Skip to content

release-25.3.adoc

Latest commit

 

History

History
411 lines (305 loc) · 21.7 KB

release-25.3.adoc

File metadata and controls

411 lines (305 loc) · 21.7 KB
Raw

Release 25.3

25.3.0

Released on 2025-03-21.

New platform features

General

  • Operators deployed by Helm will contain an extra pod annotation: checksum/config. This field triggers a rollout of Deployments when the ConfigMap contents change.

  • Operators for Java products now support setting JVM arguments. See the override concept page and issues#584.

Authorization
Security

  • Additional trust roots can be specified in an autoTls SecretClass. See the autoTls backend documentation.

  • The Stackable Secret Operator’s experimentalCertManager backend now supports specifying custom key lengths. The autoTls backend has supported this since 24.11.

  • Users can now configure the lifetime of self-signed certificates directly in the product’s custom resources which influences the frequency of pod restarts. Details can be found on the temporary credentials lifetime page.

Observability

Products now log information about their container environment, on startup and on an interval after that.

NiFi

Add Hadoop libraries for accessing Azure and GCP. See docker-images#943.

Platform improvements

General
OCI Registry

Starting with this release, our OCI registry located at oci.stackable.tech was promoted to stable. This means that our operators, the product image selection and tools will use the registry by default instead of the previous Docker repository located at docker.stackable.tech.

Note

To ease the transition, operator images, product images, and operator Helm charts are published both on the old Docker repository as well as the new OCI registry. Subsequent releases will only be published on oci.stackable.tech.

Using the old Docker repository is still possible:

  • Products can use the old images by setting the spec.image.repo to docker.stackable.tech/stackable in the respective product CustomResource.

  • Our stackablectl tool can pull Helm charts from the old repository by providing the --chart-source repo argument during operator installs. Unfortunately, some Helm chart values point to the OCI registry and stackablectl doesn’t support overriding these values. Use helm directly instead.

  • Operators can be installed via helm install with a custom image.repository value set.

$ helm repo add stackable-stable https://repo.stackable.tech/repository/helm-stable/
$ helm repo update stackable-stable
$ helm install --wait airflow-operator stackable-stable/airflow-operator --version 25.3 --set image.repository=docker.stackable.tech/stackable/airflow-operator
DNS lookup performance

Users can now opt-in to experimental support for improved DNS performance by specifying a fully qualified domain name (with a trailing dot) as Kubernetes cluster domain for our operators. This can reduce the amount of DNS queries within the cluster, but might have side effects, hence we consider the support experimental for now. Take a look at our documentation to find out how to enable this improvement.

Vulnerabilities

41 CVEs were fixed in the Stackable product images. This includes 6 critical and 16 high-severity CVEs.

Authorization

OPA Rego rules no longer require the future.keywords import. They have been stabilized in OPA 1.0 and are now implicitly imported.

Druid

The default memory limits have been increased for following roles. See druid-operator#685.

  • Coordinator: From 512Mi to 768Mi

  • Middle Manager: From 1Gi to 1500Mi.

Note
 Upgrades to existing deployments could cause memory limits to be reached on the node/namespace.
Hive

The the default memory reservation of Hive metastore has been increased from 512Mi to 768Mi to avoid OOMKilled events. See hive-operator#578.

Bug fixes

  • Previously, pods with a Listener volume were stuck in an "Unknown" state after their node was restarted. With this release, Listener volumes are correctly republished and the pods restart as expected. See listener-operator#262.

  • Previously, TLS certificates generated by the secret operator referenced a wrong issuer if the secret operator used an intermediate CA. With this release, the issuer of the generated TLS certificate is correct and using an intermediate CA in the secret operator works as expected. See secret-operator#566.

  • In 24.11 we used a custom build of jmx_exporter to resolve a performance degradation. In this release, Java products ship with the fixed upstream jmx_exporter 1.1.0 which includes the fix.

  • In 24.11, HDFS metrics suffixed with _total, _created, and _info were not exported by the jmx_exporter. With this release, metrics suffixed with _total, e.g. hadoop_namenode_files_total, are emitted again. Metrics originally suffixed with _created and _info are now suffixed with _created_ and _info_ to be OpenMetrics compliant. See hdfs-operator#634.

Platform deprecations

Kafka operator

The -nodeport discovery ConfigMaps have been deprecated for removal. Use the primary discovery CMs instead. See the deprecation tracking issue for more information.

Product versions

As with previous SDP releases, many product images have been updated to their latest versions. The LTS version has in many cases also been adjusted in line with our support policy.

Refer to the supported versions documentation for a complete overview including LTS versions or deprecations.

New versions

The following new product versions are now supported:

Deprecated versions

The following product versions are deprecated and will be removed in a later release:

Removed versions

The following product versions are no longer supported (although images for released product versions remain available here):

stackablectl

  • A new demo called jupyterhub-keycloak was added and is available via stackablectl. The JupyterHub-Keycloak integration demo offers a comprehensive and secure multi-user data science environment on Kubernetes, integrating Single Sign-on Jupyter notebooks with Stackable Spark and S3 storage. The demo can be installed by running stackablectl demo install jupyterhub-keycloak. See demos#155 and documentation#715.

  • Demos and stacks are now versioned and the main branch is considered unstable. stackablectl by default installs the latest stable demo and/or stack. A specific release can be targeted by providing the --release argument. See stackablectl#340.

  • Add new argument --chart-source so that operator charts can be pulled either from an OCI registry (the default) or from a index.yaml-based repository. See stackablectl#344.

  • Use rustls-native-certs so that stackablectl can be used in environments with internal PKI. See stackablectl#351.

  • Use heritage label when looking up the minio-console stacklet. See stackablectl#364.

  • Improve tracing and log output. See stackablectl#365.

Supported Kubernetes versions

This release supports the following Kubernetes versions:

  • 1.32

  • 1.31

  • 1.30

These Kubernetes versions are no longer supported:

  • 1.29

Supported OpenShift versions

This release is available in the RedHat Certified Operator Catalog for the following OpenShift versions:

  • 4.17

  • 4.16

  • 4.15

  • 4.14

Breaking changes

Of the changes mentioned above, the following are breaking (or could lead to breaking behaviour), and you will need to adapt your existing CRDs accordingly:

General

S3 bucket region can now be configured for S3Connection, S3Bucket, and inline S3 references. It defaults to us-east-1. See the tracking issue.

Note
 Products that use the Hadoop S3 implementation previously defaulted to us-east-2, so if there are bucket connectivity problems, you will need to set the region us-east-2 explicitly.
Airflow operator

The field .spec.clusterConfig.dagsGitSync[].wait changed from uint8 to our human-readable Duration type. If you have specified a time without a unit, eg: wait: 20, you will need to add the applicable unit, eg: wait: 20s.

Druid operator
Note
 All Druid versions are affected.

If druid-opa-authorizer is used, input.user needs to be replaced by input.authenticationResult.identity in applicable Rego rules. Change in druid-opa-authorizer#85.

OPA operator

  • Using if for all rules and contains for multi-value rules is now mandatory.

  • strict mode is now enabled by default. For more upgrade information, read the Upgrading Rego section of the official documentation.

Trino operator

Trino now uses the native S3 implementation which has the following requirements for S3 connections:

  • TLS is always enabled and cannot be disabled.

  • Client-side encryption is not supported. Server-side encryption (SSE) is the recommended alternative.

  • Multipart (non-streaming) writes and upload are not supported.

Legacy S3 support (via Hadoop) has been disabled and will be removed in a future version of Trino.

Upgrade from 24.11

Using stackablectl

Uninstall the 24.11 release

$ stackablectl release uninstall 24.11

Uninstalled release '24.11'

Use "stackablectl release list" to list available releases.
# ...

Afterwards you will need to upgrade the CustomResourceDefinitions (CRDs) installed by the Stackable Platform. The reason for this is that helm will uninstall the operators but not the CRDs. This can be done using kubectl replace.

kubectl replace -f https://raw.githubusercontent.com/stackabletech/airflow-operator/25.3.0/deploy/helm/airflow-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/commons-operator/25.3.0/deploy/helm/commons-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/druid-operator/25.3.0/deploy/helm/druid-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/hbase-operator/25.3.0/deploy/helm/hbase-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/hdfs-operator/25.3.0/deploy/helm/hdfs-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/hive-operator/25.3.0/deploy/helm/hive-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/kafka-operator/25.3.0/deploy/helm/kafka-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/listener-operator/25.3.0/deploy/helm/listener-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/nifi-operator/25.3.0/deploy/helm/nifi-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/opa-operator/25.3.0/deploy/helm/opa-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/secret-operator/25.3.0/deploy/helm/secret-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/spark-k8s-operator/25.3.0/deploy/helm/spark-k8s-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/superset-operator/25.3.0/deploy/helm/superset-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/trino-operator/25.3.0/deploy/helm/trino-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/zookeeper-operator/25.3.0/deploy/helm/zookeeper-operator/crds/crds.yaml
customresourcedefinition.apiextensions.k8s.io "airflowclusters.airflow.stackable.tech" replaced
customresourcedefinition.apiextensions.k8s.io "authenticationclasses.authentication.stackable.tech" replaced
customresourcedefinition.apiextensions.k8s.io "s3connections.s3.stackable.tech" replaced
...

Install the 25.3 release

$ stackablectl release install 25.3

Installed release '25.3'

Use "stackablectl operator installed" to list installed operators.
Using Helm

Use helm list to list the currently installed operators.

You can use the following command to uninstall all operators that are part of the 24.11 release:

$ helm uninstall airflow-operator commons-operator druid-operator hbase-operator hdfs-operator hive-operator kafka-operator listener-operator nifi-operator opa-operator secret-operator spark-k8s-operator superset-operator trino-operator zookeeper-operator
release "airflow-operator" uninstalled
release "commons-operator" uninstalled
...

Afterward you will need to upgrade the CustomResourceDefinitions (CRDs) installed by the Stackable Platform. The reason for this is that helm will uninstall the operators but not the CRDs. This can be done using kubectl replace:

kubectl replace -f https://raw.githubusercontent.com/stackabletech/airflow-operator/25.3.0/deploy/helm/airflow-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/commons-operator/25.3.0/deploy/helm/commons-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/druid-operator/25.3.0/deploy/helm/druid-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/hbase-operator/25.3.0/deploy/helm/hbase-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/hdfs-operator/25.3.0/deploy/helm/hdfs-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/hive-operator/25.3.0/deploy/helm/hive-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/kafka-operator/25.3.0/deploy/helm/kafka-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/listener-operator/25.3.0/deploy/helm/listener-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/nifi-operator/25.3.0/deploy/helm/nifi-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/opa-operator/25.3.0/deploy/helm/opa-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/secret-operator/25.3.0/deploy/helm/secret-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/spark-k8s-operator/25.3.0/deploy/helm/spark-k8s-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/superset-operator/25.3.0/deploy/helm/superset-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/trino-operator/25.3.0/deploy/helm/trino-operator/crds/crds.yaml
kubectl replace -f https://raw.githubusercontent.com/stackabletech/zookeeper-operator/25.3.0/deploy/helm/zookeeper-operator/crds/crds.yaml
customresourcedefinition.apiextensions.k8s.io "airflowclusters.airflow.stackable.tech" replaced
customresourcedefinition.apiextensions.k8s.io "authenticationclasses.authentication.stackable.tech" replaced
customresourcedefinition.apiextensions.k8s.io "s3connections.s3.stackable.tech" replaced
...

Install the 25.3 release

helm repo add stackable-stable https://repo.stackable.tech/repository/helm-stable/
helm repo update stackable-stable
helm install --wait airflow-operator stackable-stable/airflow-operator --version 25.3.0
helm install --wait commons-operator stackable-stable/commons-operator --version 25.3.0
helm install --wait druid-operator stackable-stable/druid-operator --version 25.3.0
helm install --wait hbase-operator stackable-stable/hbase-operator --version 25.3.0
helm install --wait hdfs-operator stackable-stable/hdfs-operator --version 25.3.0
helm install --wait hive-operator stackable-stable/hive-operator --version 25.3.0
helm install --wait kafka-operator stackable-stable/kafka-operator --version 25.3.0
helm install --wait listener-operator stackable-stable/listener-operator --version 25.3.0
helm install --wait nifi-operator stackable-stable/nifi-operator --version 25.3.0
helm install --wait opa-operator stackable-stable/opa-operator --version 25.3.0
helm install --wait secret-operator stackable-stable/secret-operator --version 25.3.0
helm install --wait spark-k8s-operator stackable-stable/spark-k8s-operator --version 25.3.0
helm install --wait superset-operator stackable-stable/superset-operator --version 25.3.0
helm install --wait trino-operator stackable-stable/trino-operator --version 25.3.0
helm install --wait zookeeper-operator stackable-stable/zookeeper-operator --version 25.3.0

Known issues

Hive operator

In Hive 4.0.1 with Kerberos enabled, health checks cause excessive error logs:

ERROR [Metastore-Handler-Pool: Thread-65] server.TThreadPoolServer: Thrift Error occurred during processing of message.

This is because the health check doesn’t complete SASL authentication. The error is ignorable, though it can be hidden with the following configuration:

spec:
  metastore:
    config:
      logging:
        containers:
          hive:
            loggers:
              org.apache.thrift.server.TThreadPoolServer:
                level: NONE
Note
 This will suppress all logging from TThreadPoolServer, including log events that might be useful for diagnosing issues.