Major changes
- The **Ingress controller version 1.9** has been introduced. It is based on the chroot version of Nginx (which is more secure) and **adds fixes for several recently discovered critical vulnerabilities (CVE-2022-4886, CVE-2023-5043, CVE-2023-5044)**. Updating the Ingress controller is strongly recommended, as these vulnerabilities are only mitigated in version 1.9. On top of that, version 1.9 features a new [annotationValidationEnabled](https://deckhouse.io/documentation/v1.54/modules/402-ingress-nginx/cr.html#ingressnginxcontroller-v1-spec-annotationvalidationenabled) parameter (disabled by default) to activate the validation of the Ingress resource annotations.
- **The [configOverrides](https://deckhouse.io/documentation/latest/installing/configuration.html#initconfiguration-deckhouse-configoverrides) parameter of the InitConfiguration resource has been deprecated**. From now on, modules are configured using ModuleConfig resources both during and after the Deckhouse installation.
- **The _virtualization_ module** is about to undergo a major redesign. Starting with Deckhouse 1.54, the existing module implementation **can no longer be enabled**. However, you can continue to use it provided that it was enabled earlier (changing the module configuration is also blocked).
- **Vulnerabilities** in the following components have been mitigated: _kube-rbac-proxy, protobuf-exporter, nginx-exporter, kruise-state-metrics, kruise, local-path-provisioner, loki, kube-state-metrics, bashible-apiserver, alertmanager, trickster_.
- The _chrony, local-path-provisioner, monitoring-ping_ modules now use distroless images. This increases module security and reduces the attack surface.
- It is now possible to set your own logo in Grafana and on the authentication page (user-authn module). See the [PR description](https://github.com/deckhouse/deckhouse/pull/6268) for more details.
The following components will be restarted during the update
- **Kubernetes control plane**
- **Ingress controller**
- **Prometheus/Grafana**
- admission-policy-engine
- cert-manager
- chrony
- cloud-provider-aws (cloud-data-discoverer)
- cloud-provider-azure (cloud-data-discoverer)
- cloud-provider-gcp (cloud-data-discoverer)
- cloud-provider-openstack (cloud-data-discoverer)
- cloud-provider-yandex (cloud-metrics-exporter)
- cni-cilium (agent, operator)
- dashboard
- extended-monitoring
- istio (api-proxy)
- kube-dns
- kube-proxy
- linstor (linstor-controller, linstor-node, piraeus-operator)
- local-path-provisioner
- log-shipper
- loki
- metallb
- monitoring-kubernetes (ebpf-exporter, kube-state-metrics, node-exporter)
- monitoring-kubernetes-control-plane
- node-local-dns
- node-manager (bashible-apiserver, capi-controller-manager, cluster-autoscaler, early-oom, machine-controller-manager)
- openvpn
- operator-prometheus
- operator-trivy
- pod-reloader
- runtime-audit-engine
- snapshot-controller
- terraform-manager
- upmeter
- user-authn (dex)
Component version updates
- Kubernetes control plane: `1.25.15`, `1.26.10`, `1.27.7`, `1.28.3`.
- NGINX Ingress Controller: `1.9.4`
- Grafana Loki: `2.7.7`
See [CHANGELOG v1.54](https://github.com/deckhouse/deckhouse/blob/main/CHANGELOG/CHANGELOG-v1.54.md) for more details.