Changes and Releases
Updates on Giant Swarm workload cluster releases, apps, UI improvements and documentation changes.
Added
- Add Gateway API
HTTPRoute resources for Loki, Mimir, and Tempo (read and write), replacing the previous NGINX ingress setup. - Add native JWT authentication via Envoy Gateway
SecurityPolicy.jwt, supporting multiple OIDC providers (e.g. Dex, Azure AD). Configurable via auth.jwt.providers. - Add
/loki/api/v1/rules to the Loki read routes. - Add
GRPCRoute for Tempo gRPC traffic (port 9095), routing all tempopb.* services to tempo-query-frontend with JWT enforcement via SecurityPolicy.
Changed
- Replace NGINX ingress-based auth (
nginx.ingress.kubernetes.io/auth-url) with Envoy Gateway SecurityPolicy JWT validation — no external auth service (oauth2-proxy or Dex extAuth) required. - Change missing
X-Scope-OrgID response code from 400 to 401 across all routes. - When
auth.jwt.providers is empty and a service is enabled, routes are silently not rendered (no chart error). Previously the chart would fail with an error. - Fix Tempo gRPC route service regex from
tempopb to tempopb\.[^/]+ to correctly match package-qualified service names (e.g. tempopb.StreamingQuerier).
Removed
- Remove dependency on oauth2-proxy for write route authentication.
- Remove Envoy Gateway
Backend CRD and extAuth configuration in favour of inline JWT validation.
Changed
- Upgraded chart dependency to kube-prometheus-stack-82.8.0
- Added VPA support for Alertmanager
- Added VPA support for Prometheus
- grafana from 11.2.2 to 11.2.3
Changed
- Upgraded chart dependency to kube-prometheus-stack-82.8.0
- Added VPA support for Alertmanager
- Added VPA support for Prometheus
- grafana from 11.2.2 to 11.2.3
Changes compared to v34.0.0
Components
- cluster-vsphere from v4.1.2 to v4.1.4
- Flatcar from v4459.2.2 to v4459.2.3
- Kubernetes from v1.34.3 to v1.34.5
- os-tooling from v1.26.3 to v1.26.4
Changed
- HelmReleases: Reduce hard-coded default interval from 10m to 5m.
- Values: Enable management cluster registry cache for
gsoci.azurecr.io.
Apps
- cert-exporter from v2.9.15 to v2.9.16
- cert-manager from v3.9.4 to v3.11.0
- chart-operator-extensions from v1.1.2 to v1.1.3
- cilium from v1.3.4 to v1.4.1
- cilium-servicemonitors from v0.1.3 to v0.1.4
- coredns-extensions from v0.1.2 to v0.1.3
- etcd-defrag from v1.2.3 to v1.2.4
- etcd-k8s-res-count-exporter from v1.10.12 to v1.10.14
- k8s-dns-node-cache from v2.9.1 to v2.9.2
- kube-vip from v0.2.0 to v0.3.0
- metrics-server from v2.7.0 to v2.8.0
- net-exporter from v1.23.0 to v1.23.1
- node-exporter from v1.20.10 to v1.20.11
- observability-bundle from v2.5.0 to v2.6.0
- observability-policies from v0.0.3 to v0.0.4
- priority-classes from v0.3.0 to v0.3.1
- security-bundle from v1.16.1 to v1.17.0
- teleport-kube-agent from v0.10.7 to v0.10.8
- vertical-pod-autoscaler from v6.1.1 to v6.1.2
- vertical-pod-autoscaler-crd from v4.1.1 to v4.1.2
Changed
Added
- Add Vertical Pod Autoscaler (VPA) support for webhook pods.
- Add
io.giantswarm.application.audience and io.giantswarm.application.managed chart annotations for Backstage visibility. - Add PodLogs for log collection.
Fixed
- Fix
controller Vertical Pod Autoscaler (VPA) resource syntax.
Changed
Changed
- Upgrade Cilium to v1.19.1.
- Upgrade Cilium to v1.19.0.
- Update chart icon to use Giant Swarm-hosted Cilium icon.
- Upgrade Cilium to v1.18.7.
Changed
- Migrate chart metadata annotations
Changed
- Chart: Update dependency ahrtr/etcd-defrag to v0.37.0. (#78)
Changed
- Migrate to App Build Suite (ABS) for Helm chart building.
- Go: Update dependencies.
Removed
- Removed
PodSecurityPolicy. - Removed
global.podSecurityStandards.enforced helm value. - Removed
resource.psp helm value.
Changed
- Upgrade application to version 1.26.7 (includes coredns 1.13.1)
Changed
- Improve Chart.yaml metadata and management.
- PolicyException: Use Kyverno-native API instead of Giant Swarm abstraction.
- DaemonSet: Ensure leading
v when defaulting to .Chart.AppVersion.
Changed
- Upgrade metrics-server to v0.8.1.
- Change team annotation in
Chart.yaml to OpenContainers format (io.giantswarm.application.team).
Removed
- Removed
PodSecurityPolicy. - Removed
global.podSecurityStandards.enforced helm value.
Changed
- Migrate to App Build Suite (ABS) for building and publishing Helm charts.
Fixed
- Removed duplicated
app label which is already added by the selector helper.
Added
- Add KSM metrics for Gateway API resources
Changed
- Rename app to
observability-policies - Change team annotation in
Chart.yaml to OpenContainers format (io.giantswarm.application.team).
Fixed
- Sanitize
Chart.Version used in labels. This is needed because flux apapends the digest to the version using the + character which is not allowed in labels.
Changed
- Update
kyverno (app) to v0.23.0. - Update
kyverno-crds (app) to v1.16.0. - Update
reports-server (app) to v0.1.0. - Update
cloudnative-pg (app) to v0.0.13. - Update
kubescape (app) to v0.0.5. - Update
starboard-exporter (app) to v1.0.2.
Added
- Add
io.giantswarm.application.audience and io.giantswarm.application.managed chart annotations for Backstage visibility.
Changed
- Migrate chart metadata annotations to OCI-compatible format.
Fixed
- Pushed helm chart to OCI repository.
vertical-pod-autoscaler-crd v4.1.1…v4.1.2
Fixed
- Pushed helm chart to OCI repository.
Added
- Add KSM metrics for Envoy Gateway resources.
- Add
application.giantswarm.io/team annotation from HelmReleases as label to KSM emitted metrics.
Changed
- Change team annotation in
Chart.yaml to OpenContainers format (io.giantswarm.application.team). - Update alloy-app to 0.17.1
- Update kube-prometheus-stack to 20.0.0
- Update prometheus-operator-crd to 20.0.0
Changed
- Upgrade Alloy upstream chart from 1.6.0 to 1.6.1 (CHANGELOG)
- This bumps the version of Alloy from 1.13.0 to 1.13.2 (CHANGELOG)
Fixed
- Fix memory usage calculation in
nodes-overview and cluster-overview dashboards by using node_memory_MemAvailable_bytes instead of node_memory_MemFree_bytes, which incorrectly excluded cached/buffered memory from free memory
Changed
- Update DNS dashboard
- Add new node and pod filters
- Update variables description and query to use coredns_build_info as label source
- Remove cache prefetch panel since the metric is gone
- Fix DNS dashboard log panels
Kube-Builder Operators dashboard: add a logs datasource selector
Added
- Add Crossplane support for Azure (CAPZ) blob storage provisioning with the following resources:
- Storage Accounts and Blob Containers for mimir, ruler, and alertmanager components
- ManagementPolicy for automatic blob expiration (configurable per component)
- PrivateEndpoint for private cluster deployments (when
crossplane.private: true)
- Tags from AzureCluster CR are automatically merged with user-provided tags (keys sanitized for Azure compatibility)
- Storage account names are automatically derived and sanitized from container names to meet Azure naming requirements
