3.2.0.azl0

• Aligning with the latest vanilla Kata release, both packages now use the same sources based on upstream v3.2.0 plus some Microsoft changes for AKS
• osbuilder: use Azure Linux PMC UVM build meta-package

There is no new release of genpolicy with this version, please keep using genpolicy 0.6.2-5.

genpolicy-0.6.2-5

Release notes

• Policy generation improvements

What's Changed

• genpolicy: reject some of the CopyFile requests by @danmihai1 in #136
• genpolicy: block some symlink create requests by @danmihai1 in #137
• genpolicy: reject kernel_modules by @danmihai1 in #139
• genpolicy: validate create sandbox storages by @danmihai1 in #139
• genpolicy: reject create custom hook settings by @danmihai1 in #140

Full Changelog: genpolicy-0.6.2-4...genpolicy-0.6.2-5

Limitations and Important Notes

• Doesn't support CronJob deployment
• Doesn't support the UDP protocol for Services, LoadBalancers, and EndpointSlices
• Only supports pods the use IPv4 addresses
• subPath field in the volume mount is not supported
• Pod Disruption Budget is not supported
• Priority Classes are not supported
• User managed identity based ACR authentication is not supported

cc-0.6.3

• merge upstream 3.2 code base
• utarfs: implement the enumeration of xattrs
• enforce restrictive policy
• alignment of memory allocation between vanilla Kata and Kata-CC

genpolicy-0.6.2-4

Release notes

• Add support for images with application/vnd.oci.image.index.v1+json manifest media type, such as latest versions of docker.io/library/busybox and docker.io/library/ubuntu

What's Changed

• genpolicy: Update oci_distribution to 0.10.0 by @Redent0r in #129
• lib: Add type definition for Windows support by @Redent0r in #134

Full Changelog: https://github.com/microsoft/kata-containers/commits/genpolicy-0.6.2-4

Limitations and Important Notes

• Doesn't support CronJob deployment
• Doesn't support the UDP protocol for Services, LoadBalancers, and EndpointSlices
• Only supports pods the use IPv4 addresses
• subPath field in the volume mount is not supported
• Pod Disruption Budget is not supported
• Priority Classes are not supported

genpolicy-0.6.2-3

Release notes

• Add support for running genpolicy concurrently
• Update default configuration to deny UpdateEphemeralMountsRequest by default

What's Changed

• Update caching mechanism to allow for concurrent genpolicy runs by @SethHollandsworth in #113
• genpolicy: deny UpdateEphemeralMountsRequest by @danmihai1 in #126

Full Changelog: genpolicy-0.6.2-2...genpolicy-0.6.2-3

Limitations and Important Notes

• Doesn't support CronJob deployment
• Doesn't support the UDP protocol for Services, LoadBalancers, and EndpointSlices
• Only supports pods the use IPv4 addresses
• subPath field in the volume mount is not supported
• Pod Disruption Budget is not supported
• Priority Classes are not supported

genpolicy-0.6.2-2

Release Notes

• Update default genPolicy settings to allow the host to read guest stdout/stderr
• Add support for Kubernetes topologySpreadConstraints feature in pod YAML files
• Update default genPolicy settings to support empty AZURE_TENANT_ID and AZURE_CLIENT_ID environment variables
• Fixed ttrpc compilation issue on Windows

What's Changed

• policy: allow the Host to read Guest stdout/stderr by @danmihai1 in #109
• tools: pick up genpolicy improvements by @danmihai1 in #114
• policy: add topologySpreadConstraints support by @danmihai1 in #115
• policy: re add agent type definitions by @Redent0r in #118
• policy: allow AZURE_TENANT_ID and AZURE_CLIENT_ID to be empty by @Redent0r in #120

Full Changelog: genpolicy-0.6.2-1...genpolicy-0.6.2-2

Limitations and Important Notes

• Doesn't support CronJob deployment
• Doesn't support the UDP protocol for Services, LoadBalancers, and EndpointSlices
• Only supports pods the use IPv4 addresses
• subPath field in the volume mount is not supported
• Pod Disruption Budget is not supported
• Priority Classes are not supported

genpolicy-0.6.2-1

Merge pull request #105 from microsoft/saulparedes/add_update_samples…

Updates to tardev-snapshotter and genpolicy

It allows the snapshotter to populate its store not just when an image
pulled but also when containerd tries to unpack images that exist in its
own store but for which there are no snapshots in the tardev
snapshotter.

This addresses issues running the same image with different
snapshotters.

Signed-off-by: Wedson Almeida Filho [email protected]

Genpolicy Updates and Bug Fixes

tardev: use containerd's local store to fetch images

So tardev-snapshotter is not a "remote" snapshotter anymore (so we can't
do lazy-pulling) but this allows containerd to be the one downloading
images, which means the snapshotter doesn't have to get credentials
before it can use authenticated registries.

Signed-off-by: Wedson Almeida Filho <[email protected]>

SEV-SNP with dm-verity and PCI updates

policy: update sample

Update sample that hasn't been tested in a long time.

Signed-off-by: Dan Mihai <[email protected]>