- Tarook - lists.alasca.cloud

Release v15.0.0 has been published

by Steve Starke

Hi! We're happy to announce that Tarook v15.0.0 [1][2] has been published! Some notable changes, amongst others: * Calico is now deployed in eBPF dataplane mode. o Clusters with IPv6 enabled previously were configured to use the ipvs mode of kube-proxy which got deprecated with Kubernetes v1.35 [3]. Due to that deprecation, changes to the CNI setup were necessary. Calico's eBPF dataplane mode has been chosen due to its performance benefits. A migration path for existing clusters has been implemented. o kube-proxy is disabled by default now as it interferes with Calico running in eBPF dataplane mode. * When upgrading an existing cluster to this release, changes to the cluster repository's flake.nix are necessary. * The necessary changes for Ubuntu 26.04 have been implemented. * Routes to the Kubernetes Service IP range are propagated by Calico to BGP peers by default now. * Components of the monitoring stack can now be freely configured. * Support for Envoy Gateway as Gateway API integration has been added. o A migration for clusters already using the Calico Ingress Gateway has been implemented. * The "sntrup761x25519-sha512" post-quantum key exchange algorithm has been enabled for SSH. Some notable changes specifically for clusters on OpenStack or Proxmox: * The bird setup has been made compatible with bird3. Debian 13 can now be used for gateway nodes. * OpenStack Anti-Affinity-Groups can now be configured for any node. * Support for IPSec has been dropped. Check out the release notes [4] to get information about all the other changes and for more details! Best regards --- [1] https://gitlab.com/alasca.cloud/tarook/tarook/-/releases/v15.0.0 [2] https://meta.docs.tarook.cloud/supported_releases [2] https://kubernetes.io/blog/2025/12/17/kubernetes-v1-35-release/#deprecation… [3] https://docs.tarook.cloud/release/v15.0/releasenotes -- Steve Starke Team Lead Kubernetes Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 00 steve.starke(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Your Cloud Service and Cloud Technology Provider from Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

Oct. 20, 2026

Re: Topic for shore leave - future of ch-k8s-lbaas

by Friedrich Zahn

Hi everyone, On 9/11/26 10:16, Friedrich Zahn via Tarook wrote: > I would like to give you a heads-up that I would like to join today's > shore leave to discuss a potential transition of ch-k8s-lbaas into > ALASCA, specifically as part of Tarook. I discussed the issue on 2026-09-11 with Steve and we were in agreement that moving ch-k8s-lbaas into Tarook's governance would be a good move. I've put a more concrete proposal into writing, including some specific work items that would need to be tackled: https://gitlab.com/alasca.cloud/tarook/meta/-/work_items/8 One of the open questions is under what name the project will live on, I hope we don't have to spend too much time on that ;) I'll join the Shore Leave this Friday to discuss this further with the team. Best regards Friedrich

Sept. 21, 2026

Re: Topic for shore leave - future of ch-k8s-lbaas

by Steve Starke

Hi Friedrich, thanks for the heads-up, actually we were considering skipping today's shore leave due to absences. However, let's use the slot to discuss your concerns, since I also feel that the current situation is less than ideal. Best regards Steve On 11.09.26 10:16, Friedrich Zahn via Tarook wrote: > Hi everyone, > > I would like to give you a heads-up that I would like to join today's > shore leave to discuss a potential transition of ch-k8s-lbaas into > ALASCA, specifically as part of Tarook. Please let me know if the > meeting happens to not take place today or if there is no room on the > agenda, it's not too urgent. > > For everyone not familiar with the topic, some background: > ch-k8s-lbaas[0] is used by Tarook to provide a quick and simple > solution for ingress traffic, and advertised as a regular, stable > feature[1]. > > Unfortunately, the code base provenance is currently rather confusing, > there are 3 repos/forks (partially diverged) on GitHub/GitLab and 2 > registries serving images with no clear relationship between each > other. Tarook itself is using a mix of upstream sources, GitLab.com > for images and GitHub for binary artifacts. > Finally, a PR[2] I opened in April has not yet seen any maintainer > reaction, which I take as symptomatic for a general lack of upstream > activity, the last commit to main and release happened more than 2 > years ago. > > To ensure ALASCA's claim of delivering stable and operational > solutions we would like to see this tool under reliable governance, > the FOCIS team is happy to help with the transition efforts if the > Tarook team decides to proceed along that path. > > Best regards, > Friedrich > > [0]: https://github.com/cloudandheat/ch-k8s-lbaas > [1]: > https://docs.tarook.cloud/release/v14.0/user/explanation/services/ch-k8s-lb… > [2]: https://github.com/cloudandheat/ch-k8s-lbaas/pull/59 > > _______________________________________________ > Tarook mailing list -- tarook(a)lists.alasca.cloud > To unsubscribe send an email to tarook-leave(a)lists.alasca.cloud -- Steve Starke Team Lead Kubernetes Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 00 steve.starke(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Your Cloud Service and Cloud Technology Provider from Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

Sept. 11, 2026

Topic for shore leave - future of ch-k8s-lbaas

by Friedrich Zahn

Hi everyone, I would like to give you a heads-up that I would like to join today's shore leave to discuss a potential transition of ch-k8s-lbaas into ALASCA, specifically as part of Tarook. Please let me know if the meeting happens to not take place today or if there is no room on the agenda, it's not too urgent. For everyone not familiar with the topic, some background: ch-k8s-lbaas[0] is used by Tarook to provide a quick and simple solution for ingress traffic, and advertised as a regular, stable feature[1]. Unfortunately, the code base provenance is currently rather confusing, there are 3 repos/forks (partially diverged) on GitHub/GitLab and 2 registries serving images with no clear relationship between each other. Tarook itself is using a mix of upstream sources, GitLab.com for images and GitHub for binary artifacts. Finally, a PR[2] I opened in April has not yet seen any maintainer reaction, which I take as symptomatic for a general lack of upstream activity, the last commit to main and release happened more than 2 years ago. To ensure ALASCA's claim of delivering stable and operational solutions we would like to see this tool under reliable governance, the FOCIS team is happy to help with the transition efforts if the Tarook team decides to proceed along that path. Best regards, Friedrich [0]: https://github.com/cloudandheat/ch-k8s-lbaas [1]: https://docs.tarook.cloud/release/v14.0/user/explanation/services/ch-k8s-lb… [2]: https://github.com/cloudandheat/ch-k8s-lbaas/pull/59

Sept. 11, 2026

Release v14.0.0 has been published

by Steve Starke

Hi! We're happy to announce that Tarook v14.0.0 [1] has been published! Some notable changes, amongst others: * Support for deploying clusters on Proxmox has been added in an early stage. * We now provide a script to upgrade Nix on Debian-based systems [2]. * The behaviour of the "init-cluster-repo.sh" action has changed in a breaking way. * Support for Kubernetes v1.36 has been added. * Support for Kubernetes v1.32 has been dropped. * The NVIDIA packages and surroundings have been updated. * All Kubernetes control plane components can be freely customized via the configuration now. * The "apply-k8s-supplements" action does not implicitly trigger the "apply-k8s-core" action anymore. * * The tasks which checked for stale etcd peers have been removed. * * Lots of dependencies have been updated. Dependencies now have their own category in the release notes. Some notable changes specifically for clusters on OpenStack: * Terraform is now configured using Terranix. This change is breaking. Some notable changes specifically for clusters on bare metal: * The "destroy.sh" action now supports bare metal clusters. Check out the release notes [3] for more details! Best regards --- [1] https://gitlab.com/alasca.cloud/tarook/tarook/-/releases/v14.0.0 [2] https://gitlab.com/alasca.cloud/tarook/nix [3] https://docs.tarook.cloud/release/v14.0/releasenotes -- Steve Starke Team Lead Kubernetes Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 00 steve.starke(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Your Cloud Service and Cloud Technology Provider from Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

July 3, 2026

Release v13.0.0 has been published

by Steve Starke

Hi! We're happy to announce that Tarook v13.0.0 [1] has been published! Some notable changes, amongst others: - Options for flexible kubelet configuration have been added on differing levels of granularity. - Policies in the Vault backend must be updated. - The "KUBECONFIG" variable is now set by our direnv layout. - The nix-channel has been bumped to 25.11. - The Ansible playbooks have been made compatible with Ansible 12. - Nodes which are already cordoned before a rollout are not uncordoned on system or Kubernetes upgrades anymore. - The default Helm chart version of Hashicorp Vault has been bumped. Upgrading the Vault instances requires manual steps [2]. - The minimum Helm chart version of kube-prometheus-stack is now 68.4.0. - IPSec cleanup tasks have been fixed. Support for IPSec is deprecated and will be removed soon. Notable changes specifically for clusters on OpenStack: - The VolumeSnapshotClass "csi-cinder-snapclass" now allows snapshots of attached volumes. Notable changes specifically for development setups: - In setups using a local Vault container [3], the Vault certificates must be removed and regenerated. The easiest way to achieve that is to setup a new development cluster repository. Checkout the release notes [4] for details! Best regards --- [1] https://gitlab.com/alasca.cloud/tarook/tarook/-/releases/v13.0.0 [2] https://docs.tarook.cloud/release/v13.0/user/guide/vault/upgrade.html [3] https://docs.tarook.cloud/release/v13.0/user/guide/quick-start/initializati… [4] https://docs.tarook.cloud/release/v13.0/releasenotes -- Steve Starke Team Lead Kubernetes Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 00 steve.starke(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Your Cloud Service and Cloud Technology Provider from Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

April 23, 2026

Default version bumps for ingress-nginx in v12.1.1, v12.0.2 and v11.0.6

by Steve Starke

Hello Due to a recently discovered CVE [1] within the ingress-nginx component,the default version in all supported releases [2] has been bumped. Please be aware that the ingress-nginx component officially reached its EOL date and already got archived on GitHub. Best regards Steve --- [1] https://github.com/kubernetes/kubernetes/issues/137893 [2] https://meta.docs.tarook.cloud/supported_releases -- Steve Starke Team Lead Kubernetes Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 00 steve.starke(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Your Cloud Service and Cloud Technology Provider from Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

March 25, 2026

Release v12.1.0 has been published

by Steve Starke

Hi! We're happy to announce that Tarook v12.1.0 [1] has been published. Some notable changes, amongst others: * The Helm values for Calico and FluxCD can now be configured arbitrarily * Support for Kubernetes v1.35 has been added * Nodes are only rebooted during system updates if an updated package signals that a reboot is required * The Calico version is not tied to Kubernetes versions anymore * The Vault ServiceMonitor now only scrapes the active Vault instance * Affinity and tolerations have been fixed and improved for several components * Default version updates for several components Notable changes specifically for clusters on OpenStack: * The Helm values for the OpenStack CCM and Cinder-CSI-Plugin can now be configured arbitrarily * More granular configuration options for booting instances from volumes have been added * When booting instances from volumes, the volumes will not be tried to be allocated in the same AZ as the instance * The Wireguard tunnel has been extended to allow optional connectivity to the Kubernetes Pod- and Service-Network Notable changes specifically for development setups: * The state directory of the local Vault container is automatically added to the gitignore file Best regards --- [1] https://docs.tarook.cloud/release/v12.1/releasenotes -- Steve Starke Team Lead Kubernetes Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 00 steve.starke(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Your Cloud Service and Cloud Technology Provider from Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

March 16, 2026

Help needed: 3-Minute Survey for FOSS Backstage Talk

by Daniel Gerber

Dear ALASCA members, developers, supporters and friends, In a few days I will be giving a talk at this years FOSS Backstage in Berlin. To ensure that I represent the perspectives and priorities of our community accurately, as well as help guiding ALASCA’s work going forward, I would appreciate it if you could take a moment to answer this short survey: https://nextcloud.cloudandheat.com/apps/forms/s/qMYM4FiNfjkzfCzybSGcoFYM It should not take you more then 3 minutes, the answer are anonymous and can be given till Friday the 13th of March, 23:59. Please excuse duplicate notification of this survey and please share it within our community. Cheers, Daniel P.S: In case you need an English version please contact me directly! —— Dr. Daniel Gerber Softwaredeveloper ALASCA - Verband für betriebsfähige, offene Cloud-Infrastrukturen e.V. c/o Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 00 daniel.gerber(a)alasca.cloud | https://alasca.cloud/ Let's learn. Let's discuss. Let's inspire. Let's tech-talk. Alle News zu den ALASCA-Tech-Talks gibt es hier: https://alasca.cloud/alasca-tech-talks/ Verantwortliche i.S.d. § 55 Abs. 2 RStV: Dr. Marius Feldmann (Vorsitzender | Cloud&Heat Technologies GmbH) Josephine Seifert (Stellvertretende Vorsitzende) Steffen Brauß (Schatzmeister | Schwarz IT KG) Registergericht: Amtsgericht Dresden Registernummer: VR 12961 Steuernummer: 202/140/21049

March 5, 2026

Tarook workshop at CLT 2026 accepted and invitation to ALASCA booth

by Friedrich Zahn

Hi everyone, the FOCIS team is happy to announce that our proposed Tarook workshop for CLT 2026 has been accepted: https://chemnitzer.linux-tage.de/2026/en/programm/beitrag/238 We'll install Tarook and use it to run OpenDesk, showing off Tarook's many capabilities and integration with OpenStack and how setups can be reproduced across any SCS-Iaas compatible Cloud. We also got accepted for a general ALASCA booth, where we still have a vacant spot. If you would like to represent Tarook there with us and get a badge (which includes a free ticket to the Saturday evening get-together), please get in touch! Best regards Friedrich

Feb. 16, 2026