Skip to content

Release Notes

Release 3.2.0

Upgrade Notes

Please make sure to read the Upgrade Notes to see which changes have consequences for deployments being upgraded from previous Cloud Control releases.

This is particularly important if any of the following apply as they may require action prior to upgrading:

Major New Features

Cloud Control 3.2 introduces several major new features:

Argo CD compatibility

This release introduces Argo CD compatibility for all Cloud Control Helm Charts. The majority of changes made to enable Argo CD compatibility have been implemented on the cc-operator component, which will ensure objects previously generated in a manner incompatible with Argo CD are transitioned to the new mechanisms.

To facilitate both traditional Helm-based and Argo CD managed deployments, Cloud Control 3.2 contains a new Argo CD compatibility mode, which is documented along with the Argo CD requirements on the Argo CD section in the documentation.

Cloud Control Secrets Manager

This new module on the cc-operator component takes over the responsibility of generating secrets which were previously generated by Helm. Primary reason for this switch is that the Secrets Manager module allows for secrets to be generated on the Kubernetes cluster, following the server-side approach that improves both security (since secrets never leave the cluster) & compatibility with tooling such as Argo CD (and in the future, Helm v4).

The Upgrade Notes contain additional information about the introduction of this new module and how it facilitates the transition to server-side Secrets management.

Views

Views are a feature which allows the scope of zones to be narrowed, depending on the originating address of the query, by exposing different variants of zones. A simple use case for this feature is to separate internal (trusted) and external (distrusted) views of a given domain, without having to rely upon a GeoIP-like backend.

Views are configurable in Cloud Control via the views toggle on the Authoritative Server (configuration reference) and more information about the functionality can be found in the Authoritative Server documentation and .

Additions & Improvements

  • API: A new troubleshooting endpoint has been added which can be used to gain insight into the network configuration of each Pod. This feature is available via GET /debug/network and will return detailed information similar to the content exposed by Linux's ip command. Future Cloud Control versions will see additional endpoints added to perform actions such as connectivity tests.
  • Authoritative Server: Instances with Lightning Stream can now be configured to use a different mapsize for the main and shard LMDB databases via the introduction of the mapSizeShard parameter documented here
  • Authoritative Server: Additional options for the webserver can now be configured, such as webserverMaxConcurrentConnections. See the full list of options here
  • dnsdist: Rules managed by Cloud Control will now have a unique name consisting of ruleset name/rule name instead of the previous static value ccmanaged. This will make rules easier to identify inside the dnsdist console and metrics will have these unique values in the id label
  • dnsdist: Server removal is now logged in the same manner as server additions were logged in the dnsdist container. In addition, the agent container is more vocal when it synchronizes servers in dnsdist
  • dnsdist: Additional Services can now be configured for DoH, DoT, DoQ & DoH3 listeners via their respective additionalServices parameters
  • dnsdist: OCSP responses can now be configured for DoH & DoT listeners via their respective ocspEnabled parameters. See the configuration guide for the ocspEnabled parameter on the corresponding listener type for more details on how to configure this
  • dstore-dist: Kafka destinations can now use SASL for authentication using the parameters documented here
  • dstore-dist: Parquet encoding can now be selected for storage destinations using the encoding option documented here
  • dstore-dist: Any destination which is configured to produce JSON output can now have the JSON output fields controlled by the include_fields or exclude_fields parameters
  • Event Forwarder & Report API: Multiple addresses can now be configured for Elasticsearch-compatible backends via the new addresses parameter
  • Generic: All usage of Endpoints objects has been replaced with EndpointSlices as a response to Kubernetes deprecating the Endpoints object
  • Generic: Pod-specific configuration items podPreemptionPolicy, podPriorityClassName, podRuntimeClassName, podSchedulerName & podTerminationGracePeriodSeconds can now be configured globally for all Pods part of a Userplane or Controlplane deployment. Alternatively, they can be configured on individual instance sets for each component
  • Lightning Stream: The default for storageForceSnapshotInterval changed from 4h to 1h to be in line with recommended defaults to reduce number of deltas per full snapshot
  • Maintenance & Administration: The Release Download utility now also supports copying the artifacts directly into a registry
  • Monitoring: Grafana admin password can now also be provided via an existing secret, using the adminSecretName parameter in the Grafana configuration reference
  • Monitoring: Storage configuration for Prometheus has been expanded with several options and can be applied via the storage node documented here
  • Monitoring: Existing Grafana dashboards & Prometheus alert rules have been improved and new dashboards and alert rules have been added for the remaining components
  • Monitoring: Optional parameters service, environment & site can now be configured to have them added as labels on all generated metrics to ensure the corresponding dropdown selectors in the Grafana dashboards are properly populated. These can be configured on the prometheus node on Userplane and Controlplane deployments
  • Monitoring: Metric relabeling can now be configured on deployments where metrics are scraped by a Prometheus Operator. The relabeling can be configured via the relabelings parameter on the prometheus node on Userplane and Controlplane deployments
  • Recursor: Tracing can be enabled via the trace flag, see Recursor configuration for more details
  • Report API: The API key can now also be provided via an existing secret, using the apiKeySecretName parameter in the Report API configuration reference
  • TopN Reporter: Multiple addresses can now be configured for HTTP & Elasticsearch-compatible backends via the new urls parameter
  • ZoneControl: OIDC can now be enabled by configuring an OIDC User Backend and referencing it in the oidcBackend parameter on a ZoneControl instance set. Detailed OIDC configuration instructions for ZoneControl can be found here
  • ZoneControl: Branding features are now configurable, see Branding for more details

Bug Fixes

  • Auth Migrator: Fixed an issue where the migrator sometimes failed to remove a stale schema version
  • dnsdist: Adding multiple serversets to multiple pools no longer leads to unexpected pool assignment for those serversets
  • dnsdist: Packetcache configuration values which are attempted to be set to their zero or empty equivalent values are no longer ignored and are properly applied

Compatibility

PowerDNS component versions:

Component Version
Authoritative Server 5.1.4
dnsdist 2.1.1
dnsdist defender 1.2.0
Dstore components 2.4.2
Filtering components 2.11.2
Lightning Stream Enterprise 1.2.2
Recursor 5.4.5
ZoneControl 1.8.1

Utility component versions:

Component Version
Nats 2.14.2
Postgres 17.10
Redis 7.4.9

Monitoring component versions:

Component Version
Grafana 12.4.8
Grafana Operator 5.24.0