Major changes
* **The l2-load-balancer module is no longer being developed.** The module will be deprecated in the next DKP version. The functions of the *l2-load-balancer* module will be implemented in the *metallb* module.
* **A [new role-based access model](https://deckhouse.io/products/kubernetes-platform/documentation/v1.64/modules/140-user-authz/#the-new-role-based-model) has been introduced.** We recommend sticking to it for new projects.
* The option to allow only specific [Ingress controller classes](https://deckhouse.io/products/kubernetes-platform/documentation/v1.64/modules/402-ingress-nginx/cr.html#ingressnginxcontroller-v1-spec-ingressclass) (IngressClass) and specific storage classes (StorageClass) to be used in a given namespace has been added. For this, specify a list of Ingress controller classes ([policies.ingressClassNames](https://deckhouse.io/products/kubernetes-platform/documentation/v1.64/modules/015-admission-policy-engine/cr.html#operationpolicy-v1alpha1-spec-policies-ingressclassnames) parameter) and storage classes ([policies.storageClassNames](https://deckhouse.io/products/kubernetes-platform/documentation/v1.64/modules/015-admission-policy-engine/cr.html#operationpolicy-v1alpha1-spec-policies-storageclassnames) parameter) in the cluster operating policy.
* A new **deckhouse-tools** module has been introduced. The module implements a web interface for downloading the Deckhouse CLI utility (`d8`) from the cluster (no need for internet access). The web interface is available at the `tools` domain according to the established [DNS naming template](https://deckhouse.io/products/kubernetes-platform/documentation/v1.64/deckhouse-configure-global.html#parameters-modules-publicdomaintemplate).
* You can now enhance the scheduler with external plugins via webhooks (the [KubeSchedulerWebhookConfiguration](https://deckhouse.io/products/kubernetes-platform/documentation/v1.64/modules/040-control-plane-manager/cr.html#kubeschedulerwebhookconfiguration) resource). For example, you can configure data storage application pods to be allocated closer to the data, use priority when selecting a node depending on its state (network load, storage subsystem state), etc.
* A notification about the scheduled update of patch versions has been added. The notification features information about the type of update (module or DKP). You can enable it using the [update.notification.releaseType](https://deckhouse.io/products/kubernetes-platform/documentation/v1.64/modules/002-deckhouse/configuration.html#parameters-update-notification-releasetype) parameter in the [update.notification](https://deckhouse.io/products/kubernetes-platform/documentation/v1.64/modules/002-deckhouse/configuration.html#parameters-update-notification) parameter section).
Security
* The new DKP version features stricter permissions for cluster configuration files and folders and those created by Deckhouse.
Component version updates
* Kubernetes control plane: `1.28.13`, `1.29.8`, `1.30.4`
* NGINX Ingress Controller: `1.10.4`
* `cni-simple-bridge`: `1.8.9.`
* `dex`: `1.41.1`
* `falco (runtime-audit-engine)`: `0.38.1`
* `kube-router`: `1.8.9`
* `loki`: `2.9.10`
* `vector (log-shipper)`: `0.40.1`
A list of internal modules or their components that will be restarted during the upgrade
* Kubernetes control plane
* Ingress controller
* `cni-cilium-hubble`
* `cni-flannel`
* `cni-simple-bridge`
* `constraint-exporter` (`admission-policy-engine`)
* `control-plane-manager`
* `deckhouse`
* `delivery`
* `documentation`
* `istio`
* `log-shipper`
* `loki`
* `multitenancy-manager`
* `network-policy-engine`
* `node-manager`
* `operator-trivy`
* `runtime-audit-engine`
* `upmeter`
* `user-authn`
See [CHANGELOG v1.64](https://github.com/deckhouse/deckhouse/blob/main/CHANGELOG/CHANGELOG-v1.64.md) for more details.