The following components will be restarted during the update from the Deckhouse 1.41
- Kubernetes Control Plane components
- Prometheus/Trickster/Grafana
- `cni-cilium`
- `dashboard`
- `ingress-nginx`
- `istio` (control-plane only)
- `log-shipper`
Component version updates:
- Kubernetes control plane: `1.22.17`, `1.23.15`, `1.24.9`
- Yandex Cloud provider terraform: `v0.83.0`
Important update notes:
- The cluster will be automatically updated to Kubernetes 1.23 if the [kubernetesVersion](https://deckhouse.io/documentation/v1.42/installing/configuration.html#parameters-kubernetesversion) parameter is set to `Automatic`.
- If there is the [ClusterConfiguration.proxy](https://deckhouse.io/documentation/v1.42/installing/configuration.html#parameters-proxy) parameter configured, it is highly important to configure the [noProxy](https://deckhouse.io/documentation/v1.42/installing/configuration.html#parameters-proxy-noproxy) parameter with your Nodes CIDRs.
- In clusters on Google Cloud with Kubernetes 1.23+, you need to install the `node.deckhouse.io/nodeport-bind-internal-ip : "false"` annotation on a NodeGroup and restart kube-proxy pods so that load balancer healthchecks work.
Major changes:
- **The new [delivery](https://deckhouse.io/documentation/v1.42/modules/502-delivery/usage.html) module** supports the deployment of [Argo CD](https://argo-cd.readthedocs.io/)-based applications both traditionally and in a [werf bundle](https://werf.io/documentation/v1.2/advanced/bundles.html#bundles-deployment) way.
- Support for Kubernetes 1.25 has been implemented; Kubernetes 1.20 is no longer supported.
- Kubernetes 1.23 is now used by default.
- The proxy configuration mechanism has been redesigned (specifically, it is used in air-gapped environments). Proxy behavior can now be configured using the [proxy](https://deckhouse.io/documentation/v1.42/installing/configuration.html#parameters-proxy) parameter of the [ClusterConfiguration](https://deckhouse.io/documentation/v1.42/installing/configuration.html#clusterconfiguration) resource.
- Deckhouse no longer manages kernel versions but does restrict certain components from running on incompatible kernels.
- Self-signed component certificates to interact with the API server are now generated through a dedicated CA. The internal Kubernetes mechanism for issuing certificates is no longer used, given that managed solution providers (such as AWS EKS) often restrict its operation.
- The Istio dataplane is automatically updated if the `istio.deckhouse.io/auto-upgrade="true"` label is attached to the namespace or resource.
- The new [IngressIstioController](https://deckhouse.io/documentation/v1.42/modules/110-istio/cr.html#ingressistiocontroller) resource enables the implementation of an Istio-native pattern for receiving external traffic.
- The log-shipper module can now forward logs to [Splunk](https://www.splunk.com/).
- The `DexProvider` resource (of the [user-authn](https://deckhouse.io/documentation/v1.42/modules/150-user-authn/) module) now has a [claimMapping](https://deckhouse.io/documentation/v1.42/modules/150-user-authn/cr.html#dexprovider-v1-spec-oidc-claimmapping) parameter to specify a mapping for non-standard Dex provider claims.
- The OperationPolicy resource (of the [admission-policy-engine](https://deckhouse.io/documentation/v1.42/modules/015-admission-policy-engine/) module) now allows you to apply [operation policies](https://deckhouse.io/documentation/v1.42/modules/015-admission-policy-engine/#operation-policies) to resources, such as restricting image tags, registry addresses, etc. It is also possible to require that certain parameters be present in the resource specification.
See [CHANGELOG v1.42](https://github.com/deckhouse/deckhouse/blob/main/CHANGELOG/CHANGELOG-v1.42.md) for more details.