# InfluxDB Clustered Release Notes # 20241217-1494922 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20241217-1494922 ``` ## Bug Fixes This fixes a bug present in release 20241024-1354148, in which `core` pods used an invalid DSN (omitting the `?` in the query string) when attempting to connect to Postgres. `core` pods will now properly populate the DSN before connecting. ## Deployment - Entitlements associated with a `License` Custom Resource (CR), including the license expiration date, are now exposed in the `entitlements` property of that CR's `spec`. - Reduced default log level from `debug` to `info` in auth sidecar. ## Database Engine - influxql http interface: eliminated floating point rounding of query literals which caused inaccurate query results - Datafusion upgrades - Upgrade Rust to 1.83.0 ## Configuration - N/A # 20241024-1354148 ## Known Bugs ### `core` service DSN parsing errors This release has a known bug in the `core` pods with respect to handling of options in Postgres DSNs. This bug can be seen in the `core-MMMMMMMMMM-NNNNN` logs that look like the following: ``` 2024-11-04T01:00:00.000Z | 3: error returned from database: database "influxdb&options=-c%20search_path=" does not exist 2024-11-04T01:00:19.000Z | 4: database "influxdb&options=-c%20search_path=" does not exist ``` The issue here is that entire `influxdb&options=-c%20search_path=` string is being interpreted as the database name, owing to incorrect parsing of the `POSTGRES_DSN` environment variable. The workaround to deal with this before a fix makes its way into the next release is to use an image override in your AppInstance that looks like: ``` apiVersion: kubecfg.dev/v1alpha1 kind: AppInstance metadata: name: influxdb namespace: influxdb spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20241024-1354148 apiVersion: influxdata.com/v1alpha1 spec: images: overrides: - name: 'influxdb2-artifacts/granite/granite' newFQIN: 'us-docker.pkg.dev/influxdb2-artifacts/granite/granite:7acf9ca6e1ad15db80b22cd0bc071acdb561eb51' # ...additional configuration left out for brevity ``` Your AppInstance may have additional configuration, but the important part here is the `spec.package.spec.images.overrides` section where we override the built-in image used by the `core` pods with one that has a bugfix for the DSN parsing error. ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20241022-1346953 ``` ## Highlights ### This release is a checkpoint release Refer to the upgrade notes. ### AppInstance Image Override Bug Fix In `20240925-1257864`, the AppInstance image override was broken with the introduction of strict always-on license enforcement. This release fixes that bug. This bug is expected to have an outsize impact on customers running Clustered in air-gapped environments where the deployment model involves override the default image repository to point to images copied to an air-gapped registry. To address this situation, the current release is meant as an alternative to `20240925-1257864` for customers who depend on this image override feature. ### Upgrade Bug Fix In `20240925-1257864`, a schema migration bug was introduced that caused an init container in the `account` Pods to hang indefinitely. This would only happen during an upgrade -- new Clustered installs on this version should be fine. For customers who experience this bug when attempting to upgrade to `20240925-1257864`, it should be fine to use `20241024-1354148` instead. ## Upgrade notes ## Changes ### Deployment - Bug fix: IOx Garbage Collector and IOx Catalog Service can now have their default CPU/Memory resource requests and limits overridden. - Ingress: The Gateway service has been removed and superseded by the newly-introduced Core service. - Bug fix: Fix logic dealing with application of default resource limits for IOx components. - Support [`ResourceQuota`s](https://kubernetes.io/docs/concepts/policy/resource-quotas/) with the `enableDefaultResourceLimits` feature flag. This causes resource limits to be applied even to containers that don't normally have limits applied. ### Database Engine ### Configuration # 20240925-1257864 **NOTE** This release has a number of bugs in it which make it unsuitable for customer use. If you are currently running this verison, please upgrade to `20241024-1354148`. ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240925-1257864 ``` ## Highlights ### Default to partial write semantics Clustered now defaults to partial write semantics in the ingesters. If this causes unexpected problems, the behavior may be disabled by setting `INFLUXDB_IOX_PARTIAL_WRITES_ENABLED=false`. See [the Clustered docs on how to set environment variables](https://docs.influxdata.com/influxdb/clustered/admin/env-vars/). ### Deploy and use the Catalog Service by default The catalog Service is a new IOx component that centralizes access to the InfluxDB catalog among ingesters, queriers, compactors, and garbage collectors. This is expected to improve catalog query performance overall with an expected drop in p99 latencies. ## Upgrade notes ### License always required A valid license token is now required to start up. To avoid possible complications, customers who do not already have a license token should reach out to their sales representative to get a license token prior to upgrading to this release. ### Feature flag removal: `prometheusOperator` **If you have not used this feature flag, there is nothing to do.** This flag has been hidden since its deprecation. From this release the `prometheusOperator` feature flag has been removed. This means that upgrading to this release with the flag enabled may cause errors. Going forward the installation of the Prometheus operator is not a Clustered concern and must be handled externally. ## Changes ### Deployment - Introduces the `nodeAffinity` and CPU/Memory requests setting for "granite" components. Previously, these settings were only available for core IOx components. - Prior to this release many of the IOx dashboards deployed with the `grafana` feature flag were showing "no data" -- this has been fixed now and all dashboards should display actual data. ### Database Engine - Adjust compactor concurrency scaling heuristic to improve performance as memory & CPU scale. - Adjust default `INFLUXDB_IOX_COMPACTION_PARTITION_MINUTE_THRESHOLD` from `20m` to `100m` to help compactor more quickly rediscover cool partitions. ### Configuration - Introduces the `podAntiAffinity` setting for components within InfluxDB Clustered. Previously, the scheduling of pods was influenced by the Kubernetes scheduler's default behavior. For further details, please consult the [documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#types-of-inter-pod-affinity-and-anti-affinity). # 20240819-1176644 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240819-1176644 ``` ## Highlights ### This release is a checkpoint release Refer to the upgrade notes. ### `admin` section is no longer required Previously, an identity provider setup has been required through the `admin` section of the `AppInstance`, for example: ```yaml apiVersion: kubecfg.dev/v1alpha1 kind: AppInstance metadata: name: influxdb namespace: influxdb spec: package: image: apiVersion: influxdata.com/v1alpha1 spec: # ...snip admin: users: - ... dsn: valueFrom: ... identityProvider: jwksEndpoint: ``` This section is no longer required and will no longer result in a schema validation error when omitted. When the `admin` section is omitted, the `admin-token` `Secret` can be used instead to get started quickly. **NOTE: We still highly recommend OAuth for production; however, this will enable quickstart behaviour.** ## Upgrade notes This release includes some prepatory work for changes being made to database schemas and tooling for internal services. It does not have an impact to customer workloads. ## Changes ### Deployment - Various Grafana dashboard updates - A best-effort, prepopulated `influxctl` config file is provided as a `ConfigMap` for your convenience - Enforce garbage collector replicas to 1, see the [documentation](https://docs.influxdata.com/influxdb/clustered/reference/internals/storage-engine/#garbage-collector-scaling-strategies) for further details. ### Database Engine - Improved efficiency of system table queries - Fixes for InfluxQL handling of 0 divisor - Router performance improvements for retrieval of statistics - Support for InfluxQL queries over FlightSQL - Various dependency updates ### Configuration - Added schema definitions for `admin.users` # 20240717-1117630 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240717-1117630 ``` ## Highlights ### Experimental License Enforcement This release introduces a new feature flag, `useLicensedBinaries`, that causes IOx components to be executed with a container image implementing a new license enforcement mechanism. License enforcement mechanisms include: - A proper `License` Custom Resource manifest must be installed in the namespace to which Clustered is deployed. Only one `License` named `iox-license` may be deployed per namespace. - Without a valid `License`, IOx pods will crashloop with error logs indicating that no valid license was able to be loaded. - A valid `License` is one that is properly signed by InfluxData and has not exceeded its hard expiration date. - One month before the `License` expires, all components will begin logging pending expiry warning messages. These will be visible with `kubectl log -n `. - If a valid `License` expires while the system is running, it enters a grace period. - During the `License`'s grace period, the following happens: - Throughout the grace period, all components will gradually increase the frequency of license expiry warnings. - One week into the grace period, the InfluxDB 3.0 Querier will begin returning `FailedPrecondition` gRPC responses for the first 5 minutes of every hour. - One month into the grace period, the InfluxDB 3.0 Querier will begin returning `FailedPrecondition` gRPC responses 100% of the time until the grace period ends. - At the end of the `License` grace period, all IOx components will shutdown as this is the "hard expiration" date when the binaries will no longer consider the `License` valid. This feature is being released on an experimental opt-in basis while we work with a small group of customers to test it out in their environments before making licenses required to run InfluxDB 3.0 at all. Before enabling the feature, please be sure you have a `License` manifest provided to you by your InfluxData sales representative. ### Default querier count increased Prior to this release, the number of queriers which were spawned from the default configuration was 1. This has now been increased to 3. If you have previously overwritten the default in the `AppInstance`, it is no longer required: ```yaml apiVersion: kubecfg.dev/v1alpha1 kind: AppInstance metadata: name: influxdb namespace: influxdb spec: ... resources: querier: requests: replicas: 3 # No longer required! ``` If you wish to keep the number of queriers to 1, you must override the `replicas` as shown above. Refer to the schema for further details. This new configuration serves as a scalable default installation for the Clustered product. ## Changes ### Deployment - Ingesters now have a `terminationGracePeriodSeconds` value of `600` to provide enough time to persist all buffered data. ### Database Engine - Changed default INFLUXDB*IOX_COMPACTION*\*\_CONCURRENCY to be set based on available memory rather than available cores. - Improved metadata cacheing and queries - Improved cache read efficiency - Improved cache cleaning - Fixed some I/O delays on query planning - Better handling for resizing worker pools - Faster recovery from ingester crashes - Faster graceful shutdown of terminating ingester pods - Fixed a rare issue where ingesters could become unresponsive after hitting memory limits - Added per-table column limit, to prevent unintended schema expansion - Reduced intermediate compactor writes to object storage - Increase compactor throughput - Numerous telemetry improvements - Reduced write thrashing in the catalog - Fixed errors with queries that use gap filling - Fixed errors with multiple rounds of bulk ingestion - Tuned garbage collector - Fixed some intermittent failures in bulk ingest - Reduced some network gossip between IOx pods - Fixed some inconsistent results on leading edge queries - Fixed WAL storage leak during ingester crash recovery - Improved garbage collection of data beyond the retention limit # 20240605-1035562 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240605-1035562 ``` ## Highlights Multiple improvements to compaction and pruning, and performance of concurrent queries. ### This release is a checkpoint release See Upgrade notes ### Feature flag: `noPrometheus` The introduction of the `noPrometheus` feature flag will remove the `StatefulSet` and other resources relating to a bare-bones installation of Prometheus, which could be used for basic monitoring of InfluxDB Clustered. This feature flag is useful in cases where you already have an installation of Prometheus and you wish to use it to monitor InfluxDB. Refer to the `AppInstance` schema for further details regarding feature flags. ## Upgrade notes Air-gapped installations will need to prefetch the new granite image. `us-docker.pkg.dev/influxdb2-artifacts/granite/granite@sha256:1683f97386f8af9ce60662ae4ff423770fee166b11378583e211ea30dc849633` For further details, visit the [documentation](https://docs.influxdata.com/influxdb/clustered/install/configure-cluster/?t=Private+registry+%28air-gapped%29#public-registry-non-air-gapped). ## Changes ### Deployment - Updated Granite components to reference a single image, reducing the overall image size. - Added grafana licensing dashboard - `noPrometheus` feature flag ### Database Engine - Ingesters now provide a soft, best-effort memory limit. - Provided by `INFLUXDB_IOX_RAM_SOFT_LIMIT_BYTES`, which applies a ceiling from a percentage of the container memory to avoid `OOMKilled` scenarios. - All buffered data is attempted to be persisted upon reaching this limit and a resource exhaustion error is returned for write requests until memory usage is below 50%. - Catalog cache write batching - Multiple compactor improvements - Improved performance of some metadata queries - Improved concurrent query performance - Adjusted querier partitions assigned to large queries, to reduce latency of sub-second queries and prevent resource bottlenecks cause by long running queries - This can be tuned with the `INFLUXDB_IOX_NUM_QUERY_PARTITIONS` environment variable - Improved reporting for InfluxQL syntax errors # 20240430-976585 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240430-976585 ``` ## Highlights - Configuration settings for an optional Prometheus `ServiceMonitor` have been added under `observability.serviceMonitor` - **Note:** Using this setting will delete and recreate the existing serviceMonitor resource that was provided by the feature flag. - The feature flag is now deprecated, and will be removed in a future release. ## Upgrade notes ## Changes ### Deployment - Removal of Nginx server snippet annotations (`nginx.ingress.kubernetes.io/server-snippet`). - Additional `observability` key for an `AppInstance`, refer to the [`example-customer.yml`](./example-customer.yml) file to see this in action. ### Database Engine - Improved `NULL` handling for InfluxQL. # 20240418-955990 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240418-955990 ``` ## Highlights ### Minimum `influxctl` version If a user observes an unimplemented gRPC error when running `influxctl database` commands, then the user should upgrade to influxctl version v2.8.0 or later and ensure they are running clustered `20240326-922145` or newer. If upgrading clustered is not an option, then user can continue to use a version of `influxctl` prior to v2.8.0. ## Changes ### Deployment - Routers now calculate the value of write replication based on the number of running ingesters. - This can be tuned through the `INFLUXDB_IOX_RPC_WRITE_REPLICAS` environment variable; however, high values can have an impact on the performance of the system. ### Database Engine - Router cache entries for namespace and retention periods are updated immediately via gossip. - Pod restarts are no longer required to immediately see updates. - Fixes to InfluxQL gap-filling mechanism, `FILL`. # 20240326-922145 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240325-920726 ``` ## Highlights ### Lower defaults for garbage collection Prior to this release, the garbage collector was set at 100 days before objects, that were no longer returned by queries, were deleted from object store. This has been reduced to 30 days. With a high value this leads to a situation whereby there are many dangling objects and therefore many unnecessary references in the catalog - which increases operational burden and cost. ### Added support for nodeAffinity at the per-component level Introduces the `nodeAffinity` setting for individual components within InfluxDB Clustered. Previously, the scheduling of pods was influenced by the Kubernetes scheduler's default behavior. For further details, please consult the [documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity). ## Changes ### Deployment - Support for environment variable modifications to specific components. - Update optional grafana component to version 10.3.4. - This upgrade from 9.x brings with it support for the SQL query type in the InfluxDB data source. ### Database Engine - Various additional metrics & performance improvements. - Improve compactor concurrency heuristics. - Fix gRPC reflection to only include services served by a particular listening port. - NOTE: `arrow.flight.protocol.FlightService` is known to be missing in the `iox-shared-querier`'s reflection service even though `iox-shared-querier` does run that grpc service. # 20240227-883344 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240227-883344 ``` ## Highlights ### something ### something else ## Upgrade notes ### something ## Changes ### Deployment - Gossip communication between the `global-router`, `iox-shared-compactor`, and `iox-shared-ingester` now works as expected. - Provide sane defaults to the `global-router` for maximum number of concurrent requests. - Lower the number of ndots for `dnsConfig` for IOx components. ### Database Engine - `SHOW TAG VALUES` no longer causes a crash in the querier when the database has a large number of measurements. - Number of partitions scanned over in the querier is now limited for safety. # 20240214-863513 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240214-863513 ``` ## Highlights ### This release is a checkpoint release Please refer to the "Upgrade Notes" section ### Grafana dashboards by default Previously, the `grafana` feature flag had to be enabled in order to have these dashboards created. This now occurs by default and the feature flag is reserved entirely for the creation of a Grafana `Deployment` and remains experimental. The contents of these dashboards are placed within various `ConfigMap` resources, under common format `grafana-dashboard-`. They can either be imported or mounted into your existing Grafana instance in whichever way is more convenient. ## Upgrade notes ### Consolidated Authentication An authentication component, previously known as `authz`, has been consolidated into the `token-management` service. There is now a temporary `Job` in place, `delete-authz-schema`, that will automatically remove the `authz` schema from the configured PostgreSQL database. ## Changes ### Documentation - Fixed Google example in `example-customer.yml` file. ### Deployment - Fixed a logical error in the configuration whereby using Google Workload Identity caused the `INFLUXDB_IOX_OBJECT_STORE` variable to be set to `memory` instead of `google`. - Compactor configuration concurrency is now derived from CPU limit of the pod. - Compactor now has a lower L1 compaction threshold. ### Database Engine - Correctly validate string length for column sizes. - FlightSQL support for prepared statements. - Improve metrics exposed by the compactor. - Further optimisations to `LIMIT` queries. - Add `SPREAD`, `MODE`, and `ELAPSED` support for InfluxQL. - Add `EXPLAIN` to all supported statements in InfluxQL. - Tracing correctly exposes HTTP path metrics. - Dependency updates. # 20240111-824437 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20240111-824437 ``` ## Highlights ### Ingress Improvements - Ingress no longer requires a host name to be specified. - When a TLS secret is not specified, the TLS annotations are not generated. #### Istio Support This release includes first class support for Istio via the `Gateway` and `VirtualService` resources. This can be enabled through the `ingress` key of the `AppInstance`, such as: ```yaml package: spec: ingress: template: kind: 'Gateway' apiVersion: 'networking.istio.io/v1beta1' # At present the 'selector' field is only used for Istio, this maps # directly to the Gateway selector to decide which Istio ingress controller # pods should serve the configured Gateway. selector: istio: 'ingressgateway' ``` Note that the use of `Gateway` implies the need for `VirtualService` resources, these are automatically created for you. ## Upgrade notes - As part of a `partition_id` migration that will run, if you have more than 10 million rows in the `parquet_file` table, reach out to your Sales representative before proceeding. You can confirm this with the following query: `select count(*) from iox_catalog.parquet_file`. ## Changes ### Database Engine - `partition_id` is now used to consistently address a partition in the catalog, this requires a migration which may take some time to complete. - Bug fixes and dependency updates. # 20231213-791734 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20231213-791734 ``` ## Highlights ### Labels/Annotations - You can now add custom annotations and labels in pods by specifying them under `spec.package.spec.components.*.metadata` - Common settings for all components can be specified under `spec.package.spec.components.common`. This is useful when you need to configure common node selectors, taint tolerations and annotations in order to adapt the workload to requirements of your specific execution environment. - An example of this is shown within the [`example-customer.yml`](./example-customer.yml) file. ### Contour Ingress Support - Services are now properly annotated to support the Contour Ingress controller. ## Changes ### Database Engine - Empty string values for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are ignored. - Dependency updates. - Query performance improvements. - Ingester active persist tasks are tracked as a metric. - WAL rotation logs moved from debug to info log level. - Fixed an issue where the compactor could get stuck until reboot. - Fixed an issue where the compactor might panic. - Added L2 -> L2 compactions when there are many small L2 files. # 20231117-750011 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20231117-750011 ``` ## Highlights - **This release fixes a regression in the database engine that was introduced in `20231115-746129`.** ## Changes ### Deployment - Add support for tuning per-component log filters. - Add support for `tolerations` at the per-component level. # 20231115-746129 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20231115-746129 ``` ## Highlights ### Ingress Templating An extension has been made to the `ingress` object that enables custom annotations to be placed upon `Ingress` resources. This is useful when configuration ingress alongside third-party software, such as `cert-manager`. An example of this is shown within the [`example-customer.yml`](./example-customer.yml) file. #### OpenShift `Route` Further to the ingress templating feature we also include OpenShift `Route` support. This is enabled by specifying the `apiVersion` and `kind` of the `ingress` configuration to align with `Route`'s. Doing so changes the typical `Ingress` objects to their `Route` equivalent. ```yaml spec: package: spec: ingress: template: apiVersion: 'route.openshift.io/v1' kind: 'Route' ``` A full example is shown within the [`example-customer.yml`](./example-customer.yml) file. ### Support for Google Cloud Storage (GCS) We now expose a `google` object within the `objectStore` configuration, this enables support for using Google Cloud's GCS as a backing object store for IOx components. This supports both [GKE workload identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) and [IAM Service Account](https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform#step_3_create_service_account_credentials) authentication methods. An example can be seen in the [`example-customer.yml`](./example-customer.yml) file. ### Support for Bypassing Identity Provider Configuration for Database/Token Management We now generate a valid access token for managing Databases and Tokens and store it as a secret within the namespace that InfluxDB is deployed. This token can be used in lieu of configuring an identity provider with `influxctl` for interacting with the cluster. **This access token is intended only for testing and is not recommended for use in production**. This feature requires `influxctl` version 2.2.0 or later. To use the access token, you first need to copy it to a file, which you can do by running the following command. ```sh kubectl get secrets/admin-token --template={{.data.token}} -n | base64 -d > token.json ``` After that, you need to tell `influxctl` where to find the access token by adding the following lines to your profile.toml file. ```toml [profile.auth.token] token_file = "/path/to/token.json" ``` This is a long-lived access token. Currently, the only way to revoke the token is to perform the following actions in this order: 1. Delete the `rsa-keys` secret from your Clustered context and namespace 2. Rerun the `key-gen` job 3. Restart the `authz` service If you want to create a new admin token after revoking the existing one, you need to rerun the `create-admin-token` job. ## Changes ### Deployment - Increase HTTP write request limit to 50MB (previously 10MB) - Added support for [Telegraf Operator](https://github.com/influxdata/telegraf-operator). We have added the `telegraf.influxdata.com/port` annotation to all the pods. No configuration required. We don't yet provide a way to specify the `telegraf.influxdata.com/class` annotation, which means the pods will be using the default telegraf operator class (called `default`). - Implement `ingress.template` for `Ingress` and openshift `Route` - Add `nodeSelector` support (see [`example-customer.yml`](./example-customer.yml)) - Add Google Cloud support - Fix JSONSchema for value/valueFrom configuration fields (e.g. secrets) - Fix: remove AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars when EKS IRSA is enabled ### Database Engine - ingester performance improvements - query pruning improvements: less data is fetched in many cases - new compactor metrics (partition compaction stats) - compactor tuning: autoscale L1 compaction threshold based on load - flightSQL query gRPC keep-alive fixes - log some querier configs during startup - bulk ingest gRPC API improvements - add `partition_template` column to `system.tables` table - add `last_new_file_created_at`, ` last_deleted_file_at`, `num_files` , `total_size_mb` columns to `system.partitions` table - enable gossip cache distribution for faster cache coherence between nodes # 20231024-711448 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20231024-711448 ``` ## Highlights ### Additional `AppInstance` parameters This includes an addition to the `AppInstance` `package` specification with a new key, namely `hostingEnvironment`. Going forward, this object will be updated with various environment-specific functionality, aimed at where you _host_ Clustered, such as `aws` or `openshift`. #### EKS IRSA From the addition of the `hostingEnvironment` configuration to the `AppInstance`, this now supports passing an `eksRoleArn`. This role ARN will be placed onto the IOx `ServiceAccount`, please ensure that the role you provide has AWS S3 permissions. Documentation for this and an example can be seen in the [`example-customer.yml`](./example-customer.yml) file. #### OpenShift We now also support the `openshift` key under the `hostingEnvironment` object. This specifies OpenShift tailored configuration for your environment. At the moment this simplifies the install process by removing `securityContext` from all pods, as it will be specified by your cluster's configuration instead. ### Ingress Configuration A backwards compatible change has been made to the ingress configuration. This updates the ingress to use more fine-grained rules to avoid overriding other ingress rules. You may want to review the details if you have customized the kubernetes manifests regarding the ingress resources. #### v1 write endpoint An endpoint has been exposed for the v1 write path, under `/write`. ## Changes ### Database Engine - fix: honor `SSL_CERT_FILE` for postgres connections - fix: wait for gRPC when shutting down querier ### Deployment - chore: add defined `resources` to `authzpuller` # 20231004-666907 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20231004-666907 ``` ## Highlights ### This release is a checkpoint release See Upgrade Notes section ### Objectstore custom certificates Support for custom certificates has been implemented since version [20230912-619813](#20230912-619813). Unfortunately due to a bug, our Object Store client didn't use the custom certificates. This release fixes that and you can use the existing configuration for custom certificates to also specify the certificate / CA used by your object store. ### Resource limits Until now the configuration spec only exposed the kubernetes resource _requests_ and not the limits. Setting the limits is important for proper cluster capacity configuration. This release fixes this deficiency. The documentation is in the JSON schema and in the [example-customer.yml](./example-customer.yml) file. ### Object Store Configuration A backwards compatible change has been made to object store configuration. This now enables the use of Azure blob storage. The documentation is in the JSON schema and in the [example-customer.yml](./example-customer.yml) file. ### Installation documentation moved to docs site The [Install InfluxDB Clustered](https://test2.docs.influxdata.com/influxdb/clustered/install/) instructions (formerly known as `GETTING_STARTED`) are now available on the main InfluxDB [Documentation Website](https://test2.docs.influxdata.com/influxdb/clustered/install/). The `example-customer.yml` (aka `myinfluxdb.yml`) example configuration file still lives in the release bundle alongside the RELEASE_NOTES (this file). ## Upgrade notes You **must** update to this release before updating to any subsequent release. This ensure as schema migration is sequenced properly otherwise a k8s cluster running pods with different versions will cause in impact in write availability. ## Changes ### Deployment - Add support for setting resource limits. ### Documentation Prior to this release, the example query for the sample data (`air-sensor-data.lp`) was incorrect. ### Database Engine - Use system certificate store # 20230922-650371 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20230922-650371 ``` ## Highlights ### Configuration simplification This release simplifies the configuration of the admin interface. The `internalSigningKey` configuration section is now optional, and will be autogenerated ## Upgrade notes We simplified the ingress rules, which may require some changes **if** you have custom Ingress resources pointing to the underlying services. Otherwise no changes are necessary on your side. ### Details - Ingress that previously pointed to the `account` service should now point to the `gateway` service (ex. `/account.v1.AccountService`) - Ingress that previously pointed to the `authz` service can be removed (ex. `/authz.public.v1.AuthzPublicService`) - Ingress that previously pointed to the `database-management` service should now point to the `gateway` service (ex. `/database_management.v1.DatabaseService`) - Ingress that previously pointed to the `token-management` service should now point to the `gateway` service (ex. `/token_management.public.v1.TokenManagementPublicService`) ## Changes ### Deployment - chore: Bumped reference version of kubit to 0.0.11 - fix: Updates the default number of routers to match ingesters (3) - fix: Ensure custom certificates are available to all components ### Database Engine - feat: Catalog cache convergence improvements - fix: Retries in case of OOMs # 20230915-630658 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20230915-630658 ``` ## Highlights ### Persistent volume fixes This release fixes major issue involving volume permissions in some volume provisioners (e.g. EBS). No action required for upgrades. ## Changes - Removed `Generate internal signing key` section from Getting Started doc - Updated Volume permissions to fix issues in some environments. # 20230914-628600 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20230914-628600 ``` ## Highlights ### Updated Azure AD documentation The `Appendix` / `Configuring Identity Provider` / `Azure` section of the documentation has been updated Key change: ```diff - https://login.microsoftonline.com/{AZURE_TENANT_ID}/.well-known/openid-configuration + https://login.microsoftonline.com/{AZURE_TENANT_ID}/v2.0/.well-known/openid-configuration ``` ## Changes ### Deployment - documentation fixes - generate JWT signing keys automatically ### Database Engine - minor fixes # 20230912-619813 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20230912-619813 ``` ## Highlights ### Custom CA certificates (optional) InfluxDB processes inbound API requests (_ingress_) and issues outbound API request to external services (_egress_). The _ingress_ transport security parameters (TLS) are configured in the `ingress` section. InfluxDB can work with any certificate signed with any Certificate Authority (accepting that CA is then a matter of InfluxDB client's configuration, outside of the scope of this document). OTOH, _egress_ connections to TLS secured endpoints (`https` or TLS secured postgres) are verified by a set of built-in certificate authorities (we use debian's [ca-certificates](https://packages.debian.org/stable/ca-certificates)). You may need to override the list of accepted CAs if your InfluxDB instance is configured to access dependencies that use certificates issued by your private CA. In some cases your network setup may even involve an auditing MitM proxy that issues their own certificates. This release includes an optional feature that allows you to specify your own CA list. The custom CA replaces the standard set of CA certificates. The custom certificate file can contain one or more PEM encoded CA certificates. ```bash kubectl -n influxdb create configmap custom-ca --from-file=ca.pem ``` ```yaml .... kind: AppInstance spec: ... spec: ... egress: customCertificates: valueFrom: configMapKeyRef: key: ca.pem name: custom-ca ... ``` More details in the bundled `example-customer.yaml` and JSONSchema files. ## Changes ### Deployment - Allow user to specify custom certificate authorities for egress calls. ### Database Engine - fix: Health probe livelock fix - fix: Handle oversized files in compactor - feat: Minor optimizations # 20230911-604209 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20230911-604209 ``` ## Highlights This release contains a breaking change to the monitoring subsystem that requires manual intervention in order to unblock. More details in the Upgrade notes section below. ## Upgrade notes ### Prometheus StatefulSet This release contains a change to the prometheus StatefulSet resources that cannot be reconciled automatically by the operator. The user must delete the stateful set manually. The operator will then automatically re-create the resources. ```bash kubectl -n influxdb delete sts prometheus ``` ## Changes ### Documentation - Active directory documentation updates ### Deployment - fix: Set `serviceName` in prometheus deployment. - fix: Ensure granite ingress has hostname declared ### Database Engine - chore: Updates to dependencies (parquet, datafusion, ...) - fix: adjust compactor catalog query rate limiter for small clusters # 20230908-600131 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20230908-600131 ``` ## Highlights ### Default storage class The `storageClassName` parameters are now no longer required. InfluxDB will use the cluster's default storage class unless you override it in your config. ## Changes ### Deployment - remove unnecessary grafana dashboards - make storage class optional ### Database Engine None # 20230907-597343 ## Quickstart ```yaml spec: package: image: us-docker.pkg.dev/influxdb2-artifacts/clustered/influxdb:20230907-597343 ``` ## Upgrade Notes This release requires a new configuration block: ```yaml monitoringStorage: storage: 1Gi storageClassName: ``` ## Changes ### Deployment - feat: Make gRPC ingress work with traefik ingress controller - fix: add `hosts` field to ingress specification, update schema - fix: Several fixes in ingress layer for the admin control plane (aka granite) ### Database Engine - feat: FILL(linear) for selectors (influxql) - fix: prevent sort order mismatches from creating overlapping chains - feat: minor performance optimizations - chore: change loglevel to info on No compaction job found