What’s Changed
- fix(deps): update module github.com/mark3labs/mcp-go to v0.54.1 by @renovate[bot] in https://github.com/giantswarm/klaus/pull/274
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.168...v0.0.169
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.168...v0.0.169
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.167...v0.0.168
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.166...v0.0.167
Full Changelog: https://github.com/giantswarm/muster/compare/v0.1.216...v0.1.217
Full Changelog: https://github.com/giantswarm/muster/compare/v0.1.215...v0.1.216
Full Changelog: https://github.com/giantswarm/muster/compare/v0.1.214...v0.1.215
Full Changelog: https://github.com/giantswarm/muster/compare/v0.1.213...v0.1.214
Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.0.95...v0.0.96
securityContext defaults to the bundled valkey metrics exporter sidecar (valkey.valkey.metrics.exporter.securityContext). 0.4.0 hardened the main valkey container and its init container, but the redis_exporter sidecar (containers[1], port 9121) lives under a separate values key and was still rejected by Kyverno’s disallow-privilege-escalation policy.securityContext/podSecurityContext defaults on the bundled valkey sub-chart, which were inadvertently dropped during the CRD-chart split (0.3.0). Without them, Kyverno’s disallow-privilege-escalation and restrict-seccomp-strict policies reject the muster-valkey Deployment because the init container reuses the main container’s securityContext and the upstream defaults omit allowPrivilegeEscalation: false and seccompProfile: RuntimeDefault.