kubectl gs deploy chart, replace the obsolete values examples (PodSecurityPolicy, falco-exporter, legacy eBPF flag), and describe the vendir-based upstream sync.helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.2.11.0, kubectl gs deploy chart, and remove the legacy App CR example.oidc.responseTypes: ["code", "token", "id_token"] kept, so an installation gets them without the 3.0.0 breaking change:checksum/config on the pod template), and restarts when a referenced client Secret changes.secretRef: {name, key} on an extraStaticClients entry, clientSecretRef: {name, key} on the pre-defined clients. A pre-defined client with both uses the reference; one with neither is left out and named in the release notes.mcpCapi and mcpPrometheus.v2.43.3: the upstream issuer’s key fetch is bounded to 5 seconds.maxUnavailable: 1.helm.sh/chart label is valid for long chart versions.maxUnavailable: 1 instead of minAvailable: 50%: with a single replica, 50% rounded up to one pod and would refuse every eviction, holding a node drain until its timeout.dex to v2.43.3. Token exchanges and logins through an OIDC connector no longer hang while the upstream issuer’s signing keys (JWKS) cannot be fetched: the key fetch is bounded to 5 seconds, and such a token exchange answers 503 server_error instead of 401 access_denied, with the keys URL and the failure in Dex’s log. A subject token that does not verify still gets 401 access_denied. See giantswarm/dex#80.Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.20...v1.2.21
Full Changelog: https://github.com/giantswarm/starboard-exporter/compare/v1.2.19...v1.2.20
v2.11.0 version.app.kubernetes.io/version label from the chart app version instead of the chart version, as described in the Helm chart best practices. The chart version carries build metadata that pushed the label past the 63 byte limit and made the install fail.app.kubernetes.io/name: kyverno pod label from the admission controller.kyverno, policy-reporter and shared global values so upstream keys are not rejected by the generated schema.policy-reporter to upstream version v3.10.0.kyverno to upstream version v1.18.2.clientSecretRef on a pre-defined client, secretRef on an extra client) are projected into the dex container as files, one per client, and the liveness probe compares each file with the environment variable dex started from; a rotated value fails the probe naming the client’s variable, the kubelet restarts the container and dex loads the new secret, about a minute after the Secret changed and without any other change. Before, dex kept the value it read at start-up until something else restarted it, and the client’s flows failed with invalid_client in between. Installations without referenced clients render unchanged; the checksum/config roll on a configuration change is unchanged.