(DOCSP-25320): MEKO 1.17 release notes (#1057)

* 1.17 release notes

* copy review feedback 1

* tech review feedback

* last copy review

Author: davidhou17

source/release-notes.txt

@@ -12,6 +12,56 @@ Release Notes for |k8s-op-full|
    :depth: 1
    :class: singlecol
 
+.. _ent-op-1.17.x:
+
+|k8s-op-full| 1.17 Series
+-------------------------
+
+*Released 2022-09-19*
+
+.. warning:: **Breaking Changes**
+    
+   This release removes support for |onprem| 4.4. Upgrade to |onprem| 5.0 or 
+   later before upgrading to |k8s-op-short| 1.17. For detailed instructions,
+   see :opsmgr:`Upgrade Ops Manager </tutorial/upgrade-ops-manager/>`.
+
+   For more information about |onprem| 4.4 EOL, see 
+   :website:`Legacy Support </support-policy/legacy>`.
+
+   This release also removes support for |tls| certificates in 
+   concatenated |pem| format. Before upgrading to |k8s-op-short| 
+   1.17, migrate your |pem| files stored as :k8sdocs:`Opaque secrets 
+   </concepts/configuration/secret/#opaque-secrets>` to 
+   :k8sdocs:`kubernetes.io/tls </concepts/configuration/secret/#tls-secrets>` 
+   secrets. For detailed instructions, see 
+   :ref:`migrate-to-new-tls-format`.
+
+Security Fixes
+``````````````
+
+- Introduces the ``readOnlyRootFilesystem`` setting for all deployed 
+  containers. This change also introduces additional 
+  :k8sdocs:`volumes and volume mounts </concepts/storage/volumes/>`.
+- Introduces the ``allowPrivilegeEscalation`` setting for all deployed 
+  containers. This field is set to ``false`` by default.
+
+MongoDB Resource
+````````````````
+ 
+- Deprecates Ubuntu-based images. Using UBI images is recommended. 
+  If you have questions about this change, contact `MongoDB Support
+  <https://support.mongodb.com/welcome>`__ and 
+  complete the requested fields to open a support ticket.
+ 
+MongoDBOpsManager Resource
+``````````````````````````
+
+- Adds the
+  :opsmgrkube:`spec.backup.s3OpLogStores.s3RegionOverride` and  
+  :opsmgrkube:`spec.backup.s3Stores.s3RegionOverride` fields,
+  which allow you to specify the region where your |s3|-compatible 
+  bucket resides.
+ 
 .. _ent-op-1.16.x:
 
 |k8s-op-full| 1.16 Series