Workload cluster release aws-36.2.0 for CAPA

Changes compared to v36.1.1

Components

• cluster-aws from v11.0.2 to v11.4.0
• cluster from v9.0.2 to v9.4.0
• Flatcar from v4757.2.1 to v4757.2.2

cluster-aws v11.0.2…v11.4.0

Added

• Add global.nodePools.<pool>.replicas for Karpenter node pools to keep a fixed number of nodes (static node pool). This is a tech preview of the alpha Karpenter StaticCapacity feature and requires a release with Karpenter v1.14.1 and the matching aws-resolver-rules-operator.
• Add global.nodePools.<pool>.limits.nodes to cap the number of nodes of a Karpenter node pool.
• Add the Balanced consolidation policy for Karpenter node pools.
• Karpenter: Add the karpenter.sh/do-not-sync-taints=true kubelet node label to Karpenter node pools.
• Karpenter: Add the karpenter.sh/unregistered:NoExecute kubelet taint to Karpenter node pools, previously added by the cluster chart.

Changed

• Normalize lowercase extraConfigs[*].kind values of provider-specific apps to the ConfigMap and Secret kinds that Flux accepts.
• The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
• Bump OCIRepository resources from the source.toolkit.fluxcd.io/v1beta2 API to source.toolkit.fluxcd.io/v1.
• Karpenter: Document that KarpenterMachinePool taints and startup taints are not applied to nodes.
• Karpenter: Add the automatic kubernetes.io/arch=arm64:NoSchedule taint of arm64 Karpenter node pools to the kubelet taints too.
• Default limits.cpu and limits.memory of Karpenter node pools separately, so setting only one of them no longer renders the other one empty.

cluster v9.0.2…v9.4.0

Added

• Apps: Add providerIntegration.apps.<app>.extraConfigs so provider charts can add templated config maps or secrets to an app’s values.
• Ignition: Expose sysctl and sysfs configuration per node pool via kernel.sysctls (/etc/sysctl.d/90-node-pool.conf) and kernel.sysfs (/etc/tmpfiles.d/00-node-pool.conf). The parameters required by kubelet’s protectKernelDefaults cannot be set by name, and the Image Builder and Cilium sysctl configuration keeps precedence.
• Apps: Add global.connectivity.cni.managed (default true). When false, Cilium isn’t rendered and is dropped from the dependencies of every app.
• Workers: Add nodeLabelsTemplateName and taintsTemplateName hooks under providerIntegration.workers.kubeadmConfig. They name provider templates, rendered once per node pool, that add kubelet node labels and taints.

Changed

• Ignition: Rename /etc/sysctl.d/hardening.conf to 80-hardening.conf so it sorts after Flatcar’s 65-baselayout.conf but before Image Builder’s 99-sysctl.conf and Cilium’s 99-zzz-override_cilium.conf. Previously the unprefixed file sorted last and overrode both. As a result, nodes now run with fs.inotify.max_user_watches = 524288 (previously 16384) and net.ipv4.conf.all.rp_filter = 0 (previously 1).
• Ignition: Clean up sysctl hardening. Drop keys already set by Image Builder or Cilium (fs.inotify.max_user_watches, fs.inotify.max_user_instances, net.ipv4.conf.all.rp_filter, vm.overcommit_memory, kernel.panic, kernel.panic_on_oops). Stop disabling net.ipv4.tcp_timestamps, since modern kernels randomize timestamp offsets.

Removed

• Ignition: Remove os-hardening.service. Its sysctl -p duplicated what systemd-sysctl already applies at boot. Its gpasswd calls had no effect: glibc merges group memberships from /usr/share/baselayout/group (via nss-usrfiles) regardless of /etc/group.
• Apps: Remove the static aks exceptions for the Cilium dependency of network policies and CoreDNS.
• Workers: Remove the karpenter.sh/unregistered:NoExecute taint from Karpenter node pools. Provider charts must add it via taintsTemplateName.

Apps

• cert-manager from v4.1.1 to v4.1.2
• cert-manager-crossplane-resources from v0.2.0 to v0.3.0
• cilium from v1.6.1 to v1.6.2
• coredns from v1.34.0 to v1.35.0
• etcd-defrag from v1.2.12 to v1.2.13
• external-dns from v3.6.1 to v3.7.1
• k8s-dns-node-cache from v2.11.0 to v2.11.1
• karpenter from v2.5.0 to v2.6.0
• network-policies from v0.3.2 to v0.5.0
• observability-bundle from v3.5.0 to v3.6.0

cert-manager v4.1.1…v4.1.2

Added

• cert-manager-giantswarm-clusterissuer: Allow setting cnameStrategy per DNS01 solver with acme.dns01.cloudflare.cnameStrategy, acme.dns01.route53.cnameStrategy and acme.dns01.azureDNS.cnameStrategy, so a _acme-challenge CNAME can delegate the challenge to a zone the solver can write to.

Changed

• Use imagePullPolicy: IfNotPresent for the cert-manager-giantswarm-clusterissuer hook Job, so a retried Helm hook reuses the image already present on the node instead of downloading it again.
• Run the E2E test suites automatically on release PRs by adding .github/release-pr-body.md.
• Increase clusterIssuer job memory limit from 250Mi to 512Mi.
• The ACME HTTP-01 solver of the letsencrypt-giantswarm ClusterIssuer now uses Gateway API (gatewayHTTPRoute) instead of an Ingress, and targets Envoy Gateway.

Removed

• giantSwarmClusterIssuer.acme.http01.enabled and giantSwarmClusterIssuer.acme.http01.ingressClassName (which defaulted to nginx). Setting either now fails the Helm render with a message pointing at the replacement values.

Fixed

• Trim the helm.sh/chart label of the Giant Swarm resources (VPAs, PodLogs, proxy ConfigMap) to end on an alphanumeric character. A long dev version cut at 63 characters could end on a ., and the API server rejected the resource.

cert-manager-crossplane-resources v0.2.0…v0.3.0

Added

• Read the AWS account ID, partition, and OIDC domains from the <clusterName>-crossplane-config ConfigMap if providers.aws.accountID, providers.aws.partition, or providers.aws.oidc.domain is empty. This supports EKS clusters, whose OIDC domain is only known once the cluster is provisioned. Explicitly set values take precedence over the ConfigMap.

Changed

• Restrict AWS provider permissions for ChangeResourceRecordSets to TXT records related to acme challenges.
• Create a dedicated role for azure to reduce permissions to TXT records only.

cilium v1.6.1…v1.6.2

Changed

• Upgrade Cilium to v1.20.4.
• Envoy xDS mode defaults to split again, following upstream (cilium/cilium#49383).
• Restore upstream cilium-operator tolerations instead of tolerating all taints.
• Exclude the Lens namespace label k8slens-edit-resource-version from identity computation.

coredns v1.34.0…v1.35.0

Added

• Support the forward max_age option (#528)

Changed

• Update coredns image to 1.15.0.
• Update gsoci.azurecr.io/giantswarm/docker-kubectl to v1.37.1 (#520)

Fixed

• Render forward integer options when set to 0 (#528)
• Validate additionalZones cache, forward, kubernetes, log and loadbalance blocks against the public and cluster zone schemas (#528)

etcd-defrag v1.2.12…v1.2.13

Changed

• Chart: Update dependency ahrtr/etcd-defrag to v0.46.0. (#156)

external-dns v3.6.1…v3.7.1

Changed

• Upgrade external-dns to v0.23.0.
• Sync to upstream helm chart 1.23.0.

Fixed

• CRD install job: bump the kubectl-apply-job dependency to 0.14.0, whose fallback image is gsoci.azurecr.io/giantswarm/docker-kubectl instead of quay.io/giantswarm/docker-kubectl:1.26.0, which quay.io now refuses with 401.
• Values schema: accept arbitrary keys again in free-form maps and pass-through Kubernetes objects (annotations, labels, nodeSelector, affinity, security contexts, probes, resources, extraArgs as a map, tlsConfig, secretConfiguration.data), and name in imagePullSecrets items. This broke installs, for example with the IRSA eks.amazonaws.com/role-arn service account annotation on CAPA.
• Values schema: accept the aws values that cluster-aws still sets. They have no effect.

k8s-dns-node-cache v2.11.0…v2.11.1

Added

• Chart metadata: add io.giantswarm.application.managed annotation ("true").
• Chart metadata: add keywords.

Fixed

• Make the DNS Service redirected by the CiliumLocalRedirectPolicy configurable.
• The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.

karpenter v2.5.0…v2.6.0

Added

• Add ec2:DescribeInstanceStatus permission to the Karpenter IAM role, which Karpenter requires since v1.12 for its interruption health checks.

Changed

• Update upstream Karpenter and its CRDs to v1.14.1. This might roll nodes because Karpenter v1.12 bumps the EC2NodeClass hash version from v4 to v5, which can mark existing nodes as drifted.
• Enable the StaticCapacity feature gate (NodePool.spec.replicas) in the karpenter chart defaults, as already done in karpenter-bundle. The feature is still alpha upstream, and we offer it as tech preview.

network-policies v0.3.2…v0.5.0

Added

• Add hubbleRelay to allow the AKS ACNS hubble-relay through the default deny.
• Add allowEgressToUpstreamDNS to allow pods with dnsPolicy: Default to reach upstream DNS resolvers.
• Add azureWorkloadIdentityWebhook to allow the AKS workload identity webhook through the default deny.

Changed

• Move the chart to helm/network-policies to match its name, in preparation for devctl-generated CI.

observability-bundle v3.5.0…v3.6.0

Added

• KSM custom resource state: Add status_parent_accepted and status_parent_resolved_refs gauges for Gateway API HTTPRoute, one series per parent with the condition reason as label.
• KSM custom resource state: Add target_info and status_ancestor_accepted metrics for Envoy Gateway SecurityPolicy, BackendTrafficPolicy, ClientTrafficPolicy and EnvoyExtensionPolicy.

Changed

• !Breaking change: Turn apps.<appName>.dependsOn from a list into a map from dependency name to true/false, so that a provider can turn off a single dependency (for example kyverno-crds on clusters without the security bundle) instead of overriding the whole list.