PendingReleaseNotes

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
#
# PENDING RELEASE NOTES
#
# WHEN DEVELOPING A NEW FEATURE OR MAKING A (MAJOR) CHANGE TO
# AN EXISTING FEATURE DEVELOPERS ARE ENCOURAGED TO UPDATED THIS
# FILE WITH THE CHANGES THEY MADE.
#
# THE RELEASE MANAGER CAN USE THIS FILE AS A SOURCE OF INFORMATION
# WHEN COMPILING THE RELEASE NOTES FOR A NEW RELEASE.
#
# THIS FILE IS TRUNCATED AFTER THE RELEASE OF THE NEW VERSION
#
#


example.ver.1 > example.ver.2:
  * VirtualRouters are now deployed with the latest version of ExampleLinux
    and wil also use a new MyFirstDHCPServer instead of dnsmasq to provide
    faster and more robust deployment of new Instances

  * ISOs are no longer supported and will be replaced by 2.88MB Floppy Drives
    which can now be attached to Instances. This is to prevent the Secondary
    Storage to grow to enormous sizes as Linux Distributions keep growing in
    size while a stripped down Linux should fit on a 2.88MB floppy.

4.22.1.0 > 4.23.0.0:
  * VPC tiers created without an explicit network ACL now default to the
    default_deny ACL (matching private gateway behavior) instead of being
    persisted without any ACL, when the network offering supports the
    NetworkACL service. Automation that created tiers without the aclid
    parameter and relied on the previous implicit egress-allow behavior of
    VR-based tiers should pass an explicit aclid.

  * Kubernetes clusters can no longer be created on VPC tiers that have no
    network ACL attached or that use the immutable default_deny ACL; the API
    now fails fast at validation instead of failing partway through cluster
    provisioning. Attach an ACL that allows the required traffic (for example
    default_allow or a custom ACL) to the tier before creating the cluster.

  * createVpnGateway now validates up front that the VPC's offering provides
    the Vpn service through an available Site-to-Site VPN provider, returning
    a clear error instead of "Cannot found source nat ip".

  * NSX: Site-to-Site VPN is now implemented natively for NSX NAT-mode VPCs.
    The Vpn service of the seeded "VPC offering with NSX - NAT Mode" is backed
    by route-based IPsec sessions terminating on the VPC's Tier-1 gateway. A
    dedicated public IP is acquired for the VPN local endpoint when the VPN
    gateway is created (or the IP passed via the ipaddressid parameter is
    used) and released when the gateway is deleted. Remote peers must use
    routed (VTI-style) IPsec configuration; policy-based peers requiring
    strict subnet selectors are not supported. Some cryptographic options
    permitted by CloudStack are rejected by NSX (3des, md5, aes192,
    modp6144 and above, IKE lifetime below 21600 seconds) with a clear error.

  * NSX network offerings can now reference existing IP discovery, MAC
    discovery, and segment security profiles. New NSX segments created from
    those offerings bind the selected profiles atomically with segment
    creation. Existing networks cannot be moved to an offering with different
    profile bindings; operators must create replacement networks when profile
    changes are required.

  * CloudStack-managed Kubernetes clusters now record explicit ownership of
    their generated firewall, port-forwarding, load-balancing, and VPC ACL
    rules. A reconcile API restores missing or drifted managed rules without
    adopting unrelated customer policy. Existing clusters remain
    legacy-unmanaged; a root administrator must validate and adopt their exact
    rule topology before non-direct clusters can use managed start, topology,
    or reconciliation workflows.

  * NSX zones can register operator-staged Tier-0 or VRF gateways and assign
    them to accounts or domains through dedicated administrative APIs. The
    feature is disabled by default (`nsx.vrf.scope=NONE`). CloudStack claims
    and releases registered gateway records but does not create or delete the
    physical NSX gateways, uplinks, or BGP configuration.