1. Docs
  2. Changes and releases
  3. CAPV releases

CAPV Releases

  • CAPV releases releases vsphere-34.5.0

    This release includes a containerd fix for a security vulnerability, and also bumps Kubernetes to v1.34.10 for the latest bugfixes and Flatcar to v4593.2.4.

    Components

    • Flatcar from v4593.2.2 to v4593.2.4
    • Kubernetes from v1.34.7 to v1.34.10
    • os-tooling from v1.31.0 to v1.33.1
  • CAPV releases releases vsphere-34.4.0

    Changes compared to v34.3.0

    Components

    • cluster-vsphere from v5.1.3 to v5.1.4
    • cluster from v5.3.1 to v5.3.2
    • Flatcar from v4593.2.1 to v4593.2.2

    cluster-vsphere v5.1.3…v5.1.4

    Changed

    • Chart: Fix validation errors.

    cluster v5.3.1…v5.3.2

    Changed

    • Chart: Fix validation errors.
  • CAPV releases releases vsphere-34.3.0

    Mitigates the “Dirty Frag” Linux kernel vulnerabilities (esp4/esp6, rxrpc) that could allow local privilege escalation and container escape on affected nodes.

    Changes compared to v34.2.0

    Components

    • Flatcar from v4459.2.4 to v4593.2.1
    • os-tooling from v1.28.0 to v1.31.0
  • CAPV releases releases vsphere-34.2.0

    Changes compared to v34.1.1

    Components

    • cluster-vsphere from v4.1.4 to v5.1.3
    • cluster from v5.1.2 to v5.3.1
    • Flatcar from v4459.2.3 to v4459.2.4
    • Kubernetes from v1.34.5 to v1.34.7
    • os-tooling from v1.26.4 to v1.28.0

    cluster-vsphere v4.1.4…v5.1.3

    Changed

    • HelmReleases: Reduce hard-coded default interval from 10m to 5m.
    • Apps: Enable rbac-bootstrap as a default HelmRelease app.

    Fixed

    • Allow adding additional properties into global.metadata.
    • Add missing values key to kube-vip-cloud-provider HelmRelease.

    cluster v5.1.2…v5.3.1

    Added

    • Apps: Add rbac-bootstrap as a default HelmRelease app with a default ClusterRoleBinding for giantswarm:giantswarm-admins.

    Changed

    • Apps: Use OCIRepository source for rbac-bootstrap HelmRelease.

    Fixed

    • Apps: Change rbac-bootstrap default role from read-all to view and add additional groups for token forwarded cases.

    Apps

    • cert-exporter from v2.9.16 to v2.10.1
    • cilium from v1.4.1 to v1.4.3
    • cloud-provider-vsphere from v2.2.0 to v2.4.0
    • coredns from v1.29.1 to v1.30.0
    • etcd-defrag from v1.2.4 to v1.2.6
    • k8s-dns-node-cache from v2.9.2 to v2.11.0
    • observability-bundle from v2.6.0 to v2.8.0
    • security-bundle from v1.17.0 to v1.17.1

    cert-exporter v2.9.16…v2.10.1

    Added

    • DaemonSet: Add VPA.

    Changed

    • Values: Tune resources.

    Fixed

    • Parse all PEM blocks in secrets and certificate files, not just the first one. This fixes false alerts when multiple certificates are concatenated (e.g. Kyverno webhook cert rotation).

    cilium v1.4.1…v1.4.3

    Changed

    cloud-provider-vsphere v2.2.0…v2.4.0

    Changed

    • Update to upstream v1.35.1.
    • Set version field of Chart.yaml to latest repo release fix ci checks.
    • Update to upstream 1.35.0.

    Removed

    • Removed PodSecurityPolicy.
    • Removed podSecurityPolicy helm value.

    coredns v1.29.1…v1.30.0

    Added

    • Add coredns-adopter job to adopt default CoreDNS resources on EKS clusters (disabled by default).

    Changed

    • Update coredns image to 1.14.2.

    etcd-defrag v1.2.4…v1.2.6

    Changed

    • Chart: Update dependency ahrtr/etcd-defrag to v0.39.0. (#86)
    • Chart: Update dependency ahrtr/etcd-defrag to v0.38.0. (#84)

    k8s-dns-node-cache v2.9.2…v2.11.0

    Added

    • Add configmap.log.enabled helm value to toggle CoreDNS query logging (default: false).
    • Make AAAA NOERROR configurable for IPv6.

    observability-bundle v2.6.0…v2.8.0

    Added

    • Add KSM metrics for Envoy Gateway resources.
    • Add application.giantswarm.io/team annotation from HelmReleases as label to KSM emitted metrics.

    Changed

    • Update kube-prometheus-stack to 20.1.0
    • Change team annotation in Chart.yaml to OpenContainers format (io.giantswarm.application.team).
    • Update alloy-app to 0.17.1
    • Update kube-prometheus-stack to 20.0.0
    • Update prometheus-operator-crd to 20.0.0

    security-bundle v1.17.0…v1.17.1

    Added

    • Add io.giantswarm.application.audience and io.giantswarm.application.managed chart annotations for Backstage visibility.

    Changed

    • Update falco (app) to v0.11.2.
    • Update gel (app) to v1.0.2.
    • Update kubescape (app) to v0.0.6.
    • Update reports-server (app) to v0.1.3.
    • Update starboard-exporter (app) to v1.0.3.
    • Update trivy (app) to v0.14.2.
    • Update trivy-operator (app) to v0.12.2.
    • Migrate chart annotations to OCI-compatible format.
  • CAPV releases releases vsphere-34.1.1

    Changes compared to v34.1.0

    Apps

    • cert-manager from v3.11.0 to v3.13.0

    cert-manager v3.11.0…v3.13.0

    Added

    • Add control plane node toleration to CA injector deployment.

    Changed

    • Upgrade cert-manager to v1.19.4.

    Removed

    • Remove PodSecurityPolicy (PSP) and related resources.
    • Remove Giant Swarm PSP to PSS migration logic.
  • CAPV releases releases vsphere-33.2.0

    Changes compared to v33.1.1

    Components

    • cluster-vsphere from v3.4.0 to v3.4.1
    • cluster from v4.4.0 to v4.4.1

    cluster v4.4.0…v4.4.1

    Changed

    • Control Plane: Make etcd image tag configurable. (#841)
  • CAPV releases releases vsphere-34.1.0

    Changes compared to v34.0.0

    Components

    • cluster-vsphere from v4.1.2 to v4.1.4
    • Flatcar from v4459.2.2 to v4459.2.3
    • Kubernetes from v1.34.3 to v1.34.5
    • os-tooling from v1.26.3 to v1.26.4

    cluster-vsphere v4.1.2…v4.1.4

    Changed

    • HelmReleases: Reduce hard-coded default interval from 10m to 5m.
    • Values: Enable management cluster registry cache for gsoci.azurecr.io.

    Apps

    • cert-exporter from v2.9.15 to v2.9.16
    • cert-manager from v3.9.4 to v3.11.0
    • chart-operator-extensions from v1.1.2 to v1.1.3
    • cilium from v1.3.4 to v1.4.1
    • cilium-servicemonitors from v0.1.3 to v0.1.4
    • coredns-extensions from v0.1.2 to v0.1.3
    • etcd-defrag from v1.2.3 to v1.2.4
    • etcd-k8s-res-count-exporter from v1.10.12 to v1.10.14
    • k8s-dns-node-cache from v2.9.1 to v2.9.2
    • kube-vip from v0.2.0 to v0.3.0
    • metrics-server from v2.7.0 to v2.8.0
    • net-exporter from v1.23.0 to v1.23.1
    • node-exporter from v1.20.10 to v1.20.11
    • observability-bundle from v2.5.0 to v2.6.0
    • observability-policies from v0.0.3 to v0.0.4
    • priority-classes from v0.3.0 to v0.3.1
    • security-bundle from v1.16.1 to v1.17.0
    • teleport-kube-agent from v0.10.7 to v0.10.8
    • vertical-pod-autoscaler from v6.1.1 to v6.1.2
    • vertical-pod-autoscaler-crd from v4.1.1 to v4.1.2

    cert-exporter v2.9.15…v2.9.16

    Changed

    • Go: Update dependencies.

    cert-manager v3.9.4…v3.11.0

    Added

    • Add Vertical Pod Autoscaler (VPA) support for webhook pods.
    • Add io.giantswarm.application.audience and io.giantswarm.application.managed chart annotations for Backstage visibility.
    • Add PodLogs for log collection.

    Fixed

    • Fix controller Vertical Pod Autoscaler (VPA) resource syntax.

    chart-operator-extensions v1.1.2…v1.1.3

    Changed

    cilium v1.3.4…v1.4.1

    Changed

    • Upgrade Cilium to v1.19.1.
    • Upgrade Cilium to v1.19.0.
    • Update chart icon to use Giant Swarm-hosted Cilium icon.
    • Upgrade Cilium to v1.18.7.

    cilium-servicemonitors v0.1.3…v0.1.4

    Changed

    • Migrate chart metadata annotations

    etcd-defrag v1.2.3…v1.2.4

    Changed

    • Chart: Update dependency ahrtr/etcd-defrag to v0.37.0. (#78)

    etcd-k8s-res-count-exporter v1.10.12…v1.10.14

    Changed

    • Migrate to App Build Suite (ABS) for Helm chart building.
    • Go: Update dependencies.

    Removed

    • Removed PodSecurityPolicy.
    • Removed global.podSecurityStandards.enforced helm value.
    • Removed resource.psp helm value.

    k8s-dns-node-cache v2.9.1…v2.9.2

    Changed

    • Upgrade application to version 1.26.7 (includes coredns 1.13.1)

    kube-vip v0.2.0…v0.3.0

    Changed

    • Improve Chart.yaml metadata and management.
    • PolicyException: Use Kyverno-native API instead of Giant Swarm abstraction.
    • DaemonSet: Ensure leading v when defaulting to .Chart.AppVersion.

    metrics-server v2.7.0…v2.8.0

    Changed

    • Upgrade metrics-server to v0.8.1.
    • Change team annotation in Chart.yaml to OpenContainers format (io.giantswarm.application.team).

    net-exporter v1.23.0…v1.23.1

    Removed

    • Removed PodSecurityPolicy.
    • Removed global.podSecurityStandards.enforced helm value.

    node-exporter v1.20.10…v1.20.11

    Changed

    • Migrate to App Build Suite (ABS) for building and publishing Helm charts.

    Fixed

    • Removed duplicated app label which is already added by the selector helper.

    observability-bundle v2.5.0…v2.6.0

    Added

    • Add KSM metrics for Gateway API resources

    observability-policies v0.0.3…v0.0.4

    Changed

    • Rename app to observability-policies
    • Change team annotation in Chart.yaml to OpenContainers format (io.giantswarm.application.team).

    priority-classes v0.3.0…v0.3.1

    Fixed

    • Sanitize Chart.Version used in labels. This is needed because flux apapends the digest to the version using the + character which is not allowed in labels.

    security-bundle v1.16.1…v1.17.0

    Changed

    • Update kyverno (app) to v0.23.0.
    • Update kyverno-crds (app) to v1.16.0.
    • Update reports-server (app) to v0.1.0.
    • Update cloudnative-pg (app) to v0.0.13.
    • Update kubescape (app) to v0.0.5.
    • Update starboard-exporter (app) to v1.0.2.

    teleport-kube-agent v0.10.7…v0.10.8

    Added

    • Add io.giantswarm.application.audience and io.giantswarm.application.managed chart annotations for Backstage visibility.

    Changed

    • Migrate chart metadata annotations to OCI-compatible format.

    vertical-pod-autoscaler v6.1.1…v6.1.2

    Fixed

    • Pushed helm chart to OCI repository.

    vertical-pod-autoscaler-crd v4.1.1…v4.1.2

    Fixed

    • Pushed helm chart to OCI repository.
  • CAPV releases releases vsphere-34.0.0

    Warning: Important Note for Upgrading to this Release

    tl;dr: Please first upgrade your existing cluster to Giant Swarm Release v33.1.1 for vSphere or newer before upgrading to this release! Otherwise, you risk service outage and severe issues.

    Giant Swarm Release v34.0.0 for vSphere comes with Kubernetes v1.34. This version contains etcd v3.6, which makes use of the so-called v3 store by default. Before, with etcd v3.5, the v2 store was used by default and synchronized to the already existing v3 store.

    Different flaws could lead to an inconsistency between the old v2 store and the already present but unused standby v3 store in etcd v3.5 and before. Because of this, new etcd v3.6 members, which first start to use this v3 store, might suffer from these inconsistencies.

    This can come into play when upgrading a cluster to this and future releases from any release older than Giant Swarm Release v33.1.1 for vSphere. For this reason, we require you to first upgrade your cluster to Giant Swarm Release v33.1.1 for vSphere or newer before upgrading to this or future releases.

    OIDC Structured Authentication (optional)

    This release introduces optional support for Kubernetes Structured Authentication Configuration for OIDC providers. We recommend testing this feature on a non-production cluster first.

    Minimal example

    global:
  controlPlane:
    oidc:
      structuredAuthentication:
        enabled: true
        issuers:
          - issuerUrl: https://your-idp.example.com
            clientId: kubernetes

    Example with customization

    global:
  controlPlane:
    oidc:
      structuredAuthentication:
        enabled: true
        issuers:
          - issuerUrl: https://your-idp.example.com
            clientId: kubernetes
            usernameClaim: email          # Optional: use 'email' instead of 'sub'
            groupsClaim: roles            # Optional: use 'roles' instead of 'groups'
            usernamePrefix: "oidc:"       # Optional: prefix usernames
            groupsPrefix: "oidc:"         # Optional: prefix groups

    Migration from legacy OIDC configuration

    If you already use OIDC with the legacy configuration, add structuredAuthentication.enabled: true to migrate:

    global:
  controlPlane:
    oidc:
      issuerUrl: https://your-idp.example.com
      clientId: kubernetes
      structuredAuthentication:
        enabled: true

    This will automatically convert your legacy configuration to the new structured format.

    Advanced options

    Additional configuration options are available for more complex setups, including:

    • Multiple audiences (audiences, audienceMatchPolicy)
    • Custom discovery URL (discoveryUrl)
    • Custom CA certificate (caPem)
    • CEL expressions for claim and user validation (claimValidationRules, userValidationRules)
    • Advanced claim mappings with CEL expressions (claimMappings)

    Refer to the Kubernetes Structured Authentication documentation for details.

    Changes compared to v33.1.1

    Components

    • cluster-vsphere from v3.4.0 to v4.1.2
    • Flatcar from v4459.2.1 to v4459.2.2
    • Kubernetes from v1.33.6 to v1.34.3
    • os-tooling from v1.26.2 to v1.26.3

    cluster-vsphere v3.4.0…v4.1.2

    Added

    • Add the priority-classes default app, enabled by default. This app provides standardised PriorityClass resources like giantswarm-critical and giantswarm-high, which should replace the previous inconsistent per-app priority classes.
    • Add "helm.sh/resource-policy": keep annotation to VSphereCluster CR so that it doesn’t get removed by Helm when uninstalling this chart. The CAPI controllers will take care of removing it, following the expected deletion order.
    • Add "helm.sh/resource-policy": keep annotation to the provider secret. This is to ensure that it isn’t removed by Helm, thus leading to a race condition when deleting the cluster as the vSphere cleaner needs it to clean up resources in vSphere.

    Changed

    • Chart: Update cluster to v5.1.2.
    • Chart: Update cluster to v5.1.1.
    • Chart: Update cluster to v5.1.0.
    • Chart: Update cluster to v5.0.0.
    • Chart: Update cluster to v4.6.0.
    • Chart: Update cluster to v4.5.1.
    • Chart: Update cluster to v4.5.0.

    Apps

    • cert-exporter from v2.9.14 to v2.9.15
    • cilium from v1.3.2 to v1.3.4
    • cloud-provider-vsphere from v2.0.1 to v2.2.0
    • coredns from v1.28.3 to v1.29.1
    • etcd-k8s-res-count-exporter from v1.10.11 to v1.10.12
    • network-policies from v0.1.1 to v0.1.3
    • node-exporter from v1.20.9 to v1.20.10
    • observability-bundle from v2.3.2 to v2.5.0
    • Added priority-classes v0.3.0
    • security-bundle from v1.15.0 to v1.16.1
    • vsphere-csi-driver from v3.4.2 to v3.4.3

    cert-exporter v2.9.14…v2.9.15

    Changed

    • Go: Update dependencies.

    cilium v1.3.2…v1.3.4

    Changed

    cloud-provider-vsphere v2.0.1…v2.2.0

    Added

    • Add kamaji.enabled value. If set to true, a deployment instead of the dameonset will be used for CPI controller components.

    Changed

    • Update to upstream 1.34.0.

    coredns v1.28.3…v1.29.1

    Changed

    • Update coredns image to 1.14.1.
    • Update coredns image to 1.14.0.

    etcd-k8s-res-count-exporter v1.10.11…v1.10.12

    Changed

    • Go: Update dependencies.

    network-policies v0.1.1…v0.1.3

    Added

    • Add support for Kamaji.

    Fixed

    • Fixed broken templating.

    node-exporter v1.20.9…v1.20.10

    Removed

    • Repository: Remove integration tests.

    observability-bundle v2.3.2…v2.5.0

    Added

    • Add KSM metrics kube_servicemonitor_info and kube_podmonitor_info for ServiceMonitor and PodMonitor resources
    • Add KSM metrics kube_podlog_info for PodLog resource

    Changed

    • Upgrade kube-prometheus-stack-app to 19.0.0
    • Update alloy-app to 0.16.0
      • Bumps alloy to 1.12.0

    Fixed

    • Fixed KSM metrics for endpoints

    priority-classes v0.3.0

    Changed

    • Label now uses chart version instead of app version.

    Removed

    • Removed appVersion (only version is used now).

    security-bundle v1.15.0…v1.16.1

    Changed

    • Add missing dependency to all apps.
    • Allow to set multiple dependencies on the depends-on annotation.
    • Rename edgedb to gel.
    • Update cloudnative-pg (app) to v0.0.12.
    • Update gel (app) to v1.0.1.

    vsphere-csi-driver v3.4.2…v3.4.3

    Changed

    • Update upstream chart to v3.3.1
    • Make deployment affinity and tolerations configurable in values.yaml.
  • CAPV releases releases vsphere-33.1.1

    This patch release fixes an issue with the installation of the Teleport Kube Agent app.

    Changes compared to v33.1.0

    Apps

    • coredns from v1.28.2 to v1.28.3

    coredns v1.28.2…v1.28.3

    Changed

    • Update coredns image to 1.13.2.
  • CAPV releases releases vsphere-33.1.0

    Update Kubernetes to v1.33.6, Flatcar to v4459.2.1 and various component upgrades.

    Changes compared to v33.0.1

    Components

    • cluster-vsphere from v3.2.0 to v3.4.0
    • Flatcar from v4230.2.3 to v4459.2.1
    • Kubernetes from v1.33.5 to v1.33.6
    • os-tooling from v1.26.1 to v1.26.2

    cluster-vsphere v3.2.0…v3.4.0

    Changed

    • Chart: Update cluster to v4.4.0.
    • Chart: Update cluster to v4.3.0.

    Apps

    • cert-exporter from v2.9.12 to v2.9.14
    • cert-manager from v3.9.3 to v3.9.4
    • cilium from v1.3.1 to v1.3.2
    • etcd-defrag from v1.2.1 to v1.2.3
    • etcd-k8s-res-count-exporter from v1.10.9 to v1.10.11
    • k8s-audit-metrics from v0.10.8 to v0.10.10
    • node-exporter from v1.20.7 to v1.20.9
    • observability-policies from v0.0.2 to v0.0.3
    • security-bundle from v1.13.1 to v1.15.0
    • teleport-kube-agent from v0.10.6 to v0.10.7

    cert-exporter v2.9.12…v2.9.14

    Changed

    • Go: Update dependencies.
    • Go: Update dependencies.

    cert-manager v3.9.3…v3.9.4

    Added

    • Add E2E tests using apptest-framework for automated PR testing across multiple providers (CAPA, CAPV, CAPZ, CAPVCD).
      • Basic test suite: Validates fresh installations
      • Upgrade test suite: Tests upgrade scenarios and certificate reconciliation
    • Add certificate issuance integration test to cluster-test-suites.

    Changed

    • Upgrade cert-manager to v1.18.2.

    cilium v1.3.1…v1.3.2

    Changed

    etcd-defrag v1.2.1…v1.2.3

    Changed

    • Chart: Update dependency ahrtr/etcd-defrag to v0.36.0. (#69)
    • Chart: Update dependency ahrtr/etcd-defrag to v0.35.0. (#64)

    etcd-k8s-res-count-exporter v1.10.9…v1.10.11

    Changed

    • Go: Update dependencies.
    • Go: Update dependencies.

    k8s-audit-metrics v0.10.8…v0.10.10

    Changed

    • Go: Update dependencies.
    • Go: Update dependencies.

    node-exporter v1.20.7…v1.20.9

    Changed

    • Go: Update dependencies.
    • Go: Update dependencies.

    observability-policies v0.0.2…v0.0.3

    Fixed

    • Missing RBAC for kyverno-report-controller

    security-bundle v1.13.1…v1.15.0

    Added

    • Add kubescape (app) version v0.0.4.

    Changed

    • Update kyverno (app) to v0.21.1.
    • Update kyverno-crds (app) to v1.15.0.
    • Update kyverno (app) to v0.20.1.
    • Update kyverno-crds (app) to v1.14.0.
    • Update kyverno-policies (app) to v0.24.0.
    • Update reports-server (app) to v0.0.3.

    teleport-kube-agent v0.10.6…v0.10.7

    Added

    • Add ephemeral-storage requests and limits to satisfy Kyverno policy require-emptydir-requests-and-limits.

    Changed

    • Enable upstream-provided Prometheus PodMonitor to scrape metrics from Teleport Kube Agent pods.