Skip to content

Enhancements#

Detail on the enhancements introduced in MKE 4.2.0 includes:

Windows worker nodes#

You can now run Windows worker nodes in an MKE 4 cluster.

  • Fresh installs can join Windows workers, including in air-gapped environments using mirrored Windows images and the offline image bundle.
  • gMSA (group Managed Service Accounts) is supported for Windows workloads on both fresh installs as well as MKE 3 to MKE 4 upgrades.
  • Existing MKE 3 clusters with Windows workers can be upgraded to MKE 4.
  • Windows ingress is supported.

Optional FIPS 140-3 mode#

MKE 4.2.0 can be installed in a FIPS 140-3 configuration.

  • A new FIPS mode field in the mke4.yaml configuration file, with validation, controls FIPS installs.
  • FIPS builds are provided for the MKE operator and the etcd maintenance service, and the FIPS k0s binary is synchronized to hosts during install, including for air-gapped clusters.
  • The Dex REST API server runs in a FIPS configuration when FIPS mode is enabled.

Run without an external load balancer#

Clusters that do not have an external load balancer in front of the control plane can now use the built-in Control Plane Load Balancer (CPLB). In providing CPLB, MKE 4 makes it so that a single virtual IP can front the manager nodes.

VMware vSphere child clusters#

MKE 4 can provision and manage child clusters on VMware vSphere, including in air-gapped environments. A vSphere cluster template is included for child-cluster deployments.

High Availability (HA) for system components#

The built-in MKE system components now default to an HA configuration so that the loss of a single node does not take down the management plane.

  • Critical single-replica components now run with multiple replicas by default.
  • PodDisruptionBudgets, PriorityClasses, node selectors, and topology spread constraints are applied to the system components so they are scheduled across manager nodes and protected during voluntary disruptions.

Cluster node lifecycle commands#

  • The mkectl node add and mkectl node remove commands add and drain/remove worker nodes, respectively, using lease-based cluster state, without the need to re-run a full mkectl apply command.
  • The mkectl status command reports the current state of the cluster and its addons from the command line.
  • The mkectl apply command now waits for all addons to reach a ready state before returning.

etcd maintenance service#

The etcd maintenance service:

  • Now runs on child clusters.
  • Automatically raises the etcd storage quota when etcd enters a NOSPACE alarm, instead of requiring manual intervention.
  • Records an audit trail of maintenance actions.
  • Rolls back if an MKE 4 to MKE 4+ upgrade fails, to prevent etcd from being left in a half-changed state.

CSI Secrets Store driver#

The CSI Secrets Store driver is integrated into MKE 4.x, so secrets from an external store can be mounted into Pods through a CSI volume.

Configurable resource limits and Prometheus retention#

  • Resource requests and limits for system components are configurable through the mke4.yaml configuration file.
  • Prometheus data retention is now configurable.

Addon status in the MKE API#

  • k0rdent service statuses for MKE addons are surfaced in the MKE configuration status API.
  • The mkectl apply command now waits on the reported MKE addon status instead of a fixed Helm wait, so the command reflects the real readiness of each addon.

MKE Dashboard improvements#

  • Self-service password change for local users.
  • You can exec into a Pod from the MKE Dashboard.
  • New MKE Dashboard pages:
  • Envoy Gateway controller
  • Internal gateways configuration
  • Gateway settings section
  • Updated Ingress page behavior.
  • The MKE Dashboard honors the localUsers setting and hides or blocks direct user management when local users are disabled.
  • Visual alignment with the k0rdent product family, a refactored login screen, a "Cancel" button on the YAML edit view, and display of the k0rdent version.

Update of kube-prometheus-stack to 86.2.3#

MKE 4.2.0 upgrades the kube-prometheus-stack from chart 79.5.0 to 86.2.3.

CRD upgrade

Mirantis recommends that you upgrade the CRDs for kube-prometheus-stack v0.86.2 before you upgrade your cluster to MKE 4.2.0. For detailed instruction, refer to Upgrade Considerations.