Deckhouse

Fixes


- **[cloud-provider-openstack]** Remove duplicates from additional security groups in cloud-data-discoverer. [5279](https://github.com/deckhouse/deckhouse/pull/5279)
- **[cloud-provider-openstack]** Fix migration from `openstack_blockstorage_volume_v2` to `openstack_blockstorage_volume_v3` for bastion hosts. [5271](https://github.com/deckhouse/deckhouse/pull/5271)
- **[user-authn]** Fix kubeconfig certificate generation. [5273](https://github.com/deckhouse/deckhouse/pull/5273)


For more information, see the [changelog](https://github.com/deckhouse/deckhouse/blob/main/CHANGELOG/CHANGELOG-v1.48.md) and minor version [release changes](https://github.com/deckhouse/deckhouse/releases/tag/v1.48.0).

Fixes


- **[admission-policy-engine]** Improve bootstrap handler logic. [5242](https://github.com/deckhouse/deckhouse/pull/5242)
- **[control-plane-manager]** Restoring `D8KubernetesVersionIsDeprecated` alert from `1.23` to `1.22`. [5249](https://github.com/deckhouse/deckhouse/pull/5249)

For more information, see the [changelog](https://github.com/deckhouse/deckhouse/blob/main/CHANGELOG/CHANGELOG-v1.48.md) and minor version [release changes](https://github.com/deckhouse/deckhouse/releases/tag/v1.48.0).

Fixes


- **[admission-policy-engine]** Fix constraint exporter - avoid duplications and invalid resource handling. [5240](https://github.com/deckhouse/deckhouse/pull/5240)
- **[cloud-provider-openstack]** Remove duplicates from images list in `cloud-data-discoverer`. [5241](https://github.com/deckhouse/deckhouse/pull/5241)


For more information, see the [changelog](https://github.com/deckhouse/deckhouse/blob/main/CHANGELOG/CHANGELOG-v1.48.md) and minor version [release changes](https://github.com/deckhouse/deckhouse/releases/tag/v1.48.0).

Fixes

- [cloud-provider-openstack] Fix discover volume types hooks incorrect fallback to storage classes in another modules. https://github.com/deckhouse/deckhouse/pull/5233


For more information, see the [changelog](https://github.com/deckhouse/deckhouse/blob/main/CHANGELOG/CHANGELOG-v1.48.md) and minor version [release changes](https://github.com/deckhouse/deckhouse/releases/tag/v1.48.0).

Important update notes

- **Kubernetes 1.22 is no longer supported.** The upgrade will not start if Kubernetes 1.22 is used in the cluster.
- The [groups](https://deckhouse.io/documentation/v1.48/modules/150-user-authn/cr.html#user-v1-spec-groups) parameter of the User resource is now obsolete and is read-only. Note that groups will be migrated to the [Group](https://deckhouse.io/documentation/v1.48/modules/150-user-authn/cr.html#group) resource automatically. However, to continue deploying the [User](https://deckhouse.io/documentation/v1.48/modules/150-user-authn/cr.html#user) resource without any issues, you have to modify its manifest accordingly.

Major changes

- Support for Kubernetes 1.27 has been added while support for Kubernetes 1.22 has been discontinued.
- The [highAvailability](https://deckhouse.io/documentation/v1.48/modules/402-ingress-nginx/configuration.html#parameters-highavailability) parameter has been introduced. It allows you to manually enable the high availability mode for the `ingress-nginx` module.
- The new [SecurityPolicy](https://deckhouse.io/documentation/v1.48/modules/015-admission-policy-engine/cr.html#securitypolicy) CR (the admission-policy-engine module) allows you to fine-tune security policies.
- The new [sidecar.resourcesManagement](https://deckhouse.io/documentation/v1.48/modules/110-istio/configuration.html#parameters-sidecar-resourcesmanagement) parameter allows you to manage the resources of the Istio sidecar container.
- A new [Group](https://deckhouse.io/documentation/v1.48/modules/150-user-authn/cr.html#group) custom resource has been implemented to manage static user groups.
- The new [etcdDiskSizeGb](https://deckhouse.io/documentation/v1.48/search.html?query=etcdDiskSizeGb) parameter allows you to adjust the etcd data disk size for some cloud providers.

The following components will be restarted during the update

- Kubernetes control plane
- Prometheus
- `dashboard`
- `cilium-agent`
- `gatekeeper` (`admission-policy-engine`)
- `kube-proxy`
- `linstor`

Component version updates: