1. Docs
  2. Changes and releases
  3. CAPZ releases

CAPZ Releases

  • CAPZ releases releases azure-35.0.1

    Changes compared to v34.5.0

    Components

    • cluster-azure from v5.4.2 to v9.0.0
    • cluster from v5.3.2 to v8.0.0
    • Added containerd v2.3.2
    • Kubernetes from v1.34.10 to v1.35.8
    • os-tooling from v1.33.1 to v1.34.0

    cluster-azure v5.4.2…v9.0.0

    Added

    • Add global.providerSpecific.failureDomains to restrict the availability zones of the region the control plane nodes are allowed to run in.
    • CI: Run the full set of E2E test suites automatically on release PRs, via .github/release-pr-body.md. Towards https://github.com/giantswarm/roadmap/issues/4334
    • Node pools: Add minSize and maxSize fields to enable per-node-pool autoscaling configuration.
    • Autoscaling: Deploy cluster-autoscaler to the management cluster org-namespace using in-cluster credentials to scale MachineDeployments.
    • Add support for network.giantswarm.io/wildcard-cname-target annotation on AzureCluster via global.connectivity.dns.wildcardCnameTarget.

    Changed

    • Chart: Migrate Apps to HelmReleases.
    • cert-manager: Fix version assignment.
    • Set default for nodepool’s encryptionAtHost parameter to false.
    • Enable cert-manager DNS challenges by default.
    • Make: Fix application variable.
    • Move network.giantswarm.io/wildcard-cname-target annotation from AzureCluster CR to Cluster CR.
    • Add proxy values to azuredisk-csi-driver and azurefile-csi-driver HelmRelease default values.
    • Add _clusterautoscaler_app_config.yaml to provide Azure subscriptionID to cluster-autoscaler.
    • Migrate external-dns-private from App CR to HelmRelease, removing cluster-values ConfigMap reference.
    • Add proxy env vars and ciliumNetworkPolicy to external-dns-private default values.

    Removed

    • coredns: Drop the provider-specific values override now covered by the shared cluster chart defaults.
    • Templates: Remove dead container registry cache schema.
    • Chart: Remove unused cluster-shared library chart dependency.

    Fixed

    • Bump HelmRelease resources from the removed helm.toolkit.fluxcd.io/v2beta1 API to helm.toolkit.fluxcd.io/v2 so cluster apps render on management clusters running current Flux.

    cluster v5.3.2…v8.0.0

    Added

    • Add cert-manager-crossplane-resources HelmRelease.
    • Feature Gates: Add support for defining maximum Kubernetes version.
    • Apps: Add External DNS Crossplane Resources.
    • Apps: Deploy cluster-autoscaler inCluster in Azure.
    • MachineDeployment: Add CAPI autoscaler annotations (cluster-api-autoscaler-node-group-min-size/max-size) when minSize/maxSize are set on a node pool (only in Azure).
    • Apps: Add Cluster Autoscaler Crossplane Resources.
    • Control Plane: Add Kamaji control plane support with KamajiControlPlane resource, Kamaji etcd HelmRelease, automation RBAC, and cleanup jobs. (#740)

    Changed

    • Chart: Migrate Apps to HelmReleases.
    • Migrate coredns HelmRelease values to the new coredns-app zone-aware interface.
    • Rename the internal coredns control plane helper to align with the controlPlane values key.
    • Updated cert-manager to v4.0.0 and migrated the values to match the new chart’s schema.
    • Support templating on the global.apps.<name>.extraConfigs.name field.
    • Add support for AKS clusters
    • Add support for disabling the external autoscaler annotation (cluster.x-k8s.io/replicas-managed-by: "external-autoscaler") on MachinePools.
    • Refactor providerIntegration.resourcesApi.machinePoolResourcesEnabled into an object providerIntegration.resourcesApi.machinePoolResources and move externalAutoscaler under it (now providerIntegration.resourcesApi.machinePoolResources.externalAutoscaler).
    • Bump Flux OCIRepository version to v1.
    • Control Plane: Remove handling of clusterRole resources for kamaji Datastore CRs and create kamaji-etcd polex here.
    • Control Plane: Make etcd image tag configurable. (#841)
    • Chart: Require global.release.version if using Releases to give a better rendering error message.
    • Chart: Fix validation errors.
    • Configure observability-bundle with the management cluster name.
    • Apps: Skip kyverno-crds dependency for cluster-autoscaler when deployed inCluster.
    • Apps: Add cluster-probes HelmRelease to deploy ServiceMonitors for probing workload cluster API server endpoint from the management cluster. Configurable via global.apps.clusterProbes with default module http_2xx_insecure for self-signed certificates.
    • Helpers: Use .Chart.AppVersion in app.kubernetes.io/version label.
    • Cluster API: Migrate to API v1beta2.

    Removed

    • Cluster API: Remove strategy.rollingUpdate.deletePolicy from node pools.

    Fixed

    • Control Plane: Ensure components start correctly when SELinux is set to enforcing.

    Apps

    • cert-exporter from v2.10.1 to v2.12.0
    • cert-manager from v3.13.0 to v4.1.1
    • cilium from v1.4.3 to v1.5.1
    • cilium-servicemonitors from v0.1.4 to v0.2.0
    • Added cluster-autoscaler v2.0.4
    • coredns from v1.30.0 to v1.32.0
    • etcd-defrag from v1.2.6 to v1.2.10
    • external-dns from v3.4.0 to v3.5.0
    • net-exporter from v1.23.1 to v1.24.0
    • network-policies from v0.1.3 to v0.2.0
    • node-exporter from v1.20.11 to v1.20.13
    • observability-bundle from v2.8.0 to v3.3.1
    • prometheus-blackbox-exporter from v0.7.0 to v0.9.0
    • Added rbac-bootstrap v0.3.0
    • security-bundle from v1.17.1 to v2.3.0
    • teleport-kube-agent from v0.10.8 to v0.11.1

    cert-exporter v2.10.1…v2.12.0

    Added

    • Regression tests covering the v2.11.1 metrics endpoint fix: concatenated and repeated certificates in secrets and files, and an endpoint level test asserting /metrics keeps returning 200 and serving the remaining metrics when a duplicate series is emitted.
    • ATS: End to end test for a TLS secret whose tls.crt holds a concatenated certificate chain.

    Changed

    • ATS: cert_gen now sets a certificate serial number, which defaulted to 0 for every generated certificate.
    • Go: Update dependencies.
    • Templates: Move PolicyException to kube-system namespace.
    • Build and publish a multi-arch (linux/amd64 + linux/arm64) container image. Required so the cert-exporter daemonset can run on Graviton/arm64 nodepools without exec format error.

    Fixed

    • Add a serialnumber label to the cert_exporter_not_after and cert_exporter_secret_not_after metrics so concatenated certificates no longer collide into identical series. The collision made the registry fail Gather(), which blanked out the entire /metrics endpoint (regression from v2.10.1).
    • Serve /metrics with ContinueOnError so a single problematic metric can no longer fail the whole scrape.

    cert-manager v3.13.0…v4.1.1

    Changed

    • Upgrade docker-kubectl image to support arm64 architecture
    • Updated cert-manager to upstream version v1.20.3.
    • Notes: cert-manager-edit ClusterRole no longer grants create on challenges.acme.cert-manager.io, nor create/patch/update on orders.acme.cert-manager.io.
    • Improved proxy settings by adding a proxy ConfigMap and setting upstream envFrom values for controller, webhook and cainjector.
    • Breaking: Helm values to be passed to the upstream cert-manager chart will now need to use the cert-manager path instead of root. For example, the value crds.enabled: true must now be set with cert-manager.crds.enabled: true.
    • Moved vendored chart to helm/cert-manager/charts/ and adapted sync scripts to follow new structure.

    cilium v1.4.3…v1.5.1

    Added

    • sync/verify-images.sh, run as the last step of sync/sync.sh and therefore in CI: renders the chart across four scenarios covering every image-bearing component and fails the sync unless each image is served from gsoci.azurecr.io/giantswarm/ or is explicitly listed in sync/unmirrored-images.txt. It also asserts that every configured image actually appears in a render, so a scenario that stops covering an image fails instead of silently narrowing the check. This replaces the removed patch’s fail guards, which were the only thing that made image drift visible on an upstream bump.

    Changed

    • Upgrade Cilium to v1.19.7.
    • Run the E2E test suites automatically on release PRs by adding .github/release-pr-body.md.
    • Upgrade Cilium to v1.19.6.
    • Switch Hubble TLS certificate provisioning from hubble.tls.auto.method: helm to cronJob (giantswarm#37201). The helm method minted certificates once and never renewed them, deterministically breaking hubble-relay when the leaf certs (1 year) or the CA (3 years) expired. With the cronJob method a hubble-generate-certs CronJob re-issues the leaf certificates every 4 months. On upgrade, the Helm-owned cilium-ca, hubble-server-certs and hubble-relay-client-certs secrets are deleted and re-created by a one-shot certgen job with a fresh 3-year CA; agents and hubble-relay hot-reload the new certificates without restarts.
    • Wire certgen’s --ca-enforce-validity-throughout-leaves-duration flag (new value certgen.enforceCAValidityThroughoutLeavesDuration, default true): the certgen job now fails roughly one year before the CA would no longer cover new leaf certificates, instead of silently issuing leafs that outlive the CA. certgen never rotates an existing CA on its own (cilium/certgen#500).
    • Relax hubble-relay podAffinity to preferredDuringSchedulingIgnoredDuringExecution so Karpenter can drain the last cilium-agent-bearing node during upgrades/consolidation instead of getting stuck on a required co-location with cilium.
    • Upgrade Cilium to v1.19.5.
    • Upgrade Cilium to v1.19.4.

    Removed

    • Removed the image.registry value and the sync patch behind it (roadmap#3264). The registry is now part of each image’s repository value, exactly as upstream ships it, so the chart no longer patches upstream’s cilium.image/cilium.operator.image helpers into a (list $ <image>) signature and no longer rewrites all 35 call sites with sed. helm/cilium/templates/_helpers.tpl and helm/cilium/templates/cilium-operator/_helpers.tpl are now byte-identical to upstream, and 15 template patches disappear from diffs/.

    Fixed

    • Fix four image references that were rendered as unpullable double-prefixed paths, because their repository already carried a registry while the removed patch prefixed image.registry on top: gsoci.azurecr.io/ghcr.io/spiffe/spire-server, .../spire-agent, .../docker.io/library/busybox (SPIRE mutual authentication) and .../docker.io/istio/ztunnel (encryption.type=ztunnel). All four now resolve. Latent until now because both features are disabled by default.
    • Fix rendering of the certgen job specs (hubble/tls-cronjob and clustermesh-apiserver/tls-cronjob): the image reference was not converted to the Giant Swarm cilium.image helper signature because the image-registries sync patch only processed *.yaml templates, so enabling the cronJob method failed with required list, but got "map".
    • Add NetworkPolicies allowing the hubble-generate-certs and clustermesh-apiserver-generate-certs certgen pods egress to the Kubernetes API.

    cilium-servicemonitors v0.1.4…v0.2.0

    Added

    • Add per-monitor enabled flag for the agent, hubble and operator.

    Changed

    • Switch all monitors from ServiceMonitor to PodMonitor.

    cluster-autoscaler v2.0.4

    Changed

    • Templates: Move PolicyException to kube-system namespace.

    coredns v1.30.0…v1.32.0

    Added

    • Wire up the full set of CoreDNS forward, cache, and kubernetes block parameters in the structured zone config:
      • forward: maxIdleConns, maxConnectAttempts, dohMethod, tls, tlsServername, next, nextOnNodata, failfastAllUnhealthyUpstreams, failover, resolver.
      • cache: zones, serveStale.verifyTimeout, disable.successZones, disable.denialZones.
      • kubernetes: endpoint, tls, kubeconfig, apiserverQPS, apiserverBurst, apiserverMaxInflight, namespaceLabels, fallthroughZones, multicluster, startupTimeout.

    Changed

    • Chart: Make tolerations configurable.
    • Rebuild with app-build-suite 2.2.0 (via architect orb 9.6.0): the packaged chart now carries Artifact Hub metadata (artifacthub.io/license and a Support link). No functional chart changes.
    • Standardize values.yaml comments to the # @schema / # -- (helm-docs) convention and remove section-header dividers, so values.schema.json and the chart README.md are generated from the values file. Rendered manifests are unchanged.
    • Update coredns image to 1.14.4.
    • update CoreDNS icon to light version
    • Update coredns image to 1.14.3.

    Fixed

    • Render the health directive in only the . server block. The health plugin is process-wide and can be enabled in just one Server Block, so emitting it in every zone block was invalid. ready is kept in every block (its readiness is aggregated across blocks).
    • Correct the coredns.*.cache.serveStale.refreshMode schema enum to immediate/verify (was immediate/background), matching the CoreDNS cache plugin.

    etcd-defrag v1.2.6…v1.2.10

    Changed

    • Chart: Update dependency ahrtr/etcd-defrag to v0.43.0. (#125)
    • Chart: Update dependency ahrtr/etcd-defrag to v0.42.0. (#120)
    • Chart: Update dependency ahrtr/etcd-defrag to v0.41.0. (#108)
    • Chart: Update dependency ahrtr/etcd-defrag to v0.40.0. (#94)

    external-dns v3.4.0…v3.5.0

    Changed

    • Update VPA updatePolicy.updateMode from deprecated Auto to Recreate.
    • Upgrade external-dns to v0.21.0.
    • Sync to upstream helm chart 1.21.1.
      • Add namespaceOverride value to support deploying external-dns into a different namespace than the Helm release (useful for subchart usage).
      • Add enableGatewayListenerSets value to opt into Gateway API ListenerSet resource support.
      • Add sourceNamespace value (used with namespaced=true) to watch resources in a namespace different from the deployment namespace.
      • Avoid creating cluster-scoped namespace RBAC when gatewayNamespace is set, reducing required permissions.
      • Fix extraArgs map handling: boolean values now render as --flag / --no-flag and string values are properly quoted.
    • Use external-dns.namespace in VPA and NetworkPolicy resources.

    net-exporter v1.23.1…v1.24.0

    Changed

    • Build and publish a multi-arch (linux/amd64 + linux/arm64) container image. Required so the net-exporter daemonset can run on Graviton/arm64 nodepools without exec format error.
    • Bump docker-kubectl init container from 1.25.4 to 1.36.0.

    network-policies v0.1.3…v0.2.0

    Added

    • Add support for AKS selector labels.

    Changed

    • Deprecated the .Values.kamaji in favour of the more generic .Values.konnectivityAgent to control the behaviour for the konnectivity-agent.

    node-exporter v1.20.11…v1.20.13

    Changed

    • CircleCI: Do not override app version.
    • Chart: Move PolicyException to kube-system namespace.

    observability-bundle v2.8.0…v3.3.1

    Added

    • Add KSM metrics for Gateway API ListenerSet and ReferenceGrant resources.
    • Add Backstage audience annotations.
    • Add managementCluster: "" as a top-level value (populated from the cluster chart via defaultValues)
    • Moves full KSM metricRelabelings ownership from kube-prometheus-stack-app into observability-bundle

    Changed

    • Values: Generate schema for Alloy PodLogs CRDs.
    • Values: Add Cilium as dependency for Alloy apps & Kube Prometheus Stack.
    • Values: Update Alloy apps to v0.21.2.
    • Update Gateway API KSM configs to v1 for Gateway, GatewayClass, HTTPRoute, GRPCRoute, TLSRoute and BackendTLSPolicy.
    • Update kube-prometheus-stack and prometheus-operator-crd to 22.0.0
    • Update alloy-app to 0.21.0
    • HelmReleases: honor the App platform priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)
    • Migrate sub-apps from App CRs to Flux HelmRelease CRs.
    • Remove ‘cluster-values’ ConfigMap reference from HelmReleases.
    • Add new alloy-podlogs-crds chart.
    • Update alloy-app to 0.20.0
    • Update dependency kube-prometheus-stack-app and prometheus-operator-crd to v21.0.0
    • Update alloy-app to 0.19.0

    Removed

    • Values: Remove unused catalog.

    prometheus-blackbox-exporter v0.7.0…v0.9.0

    Added

    • Add VPA for blackbox-exporter. Uses updateMode: Initial for DaemonSet and updateMode: Auto for Deployment.
    • Add toleration for kubernetes.io/arch=arm64:NoSchedule so the DaemonSet schedules on ARM worker nodes.

    Fixed

    • Add probe_target label to ensure unique synthetic metrics

    rbac-bootstrap v0.3.0

    Added

    • Add io.giantswarm.application.managed chart annotation for Backstage visibility.
    • Add optional cluster-reader ClusterRole (off by default, enabled via clusterReader.enabled: true) that aggregates into the built-in view ClusterRole and grants read access (get/list/watch) on cluster-scoped resources.

    Changed

    • Migrate chart metadata annotations to OCI-compatible format.

    security-bundle v1.17.1…v2.3.0

    Changed

    • Update kyverno-policy-operator (app) to v0.2.3.
    • Update policy-api (app) to v0.0.9.
    • Update starboard-exporter (app) to v1.2.3.
    • Update trivy (app) to v0.17.0.
    • Update trivy-operator (app) to v0.13.3.
    • Run the E2E test suites automatically on release PRs by adding .github/release-pr-body.md.
    • Values: Make Kyverno and Kyverno Policy Operator depend on Cilium.
    • Update kyverno-policies (app) to v0.26.1.
    • Update starboard-exporter (app) to v1.1.4.
    • Update trivy (app) to v0.16.0.
    • Update trivy-operator (app) to v0.13.2.
    • Update cloudnative-pg (app) to v0.1.0.
    • Update trivy (app) to v0.15.0.
    • Update falco (app) to v0.12.0.
    • HelmReleases: honor the App platform priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)
    • Migrate sub-apps from App CRs to Flux HelmRelease CRs.
    • No longer pass the ‘cluster-values’ ConfigMap to the applications inside the bundle.
    • Update kyverno (app) to v0.24.2.
    • Update kyverno-crds (app) to v1.17.0.
    • Update kyverno-policies (app) to v0.25.0.
    • Update kyverno-policy-operator (app) to v0.2.2.
    • Update kubescape (app) to v0.1.0.

    teleport-kube-agent v0.10.8…v0.11.1

    Changed

    • Values: Tolerate node.cloudprovider.kubernetes.io/uninitialized.
    • Values: Ignore taints regardless of value.
    • Values: Pass HTTP proxy settings to sub-chart.
    • Updated teleport-kube-agent to upstream version v18.7.6.
  • CAPZ releases releases azure-35.0.0

    Changes compared to v34.5.0

    Components

    • cluster-azure from v5.4.2 to v9.0.0
    • cluster from v5.3.2 to v8.0.0
    • Added containerd v2.3.2
    • Kubernetes from v1.34.10 to v1.35.8
    • os-tooling from v1.33.1 to v1.34.0

    cluster-azure v5.4.2…v9.0.0

    Added

    • Add global.providerSpecific.failureDomains to restrict the availability zones of the region the control plane nodes are allowed to run in.
    • CI: Run the full set of E2E test suites automatically on release PRs, via .github/release-pr-body.md. Towards https://github.com/giantswarm/roadmap/issues/4334
    • Node pools: Add minSize and maxSize fields to enable per-node-pool autoscaling configuration.
    • Autoscaling: Deploy cluster-autoscaler to the management cluster org-namespace using in-cluster credentials to scale MachineDeployments.
    • Add support for network.giantswarm.io/wildcard-cname-target annotation on AzureCluster via global.connectivity.dns.wildcardCnameTarget.

    Changed

    • Chart: Migrate Apps to HelmReleases.
    • cert-manager: Fix version assignment.
    • Set default for nodepool’s encryptionAtHost parameter to false.
    • Enable cert-manager DNS challenges by default.
    • Make: Fix application variable.
    • Move network.giantswarm.io/wildcard-cname-target annotation from AzureCluster CR to Cluster CR.
    • Add proxy values to azuredisk-csi-driver and azurefile-csi-driver HelmRelease default values.
    • Add _clusterautoscaler_app_config.yaml to provide Azure subscriptionID to cluster-autoscaler.
    • Migrate external-dns-private from App CR to HelmRelease, removing cluster-values ConfigMap reference.
    • Add proxy env vars and ciliumNetworkPolicy to external-dns-private default values.

    Removed

    • coredns: Drop the provider-specific values override now covered by the shared cluster chart defaults.
    • Templates: Remove dead container registry cache schema.
    • Chart: Remove unused cluster-shared library chart dependency.

    Fixed

    • Bump HelmRelease resources from the removed helm.toolkit.fluxcd.io/v2beta1 API to helm.toolkit.fluxcd.io/v2 so cluster apps render on management clusters running current Flux.

    cluster v5.3.2…v8.0.0

    Added

    • Add cert-manager-crossplane-resources HelmRelease.
    • Feature Gates: Add support for defining maximum Kubernetes version.
    • Apps: Add External DNS Crossplane Resources.
    • Apps: Deploy cluster-autoscaler inCluster in Azure.
    • MachineDeployment: Add CAPI autoscaler annotations (cluster-api-autoscaler-node-group-min-size/max-size) when minSize/maxSize are set on a node pool (only in Azure).
    • Apps: Add Cluster Autoscaler Crossplane Resources.
    • Control Plane: Add Kamaji control plane support with KamajiControlPlane resource, Kamaji etcd HelmRelease, automation RBAC, and cleanup jobs. (#740)

    Changed

    • Chart: Migrate Apps to HelmReleases.
    • Migrate coredns HelmRelease values to the new coredns-app zone-aware interface.
    • Rename the internal coredns control plane helper to align with the controlPlane values key.
    • Updated cert-manager to v4.0.0 and migrated the values to match the new chart’s schema.
    • Support templating on the global.apps.<name>.extraConfigs.name field.
    • Add support for AKS clusters
    • Add support for disabling the external autoscaler annotation (cluster.x-k8s.io/replicas-managed-by: "external-autoscaler") on MachinePools.
    • Refactor providerIntegration.resourcesApi.machinePoolResourcesEnabled into an object providerIntegration.resourcesApi.machinePoolResources and move externalAutoscaler under it (now providerIntegration.resourcesApi.machinePoolResources.externalAutoscaler).
    • Bump Flux OCIRepository version to v1.
    • Control Plane: Remove handling of clusterRole resources for kamaji Datastore CRs and create kamaji-etcd polex here.
    • Control Plane: Make etcd image tag configurable. (#841)
    • Chart: Require global.release.version if using Releases to give a better rendering error message.
    • Chart: Fix validation errors.
    • Configure observability-bundle with the management cluster name.
    • Apps: Skip kyverno-crds dependency for cluster-autoscaler when deployed inCluster.
    • Apps: Add cluster-probes HelmRelease to deploy ServiceMonitors for probing workload cluster API server endpoint from the management cluster. Configurable via global.apps.clusterProbes with default module http_2xx_insecure for self-signed certificates.
    • Helpers: Use .Chart.AppVersion in app.kubernetes.io/version label.
    • Cluster API: Migrate to API v1beta2.

    Removed

    • Cluster API: Remove strategy.rollingUpdate.deletePolicy from node pools.

    Fixed

    • Control Plane: Ensure components start correctly when SELinux is set to enforcing.

    Apps

    • cert-exporter from v2.10.1 to v2.12.0
    • cert-manager from v3.13.0 to v4.1.1
    • cilium from v1.4.3 to v1.5.1
    • cilium-servicemonitors from v0.1.4 to v0.2.0
    • Added cluster-autoscaler v2.0.4
    • coredns from v1.30.0 to v1.32.0
    • etcd-defrag from v1.2.6 to v1.2.10
    • external-dns from v3.4.0 to v3.5.0
    • net-exporter from v1.23.1 to v1.24.0
    • network-policies from v0.1.3 to v0.2.0
    • node-exporter from v1.20.11 to v1.20.13
    • observability-bundle from v2.8.0 to v3.3.1
    • prometheus-blackbox-exporter from v0.7.0 to v0.9.0
    • Added rbac-bootstrap v0.3.0
    • security-bundle from v1.17.1 to v2.3.0
    • teleport-kube-agent from v0.10.8 to v0.11.1

    cert-exporter v2.10.1…v2.12.0

    Added

    • Regression tests covering the v2.11.1 metrics endpoint fix: concatenated and repeated certificates in secrets and files, and an endpoint level test asserting /metrics keeps returning 200 and serving the remaining metrics when a duplicate series is emitted.
    • ATS: End to end test for a TLS secret whose tls.crt holds a concatenated certificate chain.

    Changed

    • ATS: cert_gen now sets a certificate serial number, which defaulted to 0 for every generated certificate.
    • Go: Update dependencies.
    • Templates: Move PolicyException to kube-system namespace.
    • Build and publish a multi-arch (linux/amd64 + linux/arm64) container image. Required so the cert-exporter daemonset can run on Graviton/arm64 nodepools without exec format error.

    Fixed

    • Add a serialnumber label to the cert_exporter_not_after and cert_exporter_secret_not_after metrics so concatenated certificates no longer collide into identical series. The collision made the registry fail Gather(), which blanked out the entire /metrics endpoint (regression from v2.10.1).
    • Serve /metrics with ContinueOnError so a single problematic metric can no longer fail the whole scrape.

    cert-manager v3.13.0…v4.1.1

    Changed

    • Upgrade docker-kubectl image to support arm64 architecture
    • Updated cert-manager to upstream version v1.20.3.
    • Notes: cert-manager-edit ClusterRole no longer grants create on challenges.acme.cert-manager.io, nor create/patch/update on orders.acme.cert-manager.io.
    • Improved proxy settings by adding a proxy ConfigMap and setting upstream envFrom values for controller, webhook and cainjector.
    • Breaking: Helm values to be passed to the upstream cert-manager chart will now need to use the cert-manager path instead of root. For example, the value crds.enabled: true must now be set with cert-manager.crds.enabled: true.
    • Moved vendored chart to helm/cert-manager/charts/ and adapted sync scripts to follow new structure.

    cilium v1.4.3…v1.5.1

    Added

    • sync/verify-images.sh, run as the last step of sync/sync.sh and therefore in CI: renders the chart across four scenarios covering every image-bearing component and fails the sync unless each image is served from gsoci.azurecr.io/giantswarm/ or is explicitly listed in sync/unmirrored-images.txt. It also asserts that every configured image actually appears in a render, so a scenario that stops covering an image fails instead of silently narrowing the check. This replaces the removed patch’s fail guards, which were the only thing that made image drift visible on an upstream bump.

    Changed

    • Upgrade Cilium to v1.19.7.
    • Run the E2E test suites automatically on release PRs by adding .github/release-pr-body.md.
    • Upgrade Cilium to v1.19.6.
    • Switch Hubble TLS certificate provisioning from hubble.tls.auto.method: helm to cronJob (giantswarm#37201). The helm method minted certificates once and never renewed them, deterministically breaking hubble-relay when the leaf certs (1 year) or the CA (3 years) expired. With the cronJob method a hubble-generate-certs CronJob re-issues the leaf certificates every 4 months. On upgrade, the Helm-owned cilium-ca, hubble-server-certs and hubble-relay-client-certs secrets are deleted and re-created by a one-shot certgen job with a fresh 3-year CA; agents and hubble-relay hot-reload the new certificates without restarts.
    • Wire certgen’s --ca-enforce-validity-throughout-leaves-duration flag (new value certgen.enforceCAValidityThroughoutLeavesDuration, default true): the certgen job now fails roughly one year before the CA would no longer cover new leaf certificates, instead of silently issuing leafs that outlive the CA. certgen never rotates an existing CA on its own (cilium/certgen#500).
    • Relax hubble-relay podAffinity to preferredDuringSchedulingIgnoredDuringExecution so Karpenter can drain the last cilium-agent-bearing node during upgrades/consolidation instead of getting stuck on a required co-location with cilium.
    • Upgrade Cilium to v1.19.5.
    • Upgrade Cilium to v1.19.4.

    Removed

    • Removed the image.registry value and the sync patch behind it (roadmap#3264). The registry is now part of each image’s repository value, exactly as upstream ships it, so the chart no longer patches upstream’s cilium.image/cilium.operator.image helpers into a (list $ <image>) signature and no longer rewrites all 35 call sites with sed. helm/cilium/templates/_helpers.tpl and helm/cilium/templates/cilium-operator/_helpers.tpl are now byte-identical to upstream, and 15 template patches disappear from diffs/.

    Fixed

    • Fix four image references that were rendered as unpullable double-prefixed paths, because their repository already carried a registry while the removed patch prefixed image.registry on top: gsoci.azurecr.io/ghcr.io/spiffe/spire-server, .../spire-agent, .../docker.io/library/busybox (SPIRE mutual authentication) and .../docker.io/istio/ztunnel (encryption.type=ztunnel). All four now resolve. Latent until now because both features are disabled by default.
    • Fix rendering of the certgen job specs (hubble/tls-cronjob and clustermesh-apiserver/tls-cronjob): the image reference was not converted to the Giant Swarm cilium.image helper signature because the image-registries sync patch only processed *.yaml templates, so enabling the cronJob method failed with required list, but got "map".
    • Add NetworkPolicies allowing the hubble-generate-certs and clustermesh-apiserver-generate-certs certgen pods egress to the Kubernetes API.

    cilium-servicemonitors v0.1.4…v0.2.0

    Added

    • Add per-monitor enabled flag for the agent, hubble and operator.

    Changed

    • Switch all monitors from ServiceMonitor to PodMonitor.

    cluster-autoscaler v2.0.4

    Changed

    • Templates: Move PolicyException to kube-system namespace.

    coredns v1.30.0…v1.32.0

    Added

    • Wire up the full set of CoreDNS forward, cache, and kubernetes block parameters in the structured zone config:
      • forward: maxIdleConns, maxConnectAttempts, dohMethod, tls, tlsServername, next, nextOnNodata, failfastAllUnhealthyUpstreams, failover, resolver.
      • cache: zones, serveStale.verifyTimeout, disable.successZones, disable.denialZones.
      • kubernetes: endpoint, tls, kubeconfig, apiserverQPS, apiserverBurst, apiserverMaxInflight, namespaceLabels, fallthroughZones, multicluster, startupTimeout.

    Changed

    • Chart: Make tolerations configurable.
    • Rebuild with app-build-suite 2.2.0 (via architect orb 9.6.0): the packaged chart now carries Artifact Hub metadata (artifacthub.io/license and a Support link). No functional chart changes.
    • Standardize values.yaml comments to the # @schema / # -- (helm-docs) convention and remove section-header dividers, so values.schema.json and the chart README.md are generated from the values file. Rendered manifests are unchanged.
    • Update coredns image to 1.14.4.
    • update CoreDNS icon to light version
    • Update coredns image to 1.14.3.

    Fixed

    • Render the health directive in only the . server block. The health plugin is process-wide and can be enabled in just one Server Block, so emitting it in every zone block was invalid. ready is kept in every block (its readiness is aggregated across blocks).
    • Correct the coredns.*.cache.serveStale.refreshMode schema enum to immediate/verify (was immediate/background), matching the CoreDNS cache plugin.

    etcd-defrag v1.2.6…v1.2.10

    Changed

    • Chart: Update dependency ahrtr/etcd-defrag to v0.43.0. (#125)
    • Chart: Update dependency ahrtr/etcd-defrag to v0.42.0. (#120)
    • Chart: Update dependency ahrtr/etcd-defrag to v0.41.0. (#108)
    • Chart: Update dependency ahrtr/etcd-defrag to v0.40.0. (#94)

    external-dns v3.4.0…v3.5.0

    Changed

    • Update VPA updatePolicy.updateMode from deprecated Auto to Recreate.
    • Upgrade external-dns to v0.21.0.
    • Sync to upstream helm chart 1.21.1.
      • Add namespaceOverride value to support deploying external-dns into a different namespace than the Helm release (useful for subchart usage).
      • Add enableGatewayListenerSets value to opt into Gateway API ListenerSet resource support.
      • Add sourceNamespace value (used with namespaced=true) to watch resources in a namespace different from the deployment namespace.
      • Avoid creating cluster-scoped namespace RBAC when gatewayNamespace is set, reducing required permissions.
      • Fix extraArgs map handling: boolean values now render as --flag / --no-flag and string values are properly quoted.
    • Use external-dns.namespace in VPA and NetworkPolicy resources.

    net-exporter v1.23.1…v1.24.0

    Changed

    • Build and publish a multi-arch (linux/amd64 + linux/arm64) container image. Required so the net-exporter daemonset can run on Graviton/arm64 nodepools without exec format error.
    • Bump docker-kubectl init container from 1.25.4 to 1.36.0.

    network-policies v0.1.3…v0.2.0

    Added

    • Add support for AKS selector labels.

    Changed

    • Deprecated the .Values.kamaji in favour of the more generic .Values.konnectivityAgent to control the behaviour for the konnectivity-agent.

    node-exporter v1.20.11…v1.20.13

    Changed

    • CircleCI: Do not override app version.
    • Chart: Move PolicyException to kube-system namespace.

    observability-bundle v2.8.0…v3.3.1

    Added

    • Add KSM metrics for Gateway API ListenerSet and ReferenceGrant resources.
    • Add Backstage audience annotations.
    • Add managementCluster: "" as a top-level value (populated from the cluster chart via defaultValues)
    • Moves full KSM metricRelabelings ownership from kube-prometheus-stack-app into observability-bundle

    Changed

    • Values: Generate schema for Alloy PodLogs CRDs.
    • Values: Add Cilium as dependency for Alloy apps & Kube Prometheus Stack.
    • Values: Update Alloy apps to v0.21.2.
    • Update Gateway API KSM configs to v1 for Gateway, GatewayClass, HTTPRoute, GRPCRoute, TLSRoute and BackendTLSPolicy.
    • Update kube-prometheus-stack and prometheus-operator-crd to 22.0.0
    • Update alloy-app to 0.21.0
    • HelmReleases: honor the App platform priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)
    • Migrate sub-apps from App CRs to Flux HelmRelease CRs.
    • Remove ‘cluster-values’ ConfigMap reference from HelmReleases.
    • Add new alloy-podlogs-crds chart.
    • Update alloy-app to 0.20.0
    • Update dependency kube-prometheus-stack-app and prometheus-operator-crd to v21.0.0
    • Update alloy-app to 0.19.0

    Removed

    • Values: Remove unused catalog.

    prometheus-blackbox-exporter v0.7.0…v0.9.0

    Added

    • Add VPA for blackbox-exporter. Uses updateMode: Initial for DaemonSet and updateMode: Auto for Deployment.
    • Add toleration for kubernetes.io/arch=arm64:NoSchedule so the DaemonSet schedules on ARM worker nodes.

    Fixed

    • Add probe_target label to ensure unique synthetic metrics

    rbac-bootstrap v0.3.0

    Added

    • Add io.giantswarm.application.managed chart annotation for Backstage visibility.
    • Add optional cluster-reader ClusterRole (off by default, enabled via clusterReader.enabled: true) that aggregates into the built-in view ClusterRole and grants read access (get/list/watch) on cluster-scoped resources.

    Changed

    • Migrate chart metadata annotations to OCI-compatible format.

    security-bundle v1.17.1…v2.3.0

    Changed

    • Update kyverno-policy-operator (app) to v0.2.3.
    • Update policy-api (app) to v0.0.9.
    • Update starboard-exporter (app) to v1.2.3.
    • Update trivy (app) to v0.17.0.
    • Update trivy-operator (app) to v0.13.3.
    • Run the E2E test suites automatically on release PRs by adding .github/release-pr-body.md.
    • Values: Make Kyverno and Kyverno Policy Operator depend on Cilium.
    • Update kyverno-policies (app) to v0.26.1.
    • Update starboard-exporter (app) to v1.1.4.
    • Update trivy (app) to v0.16.0.
    • Update trivy-operator (app) to v0.13.2.
    • Update cloudnative-pg (app) to v0.1.0.
    • Update trivy (app) to v0.15.0.
    • Update falco (app) to v0.12.0.
    • HelmReleases: honor the App platform priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)
    • Migrate sub-apps from App CRs to Flux HelmRelease CRs.
    • No longer pass the ‘cluster-values’ ConfigMap to the applications inside the bundle.
    • Update kyverno (app) to v0.24.2.
    • Update kyverno-crds (app) to v1.17.0.
    • Update kyverno-policies (app) to v0.25.0.
    • Update kyverno-policy-operator (app) to v0.2.2.
    • Update kubescape (app) to v0.1.0.

    teleport-kube-agent v0.10.8…v0.11.1

    Changed

    • Values: Tolerate node.cloudprovider.kubernetes.io/uninitialized.
    • Values: Ignore taints regardless of value.
    • Values: Pass HTTP proxy settings to sub-chart.
    • Updated teleport-kube-agent to upstream version v18.7.6.
  • CAPZ releases releases azure-34.5.0

    This release includes a containerd fix for a security vulnerability, and also bumps Kubernetes to v1.34.10 for the latest bugfixes and Flatcar to v4593.2.4.

    Components

    • Flatcar from v4593.2.2 to v4593.2.4
    • Kubernetes from v1.34.7 to v1.34.10
    • os-tooling from v1.31.0 to v1.33.1
  • CAPZ releases releases azure-34.4.0

    Changes compared to v34.3.0

    Components

    • cluster-azure from v5.4.1 to v5.4.2
    • cluster from v5.3.1 to v5.3.2
    • Flatcar from v4593.2.1 to v4593.2.2

    cluster-azure v5.4.1…v5.4.2

    Changed

    • Chart: Fix validation errors.

    cluster v5.3.1…v5.3.2

    Changed

    • Chart: Fix validation errors.
  • CAPZ releases releases azure-34.3.0

    Mitigates the “Dirty Frag” Linux kernel vulnerabilities (esp4/esp6, rxrpc) that could allow local privilege escalation and container escape on affected nodes.

    Changes compared to v34.2.0

    Components

    • Flatcar from v4459.2.4 to v4593.2.1
    • os-tooling from v1.28.0 to v1.31.0
  • CAPZ releases releases azure-34.2.0

    Changes compared to v34.1.1

    Components

    • cluster-azure from v5.3.0 to v5.4.1
    • cluster from v5.1.2 to v5.3.1
    • Flatcar from v4459.2.3 to v4459.2.4
    • Kubernetes from v1.34.5 to v1.34.7
    • os-tooling from v1.26.4 to v1.28.0

    cluster-azure v5.3.0…v5.4.1

    Changed

    • Apps: Enable rbac-bootstrap as a default HelmRelease app.

    cluster v5.1.2…v5.3.1

    Added

    • Apps: Add rbac-bootstrap as a default HelmRelease app with a default ClusterRoleBinding for giantswarm:giantswarm-admins.

    Changed

    • Apps: Use OCIRepository source for rbac-bootstrap HelmRelease.

    Fixed

    • Apps: Change rbac-bootstrap default role from read-all to view and add additional groups for token forwarded cases.

    Apps

    • azure-cloud-controller-manager from v2.0.0 to v2.1.0
    • azure-cloud-node-manager from v2.0.0 to v2.1.0
    • cert-exporter from v2.9.16 to v2.10.1
    • cilium from v1.4.1 to v1.4.3
    • coredns from v1.29.1 to v1.30.0
    • etcd-defrag from v1.2.4 to v1.2.6
    • k8s-dns-node-cache from v2.9.2 to v2.11.0
    • observability-bundle from v2.6.0 to v2.8.0
    • prometheus-blackbox-exporter from v0.5.1 to v0.7.0
    • security-bundle from v1.17.0 to v1.17.1

    azure-cloud-controller-manager v2.0.0…v2.1.0

    Changed

    • Migrate to App Build Suite (ABS).
    • Bump to upstream image v1.35.1

    Removed

    • Removed PodSecurityPolicy.
    • Removed global.podSecurityStandards.enforced helm value.

    azure-cloud-node-manager v2.0.0…v2.1.0

    Changed

    • Migrate to App Build Suite (ABS).
    • Bump to upstream image v1.35.1

    Removed

    • Removed PodSecurityPolicy.
    • Removed global.podSecurityStandards.enforced helm value.

    cert-exporter v2.9.16…v2.10.1

    Added

    • DaemonSet: Add VPA.

    Changed

    • Values: Tune resources.

    Fixed

    • Parse all PEM blocks in secrets and certificate files, not just the first one. This fixes false alerts when multiple certificates are concatenated (e.g. Kyverno webhook cert rotation).

    cilium v1.4.1…v1.4.3

    Changed

    coredns v1.29.1…v1.30.0

    Added

    • Add coredns-adopter job to adopt default CoreDNS resources on EKS clusters (disabled by default).

    Changed

    • Update coredns image to 1.14.2.

    etcd-defrag v1.2.4…v1.2.6

    Changed

    • Chart: Update dependency ahrtr/etcd-defrag to v0.39.0. (#86)
    • Chart: Update dependency ahrtr/etcd-defrag to v0.38.0. (#84)

    k8s-dns-node-cache v2.9.2…v2.11.0

    Added

    • Add configmap.log.enabled helm value to toggle CoreDNS query logging (default: false).
    • Make AAAA NOERROR configurable for IPv6.

    observability-bundle v2.6.0…v2.8.0

    Added

    • Add KSM metrics for Envoy Gateway resources.
    • Add application.giantswarm.io/team annotation from HelmReleases as label to KSM emitted metrics.

    Changed

    • Update kube-prometheus-stack to 20.1.0
    • Change team annotation in Chart.yaml to OpenContainers format (io.giantswarm.application.team).
    • Update alloy-app to 0.17.1
    • Update kube-prometheus-stack to 20.0.0
    • Update prometheus-operator-crd to 20.0.0

    prometheus-blackbox-exporter v0.5.1…v0.7.0

    Added

    • Add http_2xx_insecure module with insecure_skip_verify: true to support probing workload cluster API servers from the management cluster. The MC’s service account CA (http_2xx_k8sca) only covers the MC itself; workload clusters have their own CA which is not available to the blackbox exporter, making TLS verification impossible without this module.

    Changed

    • Set priorityClassName to system-node-critical to ensure DaemonSet pods are scheduled even on full nodes.

    security-bundle v1.17.0…v1.17.1

    Added

    • Add io.giantswarm.application.audience and io.giantswarm.application.managed chart annotations for Backstage visibility.

    Changed

    • Update falco (app) to v0.11.2.
    • Update gel (app) to v1.0.2.
    • Update kubescape (app) to v0.0.6.
    • Update reports-server (app) to v0.1.3.
    • Update starboard-exporter (app) to v1.0.3.
    • Update trivy (app) to v0.14.2.
    • Update trivy-operator (app) to v0.12.2.
    • Migrate chart annotations to OCI-compatible format.
  • CAPZ releases releases azure-34.1.1

    Changes compared to v34.1.0

    Apps

    • cert-manager from v3.11.0 to v3.13.0

    cert-manager v3.11.0…v3.13.0

    Added

    • Add control plane node toleration to CA injector deployment.

    Changed

    • Upgrade cert-manager to v1.19.4.

    Removed

    • Remove PodSecurityPolicy (PSP) and related resources.
    • Remove Giant Swarm PSP to PSS migration logic.
  • CAPZ releases releases azure-33.2.0

    Changes compared to v33.1.1

    Components

    • cluster-azure from v4.4.0 to v4.4.1
    • cluster from v4.4.0 to v4.4.1

    cluster v4.4.0…v4.4.1

    Changed

    • Control Plane: Make etcd image tag configurable. (#841)
  • CAPZ releases releases azure-34.1.0

    Changes compared to v34.0.0

    Components

    • cluster-azure from v5.1.2 to v5.3.0
    • Flatcar from v4459.2.2 to v4459.2.3
    • Kubernetes from v1.34.3 to v1.34.5
    • os-tooling from v1.26.3 to v1.26.4

    cluster-azure v5.1.2…v5.3.0

    Changed

    • Values: Update default instance size to D4as_v5.
    • Values: Use container registries from cluster chart.
    • Allow CertManager to use DNS challenges on non-private clusters.

    Apps

    • cert-exporter from v2.9.15 to v2.9.16
    • cert-manager from v3.9.4 to v3.11.0
    • chart-operator-extensions from v1.1.2 to v1.1.3
    • cilium from v1.3.4 to v1.4.1
    • cilium-servicemonitors from v0.1.3 to v0.1.4
    • coredns-extensions from v0.1.2 to v0.1.3
    • etcd-defrag from v1.2.3 to v1.2.4
    • etcd-k8s-res-count-exporter from v1.10.12 to v1.10.14
    • k8s-audit-metrics from v0.10.11 to v0.10.13
    • k8s-dns-node-cache from v2.9.1 to v2.9.2
    • metrics-server from v2.7.0 to v2.8.0
    • net-exporter from v1.23.0 to v1.23.1
    • node-exporter from v1.20.10 to v1.20.11
    • observability-bundle from v2.5.0 to v2.6.0
    • observability-policies from v0.0.3 to v0.0.4
    • priority-classes from v0.3.0 to v0.3.1
    • prometheus-blackbox-exporter from v0.5.0 to v0.5.1
    • security-bundle from v1.16.1 to v1.17.0
    • teleport-kube-agent from v0.10.7 to v0.10.8
    • vertical-pod-autoscaler from v6.1.1 to v6.1.2
    • vertical-pod-autoscaler-crd from v4.1.1 to v4.1.2

    cert-exporter v2.9.15…v2.9.16

    Changed

    • Go: Update dependencies.

    cert-manager v3.9.4…v3.11.0

    Added

    • Add Vertical Pod Autoscaler (VPA) support for webhook pods.
    • Add io.giantswarm.application.audience and io.giantswarm.application.managed chart annotations for Backstage visibility.
    • Add PodLogs for log collection.

    Fixed

    • Fix controller Vertical Pod Autoscaler (VPA) resource syntax.

    chart-operator-extensions v1.1.2…v1.1.3

    Changed

    cilium v1.3.4…v1.4.1

    Changed

    • Upgrade Cilium to v1.19.1.
    • Upgrade Cilium to v1.19.0.
    • Update chart icon to use Giant Swarm-hosted Cilium icon.
    • Upgrade Cilium to v1.18.7.

    cilium-servicemonitors v0.1.3…v0.1.4

    Changed

    • Migrate chart metadata annotations

    etcd-defrag v1.2.3…v1.2.4

    Changed

    • Chart: Update dependency ahrtr/etcd-defrag to v0.37.0. (#78)

    etcd-k8s-res-count-exporter v1.10.12…v1.10.14

    Changed

    • Migrate to App Build Suite (ABS) for Helm chart building.
    • Go: Update dependencies.

    Removed

    • Removed PodSecurityPolicy.
    • Removed global.podSecurityStandards.enforced helm value.
    • Removed resource.psp helm value.

    k8s-audit-metrics v0.10.11…v0.10.13

    Changed

    • Migrate to App Build Suite (ABS) for Helm chart building.
    • Go: Update dependencies.

    Removed

    • Removed PodSecurityPolicy.
    • Removed global.podSecurityStandards.enforced helm value.
    • Removed resource.psp helm value.

    k8s-dns-node-cache v2.9.1…v2.9.2

    Changed

    • Upgrade application to version 1.26.7 (includes coredns 1.13.1)

    metrics-server v2.7.0…v2.8.0

    Changed

    • Upgrade metrics-server to v0.8.1.
    • Change team annotation in Chart.yaml to OpenContainers format (io.giantswarm.application.team).

    net-exporter v1.23.0…v1.23.1

    Removed

    • Removed PodSecurityPolicy.
    • Removed global.podSecurityStandards.enforced helm value.

    node-exporter v1.20.10…v1.20.11

    Changed

    • Migrate to App Build Suite (ABS) for building and publishing Helm charts.

    Fixed

    • Removed duplicated app label which is already added by the selector helper.

    observability-bundle v2.5.0…v2.6.0

    Added

    • Add KSM metrics for Gateway API resources

    observability-policies v0.0.3…v0.0.4

    Changed

    • Rename app to observability-policies
    • Change team annotation in Chart.yaml to OpenContainers format (io.giantswarm.application.team).

    priority-classes v0.3.0…v0.3.1

    Fixed

    • Sanitize Chart.Version used in labels. This is needed because flux apapends the digest to the version using the + character which is not allowed in labels.

    prometheus-blackbox-exporter v0.5.0…v0.5.1

    Changed

    • Migrate to App Build Suite (ABS) for Helm chart building.

    security-bundle v1.16.1…v1.17.0

    Changed

    • Update kyverno (app) to v0.23.0.
    • Update kyverno-crds (app) to v1.16.0.
    • Update reports-server (app) to v0.1.0.
    • Update cloudnative-pg (app) to v0.0.13.
    • Update kubescape (app) to v0.0.5.
    • Update starboard-exporter (app) to v1.0.2.

    teleport-kube-agent v0.10.7…v0.10.8

    Added

    • Add io.giantswarm.application.audience and io.giantswarm.application.managed chart annotations for Backstage visibility.

    Changed

    • Migrate chart metadata annotations to OCI-compatible format.

    vertical-pod-autoscaler v6.1.1…v6.1.2

    Fixed

    • Pushed helm chart to OCI repository.

    vertical-pod-autoscaler-crd v4.1.1…v4.1.2

    Fixed

    • Pushed helm chart to OCI repository.
  • CAPZ releases releases azure-34.0.0

    Warning: Important Note for Upgrading to this Release

    tl;dr: Please first upgrade your existing cluster to Giant Swarm Release v33.1.1 for Azure or newer before upgrading to this release! Otherwise, you risk service outage and severe issues.

    Giant Swarm Release v34.0.0 for Azure comes with Kubernetes v1.34. This version contains etcd v3.6, which makes use of the so-called v3 store by default. Before, with etcd v3.5, the v2 store was used by default and synchronized to the already existing v3 store.

    Different flaws could lead to an inconsistency between the old v2 store and the already present but unused standby v3 store in etcd v3.5 and before. Because of this, new etcd v3.6 members, which first start to use this v3 store, might suffer from these inconsistencies.

    This can come into play when upgrading a cluster to this and future releases from any release older than Giant Swarm Release v33.1.1 for Azure. For this reason, we require you to first upgrade your cluster to Giant Swarm Release v33.1.1 for Azure or newer before upgrading to this or future releases.

    OIDC Structured Authentication (optional)

    This release introduces optional support for Kubernetes Structured Authentication Configuration for OIDC providers. We recommend testing this feature on a non-production cluster first.

    Minimal example

    global:
  controlPlane:
    oidc:
      structuredAuthentication:
        enabled: true
        issuers:
          - issuerUrl: https://your-idp.example.com
            clientId: kubernetes

    Example with customization

    global:
  controlPlane:
    oidc:
      structuredAuthentication:
        enabled: true
        issuers:
          - issuerUrl: https://your-idp.example.com
            clientId: kubernetes
            usernameClaim: email          # Optional: use 'email' instead of 'sub'
            groupsClaim: roles            # Optional: use 'roles' instead of 'groups'
            usernamePrefix: "oidc:"       # Optional: prefix usernames
            groupsPrefix: "oidc:"         # Optional: prefix groups

    Migration from legacy OIDC configuration

    If you already use OIDC with the legacy configuration, add structuredAuthentication.enabled: true to migrate:

    global:
  controlPlane:
    oidc:
      issuerUrl: https://your-idp.example.com
      clientId: kubernetes
      structuredAuthentication:
        enabled: true

    This will automatically convert your legacy configuration to the new structured format.

    Advanced options

    Additional configuration options are available for more complex setups, including:

    • Multiple audiences (audiences, audienceMatchPolicy)
    • Custom discovery URL (discoveryUrl)
    • Custom CA certificate (caPem)
    • CEL expressions for claim and user validation (claimValidationRules, userValidationRules)
    • Advanced claim mappings with CEL expressions (claimMappings)

    Refer to the Kubernetes Structured Authentication documentation for details.

    Changes compared to v33.1.1

    Components

    • cluster-azure from v4.4.0 to v5.1.2
    • Flatcar from v4459.2.1 to v4459.2.2
    • Kubernetes from v1.33.6 to v1.34.3
    • os-tooling from v1.26.2 to v1.26.3

    cluster-azure v4.4.0…v5.1.2

    Added

    • Add the priority-classes default app, enabled by default. This app provides standardised PriorityClass resources like giantswarm-critical and giantswarm-high, which should replace the previous inconsistent per-app priority classes.
    • Add "helm.sh/resource-policy": keep annotation to AzureCluster CR so that it doesn’t get removed by Helm when uninstalling this chart. The CAPI controllers will take care of removing it, following the expected deletion order.

    Changed

    • Chart: Update cluster to v5.1.2.
    • Chart: Update cluster to v5.1.1.
    • Chart: Update cluster to v5.1.0.
    • Chart: Update cluster to v5.0.0.

    Apps

    • azure-cloud-controller-manager from v1.32.7-1 to v2.0.0
    • azure-cloud-node-manager from v1.32.7 to v2.0.0
    • azuredisk-csi-driver from v1.32.9 to v2.1.0
    • azurefile-csi-driver from v1.32.5 to v2.0.0
    • cert-exporter from v2.9.14 to v2.9.15
    • cilium from v1.3.2 to v1.3.4
    • coredns from v1.28.3 to v1.29.1
    • etcd-k8s-res-count-exporter from v1.10.11 to v1.10.12
    • external-dns from v3.2.0 to v3.4.0
    • k8s-audit-metrics from v0.10.10 to v0.10.11
    • network-policies from v0.1.1 to v0.1.3
    • node-exporter from v1.20.9 to v1.20.10
    • observability-bundle from v2.3.2 to v2.5.0
    • Added priority-classes v0.3.0
    • security-bundle from v1.15.0 to v1.16.1

    azure-cloud-controller-manager v1.32.7-1…v2.0.0

    Changed

    • Chart: Update to upstream v1.34.3. (#132)

    azure-cloud-node-manager v1.32.7…v2.0.0

    Changed

    • Chart: Update to upstream v1.34.3. (#118)

    azuredisk-csi-driver v1.32.9…v2.1.0

    Changed

    • Chart: Update to upstream v1.34.0. (#118)
    • Chart: Update to upstream v1.33.7. (#114)

    azurefile-csi-driver v1.32.5…v2.0.0

    Changed

    • Chart: Update to upstream v1.34.2. (#71)

    cert-exporter v2.9.14…v2.9.15

    Changed

    • Go: Update dependencies.

    cilium v1.3.2…v1.3.4

    Changed

    coredns v1.28.3…v1.29.1

    Changed

    • Update coredns image to 1.14.1.
    • Update coredns image to 1.14.0.

    etcd-k8s-res-count-exporter v1.10.11…v1.10.12

    Changed

    • Go: Update dependencies.

    external-dns v3.2.0…v3.4.0

    Changed

    • Sync to upstream helm chart 1.20.0.
      • Add option to set annotationPrefix.
      • Fixed the missing schema for .provider.webhook.serviceMonitor configs.
      • Fixed incorrect indentation of selector labels under spec.template.spec.topologySpreadConstraints when topologySpreadConstraints is set.
    • Use kubectl-apply-job when installing CRDs.
    • Upgrade external-dns to v0.20.0.
    • Update DNSEndpoints CRD.
    • Sync to upstream helm chart 1.19.0.
      • Grant discovery.k8s.io/endpointslices permission only when using service source.
      • Update RBAC for Service source to support EndpointSlices.
      • Allow extraArgs to also be a map enabling overrides of individual values.
      • Set defaults for automountServiceAccountToken and serviceAccount.automountServiceAccountToken to true in Helm chart values.
      • Correctly handle txtPrefix and txtSuffix arguments when both are provided.
      • Add ability to generate schema with helm plugin schema.
      • Regenerate JSON schema with `helm-values-schema-json’ plugin.
      • Added ability to configure imagePullSecrets via helm global value.
      • Added options to configure labelFilter and managedRecordTypes via dedicated helm values.
      • Allow templating serviceaccount.annotations keys and values, by rendering them using the tpl built-in function.
      • Added support for extraContainers argument.
      • Added support for setting excludeDomains argument.
      • Added support for setting dnsConfig.
      • Added support for webhook providers.
    • Restrict managed record types to A and CNAME.

    k8s-audit-metrics v0.10.10…v0.10.11

    Changed

    • Go: Update dependencies.

    network-policies v0.1.1…v0.1.3

    Added

    • Add support for Kamaji.

    Fixed

    • Fixed broken templating.

    node-exporter v1.20.9…v1.20.10

    Removed

    • Repository: Remove integration tests.

    observability-bundle v2.3.2…v2.5.0

    Added

    • Add KSM metrics kube_servicemonitor_info and kube_podmonitor_info for ServiceMonitor and PodMonitor resources
    • Add KSM metrics kube_podlog_info for PodLog resource

    Changed

    • Upgrade kube-prometheus-stack-app to 19.0.0
    • Update alloy-app to 0.16.0
      • Bumps alloy to 1.12.0

    Fixed

    • Fixed KSM metrics for endpoints

    priority-classes v0.3.0

    Changed

    • Label now uses chart version instead of app version.

    Removed

    • Removed appVersion (only version is used now).

    security-bundle v1.15.0…v1.16.1

    Changed

    • Add missing dependency to all apps.
    • Allow to set multiple dependencies on the depends-on annotation.
    • Rename edgedb to gel.
    • Update cloudnative-pg (app) to v0.0.12.
    • Update gel (app) to v1.0.1.