OSC Release v1.0.5
OSC Release v1.0.5 is a comprehensive update encompassing all OSC Gardener components. This release includes compatibility updates for Gardener v1.138.2, enhancements to the GPU operator, support for centralized OIDC configuration, and various infrastructure improvements. Furthermore, Kubernetes 1.35 support has been added for Shoot Clusters. Additionally, several shared components have been updated (e.g., Cilium 1.19.6, cert-manager 1.20.3, Gateway API/Envoy 1.8.3). The GPU/NFD tooling has also been enhanced with Dynamic Resource Allocation (DRA) support and the addition of a new DCGM monitoring dashboard.
Key features and improvements
- Gardener Upgrade: Upgraded to the upstream Gardener release v1.138.2.
- Support for 1.35 K8S version on Shoots: Support for K8S in version 1.35 introduced.
- OSC Registry Migration: We are introducing a new OSC Registry system that will serve as the base registry for all images from the PaaS management clusters. This includes container images within the kube-system namespace, which are considered system components and are maintained by OSC.
- Ceph S3 Shoot Bucket Extension: We are introducing a new extension that provides S3 storage based on Ceph S3. This differs from the original S3 extension, which used MinIO as the backend. By default, the new extension will be disabled and must be explicitly enabled in the Shoot manifest. We ask every customer to transition from the old MinIO S3 extension to the new Ceph S3 extension. The old MinIO S3 extension will be deprecated in future releases. For now, both extensions will be available to customers and can operate independently.
- Tier 3 storage: Customers can now utilize Tier 3 storage for applications that are not sensitive to read/write speed.
- OSC Dashboard: The OSC Dashboard was Upgraded to v2.10.0. Please see the more detailed release notes below.
- Live Consumption dashboard: The OSC Dashboard now displays resource consumption at the physical layer. The consumption is displayed categorized by Project. This allows customers to track their resource usage from an infrastructure perspective as well. This functionality was already available for some customers in 1.0.4, but from 1.0.5 it will be available for every customer.
- NVIDIA GPU Operator Upgrade with DRA Support: The NVIDIA GPU Operator has been upgraded to v25.10.1. On Shoot Clusters running Kubernetes 1.34.2 or later, GPUs are now allocated through dynamic resource allocation (DRA) by default; existing workloads using
nvidia.com/gpuresource requests must be reworked to resource claims, or DRA must be disabled explicitly. - GPU Operator Default Tolerations: The DaemonSets managed by the NVIDIA GPU Operator now tolerate node taints by default (
operator: Exists). Manual toleration configuration through the NFD extension is no longer required for running GPU workloads on tainted GPU nodes.
Required customer actions before upgrade
- All tenants are updated to OSC release v1.0.4
- All Shoot Cluster Worker-Nodes are updated to Garden Linux 2150
Breaking Changes
- Image pull paths change for OSC maintained components migrated to the OSC Registry
OSC Dashboard v2.10.0
Added
- Shoot Extension Management: deployment status hint on each extension row and in the management dialog. Human readable statuses — "Auto-enabled for all clusters" (was: Always), "Auto-enabled for clusters with worker nodes" (was
AlwaysExceptNoShootsor "Installed on your cluster only after you enable it") — translated into all 6 locales. - Monitoring Physical Nodes (Live Consumption Dashboard)
Changed
- Shoot Extension Management: the default enabled state (if the Shoot manifest has no explicit
spec.extensions[]entry) of an extension is now derived from the extension's ControllerRegistration on the Garden cluster instead of a hardcoded frontend registry flag. Applies both to the "Shoot Details/ Cluster Services" card and to the "New Shoot" wizard)
Fixed
- Physical Nodes: nodes are no longer missing from the capacity view. The zone of a node is now read from the worker-pool zone index Gardener embeds in the machine name (
<technicalID>-<pool>-z<N>-...->spec.provider.workers[pool].zones[N-1]) instead of being guessed by comparing the cluster label and host name against zone names - New Shoot wizard: attribute changes are no longer lost when switching between the wizard and the YAML editor tab - the rendered manifest was reset to a default manifest since 2.8.0
Upgrade table of upstream components
| Component | Current version PaaS | Previous version | CVE fixed |
|---|---|---|---|
| cilium | 1.19.6 | 1.18.8 | CVE-2024-33860, CVE-2024-42488 CVE-2024-21663 |
| cert-manager | 1.20.3 | 1.19.4 | GHSA-8rvj-mm4h-c258 |
| Gateway API (Envoy) | v1.8.3 | 1.6.3 | CVE-2026-53713, CVE-2024-42498, CVE-2026-48044, CVE-2026-47220 |
| Velero | 1.18.1 | 1.18.0 | |
| node-feature-discovery | v0.19.0 | v0.18.3 | |
| opentofu | 1.11.6 | 1.8.11 | CVE-2024-24786 |
| Golang | 1.26.5 | 1.26.1 | CVE-2026-39825 , CVE-2026-39822 , CVE-2026-39820 , CVE-2026-33814 |
| Dex | v2.45.1 | v2.44.0 | |
| keycloak | 26.5.7 | 26.3.5 | CVE-2026-11800 , CVE-2026-18963 , CVE-2026-7507, CVE-2026-1002, CVE-2025-67735 |
| coredns (management clusters) | 1.14.6 | 1.14.0 | CVE-2026-62994 |