Fleet Management - Giant Swarm Changes and Releases

zot release v2.8.0

Tue, 16 Jun 2026 15:30:01 +0000

Changed

Update to upstream Helm Chart v0.1.117 and Zot v2.1.17.

keda-app release v5.0.4

Mon, 15 Jun 2026 22:28:30 +0000

Changed

Fix ABS config to not override AppVersion in Chart.yaml

keda-app release v5.0.3

Mon, 15 Jun 2026 16:02:51 +0000

Changed

Use Giant Swarm hosted app icon

kubectl-gs release v5.6.4

Mon, 01 Jun 2026 11:04:04 +0000

Added

login: new --oidc-scope flag (repeatable, comma-separated) appends extra scopes to the direct workload-cluster OIDC request. Use --oidc-scope=groups with Okta to receive group memberships in the ID token when the workload cluster’s structured auth is configured with groupsClaim.

capa-karpenter-taint-remover release v1.1.0

Fri, 29 May 2026 09:05:32 +0000

Changed

Build and publish a multi-arch (linux/amd64 + linux/arm64) container image.
Add io.giantswarm.application.audience: all annotation to publish the app to the customer Backstage catalog.
Migrate chart metadata annotations to io.giantswarm.application.* format.

aws-load-balancer-controller-app release v5.2.0

Fri, 29 May 2026 08:07:02 +0000

Added

Add valuesFromSecret value to optionally inject a Secret as an additional valuesFrom source in the HelmRelease.

kubectl-gs release v5.6.3

Thu, 28 May 2026 11:52:50 +0000

Fixed

login: stop silently rerouting client-certificate logins to direct OIDC. Passing any cert-only flag now skips structured-auth detection.

Changed

template cluster: expand the command’s --help with a multi-line Long description, a docs URL, and worked examples — including how to add an arm64 worker node pool to the generated values.yaml for AWS clusters.

kubectl-gs release v5.6.2

Fri, 22 May 2026 15:19:35 +0000

Fixed

login: do not break the generated kubeconfig when the OIDC provider does not return a refresh token. The plugin now serves the still-valid ID token first and only requires a refresh token at renewal time.

kubectl-gs release v5.6.1

Fri, 22 May 2026 08:23:46 +0000

Changed

Upgrading Flux API versions to match the ones considered stable in Flux 2.6.

kubectl-gs release v5.6.0

Tue, 19 May 2026 12:58:47 +0000

Changed

login: when a workload cluster’s structured authentication exposes multiple OIDC issuers and no --oidc-issuer / --oidc-client-id flag is set, prompt the user to pick one from a numbered menu (interactive TTY only). Non-interactive invocations keep the previous error listing the available issuers so scripted callers stay informative.
Bump giantswarm/architect orb to 8.2.2 and re-enable cosign keyless chart signing (sign: false removed from every push-to-app-catalog* invocation). v8.2.2 ships architect-orb#772 which upgrades the app-build-suite executor image from 1.8.0-circleci to 1.8.1-circleci – the new image includes the cosign binary that v8.2.0’s chart signing defaults require. Closes architect-orb#769.
Bump giantswarm/architect orb to 8.2.1 to pick up architect-orb#767: image-login-to-registries is now POSIX-portable, unblocking architect/sync-china-registry (the gsoci -> Aliyun mirror via the in-China giantswarm/galaxy-runner). The v8.1.0 refactor accidentally introduced bash-only ${!var} indirect expansion in the shared login command, which BusyBox /bin/sh (used by the regctl executor) rejected with bad substitution – so no Aliyun mirror has been happening since the migration to split-china-push: true. v8.2.x also enables cosign keyless signing, SLSA provenance, and SBOM attestations by default for public images and charts.
Enable split-china-push: true on the tag-build push-to-registries-multiarch job and add a companion sync-china-registry job. The cross-Pacific docker buildx push to the Aliyun mirror is replaced with a regctl image copy from gsoci to Aliyun executed on the in-China giantswarm/galaxy-runner self-hosted CircleCI runner.
Bump giantswarm/architect orb to 8.1.0 and replace the hand-rolled inline push-to-registries-multiarch job (~75 lines of docker buildx wrapper) with architect/push-to-registries and multiarch: true. The orb job builds the multi-arch image from the per-arch binaries produced by go-build-{amd64,arm64} and reuses the Dockerfile’s COPY ./kubectl-gs-${TARGETARCH} step. Picks up the v8.1.0 QEMU/binfmt auto-registration, hardened buildx bootstrap, and standard OCI image labels for free.

Fixed

login: enable PKCE (RFC 7636) on the direct OIDC flow used for workload clusters with Kubernetes structured authentication. Public OIDC clients registered without a client_secret (e.g. Okta SPA / Native apps) previously failed the token exchange with invalid_client because neither client authentication nor a PKCE code verifier was sent. The Dex-mediated management cluster flow is unaffected.
Drop linux/386 from the docker image’s --platform list. The base image gsoci.azurecr.io/giantswarm/alpine does not ship a linux/386 variant, so the legacy inline push-to-registries-multiarch job’s buildx invocation has been silently failing for that platform on every run – the bug was masked by the script’s ... | tee .docker.log pipe always returning 0, so the failed buildx output never affected the job’s exit code. The pushed multi-arch image therefore never actually contained a linux/386 variant. The standalone linux/386 kubectl-gs binary continues to be produced by go-build-386 and shipped through GitHub releases / krew.

kubectl-gs release v5.5.0

Tue, 12 May 2026 10:12:09 +0000

Added

login: support direct OIDC authentication for workload clusters (Kubernetes structured authentication). The appropriate workload-cluster authentication mode is now selected automatically based on the cluster’s configuration.

zot release v2.7.0

Thu, 07 May 2026 11:50:13 +0000

Changed

Update to upstream Helm Chart v0.1.112 and Zot v2.1.16.

kubectl-gs release v5.4.0

Mon, 04 May 2026 09:55:40 +0000

Added

Add global.release.version to template output for EKS

Removed

Remove unused code (error variables, helper functions, types, and dead templates)
Stop templating the deprecated default-apps-eks App

kubectl-gs release v5.3.1

Sat, 04 Apr 2026 06:14:43 +0000

Fixed

Updated dependencies

kubectl-gs release v5.3.0

Fri, 27 Mar 2026 11:18:25 +0000

Added

Usage info now also shows aliases for subcommands.

kubectl-gs release v5.2.0

Thu, 26 Mar 2026 16:59:12 +0000

Changed

Deprecated app-related commands: get apps, get catalogs, gitops add app, update app, validate apps.
Added extra error logging when doing login and cache operations.
Added handler for Exec AuthType.

kubectl-gs release v5.1.0

Thu, 26 Mar 2026 07:04:12 +0000

Changed

Migrate cluster.x-k8s.io API usage from v1beta1 to v1beta2. MachinePool CRD reference updated from exp.cluster.x-k8s.io to cluster.x-k8s.io.
Mark template app command as deprecated

Added

Add deploy chart command.

aws-load-balancer-controller-app release v5.1.0

Wed, 25 Mar 2026 14:43:04 +0000

Changed

Update chart icon URL to use Giant Swarm hosted SVG icon.

aws-efs-csi-driver release v3.3.0

Wed, 25 Mar 2026 09:19:43 +0000

Changed

Migrate chart metadata annotations to io.giantswarm.application.* format for both the app and bundle charts.
Use upstream Helm chart as a dependency instead of forking templates.
Update ABS config to replace .appVersion in Chart.yaml with version detected by ABS.

Fixed

Use .Chart.AppVersion instead of .Chart.Version for OCIRepository tag.

kubectl-gs release v5.0.2

Tue, 10 Mar 2026 14:22:56 +0000

Fixed

Fix Windows build failure caused by syscall.Flock usage in credential cache (not available on Windows).

kubectl-gs release v5.0.1

Tue, 10 Mar 2026 13:55:04 +0000

Fixed

Apply --label flag values to the Cluster CR via Helm values (global.metadata.labels), the App CR, and the ConfigMap when using template cluster.

kubectl-gs release v5.0.0

Tue, 10 Mar 2026 12:36:05 +0000

Removed

Remove template nodepool command.
Remove template networkpool command.
Remove AWS vintage and Azure vintage providers from template cluster command.
Remove AWS vintage and Azure vintage providers from get clusters and get nodepools commands.
Remove typed dependencies on sigs.k8s.io/cluster-api, sigs.k8s.io/cluster-api-provider-aws, and sigs.k8s.io/cluster-api-provider-azure in favor of unstructured objects.

Fixed

Fix flaky nodepool, orgs, and clusters tests caused by timing race in AGE column rendering.
Update documentation URL from docs.giantswarm.io/use-the-api/kubectl-gs/ to docs.giantswarm.io/reference/kubectl-gs/.

kubectl-gs release v4.12.0

Wed, 04 Mar 2026 21:53:20 +0000

Added

Add locks to cache writing when doing kubectl-gs login to prevent race-condition between multiple kubectl calls.

aws-load-balancer-controller-app release v5.0.3

Fri, 27 Feb 2026 13:31:46 +0000

Changed

Update ABS config to replace .appVersion in Chart.yaml with version detected by ABS.

Fixed

Use .Chart.AppVersion instead of .Chart.Version for OCIRepository tag.

aws-load-balancer-controller-app release v5.0.2

Thu, 26 Feb 2026 09:49:42 +0000

Changed

Update IAM Policy in bundle to match the requirements for v3.0.0.

vertical-pod-autoscaler-app release v6.1.2

Tue, 24 Feb 2026 12:16:26 +0000

Fixed

Pushed helm chart to OCI repository.

kubectl-gs release v4.11.0

Fri, 20 Feb 2026 14:57:48 +0000

Added

Use release-<provider> chart name for Release versions (major >= 35) in template cluster command for all providers (CAPA, CAPZ, VSphere, Cloud Director, EKS).
Omit global.release.version from user config for Release versions, as it is baked into the chart.

capa-karpenter-taint-remover release v1.0.2

Thu, 19 Feb 2026 15:12:07 +0000

Changed

Migrate to App Build Suite (ABS) for building and publishing Helm charts.

keda-app release v5.0.2

Mon, 16 Feb 2026 14:59:58 +0000

Added

Added Backstage audience annotations.

keda-app release v5.0.1

Mon, 16 Feb 2026 08:19:54 +0000

Changed

Change team annotation in Chart.yaml to OpenContainers format (io.giantswarm.application.team).

aws-node-termination-handler-app release v1.23.1

Thu, 12 Feb 2026 16:55:44 +0000

Fixed

Push the chart to the default catalog.

kubectl-gs release v4.10.1

Thu, 12 Feb 2026 14:51:25 +0000

Changed

Change cache logic so initial id_token doesn’t get discarded.

keda-app release v5.0.0

Wed, 11 Feb 2026 12:46:45 +0000

Changed

Upgrade app to version 2.19.0 to support kubernetes 1.32 to 1.34.
Upgrade chart to upstream version 2.19.0.

keda-app release v4.0.0

Wed, 11 Feb 2026 11:37:15 +0000

Changed

Upgrade app to version 2.18.3 to support kubernetes 1.31 to 1.33.
Upgrade chart to upstream version 2.18.3.

aws-efs-csi-driver release v3.2.0

Wed, 04 Feb 2026 14:59:06 +0000

Changed

Upgrade upstream AWS EFS CSI Driver from v2.1.9 to v2.3.0.
Update sidecar images:
- livenessprobe: v2.16.0 -> v2.17.0
- csi-node-driver-registrar: v2.14.0 -> v2.15.0
- csi-provisioner: v5.3.0 -> v6.1.0

Added

Add controller.revisionHistoryLimit and node.revisionHistoryLimit for controlling rollback history.
Add controller.socketDirVolume.emptyDir for configuring CSI socket volume (sizeLimit, medium).
Add controller.fileSystemIdRefs.enabled for dynamic filesystem ID resolution from ConfigMap/Secret.
Add node.serviceAccount.disableMutation for disabling mutating permissions in security-sensitive environments.

Security

Multiple CVE fixes in upstream (sidecars, openssl, Golang 1.25.5).

keda-app release v3.1.1

Sat, 31 Jan 2026 18:37:51 +0000

Changed

Build with up-to-date pipelines.

aws-load-balancer-controller-app release v5.0.1

Thu, 29 Jan 2026 16:19:18 +0000

Fixed

Fix JSON Schema values.schema.json fields that were incorrectly defined as "type": "null" to allow actual configuration values (strings, integers, booleans, arrays, objects) in addition to null.

aws-load-balancer-controller-app release v5.0.0

Thu, 29 Jan 2026 13:33:18 +0000

Changed

Upgrade aws-load-balancer-controller from v2.8.3 to v3.0.0.
Remove PSPs
Move PolicyException to policy-exceptions namespace.
Migrate from ClusterID to ClusterName
Add additional permissions elasticloadbalancing:DescribeListenerAttributes

zot release v2.6.2

Fri, 23 Jan 2026 10:34:06 +0000

Changed

Update to upstream Helm Chart v0.1.95 and Zot v2.11.13.

zot release v2.6.1

Thu, 22 Jan 2026 14:30:40 +0000

Changed

Updated chart metadata

aws-load-balancer-controller-app release v4.0.0

Tue, 20 Jan 2026 15:02:42 +0000

Changed

Move Giant Swarm specific values to the bundle chart. Clean up the aws-load-balancer-controller chart from any GS specific stuff.
Shorten bundle chart name to aws-lb-controller-bundle

aws-efs-csi-driver release v3.1.0

Tue, 20 Jan 2026 11:03:20 +0000

Added

Add additional permissions to the controller IAM role.

Changed

Document upgrade path from v2 to v3

Fixed

Configure the efs-csi-driver chart to use the IAM role managed by the bundle chart.

kubectl-gs release v4.10.0

Fri, 16 Jan 2026 10:47:23 +0000

Changed

Replace github.com/giantswarm/release-operator/v4/api/v1alpha1 with github.com/giantswarm/releases/sdk/api/v1alpha1 for Release CRD types.
Update k8s dependencies to v0.35.0.

zot release v2.6.0

Mon, 12 Jan 2026 08:53:05 +0000

Added

Add Envoy Gateway BackendTrafficPolicy to support custom buffer size.

kubectl-gs release v4.9.1

Mon, 05 Jan 2026 22:06:50 +0000

Changed

Update CI so the update-krew-index job waits until the binaries have been pushed to the registries.

kubectl-gs release v4.9.0

Mon, 05 Jan 2026 21:49:43 +0000

Added

Add support for user.Exec using client-go credential plugin framework.
Support non-default session timeout lengths.

Changed

Update github.com/3th1nk/cidr to v0.3.0, adapt internal CIDR mask size calculation in the tempalte cluster command.

zot release v2.5.0

Thu, 18 Dec 2025 15:21:54 +0000

Added

Add Gateway API support with HTTPRoute template (also supports GRPCRoute, TCPRoute, TLSRoute, UDPRoute).
Add Envoy Gateway SecurityPolicy support for authentication and authorization (basicAuth, CORS, JWT, OIDC, extAuth, authorization).

Changed

Migrate Chart.yaml annotations to new format as per https://docs.giantswarm.io/reference/platform-api/chart-metadata/

aws-load-balancer-controller-app release v3.0.0

Thu, 04 Dec 2025 08:28:28 +0000

Changed

Merge both the bundle and app chart into the same repository. Now the AWS Load Balancer Controller app and the bundle containing the necessary IAM resources (managed by Crossplane) will live in this repository.
The bundle chart now deploys the workload cluster chart using Flux HelmRelease instead of App CR.
Make sure both the bundle and app charts have been pushed to the catalogs before pushing to the capa app collection

zot release v2.4.0

Fri, 21 Nov 2025 16:08:47 +0000

Changed

Update to upstream Helm Chart v0.1.91 and Zot v2.1.11.

aws-efs-csi-driver release v3.0.0

Wed, 19 Nov 2025 08:53:26 +0000

Changed

Merge both the bundle and app chart into the same repository. Now the AWS EFS Driver app and the bundle containing the necessary IAM resources (managed by Crossplane) will live in this repository.