Connectivity

  • Changed

    • Update Envoy Gateway to v1.7.2.
    • Grant infra-manager get/list/watch on Secrets when GatewayNamespace deploy mode is used with explicit watch namespaces.
  • Changed

    • Update VPA updatePolicy.updateMode from deprecated Auto to Recreate.
    • Upgrade external-dns to v0.21.0.
    • Sync to upstream helm chart 1.21.1.
      • Add namespaceOverride value to support deploying external-dns into a different namespace than the Helm release (useful for subchart usage).
      • Add enableGatewayListenerSets value to opt into Gateway API ListenerSet resource support.
      • Add sourceNamespace value (used with namespaced=true) to watch resources in a namespace different from the deployment namespace.
      • Avoid creating cluster-scoped namespace RBAC when gatewayNamespace is set, reducing required permissions.
      • Fix extraArgs map handling: boolean values now render as --flag / --no-flag and string values are properly quoted.
    • Use external-dns.namespace in VPA and NetworkPolicy resources.
  • Added

    • Add configmap.log.enabled helm value to toggle CoreDNS query logging (default: false).
  • Added

    • Make AAAA NOERROR configurable for IPv6.
  • Added

    • Add awsPartition value to support non-standard AWS partitions (e.g. China).
    • Add oidcDomain and oidcDomains values to support multiple OIDC providers; the IAM trust policy now iterates over all provided domains.
    • Add managed-by: external-dns-crossplane-resources tag to the IAM role.

    Changed

    • Add io.giantswarm.application.audience: giantswarm annotation.
    • Migrate chart metadata annotations to io.giantswarm.application.* format.
    • Move required validation for awsPartition and accountID into named template helpers.
    • Replace deprecated app.giantswarm.io/branch, application.kubernetes.io/managed-by, and giantswarm.io/service-type labels with app.kubernetes.io/* equivalents.
    • Update chart description, icon, and owning team (cabbage).

    Removed

    • Remove name, serviceType, project.branch, and project.commit values that were leftover hackathon scaffolding.
    • Remove hardcoded baseDomain-based OIDC provider URL; replaced by oidcDomain/oidcDomains.
  • Added

    • Add coredns-adopter job to adopt default CoreDNS resources on EKS clusters (disabled by default).
  • Changed

    • Update Envoy Gateway to v1.7.1.
  • Changed

    • Make VPA resource more flexible: updateMode, controlledValues, and mode are now configurable per container group; maxAllowed is supported for both proxy and controller containers.
  • Changed

    • Chart: Sync to upstream.
      • Controller: Update image to v1.15.1.
      • Kube Webhook CertGen: Update image to v1.6.9.
  • Changed

    • Chart: Sync to upstream.
      • Controller: Update image to v1.14.5.
      • Kube Webhook CertGen: Update image to v1.6.9.