Warning: Important Note for Upgrading to this Release
tl;dr: Please first upgrade your existing cluster to Giant Swarm Release v33.1.4 for CAPA or newer before upgrading to this release! Otherwise, you risk service outage and severe issues.
Giant Swarm Release v34.0.0 for CAPA comes with Kubernetes v1.34. This version contains etcd v3.6, which makes use of the so-called v3 store by default. Before, with etcd v3.5, the v2 store was used by default and synchronized to the already existing v3 store.
Different flaws could lead to an inconsistency between the old v2 store and the already present but unused standby v3 store in etcd v3.5 and before. Because of this, new etcd v3.6 members, which first start to use this v3 store, might suffer from these inconsistencies.
This can come into play when upgrading a cluster to this and future releases from any release older than Giant Swarm Release v33.1.4 for CAPA. For this reason, we require you to first upgrade your cluster to Giant Swarm Release v33.1.4 for CAPA or newer before upgrading to this or future releases.
OIDC Structured Authentication (optional)
This release introduces optional support for Kubernetes Structured Authentication Configuration for OIDC providers. We recommend testing this feature on a non-production cluster first.
Minimal example
global:
controlPlane:
oidc:
structuredAuthentication:
enabled: true
issuers:
- issuerUrl: https://your-idp.example.com
clientId: kubernetes
Example with customization
global:
controlPlane:
oidc:
structuredAuthentication:
enabled: true
issuers:
- issuerUrl: https://your-idp.example.com
clientId: kubernetes
usernameClaim: email # Optional: use 'email' instead of 'sub'
groupsClaim: roles # Optional: use 'roles' instead of 'groups'
usernamePrefix: "oidc:" # Optional: prefix usernames
groupsPrefix: "oidc:" # Optional: prefix groups
Migration from legacy OIDC configuration
If you already use OIDC with the legacy configuration, add structuredAuthentication.enabled: true to migrate:
global:
controlPlane:
oidc:
issuerUrl: https://your-idp.example.com
clientId: kubernetes
structuredAuthentication:
enabled: true
This will automatically convert your legacy configuration to the new structured format.
Advanced options
Additional configuration options are available for more complex setups, including:
- Multiple audiences (
audiences,audienceMatchPolicy) - Custom discovery URL (
discoveryUrl) - Custom CA certificate (
caPem) - CEL expressions for claim and user validation (
claimValidationRules,userValidationRules) - Advanced claim mappings with CEL expressions (
claimMappings)
Refer to the Kubernetes Structured Authentication documentation for details.
Changes compared to v33.1.4
Components
- cluster-aws from v6.4.3 to v7.2.5
- Flatcar from v4459.2.1 to v4459.2.2
- Kubernetes from v1.33.6 to v1.34.3
- os-tooling from v1.26.2 to v1.26.3
cluster-aws v6.4.3…v7.2.5
Warning: Breaking Changes
- The following IAM permissions have been removed from the control plane nodes
- autoscaling:SetDesiredCapacity
- autoscaling:TerminateInstanceInAutoScalingGroup
- Removed
global.providerSpecific.reducedInstanceProfileIamPermissionsForWorkersvalue, as that’s the default behavior now. It cannot be overridden anymore.
Added
- Add
kubernetes.io/cluster/$clusterName: "owned"andsigs.k8s.io/cluster-api-provider-aws/cluster/$clusterName: "owned"tags to theIRSAClaimCR so that resources created by Crossplane contain the expected tags. This also allows to find the S3 buckets that need to be deleted when removing a cluster. - This change will roll the control plane nodes Add
preKubeadmCommandto wait for the API server load balancer DNS to be resolvable before running kubeadm on control plane nodes. This prevents kubeadm from failing when the ELB DNS record hasn’t propagated yet. - This change will roll the nodes Add Crossplane IAM Roles, policies and instance profiles for worker and control plane nodes. Instead of having an IAM Role per node pool, now we’ll use the same for all node pools.
- Add the
priority-classesdefault app, enabled by default. This app provides standardisedPriorityClassresources likegiantswarm-criticalandgiantswarm-high, which should replace the previous inconsistent per-app priority classes. - This change will roll the nodes on Karpenter node pools Attach the
lbSecurity Group to Karpenter nodes. - This change will roll the nodes on Karpenter node pools Name instance on AWS after the nodepool name.
Changed
- Chart: Update
clusterto v5.1.2. - Chart: Update
clusterto v5.1.1. - Chart: Update
clusterto v5.1.0. - Chart: Update
clusterto v5.0.0. - Reduce redundant parts of JSON schema for Karpenter vs. MachinePool types of node pools
- Adjust node max pods based on the
nodeCidrMaskSize
Fixed
- Fix Karpenter schema definition: changed from
appschema tohelmReleaseschema to correctly reflect that Karpenter is deployed as a HelmRelease resource. This fixes incorrect field definitions inextraConfigs(capitalized enum valuesConfigMap/Secretandoptionalfield instead ofpriority). - Fix Karpenter NodePool subnet filtering: when users define custom
subnetTags, the defaultgiantswarm.io/role: "nodes"filter is no longer applied, allowing full control over subnet selection. The cluster ownership tag (sigs.k8s.io/cluster-api-provider-aws/cluster/<cluster-name>: owned) is still enforced for security. - Fix Karpenter HelmRelease: add missing
valuesFromparent field forextraConfigs, enabling customers to use custom ConfigMaps and Secrets for Karpenter configuration. - Ensure
AWSCluster.spec.network.subnets.tagsis not rendered asnull - Add missing documentation for node pools (health checks were not listed)
- Ensure defaulting
maxHealthyPercentagesince Helm does not use the default from the schema
Removed
- Remove
RolePolicyAttachmentcrossplane custom resources as they are not needed when usingRoleandRolePolicy.
Apps
- cert-exporter from v2.9.14 to v2.9.15
- cilium from v1.3.2 to v1.3.4
- cloud-provider-aws from v1.33.2-1 to v2.0.0
- cluster-autoscaler from v1.33.1-2 to v1.34.1-1
- coredns from v1.28.3 to v1.29.1
- etcd-k8s-res-count-exporter from v1.10.11 to v1.10.12
- external-dns from v3.2.0 to v3.4.0
- k8s-audit-metrics from v0.10.10 to v0.10.11
- network-policies from v0.1.1 to v0.1.3
- node-exporter from v1.20.9 to v1.20.10
- Added node-problem-detector v0.5.2
- observability-bundle from v2.3.2 to v2.5.0
- Added priority-classes v0.3.0
- security-bundle from v1.15.0 to v1.16.1
cert-exporter v2.9.14…v2.9.15
Changed
- Go: Update dependencies.
cilium v1.3.2…v1.3.4
Changed
cloud-provider-aws v1.33.2-1…v2.0.0
Changed
- Chart: Update to upstream v1.34.0.
cluster-autoscaler v1.33.1-2…v1.34.1-1
Changed
- Chart: Update to upstream v1.34.1.
coredns v1.28.3…v1.29.1
Changed
etcd-k8s-res-count-exporter v1.10.11…v1.10.12
Changed
- Go: Update dependencies.
external-dns v3.2.0…v3.4.0
Changed
- Sync to upstream helm chart 1.20.0.
- Add option to set annotationPrefix.
- Fixed the missing schema for .provider.webhook.serviceMonitor configs.
- Fixed incorrect indentation of selector labels under spec.template.spec.topologySpreadConstraints when topologySpreadConstraints is set.
- Use kubectl-apply-job when installing CRDs.
- Upgrade external-dns to v0.20.0.
- Update DNSEndpoints CRD.
- Sync to upstream helm chart
1.19.0.- Grant
discovery.k8s.io/endpointslicespermission only when usingservicesource. - Update RBAC for
Servicesource to supportEndpointSlices. - Allow extraArgs to also be a map enabling overrides of individual values.
- Set defaults for
automountServiceAccountTokenandserviceAccount.automountServiceAccountTokentotruein Helm chart values. - Correctly handle
txtPrefixandtxtSuffixarguments when both are provided. - Add ability to generate schema with
helm plugin schema. - Regenerate JSON schema with `helm-values-schema-json’ plugin.
- Added ability to configure
imagePullSecretsvia helmglobalvalue. - Added options to configure
labelFilterandmanagedRecordTypesvia dedicated helm values. - Allow templating
serviceaccount.annotationskeys and values, by rendering them using thetplbuilt-in function. - Added support for
extraContainersargument. - Added support for setting
excludeDomainsargument. - Added support for setting
dnsConfig. - Added support for webhook providers.
- Grant
- Restrict managed record types to A and CNAME.
k8s-audit-metrics v0.10.10…v0.10.11
Changed
- Go: Update dependencies.
network-policies v0.1.1…v0.1.3
Added
- Add support for Kamaji.
Fixed
- Fixed broken templating.
node-exporter v1.20.9…v1.20.10
Removed
- Repository: Remove integration tests.
node-problem-detector v0.5.2
Changed
- Build: Switch to pushing to
defaultinstead ofplaygroundcatalog as this app will be fully supported in production
observability-bundle v2.3.2…v2.5.0
Added
- Add KSM metrics
kube_servicemonitor_infoandkube_podmonitor_infofor ServiceMonitor and PodMonitor resources - Add KSM metrics
kube_podlog_infofor PodLog resource
Changed
- Upgrade
kube-prometheus-stack-appto 19.0.0 - Update alloy-app to 0.16.0
- Bumps alloy to 1.12.0
Fixed
- Fixed KSM metrics for endpoints
priority-classes v0.3.0
Changed
- Label now uses chart version instead of app version.
Removed
- Removed appVersion (only version is used now).
security-bundle v1.15.0…v1.16.1
Changed
- Add missing dependency to all apps.
- Allow to set multiple dependencies on the depends-on annotation.
- Rename
edgedbtogel. - Update
cloudnative-pg(app) to v0.0.12. - Update
gel(app) to v1.0.1.