Warning: Important Note for Upgrading to this Release
tl;dr: Please first upgrade your existing cluster to Giant Swarm Release v33.1.1 for Azure or newer before upgrading to this release! Otherwise, you risk service outage and severe issues.
Giant Swarm Release v34.0.0 for Azure comes with Kubernetes v1.34. This version contains etcd v3.6, which makes use of the so-called v3 store by default. Before, with etcd v3.5, the v2 store was used by default and synchronized to the already existing v3 store.
Different flaws could lead to an inconsistency between the old v2 store and the already present but unused standby v3 store in etcd v3.5 and before. Because of this, new etcd v3.6 members, which first start to use this v3 store, might suffer from these inconsistencies.
This can come into play when upgrading a cluster to this and future releases from any release older than Giant Swarm Release v33.1.1 for Azure. For this reason, we require you to first upgrade your cluster to Giant Swarm Release v33.1.1 for Azure or newer before upgrading to this or future releases.
OIDC Structured Authentication (optional)
This release introduces optional support for Kubernetes Structured Authentication Configuration for OIDC providers. We recommend testing this feature on a non-production cluster first.
Minimal example
global:
controlPlane:
oidc:
structuredAuthentication:
enabled: true
issuers:
- issuerUrl: https://your-idp.example.com
clientId: kubernetes
Example with customization
global:
controlPlane:
oidc:
structuredAuthentication:
enabled: true
issuers:
- issuerUrl: https://your-idp.example.com
clientId: kubernetes
usernameClaim: email # Optional: use 'email' instead of 'sub'
groupsClaim: roles # Optional: use 'roles' instead of 'groups'
usernamePrefix: "oidc:" # Optional: prefix usernames
groupsPrefix: "oidc:" # Optional: prefix groups
Migration from legacy OIDC configuration
If you already use OIDC with the legacy configuration, add structuredAuthentication.enabled: true to migrate:
global:
controlPlane:
oidc:
issuerUrl: https://your-idp.example.com
clientId: kubernetes
structuredAuthentication:
enabled: true
This will automatically convert your legacy configuration to the new structured format.
Advanced options
Additional configuration options are available for more complex setups, including:
- Multiple audiences (
audiences, audienceMatchPolicy) - Custom discovery URL (
discoveryUrl) - Custom CA certificate (
caPem) - CEL expressions for claim and user validation (
claimValidationRules, userValidationRules) - Advanced claim mappings with CEL expressions (
claimMappings)
Refer to the Kubernetes Structured Authentication documentation for details.
Changes compared to v33.1.1
Components
- cluster-azure from v4.4.0 to v5.1.2
- Flatcar from v4459.2.1 to v4459.2.2
- Kubernetes from v1.33.6 to v1.34.3
- os-tooling from v1.26.2 to v1.26.3
Added
- Add the
priority-classes default app, enabled by default. This app provides standardised PriorityClass resources like giantswarm-critical and giantswarm-high, which should replace the previous inconsistent per-app priority classes. - Add
"helm.sh/resource-policy": keep annotation to AzureCluster CR so that it doesn’t get removed by Helm when uninstalling this chart. The CAPI controllers will take care of removing it, following the expected deletion order.
Changed
- Chart: Update
cluster to v5.1.2. - Chart: Update
cluster to v5.1.1. - Chart: Update
cluster to v5.1.0. - Chart: Update
cluster to v5.0.0.
Apps
- azure-cloud-controller-manager from v1.32.7-1 to v2.0.0
- azure-cloud-node-manager from v1.32.7 to v2.0.0
- azuredisk-csi-driver from v1.32.9 to v2.1.0
- azurefile-csi-driver from v1.32.5 to v2.0.0
- cert-exporter from v2.9.14 to v2.9.15
- cilium from v1.3.2 to v1.3.4
- coredns from v1.28.3 to v1.29.1
- etcd-k8s-res-count-exporter from v1.10.11 to v1.10.12
- external-dns from v3.2.0 to v3.4.0
- k8s-audit-metrics from v0.10.10 to v0.10.11
- network-policies from v0.1.1 to v0.1.3
- node-exporter from v1.20.9 to v1.20.10
- observability-bundle from v2.3.2 to v2.5.0
- Added priority-classes v0.3.0
- security-bundle from v1.15.0 to v1.16.1
Changed
- Chart: Update to upstream v1.34.3. (#132)
Changed
- Chart: Update to upstream v1.34.3. (#118)
Changed
- Chart: Update to upstream v1.34.0. (#118)
- Chart: Update to upstream v1.33.7. (#114)
Changed
- Chart: Update to upstream v1.34.2. (#71)
Changed
Changed
Changed
- Update
coredns image to 1.14.1. - Update
coredns image to 1.14.0.
Changed
Changed
- Sync to upstream helm chart 1.20.0.
- Add option to set annotationPrefix.
- Fixed the missing schema for .provider.webhook.serviceMonitor configs.
- Fixed incorrect indentation of selector labels under spec.template.spec.topologySpreadConstraints when topologySpreadConstraints is set.
- Use kubectl-apply-job when installing CRDs.
- Upgrade external-dns to v0.20.0.
- Update DNSEndpoints CRD.
- Sync to upstream helm chart
1.19.0.- Grant
discovery.k8s.io/endpointslices permission only when using service source. - Update RBAC for
Service source to support EndpointSlices. - Allow extraArgs to also be a map enabling overrides of individual values.
- Set defaults for
automountServiceAccountToken and serviceAccount.automountServiceAccountToken to true in Helm chart values. - Correctly handle
txtPrefix and txtSuffix arguments when both are provided. - Add ability to generate schema with
helm plugin schema. - Regenerate JSON schema with `helm-values-schema-json’ plugin.
- Added ability to configure
imagePullSecrets via helm global value. - Added options to configure
labelFilter and managedRecordTypes via dedicated helm values. - Allow templating
serviceaccount.annotations keys and values, by rendering them using the tpl built-in function. - Added support for
extraContainers argument. - Added support for setting
excludeDomains argument. - Added support for setting
dnsConfig. - Added support for webhook providers.
- Restrict managed record types to A and CNAME.
Changed
Added
Fixed
Removed
- Repository: Remove integration tests.
Added
- Add KSM metrics
kube_servicemonitor_info and kube_podmonitor_info for ServiceMonitor and PodMonitor resources - Add KSM metrics
kube_podlog_info for PodLog resource
Changed
- Upgrade
kube-prometheus-stack-app to 19.0.0 - Update alloy-app to 0.16.0
Fixed
- Fixed KSM metrics for endpoints
priority-classes v0.3.0
Changed
- Label now uses chart version instead of app version.
Removed
- Removed appVersion (only version is used now).
Changed
- Add missing dependency to all apps.
- Allow to set multiple dependencies on the depends-on annotation.
- Rename
edgedb to gel. - Update
cloudnative-pg (app) to v0.0.12. - Update
gel (app) to v1.0.1.
