Grafana Dashboard using ConfigMap

In the Cisco Common Execution Environment (CEE), you can now define and deploy Grafana dashboards using ConfigMap in the CNDP-managed Kubernetes cluster. A ConfigMap is an API object used to store non-confidential data in key-value pairs. It allows you to decouple environment-specific configuration from container images to port your applications easily.

This support is added in addition to the existing mechanism of loading dashboards using Git server pods.

Kubernetes Version Upgrade

With this release, you can upgrade the Kubernetes version from 1.29 to 1.30.

New Addons

SMI supports new addons that can be configured during cluster synchronization:

• Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration such as Git repositories. It automates updates to configuration whenever there is new code to deploy.

  Command Introduced: clusters cluster_name addons flux { enabled | disabled }

• Cert-manager allows you to add certificates and certificate issuers as resource types in Kubernetes clusters. This simplifies the process of managing TLS certificates and tunnel termination for API endpoints.

  Command Introduced: clusters cluster_name addons cert-manager { enabled | disabled }

• External Secrets Operator (ESO) is a Kubernetes operator that integrates external secret management systems such as Vault. The operator reads information from external APIs and automatically injects the values into a Kubernetes Secret.

  Command Introduced: clusters cluster_name addons external-secrets-operator

Prometheus Operator and Pushgateway Support

CEE is enhanced to install Prometheus using the Prometheus Operator with the support of Pushgateway.

The Prometheus Operator allows you to manage and configure the Prometheus-based monitoring stack for Kubernetes clusters. The Pushgateway is an intermediary service that allows you to push metrics to Prometheus from batch jobs which cannot be scraped.

Commands Introduced:

• prometheus prometheus-operator

• prometheus pushgateway

• prometheus pushgateway port

Server Isolation

The server isolation feature allows you to set a threshold for worker node failures that the system can tolerate. This feature increases the success rates of cluster synchronization.

Command Introduced:

clusters cluster_name actions sync run upgrade-strategy concurrent [ isolate-on-hardware-failure { false | true } node-tolerance tolerance_value ]

SMI Base Image Patch Without A/B Upgrade

The Base Image Patch feature enables the application of patches to the base image in a non-disruptive manner and avoids the need for a full A/B upgrade.

This feature is useful when minor updates or security patches need to be applied to the base image for the following scenarios:

• Third-party software and library updates

• Kernel upgrades for security changes

• Addition or upgrade of kernel modules

Commands Introduced:

• clusters cluster_name actions sync run disable-partition-upgrade { true | false } —Apply the patch from cluster manager for full cluster synchronization

• clusters cluster_name actions sync run sync-phase patch —Apply the patch using sync-phase

• clusters cluster_name actions patch pre-check —Identify any issues before applying a patch

• clusters cluster_name actions patch status —Provide the current patch level and status

Updated Versions for Third-Party Software

SMI supports updated versions for the following third-party software in this release:

• Calico—3.28

• Containerd—1.7.18

• Confd—7.7.16

• Docker—26.1.4

• Helm—3.15.2

• nginx—4.10.1