CAPA Releases
Changes compared to v35.3.0
Components
- cluster-aws from v10.5.0 to v10.6.0
Added
- Add
global.nodePools.<pool>.replicas for Karpenter node pools to keep a fixed number of nodes (static node pool). This is a tech preview of the alpha Karpenter StaticCapacity feature and requires a release with Karpenter v1.14.1 and the matching aws-resolver-rules-operator. - Add
global.nodePools.<pool>.limits.nodes to cap the number of nodes of a Karpenter node pool. - Add the
Balanced consolidation policy for Karpenter node pools.
Fixed
- Default
limits.cpu and limits.memory of Karpenter node pools separately, so setting only one of them no longer renders the other one empty.
Apps
- karpenter from v2.5.0 to v2.6.0
Added
- Add
ec2:DescribeInstanceStatus permission to the Karpenter IAM role, which Karpenter requires since v1.12 for its interruption health checks.
Changed
- Update upstream Karpenter and its CRDs to v1.14.1. This might roll nodes because Karpenter v1.12 bumps the
EC2NodeClass hash version from v4 to v5, which can mark existing nodes as drifted. - Enable the
StaticCapacity feature gate (NodePool.spec.replicas) in the karpenter chart defaults, as already done in karpenter-bundle. The feature is still alpha upstream, and we offer it as tech preview.
Changes compared to v36.1.1
Components
- cluster-aws from v11.0.2 to v11.4.0
- cluster from v9.0.2 to v9.4.0
- Flatcar from v4757.2.1 to v4757.2.2
Added
- Add
global.nodePools.<pool>.replicas for Karpenter node pools to keep a fixed number of nodes (static node pool). This is a tech preview of the alpha Karpenter StaticCapacity feature and requires a release with Karpenter v1.14.1 and the matching aws-resolver-rules-operator. - Add
global.nodePools.<pool>.limits.nodes to cap the number of nodes of a Karpenter node pool. - Add the
Balanced consolidation policy for Karpenter node pools. - Karpenter: Add the
karpenter.sh/do-not-sync-taints=true kubelet node label to Karpenter node pools. - Karpenter: Add the
karpenter.sh/unregistered:NoExecute kubelet taint to Karpenter node pools, previously added by the cluster chart.
Changed
- Normalize lowercase
extraConfigs[*].kind values of provider-specific apps to the ConfigMap and Secret kinds that Flux accepts. - The
helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _. - Bump
OCIRepository resources from the source.toolkit.fluxcd.io/v1beta2 API to source.toolkit.fluxcd.io/v1. - Karpenter: Document that
KarpenterMachinePool taints and startup taints are not applied to nodes. - Karpenter: Add the automatic
kubernetes.io/arch=arm64:NoSchedule taint of arm64 Karpenter node pools to the kubelet taints too. - Default
limits.cpu and limits.memory of Karpenter node pools separately, so setting only one of them no longer renders the other one empty.
Added
- Apps: Add
providerIntegration.apps.<app>.extraConfigs so provider charts can add templated config maps or secrets to an app’s values. - Ignition: Expose
sysctl and sysfs configuration per node pool via kernel.sysctls (/etc/sysctl.d/90-node-pool.conf) and kernel.sysfs (/etc/tmpfiles.d/00-node-pool.conf). The parameters required by kubelet’s protectKernelDefaults cannot be set by name, and the Image Builder and Cilium sysctl configuration keeps precedence. - Apps: Add
global.connectivity.cni.managed (default true). When false, Cilium isn’t rendered and is dropped from the dependencies of every app. - Workers: Add
nodeLabelsTemplateName and taintsTemplateName hooks under providerIntegration.workers.kubeadmConfig. They name provider templates, rendered once per node pool, that add kubelet node labels and taints.
Changed
- Ignition: Rename
/etc/sysctl.d/hardening.conf to 80-hardening.conf so it sorts after Flatcar’s 65-baselayout.conf but before Image Builder’s 99-sysctl.conf and Cilium’s 99-zzz-override_cilium.conf. Previously the unprefixed file sorted last and overrode both. As a result, nodes now run with fs.inotify.max_user_watches = 524288 (previously 16384) and net.ipv4.conf.all.rp_filter = 0 (previously 1). - Ignition: Clean up sysctl hardening. Drop keys already set by Image Builder or Cilium (
fs.inotify.max_user_watches, fs.inotify.max_user_instances, net.ipv4.conf.all.rp_filter, vm.overcommit_memory, kernel.panic, kernel.panic_on_oops). Stop disabling net.ipv4.tcp_timestamps, since modern kernels randomize timestamp offsets.
Removed
- Ignition: Remove
os-hardening.service. Its sysctl -p duplicated what systemd-sysctl already applies at boot. Its gpasswd calls had no effect: glibc merges group memberships from /usr/share/baselayout/group (via nss-usrfiles) regardless of /etc/group. - Apps: Remove the static
aks exceptions for the Cilium dependency of network policies and CoreDNS. - Workers: Remove the
karpenter.sh/unregistered:NoExecute taint from Karpenter node pools. Provider charts must add it via taintsTemplateName.
Apps
- cert-manager from v4.1.1 to v4.1.2
- cert-manager-crossplane-resources from v0.2.0 to v0.3.0
- cilium from v1.6.1 to v1.6.2
- coredns from v1.34.0 to v1.35.0
- etcd-defrag from v1.2.12 to v1.2.13
- external-dns from v3.6.1 to v3.7.1
- k8s-dns-node-cache from v2.11.0 to v2.11.1
- karpenter from v2.5.0 to v2.6.0
- network-policies from v0.3.2 to v0.5.0
- observability-bundle from v3.5.0 to v3.6.0
Added
- cert-manager-giantswarm-clusterissuer: Allow setting
cnameStrategy per DNS01 solver with acme.dns01.cloudflare.cnameStrategy, acme.dns01.route53.cnameStrategy and acme.dns01.azureDNS.cnameStrategy, so a _acme-challenge CNAME can delegate the challenge to a zone the solver can write to.
Changed
- Use
imagePullPolicy: IfNotPresent for the cert-manager-giantswarm-clusterissuer hook Job, so a retried Helm hook reuses the image already present on the node instead of downloading it again. - Run the E2E test suites automatically on release PRs by adding
.github/release-pr-body.md. - Increase clusterIssuer job memory limit from 250Mi to 512Mi.
- The ACME HTTP-01 solver of the
letsencrypt-giantswarm ClusterIssuer now uses Gateway API (gatewayHTTPRoute) instead of an Ingress, and targets Envoy Gateway.
Removed
giantSwarmClusterIssuer.acme.http01.enabled and giantSwarmClusterIssuer.acme.http01.ingressClassName (which defaulted to nginx). Setting either now fails the Helm render with a message pointing at the replacement values.
Fixed
- Trim the
helm.sh/chart label of the Giant Swarm resources (VPAs, PodLogs, proxy ConfigMap) to end on an alphanumeric character. A long dev version cut at 63 characters could end on a ., and the API server rejected the resource.
cert-manager-crossplane-resources v0.2.0…v0.3.0
Added
- Read the AWS account ID, partition, and OIDC domains from the
<clusterName>-crossplane-config ConfigMap if providers.aws.accountID, providers.aws.partition, or providers.aws.oidc.domain is empty. This supports EKS clusters, whose OIDC domain is only known once the cluster is provisioned. Explicitly set values take precedence over the ConfigMap.
Changed
- Restrict AWS provider permissions for
ChangeResourceRecordSets to TXT records related to acme challenges. - Create a dedicated role for azure to reduce permissions to TXT records only.
Changed
- Upgrade Cilium to v1.20.4.
- Envoy xDS mode defaults to
split again, following upstream (cilium/cilium#49383). - Restore upstream
cilium-operator tolerations instead of tolerating all taints. - Exclude the Lens namespace label
k8slens-edit-resource-version from identity computation.
Added
- Support the forward
max_age option (#528)
Changed
- Update
coredns image to 1.15.0. - Update gsoci.azurecr.io/giantswarm/docker-kubectl to v1.37.1 (#520)
Fixed
- Render forward integer options when set to
0 (#528) - Validate
additionalZones cache, forward, kubernetes, log and loadbalance blocks against the public and cluster zone schemas (#528)
Changed
- Chart: Update dependency ahrtr/etcd-defrag to v0.46.0. (#156)
Changed
- Upgrade external-dns to v0.23.0.
- Sync to upstream helm chart 1.23.0.
Fixed
- CRD install job: bump the
kubectl-apply-job dependency to 0.14.0, whose fallback image is gsoci.azurecr.io/giantswarm/docker-kubectl instead of quay.io/giantswarm/docker-kubectl:1.26.0, which quay.io now refuses with 401. - Values schema: accept arbitrary keys again in free-form maps and pass-through Kubernetes objects (annotations, labels,
nodeSelector, affinity, security contexts, probes, resources, extraArgs as a map, tlsConfig, secretConfiguration.data), and name in imagePullSecrets items. This broke installs, for example with the IRSA eks.amazonaws.com/role-arn service account annotation on CAPA. - Values schema: accept the
aws values that cluster-aws still sets. They have no effect.
Added
- Chart metadata: add
io.giantswarm.application.managed annotation ("true"). - Chart metadata: add
keywords.
Fixed
- Make the DNS Service redirected by the
CiliumLocalRedirectPolicy configurable. - The
helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
Added
- Add
ec2:DescribeInstanceStatus permission to the Karpenter IAM role, which Karpenter requires since v1.12 for its interruption health checks.
Changed
- Update upstream Karpenter and its CRDs to v1.14.1. This might roll nodes because Karpenter v1.12 bumps the
EC2NodeClass hash version from v4 to v5, which can mark existing nodes as drifted. - Enable the
StaticCapacity feature gate (NodePool.spec.replicas) in the karpenter chart defaults, as already done in karpenter-bundle. The feature is still alpha upstream, and we offer it as tech preview.
Added
- Add
hubbleRelay to allow the AKS ACNS hubble-relay through the default deny. - Add
allowEgressToUpstreamDNS to allow pods with dnsPolicy: Default to reach upstream DNS resolvers. - Add
azureWorkloadIdentityWebhook to allow the AKS workload identity webhook through the default deny.
Changed
- Move the chart to
helm/network-policies to match its name, in preparation for devctl-generated CI.
Added
- KSM custom resource state: Add
status_parent_accepted and status_parent_resolved_refs gauges for Gateway API HTTPRoute, one series per parent with the condition reason as label. - KSM custom resource state: Add
target_info and status_ancestor_accepted metrics for Envoy Gateway SecurityPolicy, BackendTrafficPolicy, ClientTrafficPolicy and EnvoyExtensionPolicy.
Changed
- !Breaking change: Turn
apps.<appName>.dependsOn from a list into a map from dependency name to true/false, so that a provider can turn off a single dependency (for example kyverno-crds on clusters without the security bundle) instead of overriding the whole list.
Changes compared to v35.2.3
Components
- cluster-aws from v10.4.2 to v10.5.0
- cluster from v8.4.2 to v8.5.0
- Flatcar from v4757.2.1 to v4757.2.2
Added
- Ignition: Expose
sysctl and sysfs configuration per node pool via kernel.sysctls (/etc/sysctl.d/90-node-pool.conf) and kernel.sysfs (/etc/tmpfiles.d/00-node-pool.conf). The parameters required by kubelet’s protectKernelDefaults cannot be set by name, and the Image Builder and Cilium sysctl configuration keeps precedence.
Changed
- Ignition: Rename
/etc/sysctl.d/hardening.conf to 80-hardening.conf so it sorts after Flatcar’s 65-baselayout.conf but before Image Builder’s 99-sysctl.conf and Cilium’s 99-zzz-override_cilium.conf. Previously the unprefixed file sorted last and overrode both. As a result, nodes now run with fs.inotify.max_user_watches = 524288 (previously 16384) and net.ipv4.conf.all.rp_filter = 0 (previously 1). - Ignition: Clean up sysctl hardening. Drop keys already set by Image Builder or Cilium (
fs.inotify.max_user_watches, fs.inotify.max_user_instances, net.ipv4.conf.all.rp_filter, vm.overcommit_memory, kernel.panic, kernel.panic_on_oops). Stop disabling net.ipv4.tcp_timestamps, since modern kernels randomize timestamp offsets.
Removed
- Ignition: Remove
os-hardening.service. Its sysctl -p duplicated what systemd-sysctl already applies at boot. Its gpasswd calls had no effect: glibc merges group memberships from /usr/share/baselayout/group (via nss-usrfiles) regardless of /etc/group.
Changes compared to v36.1.0
Components
- cluster-aws from v11.0.1 to v11.0.2
Changed
- Bump
OCIRepository resources from the source.toolkit.fluxcd.io/v1beta2 API to source.toolkit.fluxcd.io/v1.
Apps
- aws-pod-identity-webhook from v2.3.0 to v2.3.1
- cluster-autoscaler from v2.1.0 to v2.1.1
- external-dns from v3.6.0 to v3.6.1
Added
- Build and publish
linux/arm64 images of aws-pod-identity-restarter.
Fixed
- Bump
golang.org/x/net to v0.61.0. - The
helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
Fixed
- RBAC: Allow reading
infrastructure.cluster.x-k8s.io resources when clusterAPI.enabled is set. - The
helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
Fixed
- CRD install job: bump the
kubectl-apply-job dependency to 0.14.0, whose fallback image is gsoci.azurecr.io/giantswarm/docker-kubectl instead of quay.io/giantswarm/docker-kubectl:1.26.0, which quay.io now refuses with 401.
Changes compared to v35.1.1
Apps
- external-dns from v3.5.0 to v3.5.1
Fixed
- CRD install job: bump the
kubectl-apply-job dependency to 0.14.0 and pull it from oci://gsoci.azurecr.io/charts/giantswarm. Its fallback image is gsoci.azurecr.io/giantswarm/docker-kubectl instead of quay.io/giantswarm/docker-kubectl:1.26.0, which quay.io now refuses with 401.
Changes compared to v34.5.0
Apps
- external-dns from v3.4.0 to v3.4.1
Fixed
- CRD install job: bump the
kubectl-apply-job dependency to 0.14.0 and pull it from oci://gsoci.azurecr.io/charts/giantswarm. Its fallback image is gsoci.azurecr.io/giantswarm/docker-kubectl instead of quay.io/giantswarm/docker-kubectl:1.26.0, which quay.io now refuses with 401.
Changes compared to v35.2.2
Apps
- external-dns from v3.6.0 to v3.6.1
Fixed
- CRD install job: bump the
kubectl-apply-job dependency to 0.14.0, whose fallback image is gsoci.azurecr.io/giantswarm/docker-kubectl instead of quay.io/giantswarm/docker-kubectl:1.26.0, which quay.io now refuses with 401.
Changes compared to v35.2.1
Components
- cluster-aws from v10.4.1 to v10.4.2
Changed
- Bump
OCIRepository resources from the source.toolkit.fluxcd.io/v1beta2 API to source.toolkit.fluxcd.io/v1.
Apps
- aws-pod-identity-webhook from v2.3.0 to v2.3.1
Added
- Build and publish
linux/arm64 images of aws-pod-identity-restarter.
Fixed
- Bump
golang.org/x/net to v0.61.0. - The
helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
Changes compared to v35.2.0
Apps
- cluster-autoscaler from v2.0.4 to v2.0.5
Fixed
- RBAC: Allow reading
infrastructure.cluster.x-k8s.io resources when clusterAPI.enabled is set. - The
helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
Changes compared to v35.2.0
Components
- cluster-aws from v10.4.1 to v11.0.1
- cluster from v8.4.2 to v9.0.2
- Kubernetes from v1.35.9 to v1.36.5
Changed
kubeadm: Exclude /etc/.systemd-confext from restorecon.- Cilium: Replace the catch-all
- operator: Exists toleration on cilium-operator with an explicit list.
Removed
- Chart: Remove App to HelmRelease migration.
Apps
- cilium from v1.5.2 to v1.6.1
- cloud-provider-aws from v2.1.0 to v2.2.0
- cluster-autoscaler from v2.0.4 to v2.1.0
Added
- Declare the
io.giantswarm.application.audience (all) and
Changed
- Upgrade Cilium to v1.20.2.
- Move the team annotation from the legacy
application.giantswarm.io/team key to - Point
home at this repository instead of https://cilium.io/, as the standard requires. - Upgrade Cilium to v1.20.1 from v1.19.7. Please review the upstream 1.20 upgrade notes before rolling this out.
- Serve the ztunnel image from
gsoci.azurecr.io/giantswarm/cilium-ztunnel instead of pulling it from upstream. Cilium v1.20 moved this image from docker.io/istio/ztunnel to quay.io/cilium/ztunnel:v1.0.0, and our mirror carries exactly that digest, so it no longer has to be allow-listed in sync/unmirrored-images.txt. Only used by encryption.type=ztunnel, which we do not support.
Removed
- Upstream removed these long-deprecated Helm values in v1.20. None of them are set by this chart’s defaults, and because the chart’s
values.schema.json does not reject unknown keys, leftovers in existing values are silently ignored rather than rejected — check your values before upgrading:encryption.strictMode.{enabled,cidr,allowRemoteNodeIdentities} → use encryption.strictMode.egress.*encryption.ipsec.encryptedOverlayclustermesh.enableMCSAPISupport → use clustermesh.mcsapi.enabled (MCS-API is now stable upstream)clustermesh.apiserver.tls.{server,admin,remote}.{cert,key} and clustermesh.apiserver.tls.enableSecrets → enable auto-generation or pre-create the secretshubble.redact.kafka.apiKey → Kafka-aware L7 policy support and proxylib were removed upstreampreflight.tofqdnsPreCache → the preflight FQDN poller was removed upstreamhubble.ui.backend.{livenessProbe,readinessProbe}.enabled
sync/patches/certgen/. Cilium v1.20 ships the certgen.enforceCAValidityThroughoutLeavesDuration value and wires --ca-enforce-validity-throughout-leaves-duration into both certgen job specs itself, so the Giant Swarm patch that added them became a no-op (it detected this and skipped). The default stays true and the rendered job specs are unchanged, so two more patches drop out of diffs/.
Added
Changed
- Add
io.giantswarm.application.audience: all annotation to publish the app to the customer Backstage catalog. - Migrate chart metadata annotations to
io.giantswarm.application.* format. - Chart: Update to upstream v1.36.1.
Changed
- Chart: Update to upstream v1.36.1.
