3.2.0.azl1.genpolicy0

Release Notes

• Added support new confidential CSI driver types (cc-managed-csi, cc-local-csi driver, cc-azurefile-csi drivers)
• Added support for pulling container image layers using containerd (-d). This enables:
  • Managed identity authentication to private registries
  • Support for images with v1 manifest and prettyjws media type
• Added support for read-only hostPath in pod spec
• Updated caching mechanism for image layers to allow to run in parallel
• Added version flag (-v)
• Added support for non-default namespace names. It may now be specified in the genpolicy-settings.json file.
• You may now also specify persistent volume claims (PVCs) using -c param (for e.g. CSI driver)
• Improved handling of images that have layers with special symlinks (tarfsindex crate)
• Added persistent storage support for statefulsets

What's Changed

• genpolicy sync with upstream [1/3] by @Redent0r in #171
• genpolicy sync upstream [2/3] by @Redent0r in #172
• genpolicy sync upstream [3/3] by @Redent0r in #173
• genpolicy: use containerd_client by @Redent0r in #163
• genpolicy: support read-only hostPath by @Redent0r in #175
• genpolicy: add support for cc-managed-csi by @sprt in #174
• genpolicy: add --version flag by @Redent0r in #176
• genpolicy: add support for cc-local-csi by @sprt in #178
• genpolicy: add missing cache improvements by @Redent0r in #181
• genpolicy: add support for cc-azurefile-csi driver by @arc9693 in #180
• genpolicy: add persistent storage support for stateful sets by @arc9693 in #199

Limitations and important notes

• This release is only compatible with Kata components based on release 3.2.0.azl0 and onwards
• Building method has been updated from cargo build to LIBC=gnu BUILD_TYPE= make
• Removed -i option. Simplify path handling with explicit flags for rules.rego (-p) and genpolicy-settings.json (-j)
• Authentication to private registries is not supported on Windows
• Windows support will be deprecated next release
• Doesn't support CronJob deployment
• Doesn't support the UDP protocol for Services, LoadBalancers, and EndpointSlices
• Only supports pods that use IPv4 addresses

Full Changelog: 3.2.0.azl0.genpolicy1...3.2.0.azl1.genpolicy0