Skip to content

Commit 3fab8a4

Browse files
stevsmitstevsmit
authored
Merge pull request #92230 from apurvabhide17/OADP-5512-1.5.0-release-notes
OADP-5512-Added OADP 1.5.0 release note structure
2 parents de1237c + 223916d commit 3fab8a4

8 files changed

+507
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3558,6 +3558,8 @@ Topics:
35583558
- Name: OADP release notes
35593559
Dir: release-notes
35603560
Topics:
3561+
- Name: OADP 1.5 release notes
3562+
File: oadp-1-5-release-notes
35613563
- Name: OADP 1.4 release notes
35623564
File: oadp-1-4-release-notes
35633565
- Name: OADP performance

‎backup_and_restore/application_backup_and_restore/release-notes/oadp-1-5-release-notes.adoc

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
3+
[id="oadp-1-5-release-notes"]
4+
= OADP 1.5 release notes
5+
include::_attributes/common-attributes.adoc[]
6+
include::_attributes/attributes-openshift-dedicated.adoc[]
7+
:context: oadp-1-5-release-notes
8+
9+
toc::[]
10+
11+
The release notes for {oadp-first} describe new features and enhancements, deprecated features, product recommendations, known issues, and resolved issues.
12+
13+
[NOTE]
14+
====
15+
For additional information about {oadp-short}, see link:https://access.redhat.com/articles/5456281[{oadp-first} FAQs]
16+
====
17+
18+
include::modules/oadp-1-5-0-release-notes.adoc[leveloffset=+1]
19+
20+
[id="upgrade-notes-1-5-0_{context}"]
21+
== Upgrading OADP 1.4.0 to 1.5.0
22+
23+
[NOTE]
24+
====
25+
Always upgrade to the next minor version. Do not skip versions. To update to a later version, upgrade only one channel at a time. For example, to upgrade from {oadp-short} 1.1 to 1.3, upgrade first to 1.2, and then to 1.3.
26+
====
27+
28+
include::modules/changes-from-oadp-1-4-to-1-5.adoc[leveloffset=+2]
29+
include::modules/oadp-backing-up-dpa-configuration-1-5-0.adoc[leveloffset=+2]
30+
include::modules/oadp-upgrading-oadp-operator-1-5-0.adoc[leveloffset=+2]
31+
include::modules/converting-dpa-to-the-new-version-for-oadp-1-5-0.adoc[leveloffset=+2]
32+
include::modules/oadp-verifying-upgrade-1-5-0.adoc[leveloffset=+2]

‎modules/changes-from-oadp-1-4-to-1-5.adoc

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * backup_and_restore/oadp-1-5-release-notes.adoc
4+
:_mod-docs-content-type: CONCEPT
5+
6+
[id="changes-from-oadp-1-4-to-1-5_{context}"]
7+
= Changes from OADP 1.4 to 1.5
8+
9+
The Velero server has been updated from version 1.14 to 1.16.
10+
11+
This changes the following:
12+
13+
Version Support changes::
14+
{oadp-full} implements a streamlined version support policy. Red{nbsp}Hat supports only one version of {oadp-first} on one {OCP-short} version to ensure better stability and maintainability. {oadp-short} 1.5.0 is only supported on {OCP-short} 4.19 version.
15+
16+
OADP Self-Service::
17+
{oadp-short} 1.5.0 introduces a new feature named {oadp-short} Self-Service, enabling namespace admin users to back up and restore applications on the {product-title}.
18+
In the earlier versions of {oadp-short}, you needed the cluster-admin role to perform {oadp-short} operations such as backing up and restoring an application, creating a backup storage location, and so on.
19+
+
20+
From {oadp-short} 1.5.0 onward, you do not need the cluster-admin role to perform the backup and restore operations. You can use {oadp-short} with the namespace admin role. The namespace admin role has administrator access only to the namespace the user is assigned to.
21+
You can use the Self-Service feature only after the cluster administrator installs the {oadp-short} Operator and provides the necessary permissions.
22+
23+
`backupPVC` and `restorePVC` configurations::
24+
A `backupPVC` resource is an intermediate persistent volume claim (PVC) to access data during the data movement backup operation. You create a `readonly` backup PVC by using the `nodeAgent.backupPVC` section of the `DataProtectionApplication` (DPA) custom resource.
25+
+
26+
A `restorePVC` resource is an intermediate PVC that is used to write data during the Data Mover restore operation.
27+
+
28+
You can configure `restorePVC` in the DPA by using the `ignoreDelayBinding` field.

‎modules/converting-dpa-to-the-new-version-for-oadp-1-5-0.adoc

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * backup_and_restore/oadp-1-5-release-notes.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
6+
[id="converting-dpa-to-the-new-version-for-oadp-1-5-0_{context}"]
7+
= Converting DPA to the new version for OADP 1.5.0
8+
9+
The {oadp-first} 1.4 is not supported on {OCP-short} 4.19. You can convert Data Protection Application (DPA) to the new {oadp-short} 1.5 version by using the new `spec.configuration.nodeAgent` field and its sub-fields.
10+
11+
.Procedure
12+
13+
. To configure `nodeAgent` daemon set, use the `spec.configuration.nodeAgent` parameter in DPA. See the following example:
14+
+
15+
.Example `DataProtectionApplication` configuration
16+
[source,yaml]
17+
----
18+
...
19+
spec:
20+
configuration:
21+
nodeAgent:
22+
enable: true
23+
uploaderType: kopia
24+
...
25+
----
26+
27+
. To configure `nodeAgent` daemon set by using the `ConfigMap` resource named `node-agent-config`, see the following example configuration:
28+
+
29+
.Example config map
30+
[source,yaml]
31+
----
32+
...
33+
spec:
34+
configuration:
35+
nodeAgent:
36+
backupPVC:
37+
...
38+
loadConcurrency:
39+
...
40+
podResources:
41+
...
42+
restorePVC:
43+
...
44+
...
45+
----

‎modules/oadp-1-5-0-release-notes.adoc

Lines changed: 265 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,265 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * backup_and_restore/oadp-1-5-release-notes.adoc
4+
:_mod-docs-content-type: REFERENCE
5+
6+
[id="oadp-1-5-0-release-notes_{context}"]
7+
= OADP 1.5.0 release notes
8+
9+
The {oadp-first} 1.5.0 release notes lists resolved issues and known issues.
10+
11+
[id="new-features-1-5-0_{context}"]
12+
== New features
13+
14+
.OADP 1.5.0 introduces a new Self-Service feature
15+
16+
{oadp-short} 1.5.0 introduces a new feature named {oadp-short} Self-Service, enabling namespace admin users to back up and restore applications on the {product-title}.
17+
In the earlier versions of {oadp-short}, you needed the cluster-admin role to perform {oadp-short} operations such as backing up and restoring an application, creating a backup storage location, and so on.
18+
19+
From {oadp-short} 1.5.0 onward, you do not need the cluster-admin role to perform the backup and restore operations. You can use {oadp-short} with the namespace admin role. The namespace admin role has administrator access only to the namespace the user is assigned to.
20+
You can use the Self-Service feature only after the cluster administrator installs the {oadp-short} Operator and provides the necessary permissions.
21+
22+
link:https://issues.redhat.com/browse/OADP-4001[OADP-4001]
23+
24+
.Collecting logs with the `must-gather` tool has been improved with a Markdown summary
25+
26+
You can collect logs, and information about {oadp-first} custom resources by using the `must-gather` tool. The `must-gather` data must be attached to all customer cases.
27+
This tool generates a Markdown output file with the collected information, which is located in the `must-gather` logs clusters directory.
28+
29+
link:https://issues.redhat.com/browse/OADP-5384[OADP-5384]
30+
31+
.`dataMoverPrepareTimeout` and `resourceTimeout` parameters are now added to `nodeAgent` within the DPA
32+
33+
The `nodeAgent` field in Data Protection Application (DPA) now includes the following parameters:
34+
35+
* `dataMoverPrepareTimeout`: Defines the duration the `DataUpload` or `DataDownload` process will wait. The default value is 30 minutes.
36+
37+
* `resourceTimeout`: Sets the timeout for resource processes not addressed by other specific timeout parameters. The default value is 10 minutes.
38+
39+
link:https://issues.redhat.com/browse/OADP-3736[OADP-3736]
40+
41+
.Use the `spec.configuration.nodeAgent` parameter in DPA for configuring `nodeAgent` daemon set
42+
43+
Velero no longer uses the `node-agent-config` config map for configuring the `nodeAgent` daemon set. With this update, you must use the new `spec.configuration.nodeAgent` parameter in a Data Protection Application (DPA) for configuring the `nodeAgent` daemon set.
44+
45+
link:https://issues.redhat.com/browse/OADP-5042[OADP-5042]
46+
47+
.Configuring DPA with with the backup repository configuration config map is now possible
48+
49+
With Velero 1.15 and later, you can now configure the total size of a cache per repository. This prevents pods from being removed due to running out of ephemeral storage. See the following new parameters added to the `NodeAgentConfig` field in DPA:
50+
51+
* `cacheLimitMB`: Sets the local data cache size limit in megabytes.
52+
* `fullMaintenanceInterval`: The default value is 24 hours. Controls the removal rate of deleted Velero backups from the Kopia repository using the following override options:
53+
** `normalGC: 24 hours`
54+
** `fastGC: 12 hours`
55+
** `eagerGC: 6 hours`
56+
57+
link:https://issues.redhat.com/browse/OADP-5900[OADP-5900]
58+
59+
.Enhancing the node-agent security
60+
61+
With this update, the following changes are added:
62+
63+
* A new `configuration` option is now added to the `velero` field in DPA.
64+
* The default value for the `disableFsBackup` parameter is `false` or `non-existing`. With this update, the following options are added to the `SecurityContext` field:
65+
** `Privileged: true`
66+
** `AllowPrivilegeEscalation: true`
67+
* If you set the `disableFsBackup` parameter to `true`, it removes the following mounts from the node-agent:
68+
** `host-pods`
69+
** `host-plugins`
70+
* Modifies that the node-agent is always run as a non-root user.
71+
* Changes the root file system to read only.
72+
* Updates the following mount points with the write access:
73+
** `/home/velero`
74+
** `tmp/credentials`
75+
* Uses the `SeccompProfileTypeRuntimeDefault` option for the `SeccompProfile` parameter.
76+
77+
link:https://issues.redhat.com/browse/OADP-5031[OADP-5031]
78+
79+
.Adds DPA support for parallel item backup
80+
81+
By default, only one thread processes an item block. Velero 1.16 supports a parallel item backup, where multiple items within a backup can be processed in parallel.
82+
83+
You can use the optional Velero server parameter `--item-block-worker-count` to run additional worker threads to process items in parallel. To enable this in OADP, set the `dpa.Spec.Configuration.Velero.ItemBlockWorkerCount` parameter to an integer value greater than zero.
84+
[NOTE]
85+
====
86+
Running multiple full backups in parallel is not yet supported.
87+
====
88+
89+
link:https://issues.redhat.com/browse/OADP-5635[OADP-5635]
90+
91+
.OADP logs are now available in the JSON format
92+
93+
With the of release {oadp-short} 1.5.0, the logs are now available in the JSON format. It helps to have pre-parsed data in their Elastic logs management system.
94+
95+
link:https://issues.redhat.com/browse/OADP-3391[OADP-3391]
96+
97+
.The `oc get dpa` command now displays `RECONCILED` status
98+
99+
With this release, the `oc get dpa` command now displays `RECONCILED` status instead of displaying only `NAME` and `AGE` to improve user experience. For example:
100+
101+
[source,terminal]
102+
----
103+
$ oc get dpa -n openshift-adp
104+
NAME RECONCILED AGE
105+
velero-sample True 2m51s
106+
----
107+
108+
link:https://issues.redhat.com/browse/OADP-1338[OADP-1338]
109+
110+
[id="resolved-issues-1-5-0_{context}"]
111+
== Resolved issues
112+
113+
.Containers now use `FallbackToLogsOnError` for `terminationMessagePolicy`
114+
115+
With this release, the `terminationMessagePolicy` field can now set the `FallbackToLogsOnError` value for the {oadp-first} Operator containers such as `operator-manager`, `velero`, `node-agent`, and `non-admin-controller`.
116+
117+
This change ensures that if a container exits with an error and the termination message file is empty, {OCP-short} uses the last portion of the container logs output as the termination message.
118+
119+
link:https://issues.redhat.com/browse/OADP-5183[OADP-5183]
120+
121+
.Namespace admin can now access the application after restore
122+
123+
Previously, the namespace admin could not execute an application after the restore operation with the following errors:
124+
125+
* `exec operation is not allowed because the pod's security context exceeds your permissions`
126+
* `unable to validate against any security context constraint`
127+
* `not usable by user or serviceaccount, provider restricted-v2`
128+
129+
With this update, this issue is now resolved and the namespace admin can access the application successfully after the restore.
130+
131+
link:https://issues.redhat.com/browse/OADP-5611[OADP-5611]
132+
133+
.Specifying status restoration at the individual resource instance level using the annotation is now possible
134+
135+
Previously, status restoration was only configured at the resource type using the `restoreStatus` field in the `Restore` custom resource (CR).
136+
137+
With this release, you can now specify the status restoration at the individual resource instance level using the following annotation:
138+
139+
[source,terminal]
140+
----
141+
metadata:
142+
annotations:
143+
velero.io/restore-status: "true"
144+
----
145+
146+
link:https://issues.redhat.com/browse/OADP-5968[OADP-5968]
147+
148+
149+
.Restore is now successful with `excludedClusterScopedResources`
150+
151+
Previously, on performing the backup of an application with the `excludedClusterScopedResources` field set to `storageclasses`, `Namespace` parameter, the backup was successful but the restore partially failed.
152+
With this update, the restore is successful.
153+
154+
link:https://issues.redhat.com/browse/OADP-5239[OADP-5239]
155+
156+
.Backup is completed even if it gets restarted during the `waitingForPluginOperations` phase
157+
158+
Previously, a backup was marked as failed with the following error message:
159+
[Source,terminal]
160+
----
161+
failureReason: found a backup with status "InProgress" during the server starting,
162+
mark it as "Failed"
163+
----
164+
165+
With this update, the backup is completed if it gets restarted during the `waitingForPluginOperations` phase.
166+
167+
link:https://issues.redhat.com/browse/OADP-2941[OADP-2941]
168+
169+
.Error messages are now more informative when the` disableFsbackup` parameter is set to `true` in DPA
170+
171+
Previously, when the `spec.configuration.velero.disableFsBackup` field from a Data Protection Application (DPA) was set to `true`, the backup partially failed with an error, which was not informative.
172+
173+
This update makes error messages more useful for troubleshooting issues. For example, error messages indicating that `disableFsBackup: true` is the issue in a DPA or not having access to a DPA if it is for non-administrator users.
174+
175+
link:https://issues.redhat.com/browse/OADP-5952[OADP-5952]
176+
177+
.Handles AWS STS credentials in the parseAWSSecret
178+
179+
Previously, AWS credentials using STS authentication were not properly validated.
180+
181+
With this update, the `parseAWSSecret` function detects STS-specific fields, and updates the `ensureSecretDataExists` function to handle STS profiles correctly.
182+
183+
link:https://issues.redhat.com/browse/OADP-6105[OADP-6105]
184+
185+
.The `repositoryMaintenance` job affinity config is available to configure
186+
187+
Previously, the new configurations for repository maintenance job pod affinity was missing from a DPA specification.
188+
189+
With this update, the `repositoryMaintenance` job affinity config is now available to map a `BackupRepository` identifier to its configuration.
190+
191+
link:https://issues.redhat.com/browse/OADP-6134[OADP-6134]
192+
193+
.The `ValidationErrors` field fades away once the CR specification is correct
194+
195+
Previously, when a schedule CR was created with a wrong `spec.schedule` value and the same was later patched with a correct value, the `ValidationErrors` field still existed. Consequently, the `ValidationErrors` field was displaying incorrect information even though the spec was correct.
196+
197+
With this update, the `ValidationErrors` field fades away once the CR specification is correct.
198+
199+
link:https://issues.redhat.com/browse/OADP-5419[OADP-5419]
200+
201+
.The `volumeSnapshotContents` custom resources are restored when the `includedNamesapces` field is used in `restoreSpec`
202+
203+
Previously, when a restore operation was triggered with the `includedNamespace` field in a restore specification, restore operation was completed successfully but no `volumeSnapshotContents` custom resources (CR) were created and the PVCs were in a `Pending` status.
204+
205+
With this update, `volumeSnapshotContents` CR are restored even when the `includedNamesapces` field is used in `restoreSpec`. As a result, an application pod is in a `Running` state after restore.
206+
207+
link:https://issues.redhat.com/browse/OADP-5939[OADP-5939]
208+
209+
.OADP operator successfully creates bucket on top of AWS
210+
211+
Previously, the container was configured with the `readOnlyRootFilesystem: true` setting for security, but the code attempted to create temporary files in the `/tmp` directory using the `os.CreateTemp()` function. Consequently, while using the AWS STS authentication with the Cloud Credential Operator (CCO) flow, {oadp-short} failed to create temporary files that were required for AWS credential handling with the following error:
212+
[source,terminal]
213+
----
214+
ERROR unable to determine if bucket exists. {"error": "open /tmp/aws-shared-credentials1211864681: read-only file system"}
215+
----
216+
With this update, the following changes are added to address this issue:
217+
218+
* A new `emptyDir` volume named `tmp-dir` to the controller pod specification.
219+
* A volume mount to the container, which mounts this volume to the `/tmp` directory.
220+
* For security best practices, the `readOnlyRootFilesystem: true` is maintained.
221+
* Replaced the deprecated `ioutil.TempFile()` function with the recommended `os.CreateTemp()` function.
222+
* Removed the unnecessary `io/ioutil` import, which is no longer needed.
223+
224+
link:https://issues.redhat.com/browse/OADP-6019[OADP-6019]
225+
226+
For a complete list of all issues resolved in this release, see the list of link:https://issues.redhat.com/issues/?filter=12462673[OADP 1.5.0 resolved issues] in Jira.
227+
228+
229+
[id="known-issues-1-5-0_{context}"]
230+
== Known issues
231+
232+
.Kopia does not delete all the artifacts after backup expiration
233+
234+
Even after deleting a backup, Kopia does not delete the volume artifacts from the `${bucket_name}/kopia/${namespace}` on the S3 location after the backup expired. Information related to the expired and removed data files remains in the metadata.
235+
To ensure that {oadp-first} functions properly, the data is not deleted, and it exists in the `/kopia/` directory, for example:
236+
237+
* `kopia.repository`: Main repository format information such as encryption, version, and other details.
238+
* `kopia.blobcfg`: Configuration for how data blobs are named.
239+
* `kopia.maintenance`: Tracks maintenance owner, schedule, and last successful build.
240+
* `log`: Log blobs.
241+
242+
link:https://issues.redhat.com/browse/OADP-5131[OADP-5131]
243+
244+
For a complete list of all known issues in this release, see the list of link:https://issues.redhat.com/issues/?filter=12472334[OADP 1.5.0 known issues] in Jira.
245+
246+
[id="deprecated-features-1-5-0_{context}"]
247+
== Deprecated features
248+
249+
.The `configuration.restic` specification field has been deprecated
250+
251+
With {oadp-first} 1.5.0, the `configuration.restic` specification field has been deprecated. Use the `nodeAgent` section with the `uploaderType` field for selecting `kopia` or `restic` as a `uploaderType`. Note that, Restic is deprecated in {oadp-first} 1.5.0.
252+
253+
link:https://issues.redhat.com/browse/OADP-5158[OADP-5158]
254+
255+
256+
[id="technoloy-preview-1-5-0_{context}"]
257+
== Technology Preview
258+
259+
.Support for HyperShift hosted OpenShift clusters is available as a Technology Preview
260+
261+
{oadp-short} can support and facilitate application migrations within HyperShift hosted {OCP-short} clusters as a Technology Preview. It ensures a seamless backup and restore operation for applications in hosted clusters.
262+
263+
For more information about the support scope of Red{nbsp}Hat Technology Preview features, see link:https://access.redhat.com/support/offerings/techpreview/[Technology Preview Features Support Scope].
264+
265+
link:https://issues.redhat.com/browse/OADP-3930[OADP-3930]

0 commit comments

Comments
 (0)