Security
Changed
- Updated RBAC rules to include
organizations/finalizers for managing .metadata.ownerReferences.blockOwnerDeletion. - Disable
PodSecurityPolicies by deafult.
Changed
- Upgrade cert-manager to v1.18.2.
Added
- Add E2E tests using apptest-framework for automated PR testing across multiple providers (CAPA, CAPV, CAPZ, CAPVCD).
- Basic test suite: Validates fresh installations
- Upgrade test suite: Tests upgrade scenarios and certificate reconciliation
- Add certificate issuance integration test to cluster-test-suites.
- Update dependency giantswarm/ingress-nginx-app to v4.1.3
- Update dependency giantswarm/athena to v1.14.1
Removed
- Removed the configuration values
letsencrypt, crtPemB64 and keyPemB64. These are not used and private certificates are configured from cert-manager.
Changed
- Change base image registry to
gsoci.azurecr.io
Changed
- Fix missing targetPort in
cainjector-service
Changed
- Only support Kyverno
PolicyException version v2 and remove v2beta1 support.
Fixed
- Fix missing cluster-wide write permissions for customer admin groups by adding the missing
write-all-customer-group ClusterRoleBinding.
Added
- Extended
crossplane-edit ClusterRoleBinding to include automation ServiceAccounts from all organization namespaces. - Added dynamic namespace watching to automatically add/remove org automation ServiceAccounts from the
crossplane-edit ClusterRoleBinding when org namespaces are created or deleted.
