Security

• May 18, 2026 Security teleport-kube-agent-app v0.11.0

  Changed

  • Updated teleport-kube-agent to upstream version v18.7.6.
• May 14, 2026 Security external-secrets v2.4.1

  Changed

  • Updating to the v2.4.1 version.

  BREAKING CHANGES

  • The Alibaba and Device42 providers are gone.
  • The htpasswd function requires three arguments from now on, see https://github.com/Masterminds/sprig/blob/master/docs/crypto.md?plain=1#L50-L56.
• May 8, 2026 Security external-secrets v1.3.2

  Changed

  • Updating to the v1.3.2 version.
• May 4, 2026 Security kyverno-app v0.24.2

  Changed

  • Updated policy-reporter to upstream version v3.7.2.
  • Updated kyverno to upstream version v1.17.2.
  • Enabled HorizontalPodAutoscaler feature for the admission-controller deployment.
  • Add tolerations for CAPI node.cluster.x-k8s.io/uninitialized taint.
• Apr 20, 2026 Security cert-manager-app v3.13.0

  Changed

  • Upgrade cert-manager to v1.19.4.
• Apr 8, 2026 Security cert-manager-app v3.12.0

  Added

  • Add control plane node toleration to CA injector deployment.

  Removed

  • Remove PodSecurityPolicy (PSP) and related resources.
  • Remove Giant Swarm PSP to PSS migration logic.
• Mar 25, 2026 Security rbac-operator v0.44.0

  Added

  • Add cluster-wide permissions for Kyverno PolicyExceptions (policyexceptions.kyverno.io) to the automation service account.
• Mar 17, 2026 Security dex-app v2.2.1

  Added

  • Add io.giantswarm.application.audience and io.giantswarm.application.managed annotations to Chart.yaml to make the app visible to customers in Backstage.

  Fixed

  • Update dex to v2.43.1-gs3. Fixes redundant group name prefixing on token refresh that caused intermittent permission denied errors for users authenticating via Azure AD and certain other Dex connectors.
• Mar 10, 2026 Security auth-bundle v0.6.0

  Added

  • Add io.giantswarm.application.managed chart annotation for Backstage visibility.

  Changed

  • Migrate chart metadata annotations to OCI-compatible format.
  • Update athena to v1.15.2.
  • Update ingress-nginx-app to version v4.2.4.
  • Update rbac-bootstrap-app to v0.2.3.
• Mar 2, 2026 Security rbac-operator v0.43.0

  Added

  • Create AWS cluster role identity roles and bindings when the operator runs in capa.

• Newer entries
• Older entries