1. Docs
  2. Changes and releases
  3. Security

Security

  • Security starboard-exporter v1.2.21

    Changed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.20...v1.2.21

  • Security starboard-exporter v1.2.20

    Changed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.19...v1.2.20

  • Security external-secrets v2.11.0

    Changed

    • Updating to the v2.11.0 version.
  • Security kyverno-app v0.25.0

    Fixed

    • Take the app.kubernetes.io/version label from the chart app version instead of the chart version, as described in the Helm chart best practices. The chart version carries build metadata that pushed the label past the 63 byte limit and made the install fail.
    • Remove the duplicated app.kubernetes.io/name: kyverno pod label from the admission controller.

    Changed

    • Allow additional properties for the vendored kyverno, policy-reporter and shared global values so upstream keys are not rejected by the generated schema.
    • Increase default VPA minimum resources for Policy Reporter components to 50m CPU/50Mi memory.
    • Updated policy-reporter to upstream version v3.10.0.
    • Updated kyverno to upstream version v1.18.2.
  • Security dex-app v3.2.3

    Fixed

    • Dex restarts when a referenced client Secret changes: the referenced Secrets (clientSecretRef on a pre-defined client, secretRef on an extra client) are projected into the dex container as files, one per client, and the liveness probe compares each file with the environment variable dex started from; a rotated value fails the probe naming the client’s variable, the kubelet restarts the container and dex loads the new secret, about a minute after the Secret changed and without any other change. Before, dex kept the value it read at start-up until something else restarted it, and the client’s flows failed with invalid_client in between. Installations without referenced clients render unchanged; the checksum/config roll on a configuration change is unchanged.
  • Security falco-app v0.14.0

    Changed

    • Updated falco to upstream version v0.45.0.
    • Updated k8s-metacollector to upstream version v0.1.4.
    • Updated charts to upstream version falco-9.2.0.
  • Security starboard-exporter v1.2.19

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.18...v1.2.19

  • Security dex-app v3.2.2

    Fixed

    • A pre-defined static client (gitopsui, muster, mcpKubernetes, mcpCapi, mcpPrometheus) with both clientSecret and clientSecretRef uses the reference and ignores the inline value instead of failing the render: a client moves from an inline secret to a referenced Secret by adding the reference where the plaintext values live, even while the encrypted values still carry the old inline secret. The release notes (helm get notes) name such a client until the inline value is deleted. A client with neither is left out as in 3.2.1; dex-k8s-authenticator and extra static clients that are not public still need exactly one source.
  • Security dex-app v3.2.1

    Fixed

    • A pre-defined static client (gitopsui, muster, mcpKubernetes, mcpCapi, mcpPrometheus) with a clientID and neither clientSecret nor clientSecretRef is left out of the dex configuration again, as before v3.1.0, and named in the release notes, instead of failing the render: values shared by several installations can declare a client whose secret only some of them carry. Both sources on one client still fail the render naming the client; dex-k8s-authenticator and extra static clients that are not public still need exactly one. Clients with a secret render unchanged.
  • Security dex-app v3.2.0

    Added

    • Built-in static clients mcpCapi and mcpPrometheus (oidc.staticClients.mcpCapi, oidc.staticClients.mcpPrometheus) with the shape and rules of mcpKubernetes: clientID, redirectURI, trustedPeers, and exactly one of clientSecret and clientSecretRef: {name, key}; both are trusted peers of dex-k8s-authenticator. Values under these keys were accepted by the schema and ignored by the templates before: an installation that carries them gets the two clients with this version, and one that carries a clientID without a secret fails the render naming the client. Installations without them render unchanged.