1. Docs
  2. Changes and releases

Changes and Releases

Updates on Giant Swarm workload cluster releases, apps, UI improvements and documentation changes.

  • Security external-secrets v0.4.2

    Fixed

    • The VPA for external-secrets erroneously picks up the kubectl pod created by the CRD installer job and changes the resource requirements for it potentially causing OOM kill for it
  • Observability observability-bundle v0.3.0

    Changed

    • Add new app dependency mechanism (app-operator.giantswarm.io/depends-on) to the prometheus-operator-app and agent so they are not installed until the CRD app is deployed.
    • prometheus-operator: drop apiserver_request_slo_duration_seconds_bucket metrics from apiserver
    • upgrade prometheus-operator-app to 4.0.1 and prometheus-operator-crd to 4.0.0
    • upgrade prometheus-agent to 0.3.0 to support chinese registry

    Added

    • Add promtail-app v1.0.1 disabled by default.
  • Security organization-operator v1.0.6

    Added

    • Added the use of the runtime/default seccomp profile.

    Fixed

    • Prevented deletion of Organization CR until the organization namespace is deleted successfully
  • Security dex-app v1.34.0

    Added

    • Add circle ci job to push to capz-app-collection on new release.
    • Static client for GitOps Server.
  • Connectivity ingress-nginx-app v2.27.0

    Added

    • Helpers: Align to upstream. (#429)
      • Helpers: Add controller.containerSecurityContext.
      • Helpers: Add ingress-nginx.image.
      • Helpers: Add ingress-nginx.imageDigest.
      • Helpers: Add ingress-nginx.controller.publishServicePath.
      • Helpers: Add ingress-nginx.params.
      • Helpers: Add isControllerTagValid.
      • Helpers: Add extraModules.
    • Chart: Align to upstream. (#431)
      • Chart: Add .helmignore.
      • Chart: Add NOTES.txt.
    • Chart: Add CI values from upstream. (#432)
    • Deployment: Align to upstream. (#433)
      • Deployment: Implement controller.kind.
      • Deployment: Implement controller.labels.
      • Deployment: Implement controller.annotations.
      • Deployment: Implement revisionHistoryLimit.
      • Deployment: Implement controller.podAnnotations.
      • Deployment: Implement controller.dnsConfig.
      • Deployment: Implement controller.hostname.
      • Deployment: Implement controller.dnsPolicy.
      • Deployment: Implement controller.podLabels.
      • Deployment: Implement imagePullSecrets.
      • Deployment: Implement controller.priorityClassName.
        NOTE: Removes the hardcoded default system-cluster-critical. Please override if required.
      • Deployment: Implement controller.podSecurityContext & controller.sysctls.
      • Deployment: Implement controller.shareProcessNamespace.
      • Deployment: Implement controller.containerName.
      • Deployment: Implement controller.updateStrategy.
      • Deployment: Implement controller.publishService.
      • Deployment: Implement controller.ingressClass.
        NOTE: If you are currently overriding controller.ingressClassResource.name, there are two cases which require manual intervention:
        • You are assigning ingresses to an ingress controller by annotation.
        • You enabled controller.ingressClassByName. Please set controller.ingressClass to the value of controller.ingressClassResource.name if any of these cases applies to you.
      • Deployment: Implement controller.configMapNamespace.
      • Deployment: Implement controller.tcp.configMapNamespace.
      • Deployment: Implement controller.udp.configMapNamespace.
      • Deployment: Implement controller.scope.namespace.
      • Deployment: Implement controller.scope.namespaceSelector.
      • Deployment: Implement controller.reportNodeInternalIp.
      • Deployment: Implement controller.admissionWebhooks.certificate & controller.admissionWebhooks.key.
      • Deployment: Implement controller.maxmindLicenseKey.
      • Deployment: Implement controller.healthCheckHost.
      • Deployment: Implement controller.healthCheckPath.
      • Deployment: Implement controller.enableTopologyAwareRouting.
      • Deployment: Implement controller.extraArgs.
      • Deployment: Implement serviceAccount.name.
      • Deployment: Implement controller.containerSecurityContext.
      • Deployment: Implement controller.hostPort.
      • Deployment: Implement controller.metrics.portName.
      • Deployment: Implement tcp & udp ports.
      • Deployment: Implement controller.customTemplate.
      • Deployment: Implement controller.extraVolumeMounts.
      • Deployment: Implement controller.opentelemetry.
      • Deployment: Implement controller.extraContainers.
      • Deployment: Implement controller.extraInitContainers.
      • Deployment: Implement controller.hostNetwork.
      • Deployment: Implement controller.nodeSelector.
      • Deployment: Implement controller.tolerations.
      • Deployment: Implement controller.affinity.
      • Deployment: Add DaemonSet option.

    Changed

    • Helpers: Align to upstream. (#429)
      • Helpers: Rename name to ingress-nginx.name.
      • Helpers: Rename chart to ingress-nginx.chart.
      • Helpers: Align ingress-nginx.fullname.
      • Helpers: Align ingress-nginx.controller.fullname.
      • Helpers: Align ingress-nginx.controller.electionID.
      • Helpers: Align ingress-nginx.defaultBackend.fullname.
      • Helpers: Align ingress-nginx.labels.
      • Helpers: Align ingress-nginx.selectorLabels.
      • Helpers: Align ingress-nginx.defaultBackend.serviceAccountName.
    • Chart: Align to upstream. (#431)
      • Chart: Align Chart.yaml.
    • HPA: Use capabilities, reorder if. (#434)
    • Deployment: Align to upstream. (#433)
      • Deployment: Align controller.image.
      • Deployment: Align startupProbe.
        NOTE: Please remove controller.startupProbe.enabled from your overrides and remove/set controller.startupProbe instead.
      • Deployment: Align livenessProbe.
        NOTE: Please remove controller.livenessProbe.enabled from your overrides and remove/set controller.livenessProbe instead.
      • Deployment: Align readinessProbe.
        NOTE: Please remove controller.readinessProbe.enabled from your overrides and remove/set controller.readinessProbe instead.
      • Deployment: Update controller.image.tag to v1.6.4.

    Removed

    • Helpers: Align to upstream. (#429)
      • Helpers: Remove resource.controller-service-internal.name.
      • Helpers: Remove resource.controller-service.name.
    • Deployment: Align to upstream. (#433)
      • Deployment: Remove controller.extraAnnotations.deployment.
        NOTE: This is part of our alignment to upstream. Use controller.annotations instead.
      • Deployment: Remove controller.extraAnnotations.pod.
        NOTE: This is part of our alignment to upstream. Use controller.podAnnotations instead.
      • Deployment: Remove sysctls setting net.ipv4.ip_local_port_range.
        NOTE: Set via controller.sysctls if required.
      • Deployment: Remove initContainers setting net.core.somaxconn.
        NOTE: Set via controller.sysctls if required.
      • Deployment: Remove controller.maxSurge.
        NOTE: This is part of our alignment to upstream. Use controller.updateStrategy instead.
      • Deployment: Remove controller.maxUnavailable.
        NOTE: This is part of our alignment to upstream. Use controller.updateStrategy instead.
      • Deployment: Remove controller.userID.
        NOTE: This is part of our alignment to upstream. Use controller.image.runAsUser instead.
      • Deployment: Remove controller.groupID.
        NOTE: This is part of our alignment to upstream. There is no replacement for this key.
      • Deployment: Remove controller.antiAffinityScheduling & controller.nodeAffinity. NOTE: This is part of our alignment to upstream. Use controller.affinity instead.
  • Connectivity external-dns-app v2.34.0

    Added

    • Add ServiceMonitor and default values (#245).
  • Fleet Management vertical-pod-autoscaler-app v3.3.0

    Changed

    • Sync with upstream update concerning image.registry
  • Security trivy-app v0.8.0

    Changed

    • Update to upstream version 0.7.0/app version 0.37.2.
  • Security rbac-operator v0.33.0

    Added

    • Added the use of the runtime/default seccomp profile.
    • Added reconciliation of static resources like e.g. ClusterRoles, ClusterRoleBindings, ServiceAccounts in the default namespace, etc.
  • Security cert-manager-app v2.20.2

    Changed

    • Default to new IRSA role for cert-manager-controller that has permissions needed for the DNS01 challenge via AWS Route53