1. Docs
  2. Changes and releases
  3. Security

Security

  • Security dex-app v3.4.0

    Changed

    • Dex runs two replicas by default, spread one per node (topologySpreadConstraints on kubernetes.io/hostname, DoNotSchedule, and on topology.kubernetes.io/zone, ScheduleAnyway; a preferred pod anti-affinity on kubernetes.io/hostname), behind a PodDisruptionBudget of minAvailable: 1: a node drain or consolidation waits until another replica is Ready, so the identity provider stays up. With dex.replicaCount: 1 and no autoscaling the budget stays maxUnavailable: 1.
  • Security kyverno-app v0.25.3

    Changed

    • Updated policy-reporter to upstream version v3.11.1.
  • Security cert-manager-app v4.1.2

    Added

    • cert-manager-giantswarm-clusterissuer: Allow setting cnameStrategy per DNS01 solver with acme.dns01.cloudflare.cnameStrategy, acme.dns01.route53.cnameStrategy and acme.dns01.azureDNS.cnameStrategy, so a _acme-challenge CNAME can delegate the challenge to a zone the solver can write to.

    Changed

    • Use imagePullPolicy: IfNotPresent for the cert-manager-giantswarm-clusterissuer hook Job, so a retried Helm hook reuses the image already present on the node instead of downloading it again.
    • Run the E2E test suites automatically on release PRs by adding .github/release-pr-body.md.
    • Increase clusterIssuer job memory limit from 250Mi to 512Mi.

    Fixed

    • Trim the helm.sh/chart label of the Giant Swarm resources (VPAs, PodLogs, proxy ConfigMap) to end on an alphanumeric character. A long dev version cut at 63 characters could end on a ., and the API server rejected the resource.
  • Security kyverno-app v0.25.2

    Fixed

    • Set the chart appVersion to the Kyverno version the kyverno subchart deploys (v1.18.2), so the app.kubernetes.io/version label shows it.

    Added

    • Check that the chart appVersion equals the kyverno subchart’s appVersion in pull requests.

    Changed

    • Updated policy-reporter to upstream version v3.11.0.
  • Security dex-app v3.3.0

    Added

    • oidc.staticClients.<client>.extraRedirectURIs on the pre-defined clients that authenticate with a secret (gitopsui, muster, mcpKubernetes, mcpCapi, mcpPrometheus): further redirect URIs, rendered after redirectURI in their order, for a second application that signs in through the same client. Empty by default; installations without it render unchanged.

    Fixed

    • The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
  • Security starboard-exporter v1.2.24

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.23...v1.2.24

  • Security kyverno-app v0.25.1

    Fixed

    • Match all kyverno.io Group Policy and ClusterPolicy versions in the restrict-policy-kind-wildcards policy to ensure it still applies to newer API versions.
  • Security starboard-exporter v1.2.23

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.22...v1.2.23

  • Security starboard-exporter v1.2.22

    Fixed

    Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.21...v1.2.22

  • Security trivy-app v0.18.1

    Fixed

    • The helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.

    Changed

    • Update the README: fix broken documentation links, recommend installing via Flux HelmRelease with kubectl gs deploy chart, replace the obsolete Trivy modules example, and describe the vendir-based upstream sync.
    • Allow additional properties for vendored upstream chart values so upstream keys are not rejected by the generated schema.