1. Docs
  2. Changes and releases
  3. Security

Security

  • Security dex-app v3.1.0

    Added

    • Static clients read their secret from a Kubernetes Secret: secretRef: {name, key} in an extraStaticClients entry, clientSecretRef: {name, key} in the pre-defined clients (gitopsui, muster, mcpKubernetes, dexK8SAuthenticator), in place of the inline secret. The chart sets DEX_CLIENT_SECRET_<ID> on the dex container from the referenced key and names it in the client’s secretEnv, so a client is added by a new Secret and a plaintext list entry. Exactly one of the inline secret and the reference per client: both, or neither on a client that is not public, fails the render naming the client. Inline clients render unchanged.

    Changed

    • A pre-defined static client with a clientID but no secret (gitopsui, muster, mcpKubernetes) fails the render naming the client instead of being left out of the configuration silently.
  • Security dex-app v3.0.1

    Fixed

    • Roll dex on a configuration change: the pod template carries a checksum/config annotation with the hash of the rendered dex configuration, so every change to it produces a new ReplicaSet in the same helm upgrade that writes the secret. The Deployment is rendered by the parent chart from the subchart’s template to compute the checksum; its output is unchanged apart from the annotation. Before, the pod kept the configuration it had loaded at startup until something else restarted it.
  • Security starboard-exporter v1.2.18

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.17...v1.2.18

  • Security starboard-exporter v1.2.17

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.16...v1.2.17

  • Security rbac-operator v1.2.0

    Added

    • RBAC: Grant the automation ServiceAccounts of all organization namespaces (org-<organization>) read-only access to cluster-scoped resources looked up at Helm render time by the cluster-* (release-*) charts. For this, a cluster-app-chart-lookups ClusterRole is created, plus a per-organization ClusterRoleBinding of the same name suffixed with the namespace.
  • Security starboard-exporter v1.2.16

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.15...v1.2.16

  • Security kyverno-policies v0.28.0

    Changed

    • Updated kyverno-policies to upstream version v1.19.0.
  • Security kyverno-policies v0.27.1

    Changed

    • Allow additional properties for vendored upstream chart values so upstream keys are not rejected by the generated schema.

    Fixed

    • Take the app.kubernetes.io/version label from the chart app version instead of the chart version. Flux adds build metadata to the chart version, which pushed the label past the 63 byte limit and made the install fail. The app version carries the same value without that metadata.
  • Security falco-app v0.13.0

    Added

    • Route Falco security events to the Giant Swarm Security Grafana organization. Operational data still goes to the default tenant.
    • Enable metrics scraping for Falcosidekick and k8s-metacollector.
    • Send Falco events to Falcosidekick by default.

    Changed

    • Enabled json_output for Falco so security events land in Loki as structured JSON.
    • Allow additional properties for vendored upstream chart values so upstream keys are not rejected by the generated schema.
    • Updated falco to upstream version v0.44.1.
    • Updated charts to upstream version falco-9.1.0.

    Fixed

    • Take the app.kubernetes.io/version label from the chart app version instead of the chart version, as described in the Helm chart best practices. The chart version carries build metadata that pushed the label past the 63 byte limit and made the install fail.
  • Security external-secrets v2.10.0

    Changed

    • Updating to the v2.10.0 version.