Skip to content

OSC Release v1.0.5

OSC Release v1.0.5 is a comprehensive update encompassing all OSC Gardener components. This release includes compatibility updates for Gardener v1.138.2, enhancements to the GPU operator, support for centralized OIDC configuration, and various infrastructure improvements. Furthermore, Kubernetes 1.35 support has been added for Shoot Clusters. Additionally, several shared components have been updated (e.g., Cilium 1.19.6, cert-manager 1.20.3, Gateway API/Envoy 1.8.3). The GPU/NFD tooling has also been enhanced with Dynamic Resource Allocation (DRA) support and the addition of a new DCGM monitoring dashboard.

Key features and improvements

  • Gardener Upgrade: Upgraded to the upstream Gardener release v1.138.2.
  • Support for 1.35 K8S version on Shoots: Support for K8S in version 1.35 introduced.
  • OSC Registry Migration: We are introducing a new OSC Registry system that will serve as the base registry for all images from the PaaS management clusters. This includes container images within the kube-system namespace, which are considered system components and are maintained by OSC.
  • Ceph S3 Shoot Bucket Extension: We are introducing a new extension that provides S3 storage based on Ceph S3. This differs from the original S3 extension, which used MinIO as the backend. By default, the new extension will be disabled and must be explicitly enabled in the Shoot manifest. We ask every customer to transition from the old MinIO S3 extension to the new Ceph S3 extension. The old MinIO S3 extension will be deprecated in future releases. For now, both extensions will be available to customers and can operate independently.
  • Tier 3 storage: Customers can now utilize Tier 3 storage for applications that are not sensitive to read/write speed.
  • OSC Dashboard: The OSC Dashboard was Upgraded to v2.10.0. Please see the more detailed release notes below.
  • Live Consumption dashboard: The OSC Dashboard now displays resource consumption at the physical layer. The consumption is displayed categorized by Project. This allows customers to track their resource usage from an infrastructure perspective as well. This functionality was already available for some customers in 1.0.4, but from 1.0.5 it will be available for every customer.
  • NVIDIA GPU Operator Upgrade with DRA Support: The NVIDIA GPU Operator has been upgraded to v25.10.1. On Shoot Clusters running Kubernetes 1.34.2 or later, GPUs are now allocated through dynamic resource allocation (DRA) by default; existing workloads using nvidia.com/gpu resource requests must be reworked to resource claims, or DRA must be disabled explicitly.
  • GPU Operator Default Tolerations: The DaemonSets managed by the NVIDIA GPU Operator now tolerate node taints by default (operator: Exists). Manual toleration configuration through the NFD extension is no longer required for running GPU workloads on tainted GPU nodes.
  • Infrastructure quota: Public IP addresses, NAT gateways and storage are shared by everyone in an OSC region. To keep a single misbehaving workload — a runaway controller, a looping pipeline, a misconfiguration — from exhausting them for everyone, OSC sets an infrastructure quota on every Seed's infrastructure account. Check the documentation on infrastructure quota.

Required customer actions before upgrade

  • All tenants are updated to OSC release v1.0.4
  • All Shoot Cluster Worker-Nodes are updated to Garden Linux 2150

Breaking Changes

  • Image pull paths change for OSC maintained components migrated to the OSC Registry

OSC Dashboard v2.10.0

Added

  • Shoot Extension Management: deployment status hint on each extension row and in the management dialog. Human readable statuses — "Auto-enabled for all clusters" (was: Always), "Auto-enabled for clusters with worker nodes" (was AlwaysExceptNoShoots or "Installed on your cluster only after you enable it") — translated into all 6 locales.
  • Monitoring Physical Nodes (Live Consumption Dashboard)

Changed

  • Shoot Extension Management: the default enabled state (if the Shoot manifest has no explicit spec.extensions[] entry) of an extension is now derived from the extension's ControllerRegistration on the Garden cluster instead of a hardcoded frontend registry flag. Applies both to the "Shoot Details/ Cluster Services" card and to the "New Shoot" wizard)

Fixed

  • Physical Nodes: nodes are no longer missing from the capacity view. The zone of a node is now read from the worker-pool zone index Gardener embeds in the machine name (<technicalID>-<pool>-z<N>-... -> spec.provider.workers[pool].zones[N-1]) instead of being guessed by comparing the cluster label and host name against zone names
  • New Shoot wizard: attribute changes are no longer lost when switching between the wizard and the YAML editor tab - the rendered manifest was reset to a default manifest since 2.8.0

Upgrade table of upstream components

Component Current version PaaS Previous version CVE fixed
cilium 1.19.6 1.18.8 CVE-2024-33860, CVE-2024-42488 CVE-2024-21663
cert-manager 1.20.4 1.19.4 GHSA-8rvj-mm4h-c258
Gateway API (Envoy) v1.8.3 1.6.3 CVE-2026-53713, CVE-2024-42498, CVE-2026-48044, CVE-2026-47220
Velero 1.18.1 v1.15.2
node-feature-discovery v0.19.0 v0.18.3
opentofu 1.11.6 1.8.11 CVE-2024-24786
Golang 1.26.5 1.26.1 CVE-2026-39825 , CVE-2026-39822 , CVE-2026-39820 , CVE-2026-33814
Dex v2.45.1 v2.44.0
keycloak 26.5.7 26.3.5 CVE-2026-11800 , CVE-2026-18963 , CVE-2026-7507, CVE-2026-1002, CVE-2025-67735
coredns (management clusters) 1.14.6 1.14.0 CVE-2026-62994

Patch release notes

Here are noted changes for every patch release in release v1.0.5

Patch release 1.0.5-1

  • OSC Dashboard: Updated to version 2.11, including minor bug fixes.
  • Ceph S3 extension: Fixed an issue where Shoot deletion could be blocked because the associated S3 storage was not cleaned up correctly. S3 storage is now removed properly during Shoot deletion.

Patch release 1.0.5-2 and 1.0.5-3

  • cert-manager: Upgraded from 1.20.3 to 1.20.4. The truststore now includes the latest publicly trusted Deutsche Telekom CA certificate.
  • Monitoring: Fixed a bug in the OpenTelemetry (OTel) Collector that collects logs from Shoot nodes and pods and forwards them to Vali. Logs are now reliably available in Plutono.

Patch release 1.0.5-4 and 1.0.5-5

  • Cilium Extension: Changed the Cilium extension configuration so that, in the case of native routing on Shoot, it uses the Shoot Pod CIDR as the IPv4 native routing CIDR instead of the node CIDR.

Warning

Rollout note: after the fix, rules that allow remote-node or the node CIDR no longer match pod-to-pod traffic. Workloads relying on such a workaround need a podSelector / namespaceSelector (or CNP fromEndpoints) rule first.

Patch release 1.0.5-6

  • CSI-driver: Fixed a bug where missing libraries prevented the driver from creating an XFS filesystem on the PV.

Patch release 1.0.5-7

  • CSI-driver: Fixed a bug where creating large volumes (e.g., 1TB) with an ext4 filesystem took a long time due to formatting.
  • SSO stack: Fixing some HIGH and CRITICAL vunlerabilites for realm-operator

Patch release 1.0.5-8

  • SSO stack: Fixing critical vulnerabilities in sso stack by upgrading keycloak to version 26.8.1
  • Gardener stack Provide customers with new minor versions of Kubernetes 1.34.12 and 1.35.9.

Patch release 1.0.5-9

  • SSO stack: Standardize database monitoring.
  • Gardener stack: Improve rendering of osc-registry CA for OperatingSystemConfig