v1.65.0 🍀 Tracking Issue

[Sparksssj]

This is a "living" issue used to track bug fixes, features, and things landing in the next release of Bottlerocket v1.65.0.

This is a convenient way for the maintainers and the community to have a birds eye view of what's happening in any given Bottlerocket release. You'll find things we're targeting for the release, target dates, and important maintenance tasks.

But anything is subject to change, this isn't a guarantee anything will actually land in a given release, and this tracking issue is not all encompassing. For a full comparison of new things for this release, use the GitHub /compare feature and check the differences between the 1.65.x branch and develop.

[xiaotianlyu]

The 1.65.0 release has passed validation and will be published shortly. AMIs and SSM parameters should already be available for this release or will be shortly. Watch for the release at https://github.com/bottlerocket-os/bottlerocket/releases to signal when the release is complete.

[mikkeloscar]

The release is still marked a pre-release so I understand it's not considered ready, I just wondering if something went wrong in the release or it's expected to take 5+ days?

I still don't see k8s AMIs in ssm:

AWS_REGION=us-east-1 aws ec2 describe-images --image-ids $(aws ssm get-parameter --region us-east-1 --name /aws/service/bottlerocket/aws-k8s-1.36/x86_64/latest/image_id \
    --region us-east-1 --query "Parameter.Value" --output text) | jq -r '.Images[].Description'

bottlerocket-aws-k8s-1.36-x86_64-v1.64.0-ad9d4847

We recently started adopting Bottlerocket, over a custom Ubuntu AMI, with the expectation that Bottlerocket provides a better and faster lifecycle e.g. for addressing CVEs. It's the first Bottlerocket release we observe, we are especially interested if it fixes many of the Critical CVEs flagged in v1.64.0

[mhmtsvr]

In my experience, the Bottlerocket team isn't very consistent about removing the pre-release tag. Sometimes it's gone in a day or two, sometimes it takes 2-3 weeks. It would be awesome if that removal were automated, so we know when to expect the move from pre-release to latest.

[xiaotianlyu]

Thanks for checking! The 1.65.0 release is still progressing through the expected rollout and validation process. We expect the release to complete within the next day or two. We’ll update the release once it is complete.

[ginglis13]

Hi @mikkeloscar and @mhmtsvr, thanks for the questions. Nothing has gone wrong with v1.65.0. The "pre-release" period is an expected part of every release where we test and validate AMIs in every AWS region in waves to reduce impact in the case of a bad release.

When we tag a release, the AMIs get built and then rolled out through staged update waves across regions, while the release goes through validation. During that window the GitHub release keeps the pre-release flag and the /aws/service/bottlerocket/.../latest/image_id SSM parameter deliberately keeps pointing at the previous stable version. Once the release has finished rolling out and cleared validation in a region, we drop the pre-release flag and latest moves to the new version.

If you need v1.65.0 now, you don't have to wait for latest to flip. Whenever the pre-release is published, we also publish version-pinned SSM parameters for every region. e.g.:

aws ssm get-parameter --region us-east-1 \
  --name /aws/service/bottlerocket/aws-k8s-1.36/x86_64/1.65.0/image_id \
  --query "Parameter.Value" --output text

As @xiaotianlyu said, we'll post here when v1.65.0 is promoted out of pre-release.

[xiaotianlyu]

Bottlerocket 1.65.0 has been released! 🚀

Please see https://github.com/bottlerocket-os/bottlerocket/releases/v1.65.0 for more details.

[mikkeloscar]

Thanks a lot for the details. We now run the latest version in our test environment!

we are especially interested if it fixes many of the Critical CVEs flagged in v1.64.0

Unfortunately v1.65.0 doesn't bring any change to this, still the same amount of CVEs present

[ginglis13]

@mikkeloscar The recommend approach for security related concerns is to reach out directly to AWS/Amazon Security, as opposed to via issues on GitHub. Please refer to our SECURITY.md