dex-app release v3.4.0

Changed

• Dex runs two replicas by default, spread one per node (topologySpreadConstraints on kubernetes.io/hostname, DoNotSchedule, and on topology.kubernetes.io/zone, ScheduleAnyway; a preferred pod anti-affinity on kubernetes.io/hostname), behind a PodDisruptionBudget of minAvailable: 1: a node drain or consolidation waits until another replica is Ready, so the identity provider stays up. With dex.replicaCount: 1 and no autoscaling the budget stays maxUnavailable: 1.