v11.0.1

Orchestrator Changes

Kubernetes

• Return enableDebuggingHandlers to default behaviour (#747)

v11.0.0

OS Changes

• Add image signing verification for ECR images signed by AWS Signer (#722)
• Add an apiclient command to lockdown the datastore to prevent further changes (#727)
• Provide rottweiler, a unified storage encryption helper (#717)
• Add support for encrypted storage (#721)
• Fix whippet defaults and wildcard replacements (#720)
• Add apiclient support to exclude settings prefixes and canonicalize output (#716)
• Add apiclient network configure subcommand (#714)
• Ensure that bootconfig keys are written in a consistent order (#735)
• Enhance bloodhound CIS compliance checks (#665, #738)
• Decouple the network stack initialization from the DATA partition (#638)
• Add EBS volumes support for ephemeral storage (#395) - Thanks @jesseanttila-cai
• Build systemd-257 with cryptsetup support (#691)
• Update host-ctr go dependencies (#723)
• Build libcryptsetup and libdevmapper with udev support (#706)
• Support kdump for zboot kernels on aarch64 (#707)

Third Party Package Updates

• Add hwloc package (#672)
• Update systemd-252 to v252.39 (#700)
• Update systemd-257 to v257.9 (#691)
• Drop socat package (#742)
• Update libexpat (#695)
• Add libudev package (#706)
• Update kexec-tools (#707)
• Add docker-cli-29, docker-engine-29 packages (#711, #743, #745)
• Update aws-otel-collector, aws-signing-helper (#715)
• Update containerd-1.7, containerd-2.0, containerd-2.1 (#724)

Build Changes

• Add changelog validation improvements (#699)
• Update bottlerocket-settings-models to v0.17.0 (#689)
• Update twoliter from v0.12.0 to v0.13.0 (#736)

Orchestrator Changes

Kubernetes

• Update DNS IP generation to support IPv6 (#734)
• Update to latest versions of ecr-credential-provider and kubernetes packages (#715)
• Add enableDebuggingHandlers, imageMinimumGCAge, maxParallelImagePulls, ImageMaximumGCAge and CPU manager settings (#689)

ECS

• Default to containerd's transfer service for docker-engine-29 (#730)

v10.9.3

Orchestrator Changes

Kubernetes

• Patch ecr-credential-provider to support AWS EUSC (#729)

v10.9.2

OS Changes

• Patch runc to set the correct mode for tmpfs mounts (#731)

v10.9.1

OS Changes

• Update runc to v1.2.8 (#708)

v10.9.0

OS Changes

• Update runc to v1.2.7 and include CVE patches (#6813a59b, #6e3d3e2e, #f330515a)
• containerd-2.1: fix image pull error when range-get request is ignored (#702)

v10.8.1

Build Changes

• Update bottlerocket-sdk from 0.65.0 to 0.65.1 (#698)

v10.8.0

OS Changes

• Provide command to detect first and third-party accelerated hardware (#644)
• Provide whippet as an alternative dbus-launcher (#661, #678)
• Make dbus-broker require dbus-launcher capability (#677)
• Provide dbus-broker-launcher as a separate package (#677)
• Allow multiple sequential calls of apiclient ephemeral-storage bind (#679)
• Log pending settings only for debug or higher log levels (#690) - Thanks @fletcherw

Build Changes

• Update bottlerocket-sdk from 0.64.0 to 0.65.0 (#684)
• Fix clippy warnings for Rust 1.90.0 (#684)

Third Party Package Updates

• Update aws-iam-authenticator, aws-ssm-agent (#684, #688)

v10.7.1

Third Party Package Updates

• Add a patch for libnvidia-container to support glibc (#687)

v10.7.0

⚠️ Core-kit v10.7.0 has a known issue with Nvidia variants. Please see #685 for details

OS Changes

• Update Rust dependencies for first-party sources (#673)
• Update Go dependencies for first-party sources (#673)
• Patch systemd to suppress a warning log that is not applicable to Bottlerocket (#681)

Third Party Package Updates

• Update glibc and docker-engine (#676, #671)
• Update core libraries: libpcre, readline, libz, libtirpc, libnftl, libbncurses, libinih, libglib, libffi, libbpf, libdevmapper, and libscrypsetup (#683)
• Update core system utilities: iproute, strace, nvme-cli, libnvme, xfsprogs, ethtool, util-linux, pciutils, dbus-broker, and e2fsprogs(#675, #680)

Build Changes

• Update bottlerocket-settings-models to v0.16.0 (#646)

Orchestrator Changes

Kubernetes

• Add pid resource to kubeReserved setting (#646)