<commit_before>## Release notes for kOps 1.22 series

# Significant changes

## Instance metadata service version 2

 On AWS, kOps will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes 1.22. In addition, the following max hop limits will be set by default:

 * worker and API server Nodes, and bastions, will have a limit of 1 hop.
 * control plane nodes will have a limit of 3 hops to accommodate for controller Pods without host networking that need to assume roles.

This will increase security by default, but may break some types of workloads. In order to revert to old behavior, add the following to the InstanceGroup:

```
spec:
  instanceMetadata:
    httpTokens: optional
```

## External ServiceAccountPermissions

Many of kOps addons can now make direct use of external permissions.
This can be enabled by adding the following to the Cluster spec:

```
spec:
  iam:
    useServiceAccountExternalPermissions: true
```

Currently this is only available using the AWS cloud provider.

## Managed nvidia instances

kOps can now provision instances with nvidia GPUs and configure it for container workloads without the need of hooks and operators. See [GPU support](https://kops.sigs.k8s.io/gpu/)

## Other significant changes

* New clusters on AWS will no longer provision an SSH public key by default. To provision
  an SSH public key on a new cluster, use the `--ssh-public-key` flag to `kops create cluster`.

* The kOps Terraform support now renders managed files through the Terraform configuration instead 
  of writing them to S3 directly. This defers changes to these files until the time of `terraform apply`.
  This feature may be temporarily disabled by turning off the `TerraformManagedFiles` feature flag
  using `export KOPS_FEATURE_FLAGS="-TerraformManagedFiles"`.

* kOps now implements graceful rotation of its Certificate Authorities and the service
  account signing key. See the documentation on [How to rotate all secrets / credentials](../operations/rotate-secrets.md)

* New clusters running Kubernetes 1.22 will have AWS EBS CSI driver enabled by default.

* kOps now supports Debian 11 (Bullseye).

* kOps can now use [external-dns](https://github.com/kubernetes-sigs/external-dns/) as a drop-in replacement for dns-controller.

# Breaking changes

## Control plane pods no longer mount /srv/kubernetes

 For security reasons, `/srv/kubernetes` is no longer mounted in the kube-apiserver and kube-controller-manager Pods. This also means the files in the default file assets path will be unavailable. If you have file assets or other files needed by kube-apiserver, you must put these into `/srv/kubernetes/kube-apiserver/` or `/srv/kubernetes/kube-controller-manager`, respectively.

For file assets, it means adding an explicit path as shown below:

```yaml
  fileAssets:
  - name: audit-policy-config<commit_msg>NodeLocalDNS forwardToKubeDNS default behaviour changes from true to false.<commit_after>## Release notes for kOps 1.22 series

# Significant changes

## Instance metadata service version 2

 On AWS, kOps will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes 1.22. In addition, the following max hop limits will be set by default:

 * worker and API server Nodes, and bastions, will have a limit of 1 hop.
 * control plane nodes will have a limit of 3 hops to accommodate for controller Pods without host networking that need to assume roles.

This will increase security by default, but may break some types of workloads. In order to revert to old behavior, add the following to the InstanceGroup:

```
spec:
  instanceMetadata:
    httpTokens: optional
```

## External ServiceAccountPermissions

Many of kOps addons can now make direct use of external permissions.
This can be enabled by adding the following to the Cluster spec:

```
spec:
  iam:
    useServiceAccountExternalPermissions: true
```

Currently this is only available using the AWS cloud provider.

## Managed nvidia instances

kOps can now provision instances with nvidia GPUs and configure it for container workloads without the need of hooks and operators. See [GPU support](https://kops.sigs.k8s.io/gpu/)

## Breacking change in NodeLocalDNS

Since 1.22.0 Cluster `spec.kubeDNS.nodeLocalDNS.forwardToKubeDNS` default behaviour changes from `true` to `false`.

## Other significant changes

* New clusters on AWS will no longer provision an SSH public key by default. To provision
  an SSH public key on a new cluster, use the `--ssh-public-key` flag to `kops create cluster`.

* The kOps Terraform support now renders managed files through the Terraform configuration instead 
  of writing them to S3 directly. This defers changes to these files until the time of `terraform apply`.
  This feature may be temporarily disabled by turning off the `TerraformManagedFiles` feature flag
  using `export KOPS_FEATURE_FLAGS="-TerraformManagedFiles"`.

* kOps now implements graceful rotation of its Certificate Authorities and the service
  account signing key. See the documentation on [How to rotate all secrets / credentials](../operations/rotate-secrets.md)

* New clusters running Kubernetes 1.22 will have AWS EBS CSI driver enabled by default.

* kOps now supports Debian 11 (Bullseye).

* kOps can now use [external-dns](https://github.com/kubernetes-sigs/external-dns/) as a drop-in replacement for dns-controller.

# Breaking changes

## Control plane pods no longer mount /srv/kubernetes

 For security reasons, `/srv/kubernetes` is no longer mounted in the kube-apiserver and kube-controller-manager Pods. This also means the files in the default file assets path will be unavailable. If you have file assets or other files needed by kube-apiserver, you must put these into `/srv/kubernetes/kube-apiserver/` or `/srv/kubernetes/kube-controller-manager`, respectively.

For file assets, it means adding an explicit path as shown below:

```yaml
  fileAssets:
  - name: audit-policy-config
{'fraction_non_alphanumeric': 0.06340755082284608, 'fraction_numerical': 0.006453694740238786, 'mean_word_length': 4.456866197183099, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6482344', 'n_tokens_mistral': 1691, 'n_tokens_neox': 1593, 'n_words': 802}