1. Docs
  2. Changes and releases
  3. Security

Security

  • Security cert-manager-app v2.22.0

    Changed

    • Install giantswarm-selfsigned ClusterIssuer regardless of global.giantSwarmClusterIssuer.install value. It is required as a default component for Giant Swarm cluster installations.
  • Security kyverno-app v0.14.6

    Added

    • Add ClusterPolicy restrict-policy-kind-wildcards to prevent running (Cluster)Policies which match all API Kinds.
    • Add PolicyException for Giant Swarm’s chart-operator.
  • Security kyverno-policies v0.19.0

    Changed

    • Enable PSS Restricted policies by default.

    Removed

    • Stop pushing to openstack-app-collection.
  • Security kyverno-app v0.14.5

    Added

    • Add a webhooks cleanup job for ensuring deletion of Kyverno webhooks on chart uninstall.

    Changed

    • Replace deprecated toleration node-role.kubernetes.io/master with node-role.kubernetes.io/control-plane on CRD install job.
  • Security trivy-app v0.8.1

    Added

    • Add Cilium Network Policy to trivy.
    • Added Kyverno PolicyException for trivy-app.

    Changed

    • Modified the VerticalPodAutoscaler to make the Container Policies configurable.
    • Moved the VerticalPodAutoscaler.enabled flag to VerticalPodAutoscaler.trivy.enabled to align with other Apps.
  • Security rbac-operator v0.33.4

    Removed

    • Stop pushing to openstack-app-collection.
  • Security rbac-operator v0.33.3

    Changed

    • Update dependency gin to v1.9.0

    Fixed

    • Fixed read-all clusterRole to append pods/log policy rule once
    • Fixed reconciling subjects in existing organization namespace role bindings
  • Security dex-app v1.34.2

    Changed

    • Changed log level to info
  • Security falco-app v0.5.2

    Changed

    • Changed the default PolicyException namespace to giantswarm.
    • Replace deprecated toleration node-role.kubernetes.io/master with node-role.kubernetes.io/control-plane on falco and falco-exporter Daemonsets.
  • Security rbac-operator v0.33.2

    Changed

    • Remove shared app collection from circle CI
    • Updated dependencies to the latest versions