1. Docs
  2. Changes and releases

Changes and Releases

Updates on Giant Swarm workload cluster releases, apps, UI improvements and documentation changes.

  • Developer Portal backstage v0.184.7

    Changed

    • Correct what the TelemetryDeck salt and the source maps actually expose in #2092 by @teemow

    Full Changelog: https://github.com/giantswarm/backstage/compare/v0.184.6...v0.184.7

  • Developer Portal backstage v0.184.6

    Fixed

    • (security) Stop serving frontend source maps from the image in #2091 by @teemow

    Full Changelog: https://github.com/giantswarm/backstage/compare/v0.184.5...v0.184.6

  • Connectivity envoy-gateway-app v1.10.1

    Fixed

    • Point the eg.image fallback at the gsoci.azurecr.io mirror. When both global.images.envoyGateway.image and deployment.envoyGateway.image.repository are empty, the chart resolved the Envoy Gateway control plane, certgen and shutdownManager images to docker.io/envoyproxy/gateway:<chart version> — a tag that never exists upstream, ignoring global.imageRegistry.
    • Honour global.imageRegistry and global.imagePullSecrets in the CRD installer Job, so the envoy-gateway-crds image can be pulled from a private mirror like every other image in the chart.
  • Developer Portal backstage v0.184.5

    Changed

    Full Changelog: https://github.com/giantswarm/backstage/compare/v0.184.4...v0.184.5

  • Developer Portal backstage v0.184.4

    Changed

    Full Changelog: https://github.com/giantswarm/backstage/compare/v0.184.3...v0.184.4

  • Developer Portal backstage v0.184.3

    Changed

    Full Changelog: https://github.com/giantswarm/backstage/compare/v0.184.2...v0.184.3

  • Connectivity envoy-gateway-app v1.10.0

    Changed

    • Breaking: Use upstream’s global.imageRegistry value instead of global.image.registry, dropping the image registry patch now that upstream supports the override natively.
    • Update Envoy Gateway to v1.9.0. Requires Gateway API v1.6 CRDs. Note that Lua EnvoyExtensionPolicy is now opt-in via config.envoyGateway.extensionApis.enableLua, and EndpointSliceIndex is enabled by default and can raise control plane memory usage.
    • Pin gateway-api-crds to 1.9.0 in the e2e and performance test suites.
    • Update perf-report claude skill:
      • the report is posted as a tar file in the PR’s comments.
      • perf-report no longer needs a cluster_id.
      • fix the nginx downstream_rps, cpu_usage and memory_usage queries: they filtered on the kube-system namespace, but the performance suites install ingress-nginx into default, so those three metrics were always empty and the comparison table rendered them as —.
      • in pipeline mode the skill no longer publishes: the generate-perf-report Tekton task creates the branch, uploads the tarball, verifies it and posts the comment itself, and the agent writes its interpretation to narrative.md instead. gh moved from the CI allowlist’s allow list to its deny list.
      • retry Mimir requests in fetch_metrics.py, so a report survives the stalls of a kubectl port-forward to the management cluster.
      • add .claude/perf-report-ci-settings.json, the permission allowlist used by the pipeline’s generate-perf-report task (--permission-mode dontAsk).
      • stop using a $DIR shell variable in the SKILL.md examples and spell the script paths out literally. A permission rule cannot match past a variable assignment, so the DIR=... && python3 "$DIR/fetch_metrics.py" ... form the examples produced was denied under the CI allowlist even though Bash(python3 *) is allowed — the agent could not run a single script and the pipeline reported success with no report.

    Added

    • Add control plane startup, liveness and readiness probes as configurable values.
  • Connectivity gateway-api-app v1.9.1

    Changed

    • Apply the CRDs from a dedicated installer image via a pre-install/pre-upgrade hook Job instead of rendering them as Helm templates. The rendered release no longer contains the CRDs, which kept it from fitting in Helm’s release Secret.
    • CRDs are applied with server-side apply and are no longer Helm-managed, so helm uninstall leaves them in place and a CRD rejected by the safe-upgrades policy now surfaces as a failed hook Job.
    • Reject unknown keys under install, which previously were silently ignored.

    Added

    • E2E test suite covering CRD installation, installer hook cleanup, the safe-upgrades admission policy and the served Gateway API resources.
    • crds.image values to override the installer image. The tag defaults to the chart version.
    • CiliumNetworkPolicy allowing the installer Job to reach the Kubernetes API server, without which the Job cannot apply the CRDs on clusters that default to denying egress. Set ciliumNetworkPolicy.enabled to false to skip it.
  • Observability silence-operator v0.21.0

    Added

    • Add startsAt, endsAt, and duration fields to the v1alpha2 Silence CRD for explicit silence scheduling. duration accepts weeks (w), days (d), hours (h), minutes (m), and seconds (s), each at most once and ordered largest to smallest: "7d", "2w", "1d12h". endsAt and duration are mutually exclusive. When neither is set, the valid-until annotation is used as a fallback.

    Changed

    • Regenerate .github/workflows/zz_generated.*.yaml via devctl to use the centralized reusable workflow, removing the Node-20 mindsers/changelog-reader-action dependency.
    • Update Go dependencies, which resolves CVE-2026-63209 (github.com/klauspost/compress) and CVE-2026-56852 (golang.org/x/text) and removes their .nancy-ignore entries.

    Fixed

    • Quote the = scalars in the generated matchType CRD schema so the rendered chart parses under PyYAML (unblocks the HelmTemplateValidator step added in app-build-suite 2.2.0).
    • Fix various CVEs by updating dependencies:
    • Skip failing CI jobs using private secrets for external contributions from fork
    • Replace deprecated controller-runtime scheme.Builder with apimachinery runtime.NewSchemeBuilder
    • Fix gosec, goconst and errcheck linter errors in tests
  • Security exception-recommender v0.3.0

    Added

    • Add io.giantswarm.application.audience and io.giantswarm.application.managed chart annotations for Backstage visibility.
    • Push to the default catalog.
    • Add example PolicyExceptionDraft CR under docs/cr so the CRD reference docs can show an example.

    Changed

    • Build the container image from the pre-built binary produced by architect/go-build instead of compiling inside the image, removing QEMU emulation from the multi-arch build.
    • Resolve updated code linter findings.
    • Use AppVersion for image tag defaulting.
    • Migrate chart metadata annotations to OCI-compatible format.