Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

What's new in Stackland 26.3.0

Written by
Updated at October 30, 2026
View in Markdown

In Stackland 26.3.0, we added managed Apache Airflow™ clusters, scanning images for vulnerabilities, and Identity and Access Management data backups. Expanded the Object Storage and Iceberg REST Catalog features, upgraded AI Studio to generic 2.0.

Important updates

  • Updated the Iceberg REST Catalog model: now the StacklandRestCatalog and StacklandRestCatalogAccessBinding resources are used instead of RestCatalog and RestCatalogPrincipal. Use the updated manifests from our guides to create catalogs and assign permissions.
  • Updated the TrinoCatalog format: the spec.type field was deleted; for the Iceberg catalog, spec.stacklandRestCatalog is used instead of spec.iceberg. Update your Managed Service for Trino connection manifests.
  • Now you can manage an Object Storage bucket's settings by declaring them in the Bucket resource. Changes of these settings via the S3 API are replaced by manifest values. Deleting a field from the manifest resets the setting to its default or clears it. For more information, see Additional bucket settings.
  • Prior to upgrading Stackland to version 26.4.0 or higher, you will need to migrate the internal Object Storage service database (metabase) from PostgreSQL 15 to PostgreSQL 17. This requirement does not apply to custom Managed Service for PostgreSQL clusters: updating the PostgreSQL major version is not supported for them yet. In version 26.3.0, upgrading the metabase is optional. For new Object Storage installations, PostgreSQL 17 is used automatically. You can learn about the preparation process and restrictions when the metabase is under maintenance in this upgrade guide.
  • When assigning permissions via Kubernetes resources, e.g., AccessBinding or ClusterAccessBinding, the role is bound to the unique ID of a user or user group in Identity and Access Management. Changing spec.subject does not result in transferring the role to a different user. You need to delete the permission assignment resource and create a new one. If you delete a user or user group and recreate it under the same name, the old permissions will not be restored automatically.
  • For new installations, increased the default size of each Identity and Access Management storage disk from 10 to 100 GiB. Take this into account when planning your disk space usage.
  • The sladm pull and sladm copy commands now require the --config parameter with the path to the cluster configuration file or folder.

New features

Managed Service for Apache Airflow™

Added the Managed Service for Apache Airflow™ component for task orchestration and data processing. Apache Airflow™ 3.1.8 is supported. Now you can create and configure clusters using the AirflowCluster resource.

Main features:

  • Importing DAG files from a Git repository or S3-compatible storage.
  • Storing task logs in a built-in Object Storage or external S3 storage.
  • Installing additional Python and Debian packages, including from private repositories.
  • Pausing and resuming a cluster, protection against accidental deletion.

AI Studio

Added the AI Studio generic 2.0 release to the platform for local deployment. Added the following features:

  • Code Interpreter in Agent Atelier: Code execution in isolated sessions. You can set the inactive session retention period and maximum session duration.
  • Multimodal Gemma 3 27B and Qwen 3.6 35B models in Model Gallery: Processing queries containing images.
  • Text recognition (OCR) you can enable regardless of language models.

Code Interpreter, new multimodal models, and OCR are enabled separately. You need GPUs for models and OCR. You can select nodes for their location and set CPU and memory. Learn how to enable them in this guide on setting up AI Studio.

Policy Manager: Image scanning

Policy Manager now enables scanning custom application images for known vulnerabilities. You can get the results in the management console and in Kubernetes reports. Detected vulnerabilities do not block starting up and restarting pods.

OS and Java library package vulnerability bases are included in the distribution; therefore, scanning is available in isolated runtimes without internet access.

You can set up the re-scanning period, number of concurrent checks, timeout, and exceptions by namespace. Scanning is disabled by default. You can enable it in the Policy Manager settings. You can specify your custom registry for updating vulnerability bases regardless of the platform version.

Identity and Access Management: Backup and recovery

Added the option to create a Identity and Access Management database backup in YDB and restore it from a local archive. The ydb-backup.sh and ydb-restore.sh scripts are available for operations.

Restoring a database replaces the current data with the backup data and requires a maintenance window, as the cluster becomes unavailable during this operation.

Configuring components before installation

Added the option to configure components at the cluster's first installation, e.g., connect Object Storage, select the Prometheus storage size, or set the Loki log retention period.

The sladm config gen-defaults components command generates configuration templates. You can edit and provide them with the cluster configuration. The sladm validate command validates the settings before installation.

Verifying signatures for images

Added verification of signatures for the platform's container images when installing or uploading to nodes. The administrator can check the presence of images and trusted signatures in the registry beforehand by running the sladm images verify command. This can also be done when preparing for installation without internet access.

Improvements

Identity and Access Management

  • When assigning permissions via Kubernetes resources, you can specify a user by their ID or name with the federation ID. Thus you can distinguish between users with the same names in different federations.
  • At installation, you can specify the disk type for the Identity and Access Management storage: SSD, NVMe, or HDD.

Object Storage

  • Upgraded Object Storage to version 26.3.9-stackland.
  • Added temporary STS access keys with a limited validity period and access policy.
  • Extended the bucket settings, which now include a size limit, versioning, labels, ACL, S3 access policies, lifecycle rules, and object version deletion protection using Object Lock.
  • In StorageConfig, you can configure CPU, memory, and the service volume size. For more information, see Configuration.
  • Bucket creation, update, and deletion errors are shown as separate statuses describing the cause.

Iceberg REST Catalog and Managed Service for Trino

Managed Service for ClickHouse®

Enhanced the security of backups when replication is delayed or individual cluster replicas are not available.

YTsaurus

YTsaurus upgraded to version 25.4.1.

Resource configuration and component availability

  • Extended the CPU and memory settings for DNS, Identity and Access Management, the license server, Logging Stack, and Monitoring.
  • Increased availability of the management console, Identity and Access Management, and Ingress during scheduled node maintenance.

Network

Added support for an HTTP proxy to access the Yandex Cloud API when managing network load balancers. This setting allows you to work with load balancers when you can only access the API from the cluster using a proxy.

Management console

  • In the management console, moved modules with a separate license to the Modules section, while the other platform components are available in the Components section.
  • Added Job deletion from the management console, including bulk deletion.
  • Updated the dialogs for connecting to Managed Service for PostgreSQL, Managed Service for ClickHouse®, and Managed Service for Apache Kafka®: after selecting the connection parameters, you get the guides and code samples for different programming languages.
  • You can select a new ClickHouse® version in the Managed Service for ClickHouse® cluster edit form. The form verifies the update's validity and prohibits version downgrading.
  • The node page correctly shows the full disk space size, as well as the size of and used up space in the ephemeral storage.
  • In the permission assignment list, added search by access subject name and navigation to linked users and groups.

Fixed issues

AI Studio

Fixed the authorization errors when starting Workflows and calling MCP tools in Agent Atelier.

Databases and analytics

  • In the management console, you can restore a Managed Service for ClickHouse® cluster from a backup after deleting the initial cluster.
  • The Managed Service for ClickHouse® cluster status does not show readiness until ClickHouse® Keeper start is complete.
  • When editing Managed Service for PostgreSQL users and databases, as well as Managed Service for ClickHouse® users and roles via the management console, fields missing in the form are saved, including labels and annotations.
  • Fixed authentication via the Trino CLI.
  • Fixed the CORS errors when using DataLens with Object Storage.

Object Storage

  • Restored the operation of signed URLs for accessing objects.
  • Fixed object filtering in a bucket in the management console.
  • You can now delete a Bucket resource with an invalid name if you did not create the bucket in the storage.
  • Fixed the Object Storage expansion errors when adding new nodes.

Access management

  • Excluded the possibility of issuing access keys for another user's service account.
  • Fixed the checks for resource permissions in the management console.
  • Logging out on the authentication page now terminates an Identity and Access Management session.

Projects

Fixed the processing of namespace re-creation for a project: now you can only create a namespace with the same name after completing deletion of the old one.

What's new in Stackland 26.2.2

Stackland version 26.2.2 is mostly a maintenance release delivering bug fixes for the installer, licensing, AI Studio components, and monitoring.

New features

Licensing

Upgrading clusters installed prior to the introduction of licensing (versions earlier than 26.1.5 and 26.2.0) is no longer blocked by license validation checks. These clusters are now automatically recognized and will continue to operate normally both during license validation and during upgrades.

Extended the license verification for new installations: in online mode, the absence of a Stackland license now results in an error instead of further installation.

AI Studio

The Model Gallery and Agent Atelier components have been migrated to the Contour ingress controller to replace ingress-nginx. For more on ingress migration, see Upgrading a cluster.

Interface

Now you can correctly enable and disable the Managed Service for Trino component in the Stackland management console.

Installation and upgrades

  • sladm now checks node DNS names when validating the configuration: if no installationIp is specified for a host, its hostname cannot be a part of the cluster’s baseDomain. This prevents naming conflicts during DNS resolution upon installation.
  • Before installation, sladm verifies that each Cilium L2 LoadBalancer IP address range is available from the network of at least one node. Configuration errors are detected before installation.
  • sladm diag now gathers an expanded range of diagnostic information, including data on deleted nodes from Kubernetes events. These events record disk cleanup results and the node's IP address, if the latter is known.
  • Migration compatibility with the current cluster version is taken into account when selecting an upgrade version. Incompatible migration is blocked before running an upgrade.

Fixed issues

Cluster installation and update

  • Resolved an issue where the installation crashed at the helm install stage due to the use of an incorrect release name in the status check.
  • Restored support for the minimal image set during upgrades. Upgrades no longer fail when updating kubelet images and those of its associated components. Added a check to verify the local registry on each node contains a complete set of images before restarting a cluster upgrade in air-gapped installations.
  • Increased the acceptable time period without any progress when uploading images from five minutes to one hour. It reduces the possibility of errors when uploading large AI/ML images via slow connections.
  • The Talos version match check at installation is only performed in air-gapped installations. In clusters with internet access, version mismatch does not block installation anymore: required images are uploaded during the installation.
  • Increased the tolerance of the initial etcd configuration: if the service goes into the Failed state, sladm automatically restarts the control-plane node, making up to three attempts. If the temporary FailedPrecondition error occurs, the etcd configuration re-runs instead of completing the installation with an error.
  • The Cilium L2 LoadBalancer now only announces VIP addresses from worker and combined nodes. Nodes only with the control-plane role do not pull in the traffic they cannot handle anymore.

Certificates and Ingress

Ingress annotations now correctly override the class specified in ClusterIssuer for the Let's Encrypt HTTP-01 solver. Any existing ClusterIssuer migrates automatically.

AI Studio

  • Fixed TLS certificate generation for Model Gallery and Agent Atelier and the automatic synchronization of the relevant secret across namespaces. This eliminates TLS errors when accessing these services.
  • The Responses endpoint (/v1/responses, /v1/files, and /v1/vector_stores) now has a dedicated Ingress controller. This ensures its availability does not depend on the FOMO API endpoints (/v1/chat/completions, /v1/embeddings, and /v1/models).
  • Vector search in Responses now uses the folder ID mapped to the Agent Atelier namespace, eliminating errors when working with multiple folders.

Object Storage

  • Fixed an infinite reconciliation loop when updating or deleting a bucket.

Monitoring

Revised the Grafana dashboard for persistent volumes to restore the display of usage statistics for Kubernetes 1.34.1, where kubelet fails to export kubelet_volume_stats_* metrics when dynamic resource allocation is enabled. Added panels to monitor TopoLVM pools and CSI operation frequency.

What's new in Stackland 26.2.1

Stackland 26.2.1 introduces cluster scaling, the AI Studio component, and a new ingress controller named Contour.

New features

Scaling a cluster

Added support for adding and deleting nodes in an already installed Stackland cluster. For more information, see Scaling a cluster.

AI Studio

Added the AI Studio component that includes the Model Gallery and Agent Atelier modules.

Contour ingress controller

Added a new ingress controller, Contour, to replace older ingress-nginx. Please note the following:

  • The ingress-nginx controller is no longer supported and will be fully removed in Stackland 27.
  • In fresh installations of Stackland 26.2.1, both system and custom ingresses use the new Contour-based implementation.
  • When upgrading to Stackland 26.2.1, existing custom ingress controllers based on the old implementation remain unchanged, while system ingress controllers migrate to Contour.
  • Users planning to upgrade to Stackland 27 must proactively schedule migration of their custom ingresses to Contour. For more information, see Upgrading a cluster.

Fixed issues

Cluster installation and update

  • Fixed a deadlock scenario where installation over an ongoing upgrade would freeze at the Cilium readiness stage.
  • Restored support for the available image set: sladm now checks for the full image set in the registry and falls back to pulling minimal if missing the required images.
  • Fixed image validation when working with TLS-enabled container registries: sladm now correctly provides TLS options to the Docker client.
  • Resolved a potential air-gapped environment upgrade failure due to missing required images.
  • Fixed the issue causing a cluster upgrade task to crash with the bundle "ytsaurus" references unknown component(s): ytsaurus error.
  • Accelerated cluster recovery after node reboots.
  • Fixed a startup failure affecting the iam-uber init-container following node reboot.

Managed Service for ClickHouse®

  • Automatic ClickHouse® parameter configuration now respects individual shard resources, ensuring correct behavior in heterogeneous clusters.
  • The ClickhouseBackup finalizer is now properly freed up if S3 credentials are already absent during namespace deletion, thus preventing deletion freezes.

YTsaurus

  • The container image registry for job environments and pause containers can now be overridden via YTsaurusConfig, now that ImagePullBackOff errors in custom registries have been resolved.
  • The YTsaurus image registry host is now dynamically injected during reconciliation, eliminating ImagePullBackOff errors in production clusters.

Identity and Access Management

  • Fixed an infinite reconciliation loop in AccessBinding.
  • Fixed a folder deletion issue in Identity and Access Management during project resource cleanup.
  • Fixed the get-tree method in resource-manager.
  • Increased the YDB query limit for the iam-role-list method.

Monitoring and logging

  • Increased the Prometheus resources for stable operation under load.
  • Reduced the default Prometheus disk size.
  • Grafana now uses prometheus.stackland.svc.cluster.local, a stable DNS alias, instead of direct Thanos Query access.
  • Added explicit mounting of the Thanos Object Storage secret into the thanos-sidecar container, resolving secret access issues in certain configurations.
  • Grafana image version is now dynamically pulled from the component registry, preventing version desynchronization.
  • Fixed a re-login issue in Grafana after session expiration.
  • Added a network policy for the logging component to restrict Loki access exclusively through the proxy; fixed the Grafana OAuth client for Identity and Access Management refresh-token policies.

Object Storage

  • Migrated the Object Storage dashboard to Thanos Querier, so now it correctly displays object sizes and counts.

Interface

  • Fixed access errors during bucket deletion, with deletion now possible even without read permissions.
  • Improved the user password update form.
  • Managed Service for Trino access rules now use a card-based layout instead of tables, improving readability.
  • The sinceSeconds parameter in the pod log filter is now correctly provided to the Kubernetes API: the invalid -1 value is no longer sent.
  • The stuck operations panel now displays in the correct color.

What's new in Stackland 26.2.0

Stackland version 26.2.0 introduces new components for data analytics: YTsaurus, Managed Service for Trino, and Iceberg REST Catalog. It also offers more options for declarative user and database management in Managed Service for PostgreSQL and Managed Service for ClickHouse®.

Important updates

  • Added the YTsaurus component, a distributed platform for big data storage and processing.
  • Added the Managed Service for Trino component, a distributed SQL engine for analytical queries.
  • Added the Iceberg REST Catalog component, a REST metadata catalog for Apache Iceberg tables.

New features

YTsaurus

Added the YTsaurus component, a platform for big data storage and distributed processing. It is configured via the custom YTsaurusConfig resource and offers the following features:

  • Deployment of a single YTsaurus cluster with automatic subcomponent management.
  • Web interface and HTTP proxy for cluster access.
  • User authentication via Identity and Access Management.
  • Cluster state monitoring using Grafana dashboards.

Managed Service for Trino

Added the Managed Service for Trino component, a distributed SQL engine for analytical queries to data from various sources. Main features:

  • Ability to create Trino clusters with coordinators and workers via the custom TrinoCluster resource.
  • Catalogs for data sources such as PostgreSQL, ClickHouse®, and Apache Iceberg.
  • Support for both external S3 storage and native Object Storage for Iceberg catalogs.
  • Ability to configure folder access rules.

Iceberg REST Catalog

Added the Iceberg REST Catalog component, a REST metadata catalog for Apache Iceberg tables, compatible with the Iceberg REST Catalog API. Main features:

  • Catalog management via the custom RestCatalog resource.
  • Catalog user management via the custom RestCatalogPrincipal resource with OAuth2 credentials.
  • Access control through user groups and catalog roles.

Managed Service for PostgreSQL: User and database management.

Added declarative management of users and databases via custom Kubernetes resources:

  • PostgresqlRole: Managing users and their permissions. Supports generated passwords or passwords from secrets.
  • PostgresqlDatabase: Managing databases, schemas, and locale providers: libc, ICU, and builtin.

Managed Service for ClickHouse®: Managing users, roles, and databases.

Added declarative management of users, roles, and databases via custom Kubernetes resources:

  • ClickhouseDatabase: Managing databases.
  • ClickhouseRole: Managing roles with multiple privileges; the guides provide examples for the reader and writer roles.
  • ClickhouseUser: Managing users with passwords stored in secrets.

Managed Service for ClickHouse®: Automatic storage expansion

Added the ability to automatically increase disk space for Managed Service for ClickHouse® clusters when a specified usage threshold is reached. This is configured in the autoScaling section of the custom ClickhouseCluster resource:

  • enabled: Enabling autoscaling.
  • maxSize: Maximum storage size.
  • standardIncreasePercent: Increment size for storage expansion.
  • resizeTriggerPercent: Threshold to trigger expansion.
  • readOnlyTriggerPercent: Threshold to switch the cluster to read-only mode.

Installing Stackland on Yandex BareMetal via PXE

Added guides for installing Stackland on Yandex BareMetal servers using PXE boot.

Installing Stackland on Yandex Cloud VMs

Added guides for installing Stackland on Yandex Compute Cloud VMs.

Improvements

Cluster upgrade

Updated the cluster upgrade form interface in the management console.

Guides

  • Added a guide for YTsaurus.
  • Added a guide for Managed Service for Trino.
  • Added a guide for Iceberg REST Catalog.
  • Added sections on user and database management in Managed Service for PostgreSQL.
  • Added sections on user, role, and database management in Managed Service for ClickHouse®.
  • Added a description of automatic storage expansion for Managed Service for ClickHouse®.
  • Added new Secrets Store guides: described injection into ConfigMap, environment variables, and troubleshooting.
  • Added guides for PXE installation on Yandex BareMetal.
  • Added guides for installation on Yandex Cloud VMs.
  • Added a page on Secrets Store troubleshooting.

Fixed issues

Cluster installation and update

  • sladm now synchronizes PlatformEnvironment IP addresses when cluster size changes.
  • Restored correct endpointURL behavior at the end of installation.
  • Fixed endpointURL in the custom kubeconfig file.
  • sladm now starts the kubelet only after images are loaded, preventing race conditions on node startup.
  • Images are pushed to the local registry upon sladm restart.
  • Fixed stale node detection during cluster upgrades.
  • Improved TCP keepalive parameters in the Talos client.
  • Refined preflight disk checks in sladm.
  • Fixed CNI validation during upgrades.
  • Host configuration is now stored using custom StacklandHostConfig resources.

Component platform

  • Migrated component resources from corev1.ResourceRequirements to v1alpha1.ResourceRequirements, with unified resource specification formats.
  • Added Object Storage namespaces to the list of system namespaces, protecting them from accidental deletion.

Identity and Access Management

  • Fixed the slow appearance of the folder-id annotation.
  • Asynchronous folder deletion in Identity and Access Management now works correctly.
  • Fixed the removal of the service account finalizer when the namespace is in Terminating status.
  • Multiple CRDs (AccessBinding, ClusterAccessBinding, ProjectAccessBinding, and GizmoAccessBinding) are now correctly unified into a single Identity and Access Management AccessBinding.
  • A dedicated GizmoAccessBinding is now used for the OAuth token exchange role, resolving naming conflicts with custom resources.
  • Cluster access binding names now follow this template: stackland-<chart_name>-<short_role>.
  • Removed an excessive default iam-api ingress.
  • iam-uber now recovers from error states after node reboot.
  • Fixed the Identity and Access Management endpoint in the management console.

Projects

  • Fixed the deletion of ProjectNamespace and its associated namespace when manually removed via kubectl.
  • Fixed namespace disappearance when toggling the ownedByNamespace flag and deleting a PNS.
  • Prohibited using project as a project name.
  • Fixed overflow in the managed-by field length.

Managed Service for ClickHouse®

  • Increased max_concurrent_queries for small clusters.
  • Set default resources for sidecar containers.
  • Restored the ability to delete a cluster without the superuser secret.
  • Fixed Kyverno checks for ClickHouse® and Keeper installation.
  • Removed an excessive port of the accesscontroller sidecar.
  • Resolved cleanup errors when deleting a cluster, with excessive Jobs now removed properly.
  • Consolidated ClickHouse® dashboards; fixed the backup dashboard.

Managed Service for PostgreSQL

  • Raised the WAL-G operator limits that were previously too low.
  • Fixed a PostgreSQL version labeling issue in images where those with tags 15 and 16 actually contained PostgreSQL 17. The actual database version remains unchanged. If your manifests specify version 15 or 16, update it to 17. For more information, see Images displaying an incorrect PostgreSQL version.

DataLens

  • You now see a correctly displayed error when an access key's service accounts do not match.
  • Removed deprecated api-key-* secret keys.
  • The default configuration is one PostgreSQL instance for GA.

SpeechSense

  • Fixed the password generator.
  • Fixed bucket name generation when using external S3.

Monitoring and logging

  • Reduced kube-state-metrics memory usage, eliminating OOM crashes.
  • Fixed the retentionSize configuration for Prometheus.
  • Restored the HWM disabling feature.
  • Updated default system metric alerts to working condition.
  • Grafana now uses the correct Loki application version.
  • Loki is sourced locally, with no external application download required.

Interface

  • Sanitized ClickHouse® resource names to comply with RFC 1123.
  • Fixed WebSocket idle timeout in pod terminal.
  • Expanded RBAC permissions for launching pod shell terminals to cover the required scope.
  • OwnerReference on ClickHouse® user secrets is now set correctly.
  • Restored shard override flags in the ClickHouse® cluster edit form.
  • The PostgreSQL cluster creation form now correctly provides the fromBackup parameter.
  • The backup creation button is now hidden for clusters without backup configuration.
  • Restored the withHeader parameter in the S3 object table.
  • Improved object sorting in buckets and refined S3 bucket tips and UX elements.
  • The redirect after bucket editing now leads to the detail page, not the bucket list.
  • The issuer URL validator error now displays a clear message.
  • Revised the Iceberg REST Catalog catalog form validation for improved consistency.
  • Fixed validation and saving issues in Iceberg REST Catalog and Managed Service for Trino forms.
  • Fixed handling of an unbounded sinceSeconds value in the pod log filter.
  • In namespace forms, fixed texts and validation.
  • The scheduledBackupEnabled toggle now works correctly for PostgreSQL clusters.
  • The cluster creation form no longer leaves an orphaned superuser secret on failure.
  • Improved Auth-UI error handling and localized messages.
  • Updated the Kubeconfig page and refined texts in project and namespace forms.
  • Unified breadcrumbs, namespace-not-found redirects, the favorites provider, and the project path/name display logic.

What's new in Stackland 26.1.5

Stackland version 26.1.5 has fixed cluster installation and upgrade issues related to Talos release images and OS version checks.

Fixed issues

Cluster installation and update

Fixed Talos version check during update: sladm now compares the full version string, including Stackland kernel build, to correctly identify obsolete nodes.

What's new in Stackland 26.1.4

Updated the base Talos build in Stackland 26.1.4.

Improvements

Cluster installation and update

Uses Linux kernel 6.12.85‑lvc19 with a fix for vulnerability CVE‑2026‑31431 (Copy Fail).

What's new in Stackland 26.1.3

Stackland version 26.1.3 features improved cluster installation and upgrade stability, interface updates, and fixes in managed database services.

Improvements

Managed Service for PostgreSQL

  • Added support for PostgreSQL for 1C versions, which are now available in the cluster creation form.
  • Unified the backup management interface between cluster creation and editing forms: the backup, schedule, and retention period toggles now work in the same way.
  • In the cluster view form, the backup settings fields are read-only.
  • Set resource requests and limits for PostgreSQL cluster containers.

Managed Service for Apache Kafka®

Set resource requests and limits for UserOperator, TopicOperator, CruiseControl, and Exporter containers.

Managed Service for ClickHouse®

Set default resources for sidecar containers.

Cluster installation and update

  • Disk checks now recognize that some block devices are LVM volumes and look for the total size of data disks, not that of each individual disk. For control-plane nodes, no total data disk size checks are performed.
  • The update process uses local registry-based extension images instead of re-downloading them from an external registry.
  • Migrated cluster host configuration to a new custom resource named StacklandHostConfig.

Fixed issues

Security

Further restricted the use of Pod Security Admission labels on namespaces: now the action is allowed only to cluster administrators.

Projects

Fixed deletion of ProjectNamespace and the associated folder in Identity and Access Management when deleting a namespace created manually via kubectl.

Cluster installation and update

  • Fixed Talos installation freeze when adding nodes to a baremetal cluster due to "half-open" TCP connections after node reboot.
  • Fixed an intermittent cluster deployment fault at the node update stage (Upgrade failed: system is still outdated).
  • Improved reconciliation error processing in sladm: reconciliation is no longer interrupted on recoverable errors.

Managed Service for PostgreSQL

  • Fixed the superuser secret name in the Performance Diagnostics configuration.
  • Fixed a port conflict between backup sidecars and Performance Diagnostics: now both functions can be used simultaneously.
  • Fixed the resumption of the backup schedule when the schedule is returned to the cluster specification.
  • Fixed the fromBackup parameter in the cluster creation form when restoring from a backup.
  • Fixed the processing of the backup schedule toggle in the cluster creation form.
  • Updated the cloudnative-pg and pg-perfdiag images.

Managed Service for ClickHouse®

  • Fixed the resumption of the backup schedule when the schedule is returned to the cluster specification.
  • Removed an excessive port of the accesscontroller sidecar container.

What's new in Stackland 26.1.0

In version 26.1.0, Stackland enters the General Availability stage. We introduced new features and improvements that make the platform more user friendly and versatile.

Important updates

  • Added support for projects, i.e., logical resource organization units that help you manage namespaces, access, and quotas at the team or application level.
  • Added the DataLens component for data visualization and analysis.
  • Added the SpeechSense component for voice and text communication analysis.
  • Integrated Yandex Object Storage. Renamed yandex-object-storage to storage.
  • Implemented updating an existing cluster.
  • Implemented automatic creation of storage classes based on disk type (HDD, SSD, NVMe, other). All disks other than the installation ones get added to one of the classes and become available for data storage right after Stackland is installed.
  • Changed the configuration installation file format.
  • Upgraded the NVIDIA® driver to version 580.126.

New features

Identity and Access Management: support for Active Directory

Added support for syncing Active Directory users and groups. Main features:

  • Automatic creation of a user pool when setting up syncing.
  • LDAPS support for secure connections to domain controller.
  • Setting up user and group attribute mapping.
  • Behavior management when deleting an AD user: blocking or deleting.

Managed Service for PostgreSQL: performance diagnostics

Implemented performance diagnostics for Managed Service for PostgreSQL clusters. The feature collects and analyzes the performance statistics of your SQL queries and sessions. Its data is visualized on a Grafana dashboard.

DataLens

Added the DataLens component for data visualization and analysis. Use it to create interactive dashboards and reports, connect to various data sources, and share your findings with your team.

SpeechSense

Added the SpeechSense component for voice and text communication analysis. The component allows you to process conversations in audio and text formats for QoS assessment and debottlenecking.

Cluster upgrade

The UI got a cluster upgrade form where you can select a version from the list of available releases. Added the sladm validate command to pre-check the configuration before an installation or upgrade. This command validates the configuration file and checks the nodes for availability. The installation of the cluster will not begin if it certain to fail.

Improvements

UI improvements

  • The component management dialogs got meaningful names (displayName) instead of internal IDs.
  • Added a feature for returning to the last viewed project.
  • Added the pop-up window to confirm a logout.
  • Added the projectMember access level.
  • Blocked deletion of projects in terminating status.
  • Improved validation of the project creation form.
  • Updated the Kubeconfig page theme.

Guides

  • Added the Projects and Resource model section to the concepts.
  • Added a guide for SpeechSense.
  • Added a guide for DataLens.
  • Added a guide on disk subsystem and its diagnostics.
  • Added a guide on upgrading a cluster.
  • Added a guide on Managed Service for PostgreSQL performance diagnostics.
  • Expanded guides on projects related to namespace management, roles, quotas.
  • Updated the quick start section.
  • Updated the Access management section.

Fixed issues

  • Fixed the issue with AccessService cache in Identity and Access Management when creating or updating OAuthClient.
  • Fixed the sidecar manager's scope of monitoring in Managed Service for ClickHouse®. Now only the current cluster's pods are monitored.
  • Fixed access permissions for the sidecar service account in Managed Service for ClickHouse®.
  • Fixed the display of Object Storage name in the UI.
  • Fixed the default storage class configuration in Managed Service for ClickHouse® manifests.
  • Fixed the processing of blank values in numeric fields of UI forms.
  • Changed the wording and validation in the project creation form.

What's new in Stackland 0.5.0

Stackland 0.5.0 introduces new features and improvements that make the platform more user friendly and versatile.

New features

Note

Installation may now take longer due to the large size of Stackland 0.5.0 components. We recommend increasing the default timeout in sladm to three hours by adding the --installation-timeout 3h key.

Warning

Before installation, remove LVM partitions on data storage disks. Use a command in this format:

nvme format -s 1 --force /dev/nvme0n1

NVIDIA® GPU support

Added the NVIDIA® GPU support component, a tool that manages your GPU resources in a Stackland cluster. It automates deployment and configuration of NVIDIA® drivers, device plugins, and other components for GPU provisioning. Added Grafana dashboards for monitoring of GPU resources.

Identity and Access Management

Added the Identity and Access Management component, which is a system for centralized management of users, groups, and access permissions. Its main features include:

  • SAML federation support.
  • AWS-compatible AccessKeys for software access to services.
  • OAuth clients for integration with applications.
  • Grafana integration with Identity and Access Management OAuth for a single authentication point.

Improvements

Deletion protection

Added protection against accidental deletion for database clusters and resources:

  • Managed Service for PostgreSQL clusters
  • Managed Service for Apache Kafka® clusters and topics
  • Managed Service for ClickHouse® clusters

Managed Service for ClickHouse®

  • Added the autotuner for automatic optimization of cluster settings.
  • Implemented storage availability checks before creating or deleting backups.

Managed Service for Apache Kafka®

Simplified ACL role selection in the user creation and editing form.

Managed Service for PostgreSQL

Improved the UX of the dialog with cluster connection info.

UI improvements

  • Added the ability to adjust column width in tables.
  • Component deactivation is now blocked if there are active resources.
  • Improved the deletion confirmation dialog.
  • Added a table for Identity and Access Management group members.
  • On the Policy Manager page, added the Mutes and Reports tab.

Fixed issues

  • Fixed the issue with the internal FQDN for Managed Service for ClickHouse®.
  • Fixed name length validation of Managed Service for ClickHouse® clusters when restoring them from a backup.
  • Fixed the critical IPv6 address handling error.
  • Fixed the issue when deleting an iptables rule of a local VMware registry.
  • Fixed the compatibility issue that made it impossible to deploy Cilium on certain ESXi / NSX configurations.

What's new in Stackland 0.4

Stackland 0.4 introduces new features and improvements that make the platform more user friendly and versatile.

New features

Managed Service for ClickHouse®

Added the Managed Service for ClickHouse® component, a managed service for working with an open-source column-oriented ClickHouse® DBMS. It simplifies database cluster deployment and upgrades, ensures fault tolerance through replication and sharding, and provides tools for backup and monitoring. With Managed Service for ClickHouse®, you can create and restore cluster using the ClickhouseCluster custom resource, take one-off backups using the ClickhouseBackup custom resource, configure data replication between hosts to ensure high availability, and use sharding for horizontal scaling and load distribution.

Policy Manager

  • Added the Policy Manager component, a tool to check Kubernetes resources for compliance with security policies. The tool generates reports in OpenReports format. Policy Manager supports two policy presets: baseline, which is the basic Kubernetes security standard for pods, and restricted, which is the secure standard for critical applications. You can select a default cluster policy preset using the PolicyManagerConfig custom resource or activate an additional preset using the ClusterPolicySet resource. To temporarily or permanently disable violation notifications for certain policies, use the ClusterPolicyMute resource.
  • Implemented the Policy Manager GUI which enables you to view reports, select policy presets to be used, use the interactive YAML editor, configure mutes and their duration.
  • Optimized state handling and resource status updates in Policy Manager to improve performance and reduce cluster load.
  • Updated the policy-reporter version, a component collecting and displaying policy violation reports.

Hardware monitoring

Added a module for monitoring cluster hardware state. The module collects data from kernel logs, sysfs, and SMART data from drives. For hardware state metrics and notifications, see the Hardware Monitoring Grafana dashboard.

Improvements

Stackland Diagnostic Tool

Added the ability to collect information about the following entities:

  • storageClass
  • ingressClass
  • clusterIssuer
  • PVC
  • statefulset
  • ingress
  • cert-manager certificates (without secrets)
  • Webhook configurations

Databases

  • Added default resources for Managed Service for ClickHouse®, which automatically apply when you create a cluster.
  • Added default resources for Managed Service for PostgreSQL clusters and connection poolers.
  • Fixed infinite reconciliation of the Managed Service for PostgreSQL component.

Message broker

Added default resources for Managed Service for Apache Kafka®, which automatically apply when you create a cluster.

Fixed issues

  • Fixed the issue with the internal FQDN for Managed Service for ClickHouse®.
  • Improved Managed Service for PostgreSQL status handling to prevent excessive update operations.
  • Fixed a bug where refresh tokens expired prematurely, requiring frequent kubeconfig updates.
  • Multiple minor fixes and improvements.

What's new in Stackland 0.3

Stackland 0.3 introduces new features and improvements that make the platform more user friendly and versatile.

Important updates

  • Updated the Managed PostgreSQL specification. Use the examples from the current version of our guides.

New features

  • Added the Managed Service for Apache Kafka® component. It enables creating message queues for data exchange between services.
  • Introduced the combined server role. It combines the control-plane and worker functions, reducing the minimum size of a fault-tolerant cluster to just three servers.
  • Support for servers with a single disk for the control-plane role is now available. It is convenient for working with small clusters.
  • Point-in-time recovery is now supported for the PostgreSQL clusters. The cluster now can be recovered from a specific moment in the past.

Improvements

  • Optimized naming system for platform components.
  • New Grafana dashboards for Storage and Object Storage.

UI improvements

  • Added Role bindings and Cluster role bindings to the Access management section.
  • New Replicas, DaemonSets, and CronJobs tabs in the Workload section.
  • Implemented timeline filtering in the System dashboard section.
  • You can now add projects to your favorites.
  • You can select the UI language.
  • The UI now displays information about the PostgreSQL cluster fault tolerance.

Fixed issues

  • Implemented static file compression, reducing the first load time by 0.3-0.4 seconds.
  • Fixed the key name display on the overview page.
  • Improved the error message display: now you will see a clear message when you try to create an access key without any buckets.
  • Fixed the error where trying to delete a non-empty bucket incorrectly displayed a message about successful deletion.
Next
Installation