1. Docs
  2. Changes and releases

Changes and Releases

Updates on Giant Swarm workload cluster releases, apps, UI improvements and documentation changes.

  • Developer Portal backstage v0.138.1

    Changed

    Full Changelog: https://github.com/giantswarm/backstage/compare/v0.138.0...v0.138.1

  • Developer Portal backstage v0.138.0

    Changed

    • AI chat: optimize the muster system prompt. systemPromptMuster.md now front-loads the muster Kubernetes tool contract (management_cluster: <mc>-mcp-kubernetes, podName, resourceType, tailLines), steers workflow discovery to a ranked filter_tools(query="<topic>") for the muster 0.9.0+ discovery tier, and prefers a matching workflow_* over raw x_kubernetes_* tools. Cuts tool-call trial-and-error and tokens on common Kubernetes questions (#1776, #1784). See ./docs/releases/v0.138.0-changelog.md for more information.
  • Observability observability-bundle v2.9.1

    Changed

    • Update alloy-app to 0.20.1
  • Security starboard-exporter v1.1.0

    Added

    • Add vulnerability_published_date, vulnerability_target, and vulnerability_class metric labels for Trivy VulnerabilityReports.
    • Disable controllers for unsupported resource types to avoid errors in environments where these CRDs are not present.

    Changed

    • Configure RBAC for only enabled controllers in Helm Chart.
    • Disable WatchList semantics for kubescape VulnerabilityManifest.
    • Switch to EndpointSlices for peer discovery used by sharding.
    • Truncate the chart’s AppVersion when it is used in Kubernetes labels.

    Fixed

    • Sanitize the helm.sh/chart label so truncated versions cannot end with an invalid character (e.g. a trailing .).
  • Developer Portal backstage v0.137.2

    Fixed

    • CI: cap the release image build to linux/amd64. The devctl-generated config built a multi-arch (amd64+arm64) image, but the arm64 cross-build of the backend’s native modules (isolated-vm, better-sqlite3, keytar) runs under QEMU emulation and silently exceeds the orb’s 20m no-output timeout, which blocked the tag pipeline (and therefore the chart catalog push) on v0.137.1. Every prior release was single-arch amd64 and the management clusters are amd64, so arm64 is unused. See ./docs/releases/v0.137.2-changelog.md for more information.
  • Security external-secrets v2.5.0

    Changed

    • Updating to the v2.5.0 version.
  • Developer Portal backstage v0.137.1

    Changed

    • CI: prepare for the devctl-generated CircleCI config. The repo-specific jobs (the Node buildjob that feeds the image build, and the second control-plane-catalog chart push) move to .circleci/custom.yml; the .ats/main.yaml smoke-test config and a renovate-custom.json5 (preserving the repo’s Renovate reviewers, package groups, and schedule) are added so the upcoming generated config.yml/workflows.yml and regenerated renovate.json5 keep the existing behavior. See ./docs/releases/v0.137.1-changelog.md for more information.
  • Developer Portal backstage v0.137.0

    Changed

    • Auth: make the muster cluster-token broker the single per-cluster access path. Broker-backed installations (those with gs.installations.<name>.clusterTokenAudience) no longer fall back to the per-cluster OAuth popup or the cookie-based /refresh; the connector mints their tokens silently and, when the main Dex session is missing, triggers exactly one main SSO re-login and retries. Per-cluster failures now surface as a typed error with a coarse reason instead of failing silently. The gs auth backend module registers only the main gs.authProvider, so a stray oidc-<mc> provider block can no longer stall startup on an unreachable Dex’s metadata discovery.
    • Clusters: render the clusters list incrementally and non-blocking. Each kubernetes proxy request is now bounded by an AbortController timeout, healthy clusters appear as soon as they resolve instead of waiting on a hung installation, and persistently failing clusters back off with a capped exponential retryDelay.

    Added

    • A persistent cluster-access status element in the sidebar (badge + popover) listing each accessed cluster with its state (healthy / degraded / session-expired) and a human-readable reason, with a “Sign in again” action when the main session expired. See ./docs/releases/v0.137.0-changelog.md for more information.
  • Observability observability-bundle v3.0.1

    Changed

    • Update alloy-app to 0.21.0
  • Fleet Management zot v2.8.0

    Changed

    • Update to upstream Helm Chart v0.1.117 and Zot v2.1.17.