github.com/Azure/aad-pod-identity@v1.8.17/website/content/en/changelog/_index.md (about) 1 --- 2 title: "Changelog" 3 linkTitle: "Changelog" 4 type: docs 5 menu: 6 main: 7 weight: 10 8 --- 9 10 ## v1.8.17 11 12 ### Continuous Integration 13 14 - ci: restrict permissions for gh workflows ([#1428](https://github.com/Azure/aad-pod-identity/pull/1428)) 15 - ci: remove nightly and load test pipeline ([#1432](https://github.com/Azure/aad-pod-identity/pull/1432)) 16 17 ### Documentation 18 19 - docs: Update RELEASE.md to clarify September EOL ([#1433](https://github.com/Azure/aad-pod-identity/pull/1433)) 20 21 ### Maintenance 22 23 - chore: use ubuntu-latest gh runner ([#1427](https://github.com/Azure/aad-pod-identity/pull/1427)) 24 - chore: update debian-iptables to bullseye-v1.5.7 ([#1435](https://github.com/Azure/aad-pod-identity/pull/1435)) 25 26 ## v1.8.16 27 28 ### Maintenance 29 30 - chore: bump github.com/Azure/go-autorest/autorest/adal from 0.9.22 to 0.9.23 ([#1415](https://github.com/Azure/aad-pod-identity/pull/1415)) 31 - chore: bump actions/stale from 7 to 8 ([#1416](https://github.com/Azure/aad-pod-identity/pull/1416)) 32 - chore: update debian-iptables to bullseye-v1.5.4 ([#1417](https://github.com/Azure/aad-pod-identity/pull/1417)) 33 - chore: update bug report template for deprecation notice ([#1419](https://github.com/Azure/aad-pod-identity/pull/1419)) 34 - chore: update golangci-lint to v1.52.2 ([#1424](https://github.com/Azure/aad-pod-identity/pull/1424)) 35 - chore: update docker base image to `registry.k8s.io/build-image/debian-iptables:bullseye-v1.5.6` ([#1425](https://github.com/Azure/aad-pod-identity/pull/1425)) 36 37 ## v1.8.15 38 39 ### Continuous Integration 40 41 - ci: increase retries in identity validator ([#1412](https://github.com/Azure/aad-pod-identity/pull/1412)) 42 - ci: update codecov config ([#1413](https://github.com/Azure/aad-pod-identity/pull/1413)) 43 44 ### Documentation 45 46 - docs: fix changelog for v1.8.12 release ([#1378](https://github.com/Azure/aad-pod-identity/pull/1378)) 47 48 ### Maintenance 49 50 - chore: bump k8s.io/client-go from 0.23.14 to 0.23.15 ([#1374](https://github.com/Azure/aad-pod-identity/pull/1374)) 51 - chore: bump github.com/Azure/azure-sdk-for-go from 67.1.0+incompatible to 67.2.0+incompatible ([#1377](https://github.com/Azure/aad-pod-identity/pull/1377)) 52 - chore: bump actions/stale from 6 to 7 ([#1379](https://github.com/Azure/aad-pod-identity/pull/1379)) 53 - chore: bump github.com/Azure/go-autorest/autorest/adal from 0.9.21 to 0.9.22 ([#1383](https://github.com/Azure/aad-pod-identity/pull/1383)) 54 - chore: bump k8s.io/component-base from 0.23.14 to 0.23.17 ([#1406](https://github.com/Azure/aad-pod-identity/pull/1406)) 55 - chore: bump autoprefixer from 10.4.13 to 10.4.14 in /website ([#1410](https://github.com/Azure/aad-pod-identity/pull/1410)) 56 - chore: bump actions/setup-go from 3 to 4 ([#1411](https://github.com/Azure/aad-pod-identity/pull/1411)) 57 - chore: update debian-iptables to bullseye-v1.5.3 ([#1414](https://github.com/Azure/aad-pod-identity/pull/1414)) 58 59 ### Other Improvements 60 61 - Update NMI server resource id query key ([#1401](https://github.com/Azure/aad-pod-identity/pull/1401)) 62 - update to github issues and pr templates for deprecation notice ([#1409](https://github.com/Azure/aad-pod-identity/pull/1409)) 63 64 ### Security Fix 65 66 - security: fix CVE-2022-41717 ([#1376](https://github.com/Azure/aad-pod-identity/pull/1376)) 67 68 ## v1.8.14 69 70 ### Continuous Integration 71 72 - ci: exclude .github path and README.md in tests ([#1343](https://github.com/Azure/aad-pod-identity/pull/1343)) 73 - ci: remove aks-engine soak clusters from pr and nightly ([#1346](https://github.com/Azure/aad-pod-identity/pull/1346)) 74 75 ### Documentation 76 77 - docs: add deprecation notice to readme ([#1345](https://github.com/Azure/aad-pod-identity/pull/1345)) 78 - Link to full description of Standard and Managed modes ([#1348](https://github.com/Azure/aad-pod-identity/pull/1348)) 79 - docs: add an anchor for deprecation announcement ([#1353](https://github.com/Azure/aad-pod-identity/pull/1353)) 80 81 ### Maintenance 82 83 - chore: add dependabot.yml ([#1331](https://github.com/Azure/aad-pod-identity/pull/1331)) 84 - chore: bump actions/stale from 4 to 6 ([#1332](https://github.com/Azure/aad-pod-identity/pull/1332)) 85 - chore: bump actions/setup-go from 2 to 3 ([#1333](https://github.com/Azure/aad-pod-identity/pull/1333)) 86 - chore: bump codecov/codecov-action from 2 to 3 ([#1334](https://github.com/Azure/aad-pod-identity/pull/1334)) 87 - chore: bump actions/checkout from 2 to 3 ([#1335](https://github.com/Azure/aad-pod-identity/pull/1335)) 88 - chore: bump postcss-cli from 7.1.2 to 10.0.0 in /website ([#1336](https://github.com/Azure/aad-pod-identity/pull/1336)) 89 - chore: bump autoprefixer from 9.8.6 to 10.4.13 in /website ([#1351](https://github.com/Azure/aad-pod-identity/pull/1351)) 90 - chore: bump k8s.io/client-go from 0.23.0 to 0.23.14 ([#1359](https://github.com/Azure/aad-pod-identity/pull/1359)) 91 - chore: bump github.com/Azure/go-autorest/autorest from 0.11.23 to 0.11.28 ([#1363](https://github.com/Azure/aad-pod-identity/pull/1363)) 92 - chore: bump github.com/stretchr/testify from 1.8.0 to 1.8.1 ([#1364](https://github.com/Azure/aad-pod-identity/pull/1364)) 93 - chore: bump postcss-cli from 10.0.0 to 10.1.0 in /website ([#1365](https://github.com/Azure/aad-pod-identity/pull/1365)) 94 - chore: bump github.com/Azure/go-autorest/autorest/adal from 0.9.18 to 0.9.21 ([#1367](https://github.com/Azure/aad-pod-identity/pull/1367)) 95 - chore: bump k8s.io/component-base from 0.23.0 to 0.23.14 ([#1368](https://github.com/Azure/aad-pod-identity/pull/1368)) 96 - chore: bump github.com/Azure/azure-sdk-for-go from 57.2.0+incompatible to 67.1.0+incompatible ([#1369](https://github.com/Azure/aad-pod-identity/pull/1369)) 97 98 ### Security Fix 99 100 - security: fix CVE-2022-32149 ([#1330](https://github.com/Azure/aad-pod-identity/pull/1330)) 101 102 ## v1.8.13 103 104 ### Bug Fixes 105 106 - add handler for invalid token requests ([#1325](https://github.com/Azure/aad-pod-identity/pull/1325)) 107 108 ### Security Fix 109 110 - fix CVE-2022-27664 ([#1326](https://github.com/Azure/aad-pod-identity/pull/1326)) 111 112 ### Maintenance 113 114 - run `apt update && apt upgrade -y` in Dockerfile ([#1317](https://github.com/Azure/aad-pod-identity/pull/1317)) 115 116 ## v1.8.12 117 118 ### Security Fix 119 120 - fix CVE-2021-46828 ([#1306](https://github.com/Azure/aad-pod-identity/pull/1306)) 121 - fix CVE-2022-37434 ([#1310](https://github.com/Azure/aad-pod-identity/pull/1310)) 122 123 ### Maintenance 124 125 - update to go 1.19 ([#1307](https://github.com/Azure/aad-pod-identity/pull/1307)) 126 - update debian-iptables to bullseye-v1.5.1 ([#1309](https://github.com/Azure/aad-pod-identity/pull/1309)) 127 128 ## v1.8.11 129 130 ### Bug Fixes 131 132 - set `Content-Length` header in NMI response ([#1297](https://github.com/Azure/aad-pod-identity/pull/1297)) 133 134 ### Security Fix 135 136 - fix CVE-2021-4209 ([#1294](https://github.com/Azure/aad-pod-identity/pull/1294)) 137 - fix multiple CVEs ([#1299](https://github.com/Azure/aad-pod-identity/pull/1299)) 138 139 ### Documentation 140 141 - add release cadence to readme ([#1296](https://github.com/Azure/aad-pod-identity/pull/1296)) 142 143 ## v1.8.10 144 145 ### Security Fix 146 147 - fix CVE-2022-1664 ([#1285](https://github.com/Azure/aad-pod-identity/pull/1285)) 148 - fix CVE-2022-2068 ([#1290](https://github.com/Azure/aad-pod-identity/pull/1290)) 149 150 ### Documentation 151 152 - add release cadence ([#1286](https://github.com/Azure/aad-pod-identity/pull/1286)) 153 154 ### Other Improvements 155 156 - Allow selecting bind address for NMI ([#1284](https://github.com/Azure/aad-pod-identity/pull/1284)) 157 - update debian-iptables to bullseye-v1.5.0 ([#1292](https://github.com/Azure/aad-pod-identity/pull/1292)) 158 159 ## v1.8.9 160 161 ### Security Fix 162 163 - fix CVE-2018-25032 ([#1261](https://github.com/Azure/aad-pod-identity/pull/1261)) 164 - fix CVE-2022-1271 ([#1270](https://github.com/Azure/aad-pod-identity/pull/1270)) 165 166 ### Other Improvements 167 168 - upgrade to debian-iptables:bullseye-v1.3.0 ([#1263](https://github.com/Azure/aad-pod-identity/pull/1263)) 169 - update to go 1.18 ([#1273](https://github.com/Azure/aad-pod-identity/pull/1273)) 170 - bump ansi-regex from 5.0.0 to 5.0.1 in /website ([#1275](https://github.com/Azure/aad-pod-identity/pull/1275)) 171 172 ## v1.8.8 173 174 ### Security Fix 175 176 - fix CVE-2022-23218 ([#1259](https://github.com/Azure/aad-pod-identity/issues/1259)) 177 178 ### Helm 179 180 - use policy/v1 for PodDisruptionBudget ([#1254](https://github.com/Azure/aad-pod-identity/issues/1254)) 181 - update nmi affinity sample in charts ([#1256](https://github.com/Azure/aad-pod-identity/issues/1256)) 182 183 ### Other Improvements 184 185 - remove redundant token get from demo ([#1258](https://github.com/Azure/aad-pod-identity/issues/1258)) 186 187 ## v1.8.7 188 189 ### Bug Fixes 190 191 - make metadata header required configurable in helm ([#1240](https://github.com/Azure/aad-pod-identity/issues/1240)) 192 - delete conntrack entries after adding iptables rules on initialization ([#1243](https://github.com/Azure/aad-pod-identity/issues/1243)) 193 194 ### Documentation 195 196 - add disclaimer for current project status ([#1231](https://github.com/Azure/aad-pod-identity/issues/1231)) 197 198 ### Security Fix 199 200 - fix CVE-2021-43618 ([#1224](https://github.com/Azure/aad-pod-identity/issues/1224)) 201 - enable readOnlyRootFilesystem for MIC ([#1225](https://github.com/Azure/aad-pod-identity/issues/1225)) 202 - fix CVE-2021-3995, CVE-2021-3996 ([#1241](https://github.com/Azure/aad-pod-identity/issues/1241)) 203 204 ### Other Improvements 205 206 - add semantic.yml ([#1214](https://github.com/Azure/aad-pod-identity/issues/1214)) 207 208 ## v1.8.6 209 210 ### Features 211 212 - return http 503 when IMDS healthcheck fails ([#1206](https://github.com/Azure/aad-pod-identity/issues/1206)) 213 214 ### Maintenance 215 216 - remove armv7 from build platforms ([#1180](https://github.com/Azure/aad-pod-identity/issues/1180)) 217 - update debian-iptables to bullseye-v1.1.0 ([#1200](https://github.com/Azure/aad-pod-identity/issues/1200)) 218 - upgrade various packages to remove jwt-go v3.2.0 dependency ([#1205](https://github.com/Azure/aad-pod-identity/issues/1205)) 219 - update adal deps to v0.9.18 ([#1208](https://github.com/Azure/aad-pod-identity/issues/1208)) 220 221 ### Helm 222 223 - support custom cloud configuration in helm chart ([#1203](https://github.com/Azure/aad-pod-identity/issues/1203)) 224 225 ## v1.8.5 226 227 ### Documentation 228 229 - Fix typo in homepage docs ([#1169](https://github.com/Azure/aad-pod-identity/issues/1169)) 230 - add note about managed mode in role assignments doc ([#1173](https://github.com/Azure/aad-pod-identity/issues/1173)) 231 232 ### Maintenance 233 234 - replace deprecated codecov uploader with GitHub Actions ([#1167](https://github.com/Azure/aad-pod-identity/issues/1167)) 235 - update nmi to bullseye (#1170) ([#1169](https://github.com/Azure/aad-pod-identity/issues/1169)) 236 - bootstrap buildx builder after creating ([#1175](https://github.com/Azure/aad-pod-identity/issues/1175)) 237 - install qemu instead of docker/binfmt ([#1176](https://github.com/Azure/aad-pod-identity/issues/1176)) 238 239 ### Security Fix 240 241 - fix CVE-2021-37750 ([#1178](https://github.com/Azure/aad-pod-identity/issues/1178)) 242 243 ## v1.8.4 244 245 ### Breaking Changes 246 247 The metadata header required flag is enabled by default to prevent SSRF attacks. Check [Metadata Header Required](https://azure.github.io/aad-pod-identity/docs/configure/feature_flags/#metadata-header-required-flag) for more information. To disable the metadata header check, set `--metadata-header-required=false` in NMI [container args](https://github.com/Azure/aad-pod-identity/blob/v1.8.6/deploy/infra/deployment-rbac.yaml#L483). 248 249 ### Bug Fixes 250 - update the node name label as part of AzureAssignedIdentity update ([#1161](https://github.com/Azure/aad-pod-identity/issues/1161)) 251 252 ### Documentation 253 - specify the latest version number containing the breaking changes ([#1150](https://github.com/Azure/aad-pod-identity/issues/1150)) 254 255 ### Maintenance 256 - set --metadata-header-required to true by default ([#1158](https://github.com/Azure/aad-pod-identity/issues/1158)) 257 - update debian-iptables to buster-v1.6.7 ([#1160](https://github.com/Azure/aad-pod-identity/issues/1160)) 258 - bump dependencies to newer versions ([#1159](https://github.com/Azure/aad-pod-identity/issues/1159)) 259 - update to go 1.17 ([#1153](https://github.com/Azure/aad-pod-identity/issues/1153)) 260 261 ### Security Fix 262 - bump go.mongodb.org/mongo-driver to v1.5.1 and add SECURITY.md ([#1156](https://github.com/Azure/aad-pod-identity/issues/1156)) 263 264 ### Testing 265 - add an option to test metadata header ([#1155](https://github.com/Azure/aad-pod-identity/issues/1155)) 266 267 ## v1.8.3 268 269 ### Documentations 270 271 - add set-retry-after-header feature flag ([#1128](https://github.com/Azure/aad-pod-identity/pull/1128)) 272 - fix doc links ([#1131](https://github.com/Azure/aad-pod-identity/pull/1131)) 273 274 ### Helm 275 276 - Expose updateStrategy configuration for NMI daemonset ([#1138](https://github.com/Azure/aad-pod-identity/pull/1138)) 277 278 ### Security 279 280 - fix CVE-2021-33910, CVE-2021-3712 ([#1144](https://github.com/Azure/aad-pod-identity/pull/1144)) 281 282 ### Test Improvements 283 284 - exclude website changes for pr trigger ([#1129](https://github.com/Azure/aad-pod-identity/pull/1129))) 285 286 ### Other Improvements 287 288 - update debian-iptables base to buster-v1.6.6 ([#1134](https://github.com/Azure/aad-pod-identity/pull/1134))) 289 - add redacted client ID in the error log ([#1141](https://github.com/Azure/aad-pod-identity/pull/1141))) 290 291 ## v1.8.2 292 293 ### Security 294 295 - dockerfile: fix CVE-2021-33910 ([#1116](https://github.com/Azure/aad-pod-identity/pull/1116)) 296 297 ### Other Improvements 298 299 - Create stale.yml ([b2fdbfde42c5fa8da68622f87d023c7dcf2dddfd](https://github.com/Azure/aad-pod-identity/commit/b2fdbfde42c5fa8da68622f87d023c7dcf2dddfd)) 300 - chore: update .github/stale.yml ([#1117](https://github.com/Azure/aad-pod-identity/pull/1117)) 301 - chore: switch from probot/stale to actions/stale ([#1118](https://github.com/Azure/aad-pod-identity/pull/1118)) 302 303 ### Bug Fixes 304 305 - fix: change stale bot trigger frequency to every day ([#1119](https://github.com/Azure/aad-pod-identity/pull/1119)) 306 307 ### Features 308 309 - feat: option to set Retry-After in NMI responses ([#1114](https://github.com/Azure/aad-pod-identity/pull/1114)) 310 311 ### Test Improvements 312 313 - test: reuse helm values during helm upgrade ([#1121](https://github.com/Azure/aad-pod-identity/pull/1121)) 314 315 ## v1.8.1 316 317 ### Features 318 319 - Add additional columns to kubectl output ([#1093](https://github.com/Azure/aad-pod-identity/pull/1093)) 320 321 ### Documentations 322 323 - docs: fix managed mode URL ([#1066](https://github.com/Azure/aad-pod-identity/pull/1066)) 324 - Update documentation to use separator between output flag & argument ([#1081](https://github.com/Azure/aad-pod-identity/pull/1081)) 325 - docs: fix typo in feature flags ([#1083](https://github.com/Azure/aad-pod-identity/pull/1083)) 326 327 ### Helm 328 329 - Automatically checksum the mic-secret secret to roll mic deployment ([#1061](https://github.com/Azure/aad-pod-identity/pull/1061)) 330 - helm: correct spec field for AzureIdentityBinding ([#1069](https://github.com/Azure/aad-pod-identity/pull/1069)) 331 - release: helm charts 4.1.1 ([#1076](https://github.com/Azure/aad-pod-identity/pull/1076)) 332 - Adds a default affinity rule to values.yaml ([#1082](https://github.com/Azure/aad-pod-identity/pull/1082)) 333 334 ### Security 335 336 - chore: bump golang.org/x/crypto to v0.0.0-20201216223049-8b5274cf687f ([#1073](https://github.com/Azure/aad-pod-identity/pull/1073)) 337 - dockerfile: fix CVE-2021-3520 ([#1078](https://github.com/Azure/aad-pod-identity/pull/1078)) 338 - chore(deps): bump browserslist from 4.14.5 to 4.16.6 in /website ([#1080](https://github.com/Azure/aad-pod-identity/pull/1080)) 339 - chore(deps): bump glob-parent from 5.1.1 to 5.1.2 in /website ([#1091](https://github.com/Azure/aad-pod-identity/pull/1091)) 340 - chore(deps): bump postcss from 7.0.35 to 7.0.36 in /website ([#1096](https://github.com/Azure/aad-pod-identity/pull/1096)) 341 - dockerfile: upgrade multiple packages due to CVEs ([#1097](https://github.com/Azure/aad-pod-identity/pull/1097)) 342 - chore: update debian base to buster-v1.6.5 ([#1101](https://github.com/Azure/aad-pod-identity/pull/1101)) 343 344 ### Bug Fixes 345 346 - fix: use correct flags for demo image ([#1087](https://github.com/Azure/aad-pod-identity/pull/1087)) 347 - fix: Remove incorrect fields from gatekeeper e2e test ([#1090](https://github.com/Azure/aad-pod-identity/pull/1090)) 348 - fix: prevent overwriting of AzureAssignedIdentity when creating it ([#1100](https://github.com/Azure/aad-pod-identity/pull/1100)) 349 - fix: mount kubelet config to /var/lib/kubelet for non-rbac deployment ([#1098](https://github.com/Azure/aad-pod-identity/pull/1098)) 350 351 ### Other Improvements 352 353 - ci: switch to staging-pool ([#1095](https://github.com/Azure/aad-pod-identity/pull/1095)) 354 - chore: enable scale features by default ([#1099](https://github.com/Azure/aad-pod-identity/pull/1099)) 355 356 ## v1.8.0 357 358 ### Breaking Changes 359 360 - The API version of Pod Identity's CRDs (`AzureIdentity`, `AzureIdentityBinding`, `AzureAssignedIdentity`, `AzurePodIdentityException`) have been upgraded from `apiextensions.k8s.io/v1beta1` to `apiextensions.k8s.io/v1`. For Kubernetes clsuters with < 1.16, `apiextensions.k8s.io/v1` CRDs would not work. You can either: 361 1. Continue using AAD Pod Identity v1.7.5 or 362 2. Upgrade your cluster to 1.16+, then upgrade AAD Pod Identity. 363 364 If AAD Pod Identity was previously installed using Helm, subsequent `helm install` or `helm upgrade` would not upgrade the CRD API version from `apiextensions.k8s.io/v1beta1` to `apiextensions.k8s.io/v1` (although `kubectl get crd -oyaml` would display `apiextensions.k8s.io/v1` since the API server internally converts v1beta1 CRDs to v1, it lacks a [structural schema](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#specifying-a-structural-schema), which is what AAD Pod Identity introduced in v1.8.0). If you wish to upgrade to the official v1 CRDs for AAD Pod Identity: 365 366 ```bash 367 kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/charts/aad-pod-identity/crds/crd.yaml 368 ``` 369 370 With [managed mode](./configure/pod_identity_in_managed_mode) enabled, you can remove the unused AzureAssignedIdentity CRD if you wish. 371 372 ```bash 373 # MANAGED MODE ONLY! 374 kubectl delete crd azureassignedidentities.aadpodidentity.k8s.io 375 ``` 376 377 ### Features 378 379 - feat: add register.go to add crds to scheme ([#1053](https://github.com/Azure/aad-pod-identity/pull/1053)) 380 381 ### Documentations 382 383 - docs: add standard to managed mode migration doc ([#1055](https://github.com/Azure/aad-pod-identity/pull/1055)) 384 - docs: add installation steps for Azure RedHat Openshift ([#1056](https://github.com/Azure/aad-pod-identity/pull/1056)) 385 386 ### Bug Fixes 387 388 - fix: remove ImagePullPolicy: Always ([#1046](https://github.com/Azure/aad-pod-identity/pull/1046)) 389 - fix: inject TypeMeta during type upgrade ([#1057](https://github.com/Azure/aad-pod-identity/pull/1057)) 390 391 ### Helm 392 393 - helm: ability to add AzureIdentities with the same name across different namespaces ([#1036](https://github.com/Azure/aad-pod-identity/pull/1036)) 394 - helm: ability to parameterize the number replicas MIC deployment ([#1041](https://github.com/Azure/aad-pod-identity/pull/1041)) 395 - helm: create optional user roles for AAD Pod Identity ([#1043](https://github.com/Azure/aad-pod-identity/pull/1043)) 396 397 ### Security 398 399 - dockerfile: upgrade debian-iptables to buster-v1.6.0 ([#1038](https://github.com/Azure/aad-pod-identity/pull/1038)) 400 - migrate from satori uuid ([#1062](https://github.com/Azure/aad-pod-identity/pull/1062)) 401 - chore(deps): bump lodash from 4.17.20 to 4.17.21 in /website ([#1063](https://github.com/Azure/aad-pod-identity/pull/1063)) 402 403 ### Other Improvements 404 405 - chore: add stale.yml ([#1032](https://github.com/Azure/aad-pod-identity/pull/1032)) 406 - chore: promote crd to apiextensions.k8s.io/v1 and remove role assignments after e2e test ([#1035](https://github.com/Azure/aad-pod-identity/pull/1035)) 407 - chore: remove vmss list from demo ([#1037](https://github.com/Azure/aad-pod-identity/pull/1037)) 408 - ci: remove CODECOV_TOKEN env var ([#1045](https://github.com/Azure/aad-pod-identity/pull/1045)) 409 - ci: create a make target to automate manifest promotion ([#1047](https://github.com/Azure/aad-pod-identity/pull/1047)) 410 411 ## v1.7.5 412 413 ### Breaking Changes 414 415 - **(Only apply to app version ≥ v1.7.5 / chart version ≥ 4.0.0)** AAD Pod Identity has dropped Helm 2 starting from chart version 4.0.0/app version 1.7.5. To install or upgrade to the latest version of AAD Pod Identity, please use Helm 3 instead. Refer to this [guide](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) on how to migrate from Helm 2 to Helm 3. 416 417 ### Helm 418 419 - helm: Add missing `weight` key in node affinity example ([#996](https://github.com/Azure/aad-pod-identity/pull/996)) 420 - helm: Added Pod Security Policy ([#998](https://github.com/Azure/aad-pod-identity/pull/998)) 421 - helm: remove helm 2 support ([#1001](https://github.com/Azure/aad-pod-identity/pull/1001)) 422 423 ### Features 424 425 - feat: add cluster identity to immutable list ([#981](https://github.com/Azure/aad-pod-identity/pull/981)) 426 427 ### Bug Fixes 428 429 - fix: skip kubenet check if allowed is true ([#999](https://github.com/Azure/aad-pod-identity/pull/999)) 430 - fix: skip PATCH call if no identities to assign or un-assign ([#1007](https://github.com/Azure/aad-pod-identity/pull/1007)) 431 - fix: add case insensitive handler pattern ([#1021](https://github.com/Azure/aad-pod-identity/pull/1021)) 432 - fix: add FileOrCreate to kubelet config file ([#1024](https://github.com/Azure/aad-pod-identity/pull/1024)) 433 434 ### Documentation 435 436 - docs: add note about system-assigned not supported ([#973](https://github.com/Azure/aad-pod-identity/pull/973)) 437 - docs: improve documentations on multiple areas ([#991](https://github.com/Azure/aad-pod-identity/pull/991)) 438 - docs: vmss typo ([#1016](https://github.com/Azure/aad-pod-identity/pull/1016)) 439 440 ### Test Improvements 441 442 - ci: switch from service principal to managed identity for e2e test ([#974](https://github.com/Azure/aad-pod-identity/pull/974)) 443 - ci: use Upstream Pool for soak & load test ([#982](https://github.com/Azure/aad-pod-identity/pull/982)) 444 - test: make backward compat test deterministic ([#986](https://github.com/Azure/aad-pod-identity/pull/986)) 445 - flake: change mic sync interval from 1h to 30s ([#989](https://github.com/Azure/aad-pod-identity/pull/989)) 446 - test: use kubectl to get vmss name ([#1027](https://github.com/Azure/aad-pod-identity/pull/1027)) 447 448 ### Other Improvements 449 450 - chore: update to go 1.16 ([#983](https://github.com/Azure/aad-pod-identity/pull/983)) 451 - chore: update k8s lib versions ([#1010](https://github.com/Azure/aad-pod-identity/pull/1010)) 452 - chore(deps): bump y18n from 4.0.0 to 4.0.1 in /website ([#1028](https://github.com/Azure/aad-pod-identity/pull/1028)) 453 454 ## v1.7.4 455 456 ### Helm 457 458 - helm: add podLabels parameter ([#963](https://github.com/Azure/aad-pod-identity/pull/963)) 459 460 ### Bug Fixes 461 462 - fix: prevent errors from being overwritten by metric report function ([#967](https://github.com/Azure/aad-pod-identity/pull/967)) 463 464 ### Features 465 466 - feat: add configuration for custom user agent ([#965](https://github.com/Azure/aad-pod-identity/pull/965)) 467 468 ## v1.7.3 469 470 ### Bug Fixes 471 472 - fix: check if provisioning state is not nil ([#960](https://github.com/Azure/aad-pod-identity/pull/960)) 473 474 ## v1.7.2 475 476 ### Breaking Changes 477 478 - The `forceNameSpaced` helm configuration variable is removed. Use `forceNamespaced` instead to configure pod identity to run in namespaced mode. 479 480 ### Features 481 482 - feat: add arm64 build ([#950](https://github.com/Azure/aad-pod-identity/pull/950)) 483 484 ### Bug Fixes 485 486 - fix: fix typos in stats variables ([#919](https://github.com/Azure/aad-pod-identity/pull/919)) 487 - fix: drop all unnecessary root capabilities for NMI ([#940](https://github.com/Azure/aad-pod-identity/pull/940)) 488 - fix: copy response header and status code to http.ResponseWriter ([#946](https://github.com/Azure/aad-pod-identity/pull/946)) 489 490 ### Security 491 492 - dockerfile: fix CVE-2020-29362, CVE-2020-29363, CVE-2020-29361 ([#924](https://github.com/Azure/aad-pod-identity/pull/924)) 493 - dockerfile: upgrade debian-iptables to buster-v1.4.0 ([#948](https://github.com/Azure/aad-pod-identity/pull/948)) 494 495 ### Helm 496 497 - helm: remove deprecated forceNameSpaced from values.yaml ([#927](https://github.com/Azure/aad-pod-identity/pull/927)) 498 - helm: skip MIC exception installation when using managed mode ([#936](https://github.com/Azure/aad-pod-identity/pull/936)) 499 500 ### Documentation 501 502 - docs: document breaking change on `azureIdentities` ([#944](https://github.com/Azure/aad-pod-identity/pull/944)) 503 504 ### Other Improvements 505 506 - chore: update github pr template ([#925](https://github.com/Azure/aad-pod-identity/pull/925)) 507 - cleanup: refactor demo code ([#930](https://github.com/Azure/aad-pod-identity/pull/930)) 508 - chore: switch to using golang builder ([#952](https://github.com/Azure/aad-pod-identity/pull/952)) 509 510 ## v1.7.1 511 512 ### Breaking Changes 513 514 - **(Only apply to app version ≥ v1.7.1 / chart version ≥ 3.0.0)** `azureIdentities` in `values.yaml` is converted to a map instead of a list of identities. 515 516 The following is an example of the required change in `values.yaml` from helm chart 2.x.x to 3.x.x: 517 518 ```diff 519 -azureIdentities: 520 - - name: "azure-identity" 521 - # if not defined, then the azure identity will be deployed in the same namespace as the chart 522 - namespace: "" 523 - # type 0: MSI, type 1: Service Principal 524 - type: 0 525 - # /subscriptions/subscription-id/resourcegroups/resource-group/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity-name 526 - resourceID: "resource-id" 527 - clientID: "client-id" 528 - binding: 529 - name: "azure-identity-binding" 530 - # The selector will also need to be included in labels for app deployment 531 - selector: "demo" 532 +azureIdentities: 533 + "azure-identity": 534 + # if not defined, then the azure identity will be deployed in the same namespace as the chart 535 + namespace: "" 536 + # type 0: MSI, type 1: Service Principal 537 + type: 0 538 + # /subscriptions/subscription-id/resourcegroups/resource-group/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity-name 539 + resourceID: "resource-id" 540 + clientID: "client-id" 541 + binding: 542 + name: "azure-identity-binding" 543 + # The selector will also need to be included in labels for app deployment 544 + selector: "demo" 545 ``` 546 547 ### Bug Fixes 548 - allow overwriting NODE_RESOURCE_GROUP in role-assignment.sh ([#873](https://github.com/Azure/aad-pod-identity/pull/873)) 549 550 ### Other Improvements 551 - fix CVE-2020-1971 ([#905](https://github.com/Azure/aad-pod-identity/pull/905)) 552 - fix CVE-2020-27350 ([#909](https://github.com/Azure/aad-pod-identity/pull/909)) 553 554 ### Documentation 555 - add note about specifying which identity to use ([#869](https://github.com/Azure/aad-pod-identity/pull/869)) 556 - fix `|` in markdown table ([#882](https://github.com/Azure/aad-pod-identity/pull/882)) 557 - use `az aks show` for node resource group & more convenient command to run role assignment script ([#879](https://github.com/Azure/aad-pod-identity/pull/879)) 558 - reduce number of role assignments ([#883](https://github.com/Azure/aad-pod-identity/pull/883)) 559 - add spring boot example which interacts with blob storage ([#878](https://github.com/Azure/aad-pod-identity/pull/878)) 560 - add changelog & development section and move java-blob example to website ([#891](https://github.com/Azure/aad-pod-identity/pull/891)) 561 - Added instructions how to mitigate ARP spoofing on kubenet clusters with OPA/Gatekeeper ([#894](https://github.com/Azure/aad-pod-identity/pull/894)) 562 - add warning note to kubenet docs ([#911](https://github.com/Azure/aad-pod-identity/pull/911)) 563 564 ### Helm 565 - rename forceNameSpaced to forceNamespaced ([#874](https://github.com/Azure/aad-pod-identity/pull/874)) 566 - bump helm chart version to 2.1.0 for aad-pod-identity v1.7.0 ([#884](https://github.com/Azure/aad-pod-identity/pull/884)) 567 - add topologySpreadConstraints and PodDisruptionBudget in helm chart ([#886](https://github.com/Azure/aad-pod-identity/pull/886)) 568 - adding option to configure kubeletConfig ([#906](https://github.com/Azure/aad-pod-identity/pull/906)) 569 - deprecate forceNameSpaced value ([#914](https://github.com/Azure/aad-pod-identity/pull/914)) 570 - add notes ([#916](https://github.com/Azure/aad-pod-identity/pull/916)) 571 - use map for azureIdentities instead of list in helm chart ([#899](https://github.com/Azure/aad-pod-identity/pull/899)) 572 573 ### Test Improvements 574 - remove getIdentityValidatorArgs ([#910](https://github.com/Azure/aad-pod-identity/pull/910)) 575 - less error-prone identityvalidator ([#901](https://github.com/Azure/aad-pod-identity/pull/901)) 576 577 ## v1.7.0 578 579 ### Breaking Changes 580 581 - With [Azure/aad-pod-identity#842](https://github.com/Azure/aad-pod-identity/pull/842), aad-pod-identity no longer works on clusters with kubenet as the network plugin. For more details, please see [Deploy AAD Pod Identity in a Cluster with Kubenet](configure/aad_pod_identity_on_kubenet/). 582 583 If you still wish to install aad-pod-identity on a kubenet-enabled cluster, set the helm chart value `nmi.allowNetworkPluginKubenet` to `true` in the helm command: 584 585 ```bash 586 helm (install|upgrade) ... --set nmi.allowNetworkPluginKubenet=true ... 587 ``` 588 589 ### Features 590 - support JSON logging format ([#839](https://github.com/Azure/aad-pod-identity/pull/839)) 591 - disable aad-pod-identity by default for kubenet ([#842](https://github.com/Azure/aad-pod-identity/pull/842)) 592 - add auxiliary tenant ids for service principal ([#843](https://github.com/Azure/aad-pod-identity/pull/843)) 593 594 ### Bug Fixes 595 - account for 150+ identity assignment and unassignment ([#847](https://github.com/Azure/aad-pod-identity/pull/847)) 596 597 ### Other Improvements 598 - include image scanning as part of CI & set non-root user in Dockerfile ([#803](https://github.com/Azure/aad-pod-identity/pull/803)) 599 600 ### Documentation 601 - initial layout for static site ([#801](https://github.com/Azure/aad-pod-identity/pull/801)) 602 - update website theme to docsy ([#828](https://github.com/Azure/aad-pod-identity/pull/828)) 603 - update invalid URLs in website ([#832](https://github.com/Azure/aad-pod-identity/pull/832)) 604 - fix casing of "priorityClassName" parameters in README.md ([#856](https://github.com/Azure/aad-pod-identity/pull/856)) 605 - add docs for various topics ([#858](https://github.com/Azure/aad-pod-identity/pull/858)) 606 - s/cluster resource group/node resource group ([#862](https://github.com/Azure/aad-pod-identity/pull/862)) 607 - add docs for configuring in custom cloud ([#863](https://github.com/Azure/aad-pod-identity/pull/863)) 608 - fix broken links and typo ([#864](https://github.com/Azure/aad-pod-identity/pull/864)) 609 610 ### Helm 611 - remove extra indentation in crd.yaml ([#833](https://github.com/Azure/aad-pod-identity/pull/833)) 612 - make runAsUser conditional for MIC in helm ([#844](https://github.com/Azure/aad-pod-identity/pull/844)) 613 614 ### Test Improvements 615 - remove aks cluster version in e2e ([#808](https://github.com/Azure/aad-pod-identity/pull/808)) 616 - decrease length of RG name to allow cluster creation in eastus2euap ([#810](https://github.com/Azure/aad-pod-identity/pull/810)) 617 - health check with podIP from the busybox container ([#840](https://github.com/Azure/aad-pod-identity/pull/840)) 618 - add gosec as part of linting ([#850](https://github.com/Azure/aad-pod-identity/pull/850)) 619 - remove --ignore-unfixed for trivy ([#854](https://github.com/Azure/aad-pod-identity/pull/854)) 620 621 ## v1.6.3 622 623 ### Features 624 625 - throttling - honor retry after header ([#742](https://github.com/Azure/aad-pod-identity/pull/742)) 626 - reconcile identity assignment on Azure ([#734](https://github.com/Azure/aad-pod-identity/pull/734)) 627 628 ### Bug Fixes 629 630 - add certs volume for non-rbac manifests ([#713](https://github.com/Azure/aad-pod-identity/pull/713)) 631 - Report original error from getPodListRetry ([#762](https://github.com/Azure/aad-pod-identity/pull/762)) 632 - initialize klog flags for NMI ([#767](https://github.com/Azure/aad-pod-identity/pull/767)) 633 - ensure stats collector doesn't aggregate stats from multiple runs ([#750](https://github.com/Azure/aad-pod-identity/pull/750)) 634 635 ### Other Improvements 636 637 - add deploy manifests and helm charts to staging dir ([#736](https://github.com/Azure/aad-pod-identity/pull/736)) 638 - fix miscellaneous linting problem in the codebase ([#733](https://github.com/Azure/aad-pod-identity/pull/733)) 639 - remove privileged: true for NMI daemonset ([#745](https://github.com/Azure/aad-pod-identity/pull/745)) 640 - Update to go1.15 ([#751](https://github.com/Azure/aad-pod-identity/pull/751)) 641 - automate role assignments and improve troubleshooting guide ([#754](https://github.com/Azure/aad-pod-identity/pull/754)) 642 - set dnspolicy to clusterfirstwithhostnet for NMI ([#776](https://github.com/Azure/aad-pod-identity/pull/776)) 643 - bump debian-base to v2.1.3 and debian-iptables to v12.1.2 ([#783](https://github.com/Azure/aad-pod-identity/pull/783)) 644 - add logs for ignored pods ([#785](https://github.com/Azure/aad-pod-identity/pull/785)) 645 646 ### Documentation 647 648 - docs: fix broken test standard link in GitHub Pull Request template ([#710](https://github.com/Azure/aad-pod-identity/pull/710)) 649 - Fixed typo ([#757](https://github.com/Azure/aad-pod-identity/pull/757)) 650 - Fixed Grammar ([#758](https://github.com/Azure/aad-pod-identity/pull/758)) 651 - add doc for deleting/recreating identity with same name ([#786](https://github.com/Azure/aad-pod-identity/pull/786)) 652 - add best practices documentation ([#779](https://github.com/Azure/aad-pod-identity/pull/779)) 653 654 ### Helm 655 656 - add release namespace to chart manifests ([#741](https://github.com/Azure/aad-pod-identity/pull/741)) 657 - Add imagePullSecretes to the Helm chart ([#774](https://github.com/Azure/aad-pod-identity/pull/774)) 658 - Expose metrics port ([#777](https://github.com/Azure/aad-pod-identity/pull/777)) 659 - add user managed identity support to helm charts ([#781](https://github.com/Azure/aad-pod-identity/pull/781)) 660 661 ### Test Improvements 662 663 - add e2e test for block-instance-metadata ([#715](https://github.com/Azure/aad-pod-identity/pull/715)) 664 - add aks as part of pr and nightly test ([#717](https://github.com/Azure/aad-pod-identity/pull/717)) 665 - add load test pipeline to nightly job ([#744](https://github.com/Azure/aad-pod-identity/pull/744)) 666 - install aad-pod-identity in kube-system namespace ([#747](https://github.com/Azure/aad-pod-identity/pull/747)) 667 - bump golangci-lint to v1.30.0 ([#759](https://github.com/Azure/aad-pod-identity/pull/759)) 668 669 670 ## v1.6.2 671 672 ### Features 673 674 - Acquire an token with the certificate of service principal ([#517](https://github.com/Azure/aad-pod-identity/pull/517)) 675 - Handle MSI auth requests by ResourceID ([#540](https://github.com/Azure/aad-pod-identity/pull/540)) 676 - make NMI listen only on localhost ([#658](https://github.com/Azure/aad-pod-identity/pull/658)) 677 - trigger MIC sync when a pod label changes ([#682](https://github.com/Azure/aad-pod-identity/pull/682)) 678 679 ### Bug Fixes 680 681 - check iptable rules match expected ([#663](https://github.com/Azure/aad-pod-identity/pull/663)) 682 683 ### Other Improvements 684 685 - update base image with debian base ([#641](https://github.com/Azure/aad-pod-identity/pull/641)) 686 - update node selector label to kubernetes.io/os ([#652](https://github.com/Azure/aad-pod-identity/pull/652)) 687 - better error messages and handling ([#666](https://github.com/Azure/aad-pod-identity/pull/666)) 688 - add default known types to scheme ([#668](https://github.com/Azure/aad-pod-identity/pull/668)) 689 - Remove unused cert volumes from mic deployment ([#670](https://github.com/Azure/aad-pod-identity/pull/670)) 690 691 ### Documentation 692 693 - update typed namespacedname case for sp example ([#649](https://github.com/Azure/aad-pod-identity/pull/649)) 694 - list components prometheus enpoints ([#660](https://github.com/Azure/aad-pod-identity/pull/660)) 695 - add helm upgrade guide and known issues ([#683](https://github.com/Azure/aad-pod-identity/pull/683)) 696 - add requirements to PR template and test standard to CONTRIBUTING.md ([#706](https://github.com/Azure/aad-pod-identity/pull/706)) 697 698 ### Helm 699 700 - add aks add-on exception in kube-system ([#634](https://github.com/Azure/aad-pod-identity/pull/634)) 701 - disable crd-install when using Helm 3 ([#642](https://github.com/Azure/aad-pod-identity/pull/642)) 702 - update default http probe port at deploy to 8085 ([#708](https://github.com/Azure/aad-pod-identity/pull/708)) 703 704 ### Test Improvements 705 706 - new test framework for aad-pod-identity ([#640](https://github.com/Azure/aad-pod-identity/pull/640)) 707 - convert e2e test cases from old to new framework ([#650](https://github.com/Azure/aad-pod-identity/pull/650)), ([#656](https://github.com/Azure/aad-pod-identity/pull/656)), ([#662](https://github.com/Azure/aad-pod-identity/pull/662)), ([#664](https://github.com/Azure/aad-pod-identity/pull/664)), ([#667](https://github.com/Azure/aad-pod-identity/pull/667)), ([#680](https://github.com/Azure/aad-pod-identity/pull/680)) 708 - add soak testing as part of nightly build & test and remove Jenkinsfile ([#687](https://github.com/Azure/aad-pod-identity/pull/687)) 709 - update e2e suite to remove flakes ([#693](https://github.com/Azure/aad-pod-identity/pull/693)), ([#695](https://github.com/Azure/aad-pod-identity/pull/695)), ([#697](https://github.com/Azure/aad-pod-identity/pull/697)), ([#699](https://github.com/Azure/aad-pod-identity/pull/699)), ([#701](https://github.com/Azure/aad-pod-identity/pull/701)) 710 - add e2e tests with resource id ([#696](https://github.com/Azure/aad-pod-identity/pull/696)) 711 - add code coverage as part of CI ([#705](https://github.com/Azure/aad-pod-identity/pull/705)) 712 713 714 ## v1.6.1 715 716 ### Features 717 - re-initialize MIC cloud client when cloud config is updated ([#590](https://github.com/Azure/aad-pod-identity/pull/590)) 718 - add finalizer for assigned identity ([#593](https://github.com/Azure/aad-pod-identity/pull/593)) 719 - make update user msi calls retriable ([#601](https://github.com/Azure/aad-pod-identity/pull/601)) 720 721 ### Bug Fixes 722 - Fix issue that caused failures with long pod name > 63 chars ([#545](https://github.com/Azure/aad-pod-identity/pull/545)) 723 - Fix updating assigned identity when azure identity updated ([#559](https://github.com/Azure/aad-pod-identity/pull/559)) 724 725 ### Other Improvements 726 - Add linting tools in Makefile ([#551](https://github.com/Azure/aad-pod-identity/pull/551)) 727 - Code clean up and enable linting tools in CI ([#597](https://github.com/Azure/aad-pod-identity/pull/597)) 728 - change to 404 instead if no azure identity found ([#629](https://github.com/Azure/aad-pod-identity/pull/629)) 729 730 ### Documentation 731 - document required role assignments ([#592](https://github.com/Azure/aad-pod-identity/pull/592)) 732 - add `--subscription` parameter to az cli commands ([#602](https://github.com/Azure/aad-pod-identity/pull/602)) 733 - add mic pod exception to deployment ([#611](https://github.com/Azure/aad-pod-identity/pull/611)) 734 - reduce ambiguity in demo and role assignment docs ([#620](https://github.com/Azure/aad-pod-identity/pull/620)) 735 - add support information to readme ([#623](https://github.com/Azure/aad-pod-identity/pull/623)) 736 - update docs for pod-identity exception ([#624](https://github.com/Azure/aad-pod-identity/pull/624)) 737 738 ### Helm 739 740 - make cloud config configurable in helm chart ([#598](https://github.com/Azure/aad-pod-identity/pull/598)) 741 - Support multiple identities in helm chart ([#457](https://github.com/Azure/aad-pod-identity/pull/457)) 742 743 ## v1.6.0 744 745 ### Breaking Changes 746 747 With [Azure/aad-pod-identity#398](https://github.com/Azure/aad-pod-identity/pull/398), the [client-go](https://github.com/kubernetes/client-go) library is upgraded to v0.17.2, where CRD [fields are now case sensitive](https://github.com/kubernetes/kubernetes/issues/64612). If you are upgrading MIC and NMI from v1.x.x to v1.6.0, MIC v1.6.0+ will upgrade the fields of existing `AzureIdentity` and `AzureIdentityBinding` on startup to the new format to ensure backward compatibility. A configmap called `aad-pod-identity-config` is created to record and confirm the successful type upgrade. 748 749 However, for future `AzureIdentity` and `AzureIdentityBinding` created using v1.6.0+, the following fields need to be changed: 750 751 ### `AzureIdentity` 752 753 | < 1.6.0 | >= 1.6.0 | 754 | ---------------- | ---------------- | 755 | `ClientID` | `clientID` | 756 | `ClientPassword` | `clientPassword` | 757 | `ResourceID` | `resourceID` | 758 | `TenantID` | `tenantID` | 759 760 ### `AzureIdentityBinding` 761 762 | < 1.6.0 | >= 1.6.0 | 763 | --------------- | --------------- | 764 | `AzureIdentity` | `azureIdentity` | 765 | `Selector` | `selector` | 766 767 ### `AzurePodIdentityException` 768 769 | < 1.6.0 | >= 1.6.0 | 770 | ----------- | ----------- | 771 | `PodLabels` | `podLabels` | 772 773 ### Features 774 - Add support for pod-identity managed mode ([#486](https://github.com/Azure/aad-pod-identity/pull/486)) 775 - Deny requests without metadata header to avoid SSRF ([#500](https://github.com/Azure/aad-pod-identity/pull/500)) 776 777 ### Bug Fixes 778 - Fix issue that caused failures with long pod name > 63 chars ([#545](https://github.com/Azure/aad-pod-identity/pull/545)) 779 - Fix updating assigned identity when azure identity updated ([#559](https://github.com/Azure/aad-pod-identity/pull/559)) 780 781 ### Other Improvements 782 - Switch to using klog for logging ([#449](https://github.com/Azure/aad-pod-identity/pull/449)) 783 - Create internal API for aadpodidentity ([#459](https://github.com/Azure/aad-pod-identity/pull/459)) 784 - Switch to using PATCH instead of CreateOrUpdate for identities ([#522](https://github.com/Azure/aad-pod-identity/pull/522)) 785 - Update client-go version to v0.17.2 ([#398](https://github.com/Azure/aad-pod-identity/pull/398)) 786 - Update to go1.14 ([#543](https://github.com/Azure/aad-pod-identity/pull/543)) 787 - Add validation for resource id format ([#548](https://github.com/Azure/aad-pod-identity/pull/548)) 788 789 ## v1.5.5 790 791 ### Bug Fixes 792 793 - Prevent flushing custom iptable rules frequently ([#474](https://github.com/Azure/aad-pod-identity/pull/474)) 794 795 ## v1.5.4 796 797 ### Features 798 799 - Add block-instance-metadata flag ([#396](https://github.com/Azure/aad-pod-identity/pull/396)) 800 - Add metrics ([#429](https://github.com/Azure/aad-pod-identity/pull/429)) 801 - Adding support for whitelisting of user-defined managed identities ([#431](https://github.com/Azure/aad-pod-identity/pull/431)) 802 803 ### Bug Fixes 804 805 - Fix glog flag parse error in nmi ([#435](https://github.com/Azure/aad-pod-identity/pull/435)) 806 807 ### Other Improvements 808 809 - Add application/json header for all return paths ([#424](https://github.com/Azure/aad-pod-identity/pull/424)) 810 - Update golang used to build binaries ([#426](https://github.com/Azure/aad-pod-identity/pull/426)) 811 - Reduce log verbosity for debug log ([#433](https://github.com/Azure/aad-pod-identity/pull/433)) 812 - Move to latest Alpine 3.10.4 ([#446](https://github.com/Azure/aad-pod-identity/pull/446)) 813 - Validate resource param exists in request ([#450](https://github.com/Azure/aad-pod-identity/pull/450)) 814 815 ## v1.5.3 816 817 ### Bug Fixes 818 819 - Fix concurrent map read and map write while updating stats ([#344](https://github.com/Azure/aad-pod-identity/pull/344)) 820 - Fix list calls to use local cache inorder to reduce api server load ([#358](https://github.com/Azure/aad-pod-identity/pull/358)) 821 - Clean up assigned identities if node not found ([#367](https://github.com/Azure/aad-pod-identity/pull/367)) 822 - Fixes to identity operations on VMSS ([#379](https://github.com/Azure/aad-pod-identity/pull/379)) 823 - Fix namespaced multiple binding/identity handling and verbose logs ([#388](https://github.com/Azure/aad-pod-identity/pull/388)) 824 - Fix panic issues while identity ids is nil ([#403](https://github.com/Azure/aad-pod-identity/pull/403)) 825 826 ### Other Improvements 827 828 - Set Content-Type on token response ([#341](https://github.com/Azure/aad-pod-identity/pull/341)) 829 - Redact client id in NMI logs ([#343](https://github.com/Azure/aad-pod-identity/pull/343)) 830 - Add user agent to kube-api calls ([#353](https://github.com/Azure/aad-pod-identity/pull/353)) 831 - Add resource and request limits ([#372](https://github.com/Azure/aad-pod-identity/pull/372)) 832 - Add user agent to ARM calls ([#387](https://github.com/Azure/aad-pod-identity/pull/387)) 833 - Scale and performance improvements ([#408](https://github.com/Azure/aad-pod-identity/pull/408)) 834 - Remove unused GET in CreateOrUpdate ([#411](https://github.com/Azure/aad-pod-identity/pull/411)) 835 - Remove deprecated API Version usages ([#416](https://github.com/Azure/aad-pod-identity/pull/416)) 836 837 ## v1.5.2 838 839 ### Bug Fixes 840 841 - Fix the token backward compat in host based token fetching ([#337](https://github.com/Azure/aad-pod-identity/pull/337)) 842 843 ## v1.5.1 844 845 ### Bug Fixes 846 847 - Append NMI version to the `User-Agent` for adal only once ([#333](https://github.com/Azure/aad-pod-identity/pull/333)) 848 849 ### Other Improvements 850 851 - Change 'updateStrategy' for nmi DaemonSet to `RollingUpdate` ([#334](https://github.com/Azure/aad-pod-identity/pull/334)) 852 853 ## v1.5 854 855 ### Features 856 857 - Support aad-pod-identity in init containers ([#191](https://github.com/Azure/aad-pod-identity/pull/191)) 858 - Cleanup iptable chain and rule on uninstall ([#211](https://github.com/Azure/aad-pod-identity/pull/211)) 859 - Remove dependency on azure.json ([#221](https://github.com/Azure/aad-pod-identity/pull/221)) 860 - Add states for AzureAssignedIdentity and improve performance ([#219](https://github.com/Azure/aad-pod-identity/pull/219)) 861 - System MSI cluster support ([#265](https://github.com/Azure/aad-pod-identity/pull/265)) 862 - Leader election in MIC ([#277](https://github.com/Azure/aad-pod-identity/pull/277)) 863 - Liveness probe for MIC and NMI ([#309](https://github.com/Azure/aad-pod-identity/pull/309)) 864 - Application Exception ([#310](https://github.com/Azure/aad-pod-identity/pull/310)) 865 866 ### Bug Fixes 867 868 - Fix AzureIdentity with service principal ([#197](https://github.com/Azure/aad-pod-identity/pull/197)) 869 - Determine resource manager endpoint based on cloud name ([#226](https://github.com/Azure/aad-pod-identity/pull/226)) 870 - Fix incorrect resource endpoint with sp ([#251](https://github.com/Azure/aad-pod-identity/pull/251)) 871 - Fix vmss identity deletion for ID in use ([#203](https://github.com/Azure/aad-pod-identity/pull/203)) 872 - Fix removal of user assigned identity from nodes with system assigned ([#259](https://github.com/Azure/aad-pod-identity/pull/259)) 873 - Handle case sensitive id check ([#271](https://github.com/Azure/aad-pod-identity/pull/271)) 874 - Fix assigned id deletion when no identity exists ([#320](https://github.com/Azure/aad-pod-identity/pull/320)) 875 876 ### Other Improvements 877 878 - Use go modules ([#179](https://github.com/Azure/aad-pod-identity/pull/179)) 879 - Log binary versions of MIC and NMI in logs ([#216](https://github.com/Azure/aad-pod-identity/pull/216)) 880 - List CRDs via cache and avoid extra work on pod update ([#232](https://github.com/Azure/aad-pod-identity/pull/232)) 881 - Reduce identity assignment times ([#199](https://github.com/Azure/aad-pod-identity/pull/199)) 882 - NMI retries and ticker for periodic sync reconcile ([#272](https://github.com/Azure/aad-pod-identity/pull/272)) 883 - Update error status code based on state ([#292](https://github.com/Azure/aad-pod-identity/pull/292)) 884 - Process identity assignment/removal for nodes in parallel ([#305](https://github.com/Azure/aad-pod-identity/pull/305)) 885 - Update base alpine image to 3.10.1 ([#324](https://github.com/Azure/aad-pod-identity/pull/324))