infrastructure.cluster.x-k8s.io resources when clusterAPI.enabled is set.helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.global.connectivity.network.mode to byo.natIPConfigurations key in AzureCluster template.kubeadm: Exclude /etc/.systemd-confext from restorecon.- operator: Exists toleration on cilium-operator with an explicit list.io.giantswarm.application.audience (all) andapplication.giantswarm.io/team key tohome at this repository instead of https://cilium.io/, as the standard requires.gsoci.azurecr.io/giantswarm/cilium-ztunnel instead of pulling it from upstream. Cilium v1.20 moved this image from docker.io/istio/ztunnel to quay.io/cilium/ztunnel:v1.0.0, and our mirror carries exactly that digest, so it no longer has to be allow-listed in sync/unmirrored-images.txt. Only used by encryption.type=ztunnel, which we do not support.values.schema.json does not reject unknown keys, leftovers in existing values are silently ignored rather than rejected — check your values before upgrading:encryption.strictMode.{enabled,cidr,allowRemoteNodeIdentities} → use encryption.strictMode.egress.*encryption.ipsec.encryptedOverlayclustermesh.enableMCSAPISupport → use clustermesh.mcsapi.enabled (MCS-API is now stable upstream)clustermesh.apiserver.tls.{server,admin,remote}.{cert,key} and clustermesh.apiserver.tls.enableSecrets → enable auto-generation or pre-create the secretshubble.redact.kafka.apiKey → Kafka-aware L7 policy support and proxylib were removed upstreampreflight.tofqdnsPreCache → the preflight FQDN poller was removed upstreamhubble.ui.backend.{livenessProbe,readinessProbe}.enabledsync/patches/certgen/. Cilium v1.20 ships the certgen.enforceCAValidityThroughoutLeavesDuration value and wires --ca-enforce-validity-throughout-leaves-duration into both certgen job specs itself, so the Giant Swarm patch that added them became a no-op (it detected this and skipped). The default stays true and the rendered job specs are unchanged, so two more patches drop out of diffs/.filesTemplateName hook under providerIntegration.workers.kubeadmConfig. It names a provider template that renders a YAML list of files, once per node pool, so that a provider can deploy files to selected node pools only. A node pool for which the template renders nothing keeps its KubeadmConfig spec, and therefore its spec hash, unchanged.mergeDefaultEvictionSettings to keep defaults for eviction like nodefs.available and nodefs.inodesFree which would otherwise be set to 0. This rolls all nodes.kubeadm: Exclude /etc/.systemd-confext from restorecon.- operator: Exists toleration on cilium-operator with an explicit list./etc/ssl/certs on nodes for fixing SELinux labeling, so any custom certificates placed there directly are preserved.helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.PodSecurityPolicy.global.podSecurityStandards.enforced helm value.PodSecurityPolicy.global.podSecurityStandards.enforced helm value.0600 ca.crt on an AKS node, where the exporter runs as an unprivileged user) stopped the walk, silently dropping every file sorting after it from the metrics. Unreadable files are now logged and skipped individually.io.giantswarm.application.managed annotation ("true").keywords.coredns image to 1.14.7.coredns image to 1.14.6..github/release-pr-body.md.helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.configmap.log, loadbalancePolicy and configmap.cache again. Since 1.31.0 coredns.<zone>.log, coredns.<zone>.loadbalance and coredns.<zone>.cache.success.ttl shipped defaults that shadowed them, so the old keys were silently ignored. They are now unset by default, restoring the documented fallback chain. Rendering with default values is unchanged.io.giantswarm.application.managed annotation ("true").keywords..github/release-pr-body.md.replicaCount value to scale the deployment down to 0 or back to 1.service.enabled value to skip creating the Service.hostAliases value to inject entries into the pod’s /etc/hosts.crd as a valid registry value, with the matching RBAC on dnsrecords.DNSRecord CRD.dnsendpoints/status from * to update.policy is now a required value. Our default of sync is unchanged.annotationPrefix to external-dns.alpha.kubernetes.io/, keeping the previous annotation prefix after upstream changed the default.helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.keywords to Chart.yaml.io.giantswarm.application.audience (all) and io.giantswarm.application.managedinterface{} with any and use for-range over integers (Go modernization).application.giantswarm.io/team key toChart.yaml apiVersion to v2. The chart declares no dependencies and had nohelm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.keywords to Chart.yaml.io.giantswarm.application.audience (all) anddenyEgressToIMDS policy denying pod egress to the instance metadata service. Disabled by default.allow-ingress-from-konnectivity CiliumNetworkPolicy into a CiliumClusterwideNetworkPolicy namedkarpenter and aws-load-balancer-controller namespaces from denyEgressToIMDS.application.giantswarm.io/team key todisableSystemdCollector value to turn the systemd collector off, mirroring the existing disableConntrackCollector and disableNvmeCollector toggles. The collector needs a D-Bus connection to the host, which is refused on nodes where AppArmor mediates D-Bus (such as AKS Ubuntu nodes running under the default containerd profile), making it fail on every scrape. Defaults to false, so behaviour is unchanged.alloy apps to 0.23.1 (Alloy v1.19.2).prometheus-operator-crd to 24.0.0 (Prometheus Operator CRDs v0.94.0).kube-prometheus-stack to 24.0.0 (chart 91.2.3, Prometheus Operator v0.94.0).TCPRoute and UDPRoute collectors to v1, which is the version the API server serves.github.com, gsoci.azurecr.io and grafana.com from every node (targets egress-github, egress-registry, egress-grafana), so an allowlist-style firewall change blocking a single domain becomes visible. The new serviceMonitor.externalTargets value is a map so per-installation, per-region or per-customer overrides can disable, change or add individual entries without copying the whole list. A separate serviceMonitor.additionalExternalTargets key takes regional/customer additions, structurally separated from the Giant Swarm defaults. Adds the http_2xx_or_401 module for registry endpoints that answer unauthenticated requests with 401. See giantswarm/giantswarm#33409.http_2xx_egress module, used by the internet egress targets. It carries a 15s timeout so probe_success reports whether an endpoint is reachable rather than whether it is fast. It is a separate module rather than a longer timeout on http_2xx because several installations pin http_2xx in their own custom values, which would silently revert the change there.instance metric relabeling from the ServiceMonitor template. It interpolated a url field that no target defines, so it rendered empty and Prometheus fell back to its $1 default, leaving instance unchanged.scrapeTimeout: 20s on http-giantswarm, egress-github, egress-registry and egress-grafana, and a 15s timeout on http_2xx_or_401. The exporter applies min(module timeout, scrapeTimeout - 0.5s offset), so the 5s serviceMonitor.defaults.scrapeTimeout capped every probe at a 4.5s deadline and raising a module timeout alone had no effect. Installations whose baseline latency is a large fraction of that deadline crossed it on endpoints that were still returning HTTP 200, making probe_success report latency rather than reachability.dns-tcp-internal and dns-udp-internal ServiceMonitors at the dns_*_internal modules. They referenced the _external modules, so both probed www.prometheus.io and in-cluster DNS resolution was never monitored.VulnerabilityReport creation, starboard-exporter metrics for that report, kyverno restricted PSS enforcement, and kyverno-policy-operator PolicyException translation.exception-recommender (app) to v0.3.0.falco (app) to v0.13.0.jiralert (app) to v0.1.4.kubescape (app) to v0.1.1.kyverno-policies (app) to v0.27.1.policy-api (app) to v0.0.12.starboard-exporter (app) to v1.2.15.trivy (app) to v0.18.0.trivy-operator (app) to v0.15.0.gel (app).kubescape a 15m install and upgrade timeout. It does not finish installing within Flux’s 5m default, so it failed with context deadline exceeded and then retried indefinitely.createNamespace on every app in the bundle, so each one creates its target namespace instead of relying on another app to have created it first. Previously kubescape failed with namespaces "kubescape" not found, and the apps targeting security-bundle could only install after kyverno-policy-operator had created it.teleport-kube-agent to upstream version v18.10.7.PodSecurityPolicy.global.podSecurityStandards.enforced helm value.PodSecurityPolicy.global.podSecurityStandards.enforced helm value.0600 ca.crt on an AKS node, where the exporter runs as an unprivileged user) stopped the walk, silently dropping every file sorting after it from the metrics. Unreadable files are now logged and skipped individually.gsoci.azurecr.io/giantswarm/cilium-ztunnel instead of pulling it from upstream. Cilium v1.20 moved this image from docker.io/istio/ztunnel to quay.io/cilium/ztunnel:v1.0.0, and our mirror carries exactly that digest, so it no longer has to be allow-listed in sync/unmirrored-images.txt. Only used by encryption.type=ztunnel, which we do not support.values.schema.json does not reject unknown keys, leftovers in existing values are silently ignored rather than rejected — check your values before upgrading:encryption.strictMode.{enabled,cidr,allowRemoteNodeIdentities} → use encryption.strictMode.egress.*encryption.ipsec.encryptedOverlayclustermesh.enableMCSAPISupport → use clustermesh.mcsapi.enabled (MCS-API is now stable upstream)clustermesh.apiserver.tls.{server,admin,remote}.{cert,key} and clustermesh.apiserver.tls.enableSecrets → enable auto-generation or pre-create the secretshubble.redact.kafka.apiKey → Kafka-aware L7 policy support and proxylib were removed upstreampreflight.tofqdnsPreCache → the preflight FQDN poller was removed upstreamhubble.ui.backend.{livenessProbe,readinessProbe}.enabledsync/patches/certgen/. Cilium v1.20 ships the certgen.enforceCAValidityThroughoutLeavesDuration value and wires --ca-enforce-validity-throughout-leaves-duration into both certgen job specs itself, so the Giant Swarm patch that added them became a no-op (it detected this and skipped). The default stays true and the rendered job specs are unchanged, so two more patches drop out of diffs/.coredns image to 1.14.6..github/release-pr-body.md.configmap.log, loadbalancePolicy and configmap.cache again. Since 1.31.0 coredns.<zone>.log, coredns.<zone>.loadbalance and coredns.<zone>.cache.success.ttl shipped defaults that shadowed them, so the old keys were silently ignored. They are now unset by default, restoring the documented fallback chain. Rendering with default values is unchanged.keywords to Chart.yaml.io.giantswarm.application.audience (all) anddenyEgressToIMDS policy denying pod egress to the instance metadata service. Disabled by default.karpenter and aws-load-balancer-controller namespaces from denyEgressToIMDS.application.giantswarm.io/team key todisableSystemdCollector value to turn the systemd collector off, mirroring the existing disableConntrackCollector and disableNvmeCollector toggles. The collector needs a D-Bus connection to the host, which is refused on nodes where AppArmor mediates D-Bus (such as AKS Ubuntu nodes running under the default containerd profile), making it fail on every scrape. Defaults to false, so behaviour is unchanged.alloy apps to 0.23.1 (Alloy v1.19.2).prometheus-operator-crd to 24.0.0 (Prometheus Operator CRDs v0.94.0).kube-prometheus-stack to 24.0.0 (chart 91.2.3, Prometheus Operator v0.94.0).TCPRoute and UDPRoute collectors to v1, which is the version the API server serves.github.com, gsoci.azurecr.io and grafana.com from every node (targets egress-github, egress-registry, egress-grafana), so an allowlist-style firewall change blocking a single domain becomes visible. The new serviceMonitor.externalTargets value is a map so per-installation, per-region or per-customer overrides can disable, change or add individual entries without copying the whole list. A separate serviceMonitor.additionalExternalTargets key takes regional/customer additions, structurally separated from the Giant Swarm defaults. Adds the http_2xx_or_401 module for registry endpoints that answer unauthenticated requests with 401. See giantswarm/giantswarm#33409.http_2xx_egress module, used by the internet egress targets. It carries a 15s timeout so probe_success reports whether an endpoint is reachable rather than whether it is fast. It is a separate module rather than a longer timeout on http_2xx because several installations pin http_2xx in their own custom values, which would silently revert the change there.instance metric relabeling from the ServiceMonitor template. It interpolated a url field that no target defines, so it rendered empty and Prometheus fell back to its $1 default, leaving instance unchanged.scrapeTimeout: 20s on http-giantswarm, egress-github, egress-registry and egress-grafana, and a 15s timeout on http_2xx_or_401. The exporter applies min(module timeout, scrapeTimeout - 0.5s offset), so the 5s serviceMonitor.defaults.scrapeTimeout capped every probe at a 4.5s deadline and raising a module timeout alone had no effect. Installations whose baseline latency is a large fraction of that deadline crossed it on endpoints that were still returning HTTP 200, making probe_success report latency rather than reachability.dns-tcp-internal and dns-udp-internal ServiceMonitors at the dns_*_internal modules. They referenced the _external modules, so both probed www.prometheus.io and in-cluster DNS resolution was never monitored.VulnerabilityReport creation, starboard-exporter metrics for that report, kyverno restricted PSS enforcement, and kyverno-policy-operator PolicyException translation.exception-recommender (app) to v0.3.0.falco (app) to v0.13.0.jiralert (app) to v0.1.4.kubescape (app) to v0.1.1.kyverno-policies (app) to v0.27.1.policy-api (app) to v0.0.12.starboard-exporter (app) to v1.2.15.trivy (app) to v0.18.0.trivy-operator (app) to v0.15.0.gel (app).kubescape a 15m install and upgrade timeout. It does not finish installing within Flux’s 5m default, so it failed with context deadline exceeded and then retried indefinitely.createNamespace on every app in the bundle, so each one creates its target namespace instead of relying on another app to have created it first. Previously kubescape failed with namespaces "kubescape" not found, and the apps targeting security-bundle could only install after kyverno-policy-operator had created it.teleport-kube-agent to upstream version v18.10.7.app.kubernetes.io/component label with the app name to the resources rendered per app, so they can be listed together.- operator: Exists toleration on the hubble-relay, hubble-ui and certgen components with an explicit list..global.connectivity.network.enablePrivateLinkWithPrivateMode). Useful for BYON scenarios.preKubeadmCommandsTemplateName and postKubeadmCommandsTemplateName hooks under providerIntegration.controlPlane.kubeadmConfig and providerIntegration.workers.kubeadmConfig. They name a provider template that renders a YAML list of additional kubeadm commands, once for the control plane and once per node pool for workers.internal.advancedConfiguration.kubelet.evictionHard values. Providers need them to tell autoscalers such as Karpenter how much of a node’s resources is allocatable.global.components.selinux.writablePolicyStore value (default true) to allow loading additional SELinux policies.ClusterTrustBundle and ClusterTrustBundleProjection feature gates (Kubernetes 1.33+) and the PodCertificateRequest feature gate (Kubernetes 1.35+) by default on kube-apiserver, kube-controller-manager and kubelet./usr (previously only /etc/kubernetes)./etc/ssl/certs for mounting into containers.docker-kubectl to v1.36.4.global.providerSpecific.failureDomains to restrict the availability zones of the region the control plane nodes are allowed to run in..github/release-pr-body.md. Towards https://github.com/giantswarm/roadmap/issues/4334minSize and maxSize fields to enable per-node-pool autoscaling configuration.network.giantswarm.io/wildcard-cname-target annotation on AzureCluster via global.connectivity.dns.wildcardCnameTarget.encryptionAtHost parameter to false.network.giantswarm.io/wildcard-cname-target annotation from AzureCluster CR to Cluster CR._clusterautoscaler_app_config.yaml to provide Azure subscriptionID to cluster-autoscaler.external-dns-private from App CR to HelmRelease, removing cluster-values ConfigMap reference.cluster chart defaults.cluster-shared library chart dependency.HelmRelease resources from the removed helm.toolkit.fluxcd.io/v2beta1 API to helm.toolkit.fluxcd.io/v2 so cluster apps render on management clusters running current Flux.cert-manager-crossplane-resources HelmRelease.cluster-autoscaler inCluster in Azure.cluster-api-autoscaler-node-group-min-size/max-size) when minSize/maxSize are set on a node pool (only in Azure).KamajiControlPlane resource, Kamaji etcd HelmRelease, automation RBAC, and cleanup jobs. (#740)coredns HelmRelease values to the new coredns-app zone-aware interface.coredns control plane helper to align with the controlPlane values key.cert-manager to v4.0.0 and migrated the values to match the new chart’s schema.global.apps.<name>.extraConfigs.name field.cluster.x-k8s.io/replicas-managed-by: "external-autoscaler") on MachinePools.providerIntegration.resourcesApi.machinePoolResourcesEnabled into an object providerIntegration.resourcesApi.machinePoolResources and move externalAutoscaler under it (now providerIntegration.resourcesApi.machinePoolResources.externalAutoscaler).global.release.version if using Releases to give a better rendering error message.observability-bundle with the management cluster name.kyverno-crds dependency for cluster-autoscaler when deployed inCluster.global.apps.clusterProbes with default module http_2xx_insecure for self-signed certificates..Chart.AppVersion in app.kubernetes.io/version label.v1beta2.strategy.rollingUpdate.deletePolicy from node pools./metrics keeps returning 200 and serving the remaining metrics when a duplicate series is emitted.tls.crt holds a concatenated certificate chain.cert_gen now sets a certificate serial number, which defaulted to 0 for every generated certificate.kube-system namespace.exec format error.serialnumber label to the cert_exporter_not_after and cert_exporter_secret_not_after metrics so concatenated certificates no longer collide into identical series. The collision made the registry fail Gather(), which blanked out the entire /metrics endpoint (regression from v2.10.1)./metrics with ContinueOnError so a single problematic metric can no longer fail the whole scrape.docker-kubectl image to support arm64 architecturecert-manager to upstream version v1.20.3.cert-manager-edit ClusterRole no longer grants create on challenges.acme.cert-manager.io, nor create/patch/update on orders.acme.cert-manager.io.envFrom values for controller, webhook and cainjector.cert-manager chart will now need to use the cert-manager path instead of root. For example, the value crds.enabled: true must now be set with cert-manager.crds.enabled: true.helm/cert-manager/charts/ and adapted sync scripts to follow new structure.sync/verify-images.sh, run as the last step of sync/sync.sh and therefore in CI: renders the chart across four scenarios covering every image-bearing component and fails the sync unless each image is served from gsoci.azurecr.io/giantswarm/ or is explicitly listed in sync/unmirrored-images.txt. It also asserts that every configured image actually appears in a render, so a scenario that stops covering an image fails instead of silently narrowing the check. This replaces the removed patch’s fail guards, which were the only thing that made image drift visible on an upstream bump..github/release-pr-body.md.hubble.tls.auto.method: helm to cronJob (giantswarm#37201). The helm method minted certificates once and never renewed them, deterministically breaking hubble-relay when the leaf certs (1 year) or the CA (3 years) expired. With the cronJob method a hubble-generate-certs CronJob re-issues the leaf certificates every 4 months. On upgrade, the Helm-owned cilium-ca, hubble-server-certs and hubble-relay-client-certs secrets are deleted and re-created by a one-shot certgen job with a fresh 3-year CA; agents and hubble-relay hot-reload the new certificates without restarts.--ca-enforce-validity-throughout-leaves-duration flag (new value certgen.enforceCAValidityThroughoutLeavesDuration, default true): the certgen job now fails roughly one year before the CA would no longer cover new leaf certificates, instead of silently issuing leafs that outlive the CA. certgen never rotates an existing CA on its own (cilium/certgen#500).hubble-relay podAffinity to preferredDuringSchedulingIgnoredDuringExecution so Karpenter can drain the last cilium-agent-bearing node during upgrades/consolidation instead of getting stuck on a required co-location with cilium.image.registry value and the sync patch behind it (roadmap#3264). The registry is now part of each image’s repository value, exactly as upstream ships it, so the chart no longer patches upstream’s cilium.image/cilium.operator.image helpers into a (list $ <image>) signature and no longer rewrites all 35 call sites with sed. helm/cilium/templates/_helpers.tpl and helm/cilium/templates/cilium-operator/_helpers.tpl are now byte-identical to upstream, and 15 template patches disappear from diffs/.repository already carried a registry while the removed patch prefixed image.registry on top: gsoci.azurecr.io/ghcr.io/spiffe/spire-server, .../spire-agent, .../docker.io/library/busybox (SPIRE mutual authentication) and .../docker.io/istio/ztunnel (encryption.type=ztunnel). All four now resolve. Latent until now because both features are disabled by default.hubble/tls-cronjob and clustermesh-apiserver/tls-cronjob): the image reference was not converted to the Giant Swarm cilium.image helper signature because the image-registries sync patch only processed *.yaml templates, so enabling the cronJob method failed with required list, but got "map".hubble-generate-certs and clustermesh-apiserver-generate-certs certgen pods egress to the Kubernetes API.enabled flag for the agent, hubble and operator.kube-system namespace.forward, cache, and kubernetes block parameters in the structured zone config:forward: maxIdleConns, maxConnectAttempts, dohMethod, tls, tlsServername, next, nextOnNodata, failfastAllUnhealthyUpstreams, failover, resolver.cache: zones, serveStale.verifyTimeout, disable.successZones, disable.denialZones.kubernetes: endpoint, tls, kubeconfig, apiserverQPS, apiserverBurst, apiserverMaxInflight, namespaceLabels, fallthroughZones, multicluster, startupTimeout.app-build-suite 2.2.0 (via architect orb 9.6.0): the packaged chart now carries Artifact Hub metadata (artifacthub.io/license and a Support link). No functional chart changes.values.yaml comments to the # @schema / # -- (helm-docs) convention and remove section-header dividers, so values.schema.json and the chart README.md are generated from the values file. Rendered manifests are unchanged.coredns image to 1.14.4.coredns image to 1.14.3.health directive in only the . server block. The health plugin is process-wide and can be enabled in just one Server Block, so emitting it in every zone block was invalid. ready is kept in every block (its readiness is aggregated across blocks).coredns.*.cache.serveStale.refreshMode schema enum to immediate/verify (was immediate/background), matching the CoreDNS cache plugin.updatePolicy.updateMode from deprecated Auto to Recreate.namespaceOverride value to support deploying external-dns into a different namespace than the Helm release (useful for subchart usage).enableGatewayListenerSets value to opt into Gateway API ListenerSet resource support.sourceNamespace value (used with namespaced=true) to watch resources in a namespace different from the deployment namespace.gatewayNamespace is set, reducing required permissions.extraArgs map handling: boolean values now render as --flag / --no-flag and string values are properly quoted.exec format error.docker-kubectl init container from 1.25.4 to 1.36.0.konnectivity-agent.kube-system namespace.ListenerSet and ReferenceGrant resources.v1 for Gateway, GatewayClass, HTTPRoute, GRPCRoute, TLSRoute and BackendTLSPolicy.kube-prometheus-stack and prometheus-operator-crd to 22.0.0alloy-app to 0.21.0priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)alloy-podlogs-crds chart.blackbox-exporter. Uses updateMode: Initial for DaemonSet and updateMode: Auto for Deployment.kubernetes.io/arch=arm64:NoSchedule so the DaemonSet schedules on ARM worker nodes.probe_target label to ensure unique synthetic metricsio.giantswarm.application.managed chart annotation for Backstage visibility.cluster-reader ClusterRole (off by default, enabled via clusterReader.enabled: true) that aggregates into the built-in view ClusterRole and grants read access (get/list/watch) on cluster-scoped resources.kyverno-policy-operator (app) to v0.2.3.policy-api (app) to v0.0.9.starboard-exporter (app) to v1.2.3.trivy (app) to v0.17.0.trivy-operator (app) to v0.13.3..github/release-pr-body.md.kyverno-policies (app) to v0.26.1.starboard-exporter (app) to v1.1.4.trivy (app) to v0.16.0.trivy-operator (app) to v0.13.2.cloudnative-pg (app) to v0.1.0.trivy (app) to v0.15.0.falco (app) to v0.12.0.priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)kyverno (app) to v0.24.2.kyverno-crds (app) to v1.17.0.kyverno-policies (app) to v0.25.0.kyverno-policy-operator (app) to v0.2.2.kubescape (app) to v0.1.0.node.cloudprovider.kubernetes.io/uninitialized.teleport-kube-agent to upstream version v18.7.6.global.providerSpecific.failureDomains to restrict the availability zones of the region the control plane nodes are allowed to run in..github/release-pr-body.md. Towards https://github.com/giantswarm/roadmap/issues/4334minSize and maxSize fields to enable per-node-pool autoscaling configuration.network.giantswarm.io/wildcard-cname-target annotation on AzureCluster via global.connectivity.dns.wildcardCnameTarget.encryptionAtHost parameter to false.network.giantswarm.io/wildcard-cname-target annotation from AzureCluster CR to Cluster CR._clusterautoscaler_app_config.yaml to provide Azure subscriptionID to cluster-autoscaler.external-dns-private from App CR to HelmRelease, removing cluster-values ConfigMap reference.cluster chart defaults.cluster-shared library chart dependency.HelmRelease resources from the removed helm.toolkit.fluxcd.io/v2beta1 API to helm.toolkit.fluxcd.io/v2 so cluster apps render on management clusters running current Flux.cert-manager-crossplane-resources HelmRelease.cluster-autoscaler inCluster in Azure.cluster-api-autoscaler-node-group-min-size/max-size) when minSize/maxSize are set on a node pool (only in Azure).KamajiControlPlane resource, Kamaji etcd HelmRelease, automation RBAC, and cleanup jobs. (#740)coredns HelmRelease values to the new coredns-app zone-aware interface.coredns control plane helper to align with the controlPlane values key.cert-manager to v4.0.0 and migrated the values to match the new chart’s schema.global.apps.<name>.extraConfigs.name field.cluster.x-k8s.io/replicas-managed-by: "external-autoscaler") on MachinePools.providerIntegration.resourcesApi.machinePoolResourcesEnabled into an object providerIntegration.resourcesApi.machinePoolResources and move externalAutoscaler under it (now providerIntegration.resourcesApi.machinePoolResources.externalAutoscaler).global.release.version if using Releases to give a better rendering error message.observability-bundle with the management cluster name.kyverno-crds dependency for cluster-autoscaler when deployed inCluster.global.apps.clusterProbes with default module http_2xx_insecure for self-signed certificates..Chart.AppVersion in app.kubernetes.io/version label.v1beta2.strategy.rollingUpdate.deletePolicy from node pools./metrics keeps returning 200 and serving the remaining metrics when a duplicate series is emitted.tls.crt holds a concatenated certificate chain.cert_gen now sets a certificate serial number, which defaulted to 0 for every generated certificate.kube-system namespace.exec format error.serialnumber label to the cert_exporter_not_after and cert_exporter_secret_not_after metrics so concatenated certificates no longer collide into identical series. The collision made the registry fail Gather(), which blanked out the entire /metrics endpoint (regression from v2.10.1)./metrics with ContinueOnError so a single problematic metric can no longer fail the whole scrape.docker-kubectl image to support arm64 architecturecert-manager to upstream version v1.20.3.cert-manager-edit ClusterRole no longer grants create on challenges.acme.cert-manager.io, nor create/patch/update on orders.acme.cert-manager.io.envFrom values for controller, webhook and cainjector.cert-manager chart will now need to use the cert-manager path instead of root. For example, the value crds.enabled: true must now be set with cert-manager.crds.enabled: true.helm/cert-manager/charts/ and adapted sync scripts to follow new structure.sync/verify-images.sh, run as the last step of sync/sync.sh and therefore in CI: renders the chart across four scenarios covering every image-bearing component and fails the sync unless each image is served from gsoci.azurecr.io/giantswarm/ or is explicitly listed in sync/unmirrored-images.txt. It also asserts that every configured image actually appears in a render, so a scenario that stops covering an image fails instead of silently narrowing the check. This replaces the removed patch’s fail guards, which were the only thing that made image drift visible on an upstream bump..github/release-pr-body.md.hubble.tls.auto.method: helm to cronJob (giantswarm#37201). The helm method minted certificates once and never renewed them, deterministically breaking hubble-relay when the leaf certs (1 year) or the CA (3 years) expired. With the cronJob method a hubble-generate-certs CronJob re-issues the leaf certificates every 4 months. On upgrade, the Helm-owned cilium-ca, hubble-server-certs and hubble-relay-client-certs secrets are deleted and re-created by a one-shot certgen job with a fresh 3-year CA; agents and hubble-relay hot-reload the new certificates without restarts.--ca-enforce-validity-throughout-leaves-duration flag (new value certgen.enforceCAValidityThroughoutLeavesDuration, default true): the certgen job now fails roughly one year before the CA would no longer cover new leaf certificates, instead of silently issuing leafs that outlive the CA. certgen never rotates an existing CA on its own (cilium/certgen#500).hubble-relay podAffinity to preferredDuringSchedulingIgnoredDuringExecution so Karpenter can drain the last cilium-agent-bearing node during upgrades/consolidation instead of getting stuck on a required co-location with cilium.image.registry value and the sync patch behind it (roadmap#3264). The registry is now part of each image’s repository value, exactly as upstream ships it, so the chart no longer patches upstream’s cilium.image/cilium.operator.image helpers into a (list $ <image>) signature and no longer rewrites all 35 call sites with sed. helm/cilium/templates/_helpers.tpl and helm/cilium/templates/cilium-operator/_helpers.tpl are now byte-identical to upstream, and 15 template patches disappear from diffs/.repository already carried a registry while the removed patch prefixed image.registry on top: gsoci.azurecr.io/ghcr.io/spiffe/spire-server, .../spire-agent, .../docker.io/library/busybox (SPIRE mutual authentication) and .../docker.io/istio/ztunnel (encryption.type=ztunnel). All four now resolve. Latent until now because both features are disabled by default.hubble/tls-cronjob and clustermesh-apiserver/tls-cronjob): the image reference was not converted to the Giant Swarm cilium.image helper signature because the image-registries sync patch only processed *.yaml templates, so enabling the cronJob method failed with required list, but got "map".hubble-generate-certs and clustermesh-apiserver-generate-certs certgen pods egress to the Kubernetes API.enabled flag for the agent, hubble and operator.kube-system namespace.forward, cache, and kubernetes block parameters in the structured zone config:forward: maxIdleConns, maxConnectAttempts, dohMethod, tls, tlsServername, next, nextOnNodata, failfastAllUnhealthyUpstreams, failover, resolver.cache: zones, serveStale.verifyTimeout, disable.successZones, disable.denialZones.kubernetes: endpoint, tls, kubeconfig, apiserverQPS, apiserverBurst, apiserverMaxInflight, namespaceLabels, fallthroughZones, multicluster, startupTimeout.app-build-suite 2.2.0 (via architect orb 9.6.0): the packaged chart now carries Artifact Hub metadata (artifacthub.io/license and a Support link). No functional chart changes.values.yaml comments to the # @schema / # -- (helm-docs) convention and remove section-header dividers, so values.schema.json and the chart README.md are generated from the values file. Rendered manifests are unchanged.coredns image to 1.14.4.coredns image to 1.14.3.health directive in only the . server block. The health plugin is process-wide and can be enabled in just one Server Block, so emitting it in every zone block was invalid. ready is kept in every block (its readiness is aggregated across blocks).coredns.*.cache.serveStale.refreshMode schema enum to immediate/verify (was immediate/background), matching the CoreDNS cache plugin.updatePolicy.updateMode from deprecated Auto to Recreate.namespaceOverride value to support deploying external-dns into a different namespace than the Helm release (useful for subchart usage).enableGatewayListenerSets value to opt into Gateway API ListenerSet resource support.sourceNamespace value (used with namespaced=true) to watch resources in a namespace different from the deployment namespace.gatewayNamespace is set, reducing required permissions.extraArgs map handling: boolean values now render as --flag / --no-flag and string values are properly quoted.exec format error.docker-kubectl init container from 1.25.4 to 1.36.0.konnectivity-agent.kube-system namespace.ListenerSet and ReferenceGrant resources.v1 for Gateway, GatewayClass, HTTPRoute, GRPCRoute, TLSRoute and BackendTLSPolicy.kube-prometheus-stack and prometheus-operator-crd to 22.0.0alloy-app to 0.21.0priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)alloy-podlogs-crds chart.blackbox-exporter. Uses updateMode: Initial for DaemonSet and updateMode: Auto for Deployment.kubernetes.io/arch=arm64:NoSchedule so the DaemonSet schedules on ARM worker nodes.probe_target label to ensure unique synthetic metricsio.giantswarm.application.managed chart annotation for Backstage visibility.cluster-reader ClusterRole (off by default, enabled via clusterReader.enabled: true) that aggregates into the built-in view ClusterRole and grants read access (get/list/watch) on cluster-scoped resources.kyverno-policy-operator (app) to v0.2.3.policy-api (app) to v0.0.9.starboard-exporter (app) to v1.2.3.trivy (app) to v0.17.0.trivy-operator (app) to v0.13.3..github/release-pr-body.md.kyverno-policies (app) to v0.26.1.starboard-exporter (app) to v1.1.4.trivy (app) to v0.16.0.trivy-operator (app) to v0.13.2.cloudnative-pg (app) to v0.1.0.trivy (app) to v0.15.0.falco (app) to v0.12.0.priority field (1-150, default 25) on extraConfigs entries. spec.valuesFrom now reproduces the App platform merge order — all configMaps before all secrets (a secret always overrides a configMap), each kind ordered by priority around the user-config layer — preserving the App CR merge semantics after the migration. (giantswarm#36096)kyverno (app) to v0.24.2.kyverno-crds (app) to v1.17.0.kyverno-policies (app) to v0.25.0.kyverno-policy-operator (app) to v0.2.2.kubescape (app) to v0.1.0.node.cloudprovider.kubernetes.io/uninitialized.teleport-kube-agent to upstream version v18.7.6.