deploy chart: add --bundle flag to deploy bundle charts in the organization namespace using the automation service account..nancy-ignore entries whose findings are resolved.crossaccount is no longer accepted in mountOptions. Driver v3.x rejects it with InvalidArgument in both CreateVolume and NodePublishVolume.updateStrategy was replaced by rollingUpdate. controller.updateStrategy and node.updateStrategy no longer exist. Use controller.rollingUpdate and node.rollingUpdate, which accept only the RollingUpdate parameters (maxSurge, maxUnavailable), so you can no longer set’ OnDelete’ for the node DaemonSet. We don’t set either key, so the defaults don’t change. The values schema allows unknown keys, so a leftover updateStrategy override in the App CR config is ignored without error. Move it to rollingUpdate.aws-efs-csi-driver chart to 4.5.0 (was 3.4.1), which moves the driver image from v2.3.1 to v3.5.0 and refreshes the csi-node-driver-registrar and livenessprobe sidecars. Upstream chart declares kubeVersion: >=1.17.0-0, covering Kubernetes 1.35.io.giantswarm.application.upstream-chart-version annotation, which still claimed 2.3.0.upstream: and would otherwise run the new templates against the old driver: aws-efs-csi-driver v2.3.0 -> v3.5.0, livenessprobe v2.17.0 -> v2.19.0, csi-node-driver-registrar v2.15.0 -> v2.17.0, csi-provisioner v6.1.0 -> v6.3.0.BREAKING CHANGE: this release introduces a new dependency on alloy-podlogs-crds HelmRelease. This is only available on Giant Swarm release v35.0.0 onward. Either use the latest v5 release of the aws-lb-controller-bundle App on v34 clusters, or set podLogs.enabled: false.
crds: CreateReplace on install and upgrade of the bundle’s HelmRelease, so Flux creates and updates the controller CRDs.PodLogs resource to ship the controller logs to Loki, enabled by default through the podLogs.enabled value. When enabled, the bundle’s HelmRelease depends on the cluster’s alloy-podlogs-crds HelmRelease, available from cluster release v35. On older releases, set podLogs.enabled: false, or the controller is never installed or upgraded.crds: CreateReplace on install and upgrade of the bundle’s HelmRelease, so Flux creates and updates the controller CRDs.apptest-framework v5 and clustertest v5.PolicyException for the controller. The controller now installs on clusters that enforce the restricted Pod Security Standards, where admission denied its Deployment before.global.podSecurityStandards.enforced Helm value from both charts. It no longer has any effect.update cluster: a Cluster API cluster’s update is checked before it is applied or scheduled. The
command fails when the management cluster has no Release for the target version (for example
aws-34.3.0), when the target is not higher than the current version, or when the values carry no
global.release.version. The current version is read from the values, not the Cluster’s label, so an
update after a failed one no longer silently changes nothing, and only global.release.version is
replaced, not every key ending in version:.template cluster: --service-priority takes effect again. The flag was accepted and validated
but its value never reached the rendered manifests, because its only consumers were the vintage
AWS/Azure providers removed in v5.0.0. It is now rendered as global.metadata.servicePriority
for every provider. Because the flag defaults to highest, templated manifests now always
carry global.metadata.servicePriority; this is semantically a no-op against the chart
default of highest, but re-templated clusters will show the added key in a GitOps diff.TelemetryDeck.AppInfo.version, the parameter the TelemetryDeck dashboard’s standard “App Versions” insight reads (it was only in the payload key appVersion, so that chart stayed empty). telemetrydeck-go v0.2.0.v2.1.20.v2.1.20.helm.sh/chart label.gitops: generated repositories now record which version of the repository structure they were built
with, in a .gitops-metadata.yaml file at the repository root. gitops init creates it and every
gitops add ... records the layer it generated.gitops check: new command reporting the parts of a GitOps repository that were generated with an older
repository structure than the current kubectl-gs produces. It exits non-zero when anything is behind, so
it can be used as a check in the repository’s own CI. Repositories created before this existed are
brought in with gitops check --adopt.
(#23540)template cluster: releases without a published release-<provider> chart, such as a hand-crafted
Release CR used for testing (e.g. 35.0.0-andreas), no longer produce an App CR pointing to a chart
which does not exist. The cluster-<provider> chart is used instead, which resolves the Release CR in
the management cluster.
(#4347)template cluster: --cluster-version is no longer ignored for CAPA, CAPZ and AKS. Setting it templates
the given cluster-<provider> app version instead of the release-<provider> chart, which allows testing
a provider chart build together with a release.kubectl gs login, instead of only a raw client error such as dial tcp 127.0.0.1:8080: connect: connection refused or no matches for kind "AppCatalogEntry". The hint is added for every command, not just template cluster.LICENSE file, so validate-krew-manifest accepts the gs plugin release.