1. Docs
  2. Changes and releases
  3. Security

Security

  • Security starboard-exporter v1.2.24

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.23...v1.2.24

  • Security kyverno-app v0.25.1

    Fixed

    • Match all kyverno.io Group Policy and ClusterPolicy versions in the restrict-policy-kind-wildcards policy to ensure it still applies to newer API versions.
  • Security starboard-exporter v1.2.23

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.22...v1.2.23

  • Security starboard-exporter v1.2.22

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.21...v1.2.22

  • Security trivy-app v0.18.1

    Fixed

    • The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.

    Changed

    • Update the README: fix broken documentation links, recommend installing via Flux HelmRelease with kubectl gs deploy chart, replace the obsolete Trivy modules example, and describe the vendir-based upstream sync.
    • Allow additional properties for vendored upstream chart values so upstream keys are not rejected by the generated schema.
  • Security falco-app v0.14.1

    Changed

    • Update the README: fix broken documentation links, recommend installing via Flux HelmRelease with kubectl gs deploy chart, replace the obsolete values examples (PodSecurityPolicy, falco-exporter, legacy eBPF flag), and describe the vendir-based upstream sync.
  • Security external-secrets v2.11.1

    Fixed

    • The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.

    Changed

    • Fix broken documentation links in the README and recommend installing via Flux HelmRelease, keeping the legacy App CR as fallback.
    • Update README examples to chart version 2.11.0, kubectl gs deploy chart, and remove the legacy App CR example.
  • Security dex-app v2.4.0

    Added

    • The 2.x line carries the 3.x features up to 3.2.5, with the 2.x default oidc.responseTypes: ["code", "token", "id_token"] kept, so an installation gets them without the 3.0.0 breaking change:
      • Dex rolls on a configuration change (checksum/config on the pod template), and restarts when a referenced client Secret changes.
      • Static clients read their secret from a Kubernetes Secret: secretRef: {name, key} on an extraStaticClients entry, clientSecretRef: {name, key} on the pre-defined clients. A pre-defined client with both uses the reference; one with neither is left out and named in the release notes.
      • Built-in static clients mcpCapi and mcpPrometheus.
      • Dex v2.43.3: the upstream issuer’s key fetch is bounded to 5 seconds.
      • The PodDisruptionBudget selects the dex pods by their selector labels, maxUnavailable: 1.
      • The helm.sh/chart label is valid for long chart versions.
  • Security dex-app v3.2.5

    Fixed

    • The PodDisruptionBudget selects the dex pods by their selector labels only. It carried the chart and version labels, which change with every release, so after an upgrade it selected no pod and protected nothing. It is maxUnavailable: 1 instead of minAvailable: 50%: with a single replica, 50% rounded up to one pod and would refuse every eviction, holding a node drain until its timeout.
  • Security dex-app v3.2.4

    Fixed

    • Update dex to v2.43.3. Token exchanges and logins through an OIDC connector no longer hang while the upstream issuer’s signing keys (JWKS) cannot be fetched: the key fetch is bounded to 5 seconds, and such a token exchange answers 503 server_error instead of 401 access_denied, with the keys URL and the failure in Dex’s log. A subject token that does not verify still gets 401 access_denied. See giantswarm/dex#80.