state and will not be applied automatically. To apply them, add the `modules.deckhouse.io/approved="true"` annotation to the corresponding moduleRelease, e.g.:
shell
kubectl annotate mr deckhouse-admin-v1.15.3 modules.deckhouse.io/approved="true"`
A list of modules and documentation is available on the Deckhouse Kubernetes Platform website under [Documentation -> Modules](https://deckhouse.io/modules/).
Switching to distroless images
The following modules and components have been migrated to distroless images:
* ceph-csi
* extended-monitoring
* network-policy-engine
* prometheus-pushgateway
* redis (the delivery module)
* runtime-audit-engine
* shell-operator
Security
The following vulnerabilities have been addressed in the CSI components:
* CVE-2022-41723
* CVE-2023-39325
* GHSA-m425-mq94-257g
Component version updates
* pushgateway: `v1.6.2`
* node-exporter: `v1.7.0`
A list of internal modules or their components that will be restarted during the upgrade
- **Ingress controller**
- **Prometheus/Grafana**
- **Kubernetes Control Plane**
- admission-policy-engine
- ceph-csi
- cert-manager
- chrony
- cloud-provider-aws
- cloud-provider-azure
- cloud-provider-gcp
- cloud-provider-openstack
- cloud-provider-vsphere
- cloud-provider-yandex
- cni-cilium
- cni-flannel
- cni-simple-bridge
- containerd
- descheduler
- documentation
- extended-monitoring
- falcosidekick (runtime-audit-engine)
- keepalived
- kube-dns
- kube-proxy
- local-path-provisioner
- loki
- metallb
- monitoring-kubernetes
- network-gateway
- network-policy-engine
- node-local-dns
- node-manager
- operator-prometheus
- operator-trivy
- pod-reloader
- prometheus-metrics-adapter
- prometheus-pushgateway
- terraform-manager
- upmeter
- user-authn
- user-authz
- vertical-pod-autoscaler